Skip to content

chore(deps): bump the go-deps group across 1 directory with 7 updates - #9

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-d71ace5edc
Open

chore(deps): bump the go-deps group across 1 directory with 7 updates#9
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-d71ace5edc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the go-deps group with 7 updates in the / directory:

Package From To
golang.org/x/crypto 0.49.0 0.55.0
github.com/beevik/etree 1.6.0 1.7.0
github.com/miekg/dns 1.1.70 1.1.72
github.com/sirosfoundation/go-cryptoutil 0.2.0 0.6.0
github.com/sirosfoundation/go-trust 0.0.0-20260108214437-2745da0592da 0.15.1
go.mongodb.org/mongo-driver 1.17.6 1.17.9
github.com/stretchr/testify 1.11.1 1.12.0

Updates golang.org/x/crypto from 0.49.0 to 0.55.0

Commits
  • f44d03d go.mod: update golang.org/x dependencies
  • 5ed4944 crypto/internal/poly1305: provide optimised assembly for riscv64
  • b07833c ssh: return window credit for discarded extended data
  • d701c51 acme: fix nil pointer dereference in pebble test error reporting
  • 999d053 ssh: fix parsing of GSSAPI payloads offering multiple mechanisms
  • 90f76b8 ssh: reject certificate signature keys before recursing
  • b53964a ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs
  • 626e40f ssh: drain stderr on forwarded TCP and Unix channels
  • 31914c6 x509roots/fallback: update bundle
  • f2135b8 all: clean up minor issues found by staticcheck
  • Additional commits viewable in compare view

Updates github.com/beevik/etree from 1.6.0 to 1.7.0

Release notes

Sourced from github.com/beevik/etree's releases.

Release v1.7.0

Breaking changes

  • To address a security issue, it was necessary to add a MaxDepth option to ReadSettings to limit the depth of XML trees during parsing. A generous default value of 1024 was chosen to avoid breaking most existing code. However, if your code is processing XML hierarchies with a depth greater than 1024, you will need to assign your Document a ReadSettings that has a MaxDepth set to a higher value.

Security Fixes

  • Limited the depth of XML trees processed by all ReadFrom functions during parsing.
  • Fixed a CompilePath index-out-of-range panic that could be caused by a missing path filter key.
  • Sanitized the contents of XML text, comment, ProcInst and Directive tokens provided by the user.
Changelog

Sourced from github.com/beevik/etree's changelog.

Release 1.7.0

Breaking changes

  • To address a security issue, it was necessary to add a MaxDepth option to ReadSettings to limit the depth of XML trees during parsing. A generous default value of 1024 was chosen to avoid breaking most existing code. However, if your code is processing XML hierarchies with a depth greater than 1024, you will need to assign your Document a ReadSettings that has a MaxDepth set to a higher value.

Security Fixes

  • Limited the depth of XML trees processed by all ReadFrom functions during parsing.
  • Fixed a CompilePath index-out-of-range panic that could be caused by a missing path filter key.
  • Sanitized the contents of XML text, comment, ProcInst and Directive tokens provided by the user.
Commits
  • 51e79d6 Release v1.7.0
  • 236bb93 Document duplication bug fix
  • 1215e0a Enforce maximum XML tree depth during parsing
  • 936bc58 Sanitize XML contents provided by callers
  • 62d8a79 Fix CompilePath index-out-of-range panic
  • See full diff in compare view

Updates github.com/miekg/dns from 1.1.70 to 1.1.72

Commits

Updates github.com/sirosfoundation/go-cryptoutil from 0.2.0 to 0.6.0

Release notes

Sourced from github.com/sirosfoundation/go-cryptoutil's releases.

v0.6.0 — pkcs11pool stability fixes

Changes

Bug fixes

  • Pool slot leak on recovery failure (): When RecoverSession fails, the broken session is now returned to the pool via Release() instead of being closed directly via ctx.CloseSession(). This preserves the pool channel capacity — the next caller will trigger a new recovery attempt and replace the broken session properly.

  • CKA_ID double-encoding in ListECKeys (): GenerateECKey stores CKA_ID as the ASCII bytes of the hex kid string. ListECKeys was re-encoding those bytes with hex.EncodeToString, producing a hex-of-hex value. Fixed to use string(attrs[0].Value) for correct round-tripping.

  • General pkcs11pool robustness (PR #19): Acquire/Release/Close guards, login tolerance, session recovery ordering, token label trimming.

Tests

  • SoftHSM2 integration tests covering pool lifecycle, key generation, signing, ECDH, listing, recovery, and error paths (71.5% statement coverage).

v0.5.0

No release notes provided.

Commits
  • c762f0c fix(pkcs11pool): address remaining Copilot review findings
  • c186cd7 fix(pkcs11pool): address Copilot code review findings (#19)
  • c328080 feat: add pkcs11pool shared PKCS#11 session pool library (#18)
  • c6b0d98 fix: standardize LICENSE to BSD-2-Clause attributed to SIROS Foundation (#17)
  • 3eb88fb fix: replace write-all with scoped workflow permissions (#15)
  • 9a4ca84 fix: replace read-all with specific permissions in scorecard workflow (#14)
  • e5cd310 ci: add SonarCloud and OpenSSF Scorecard workflows (#12)
  • 473ab79 chore(deps): bump the go-deps group in /brainpool with 2 updates (#6)
  • d238a57 chore(deps): bump the github-actions group with 4 updates (#7)
  • 95ee00e ci: use go-version-file instead of hardcoded version (#8)
  • Additional commits viewable in compare view

Updates github.com/sirosfoundation/go-trust from 0.0.0-20260108214437-2745da0592da to 0.15.1

Release notes

Sourced from github.com/sirosfoundation/go-trust's releases.

v0.15.1

No release notes provided.

v0.15.0

No release notes provided.

v0.14.1

No release notes provided.

v0.14.0

No release notes provided.

v0.13.0

No release notes provided.

v0.12.1

Security fix

Closes a certificate-to-client_id binding gap in the OpenID4VP x509_san_dns/x509_san_uri/x509_hash client_id_scheme paths introduced by v0.12.0's whitelist system-CA fallback, and present (as dead code, now fixed and reachable) in the ETSI TSL registry's SAN matching.

Previously, whitelist's TrustX509ViaSystemCA fallback and the LoTE CA-anchored fallback only verified that a presented x5c chain was issued by some trusted CA - never that the certificate actually belonged to the identity being claimed. Any certificate chaining to a trusted root (or, for LoTE, to a listed CA) could be used to impersonate any whitelisted x509_san_dns/x509_san_uri/x509_hash identity.

See #121 for full details.

Fixed

  • pkg/registry/static: evaluateViaSystemCA now verifies the presented certificate is bound to the claimed identity (DNS/URI SAN match, or cert hash match) before granting trust via the system CA pool. Unrecognized non-fetchable schemes now fail closed instead of being silently trusted.
  • pkg/registry: RegistryManager.Evaluate no longer irreversibly discards the pre-normalization client_id_scheme claim - it's preserved via Context and recoverable through the new OriginalSubjectID helper, fixing a case where the x509_san_dns fallback was unreachable in production.
  • pkg/registry/static: fixed the TrustX509ViaSystemCA gate's resource-type check drifting from SupportedResourceTypes()/Info().
  • pkg/registry/etsi: the SAN-matching check is now also reachable via the real x5c-resource-type wire convention used by production callers (previously only reachable via a convention no real caller uses).
  • pkg/registry/lote: the CA-anchored fallback (validateX5CChainCA) now performs the same binding check when the caller uses a certificate-binding client_id_scheme; unaffected for the existing plain-RP-identifier Access Certificate List model.

Added

  • pkg/registry/clientid.go: shared ParseClientIDScheme/VerifyLeafBinding helper reused across whitelist, LoTE, and etsi.

v0.12.0

No release notes provided.

v0.11.0

No release notes provided.

v0.10.0

No release notes provided.

v0.9.3

No release notes provided.

v0.9.2

No release notes provided.

v0.9.1

... (truncated)

Commits

Updates go.mongodb.org/mongo-driver from 1.17.6 to 1.17.9

Release notes

Sourced from go.mongodb.org/mongo-driver's releases.

MongoDB Go Driver 1.17.9

The MongoDB Go Driver Team is pleased to release version 1.17.9 of the official MongoDB Go Driver.

Release Highlights

This release fixes a bug caused by variable shadowing.

What's Changed

🐛 Fixed

Full Changelog: mongodb/mongo-go-driver@v1.17.8...v1.17.9

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. Questions and inquiries can be asked on the MongoDB Developer Community. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 1.17.8

The MongoDB Go Driver Team is pleased to release version 1.17.8 of the official MongoDB Go Driver.

Release Highlights

This release adds a deprecation notice to go.mongodb.org/mongo-driver, indicating users should migrate to go.mongodb.org/mongo-driver/v2. See the V2 migration guide for more information.

What's Changed

✨ New Features

Full Changelog: mongodb/mongo-go-driver@v1.17.7...v1.17.8

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. Questions and inquiries can be asked on the MongoDB Developer Community. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 1.17.7

The MongoDB Go Driver Team is pleased to release version 1.17.7 of the official MongoDB Go Driver.

Release Highlights

This release removes the deprecation notice from options.MergeClientOptions and fixes buffer handling in GSSAPI error description and username functions.

What's Changed

... (truncated)

Commits
  • 3b10ae6 BUMP v1.17.9
  • f490802 GODRIVER-3793 Fix variable shadowing in rtt monitor (#2317)
  • 5ac5a1e BUMP v1.17.8
  • f378649 Revert dry-run release bump
  • 08c2b98 BUMP v1.17.8
  • fafe527 GODRIVER-3773 Deprecate v1 (#2312)
  • eb01e7e BUMP v1.17.7
  • 3c55093 GODRIVER-3766 Remove deprecation notice for MergeClientOptions (#2294)
  • f6163bf GODRIVER-3770 Remove libasan from gssapi tests in CI (#2293)
  • 6798963 GODRIVER-3770 Fix buffer handling in GSSAPI error description and username fu...
  • Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

New Contributors

... (truncated)

Commits
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • d2699be _codegen: modernize
  • a463c8c Merge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashes
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the go-deps group across 1 directory with 7 updates
57e5436 
Bumps the go-deps group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.49.0` | `0.55.0` |
| [github.com/beevik/etree](https://github.com/beevik/etree) | `1.6.0` | `1.7.0` |
| [github.com/miekg/dns](https://github.com/miekg/dns) | `1.1.70` | `1.1.72` |
| [github.com/sirosfoundation/go-cryptoutil](https://github.com/sirosfoundation/go-cryptoutil) | `0.2.0` | `0.6.0` |
| [github.com/sirosfoundation/go-trust](https://github.com/sirosfoundation/go-trust) | `0.0.0-20260108214437-2745da0592da` | `0.15.1` |
| [go.mongodb.org/mongo-driver](https://github.com/mongodb/mongo-go-driver) | `1.17.6` | `1.17.9` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.0` |



Updates `golang.org/x/crypto` from 0.49.0 to 0.55.0
- [Commits](golang/crypto@v0.49.0...v0.55.0)

Updates `github.com/beevik/etree` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/beevik/etree/releases)
- [Changelog](https://github.com/beevik/etree/blob/main/RELEASE_NOTES.md)
- [Commits](beevik/etree@v1.6.0...v1.7.0)

Updates `github.com/miekg/dns` from 1.1.70 to 1.1.72
- [Commits](miekg/dns@v1.1.70...v1.1.72)

Updates `github.com/sirosfoundation/go-cryptoutil` from 0.2.0 to 0.6.0
- [Release notes](https://github.com/sirosfoundation/go-cryptoutil/releases)
- [Commits](sirosfoundation/go-cryptoutil@v0.2.0...v0.6.0)

Updates `github.com/sirosfoundation/go-trust` from 0.0.0-20260108214437-2745da0592da to 0.15.1
- [Release notes](https://github.com/sirosfoundation/go-trust/releases)
- [Changelog](https://github.com/sirosfoundation/go-trust/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sirosfoundation/go-trust/commits/v0.15.1)

Updates `go.mongodb.org/mongo-driver` from 1.17.6 to 1.17.9
- [Release notes](https://github.com/mongodb/mongo-go-driver/releases)
- [Commits](mongodb/mongo-go-driver@v1.17.6...v1.17.9)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.0
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/beevik/etree
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/miekg/dns
  dependency-version: 1.1.72
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/sirosfoundation/go-cryptoutil
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/sirosfoundation/go-trust
  dependency-version: 0.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.mongodb.org/mongo-driver
  dependency-version: 1.17.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants