mirror of
https://gitea.com/gitea/runner.git
synced 2026-11-04 06:25:32 +00:00
main
83
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Renovate Bot
|
6e42621b4a |
chore(deps): update dependencies (#1365)
Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
e3607b576e |
fix(deps): update module golang.org/x/net to v0.62.0 [security] (#1356)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.61.0` → `v0.62.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.61.0...refs/tags/v0.62.0) |  |  | --- ### Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net [CVE-2026-78661](https://nvd.nist.gov/vuln/detail/CVE-2026-78661) / [GO-2026-6860](https://pkg.go.dev/vuln/GO-2026-6860) <details> <summary>More information</summary> #### Details When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse. #### Severity Unknown #### References - [https://go.dev/cl/849365](https://go.dev/cl/849365) - [https://go.dev/issue/82224](https://go.dev/issue/82224) - [https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs](https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6860) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net [CVE-2026-97045](https://nvd.nist.gov/vuln/detail/CVE-2026-97045) / [GO-2026-6866](https://pkg.go.dev/vuln/GO-2026-6866) <details> <summary>More information</summary> #### Details In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text. #### Severity Unknown #### References - [https://go.dev/cl/855121](https://go.dev/cl/855121) - [https://go.dev/issue/82622](https://go.dev/issue/82622) - [https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs](https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6866) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODEuNyIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MS43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1356 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
8dd3776014 |
chore(deps): update dependencies (#1351)
Co-authored-by: Renovate Bot <[email protected]> |
||
 Renovate Botandsilverwind
|
ccb9afd7a5 |
chore(deps): update dependencies (#1308)
This PR contains the following updates: | Package | Type | Update | Change | Pending | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---|---| | [actions/setup-node](https://github.com/actions/setup-node) ([changelog](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020..949feb2413d6458794dcd2491c4babbbce0c15c1)) | action | digest | `8207627` → `949feb2` | | | | | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | require | patch | `v5.19.2` → `v5.19.3` | |  |  | | [github.com/moby/moby/api](https://github.com/moby/moby) | require | patch | `v1.56.0` → `v1.56.1` | |  |  | | [github.com/moby/moby/client](https://github.com/moby/moby) | require | patch | `v0.6.0` → `v0.6.1` | `v0.6.2` |  |  | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | require | minor | `v1.46.0` → `v1.47.0` | |  |  | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | require | minor | `v1.46.0` → `v1.47.0` | |  |  | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | require | minor | `v1.46.0` → `v1.47.0` | |  |  | | [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | require | minor | `v1.46.0` → `v1.47.0` | |  |  | | [go.opentelemetry.io/proto/otlp](https://github.com/open-telemetry/opentelemetry-proto-go) | require | patch | `v1.11.0` → `v1.11.1` | |  |  | | [golang.org/x/sync](https://pkg.go.dev/golang.org/x/sync) | require | minor | [`v0.23.0` → `v0.24.0`](https://cs.opensource.google/go/x/sync/+/refs/tags/v0.23.0...refs/tags/v0.24.0) | |  |  | | [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) | require | minor | [`v0.48.0` → `v0.49.0`](https://cs.opensource.google/go/x/sys/+/refs/tags/v0.48.0...refs/tags/v0.49.0) | |  |  | | [node](https://github.com/nodejs/node) | | digest | `0e0ff40` → `d6aa754` | | | | --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.19.3`](https://github.com/go-git/go-git/releases/tag/v5.19.3) [Compare Source](https://github.com/go-git/go-git/compare/v5.19.2...v5.19.3) #### What's Changed - \[v5] git: repository, Ensure commondir is closed. by [@​arcaven](https://github.com/arcaven) in [#​2285](https://github.com/go-git/go-git/pull/2285) - config: read repositoryformatversion in unmarshalCore by [@​c-tonneslan](https://github.com/c-tonneslan) in [#​2167](https://github.com/go-git/go-git/pull/2167) - build: Update module github.com/go-git/go-git/v5 to v5.19.2 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2304](https://github.com/go-git/go-git/pull/2304) - \[v5] plumbing: revlist, Skip path validation in the object walk by [@​r0h1tb](https://github.com/r0h1tb) in [#​2305](https://github.com/go-git/go-git/pull/2305) - build: Update module golang.org/x/crypto to v0.55.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2348](https://github.com/go-git/go-git/pull/2348) - \[v5] plumbing: transport/http, Contain credentials across redirects by [@​hiddeco](https://github.com/hiddeco) in [#​2358](https://github.com/go-git/go-git/pull/2358) - build: Fix workflows for Go 1.27 (v5) by [@​pjbgf](https://github.com/pjbgf) in [#​2364](https://github.com/go-git/go-git/pull/2364) - plumbing: format/packfile, Stop running TestChecksumMismatch and TestMalformedPack in parallel by [@​akashchamp](https://github.com/akashchamp) in [#​2421](https://github.com/go-git/go-git/pull/2421) - build: Update module golang.org/x/crypto to v0.56.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2357](https://github.com/go-git/go-git/pull/2357) - plumbing: format/packfile, Break cyclic delta chains instead of recur… by [@​jgoosens](https://github.com/jgoosens) in [#​2340](https://github.com/go-git/go-git/pull/2340) - build: Drop Go 1.25 by [@​pjbgf](https://github.com/pjbgf) in [#​2451](https://github.com/go-git/go-git/pull/2451) - build: Update module github.com/go-git/go-billy/v5 to v5.9.2 (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2467](https://github.com/go-git/go-git/pull/2467) - build: Bump pjbgf/sha1cd to v0.7.0 by [@​pjbgf](https://github.com/pjbgf) in [#​2468](https://github.com/go-git/go-git/pull/2468) #### New Contributors - [@​arcaven](https://github.com/arcaven) made their first contribution in [#​2285](https://github.com/go-git/go-git/pull/2285) - [@​c-tonneslan](https://github.com/c-tonneslan) made their first contribution in [#​2167](https://github.com/go-git/go-git/pull/2167) - [@​r0h1tb](https://github.com/r0h1tb) made their first contribution in [#​2305](https://github.com/go-git/go-git/pull/2305) - [@​akashchamp](https://github.com/akashchamp) made their first contribution in [#​2421](https://github.com/go-git/go-git/pull/2421) - [@​jgoosens](https://github.com/jgoosens) made their first contribution in [#​2340](https://github.com/go-git/go-git/pull/2340) **Full Changelog**: <https://github.com/go-git/go-git/compare/v5.19.2...v5.19.3> </details> <details> <summary>moby/moby (github.com/moby/moby/client)</summary> ### [`v0.6.1`](https://github.com/moby/moby/compare/v0.6.0...v0.6.1) [Compare Source](https://github.com/moby/moby/compare/v0.6.0...v0.6.1) </details> <details> <summary>open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)</summary> ### [`v1.47.0`](https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.47.0): /v0.69.0/v0.23.0/v0.1.0 [Compare Source](https://github.com/open-telemetry/opentelemetry-go/compare/v1.46.0...v1.47.0) This release contains the first stable release of the OpenTelemetry Go Logs API and SDK. Our project stability guarantees now apply to the following modules: - `go.opentelemetry.io/otel/log` - `go.opentelemetry.io/otel/sdk/log` See our [versioning policy](https://github.com/open-telemetry/opentelemetry-go/blob/main/VERSIONING.md) for more information about these stability guarantees. ##### Added - Add `String` method for `KeyValue` type in `go.opentelemetry.io/otel/attribute`. ([#​8205](https://github.com/open-telemetry/opentelemetry-go/issues/8205)) - Add `String` method for `Set` type in `go.opentelemetry.io/otel/attribute`. ([#​8347](https://github.com/open-telemetry/opentelemetry-go/issues/8347)) - Add `WithMaxExportBatchSize` to `go.opentelemetry.io/otel/sdk/metric` to configure the maximum export batch size for `PeriodicReader`. ([#​8960](https://github.com/open-telemetry/opentelemetry-go/issues/8960)) - Add `WithAttributeValueDepthLimit`, `DefaultAttributeValueDepthLimit`, and `SpanLimits.AttributeValueDepthLimit` in `go.opentelemetry.io/otel/sdk/trace` to configure the maximum depth of span, event, link, and instrumentation scope attribute values. ([#​8938](https://github.com/open-telemetry/opentelemetry-go/issues/8938)) - Add `WithAttributeValueDepthLimit` in `go.opentelemetry.io/otel/sdk/log` to configure the maximum depth of log record and instrumentation scope attribute values. ([#​8938](https://github.com/open-telemetry/opentelemetry-go/issues/8938)) - Add `WithMaxResponseSize` to `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8941](https://github.com/open-telemetry/opentelemetry-go/issues/8941)) - Add experimental `ProbabilitySampler` in `go.opentelemetry.io/otel/sdk/trace/x` that conforms to the [OpenTelemetry specification's threshold-based sampling algorithm](https://opentelemetry.io/docs/specs/otel/trace/sdk/#probabilitysampler). ([#​8123](https://github.com/open-telemetry/opentelemetry-go/issues/8123)) - Add experimental `*Binder` extension interfaces in `go.opentelemetry.io/otel/metric/x` for instruments that support binding attributes ahead of time. ([#​8760](https://github.com/open-telemetry/opentelemetry-go/issues/8760)) - Add the experimental `Finisher` synchronous metric instrument extension interface to `go.opentelemetry.io/otel/metric/x`. ([#​8906](https://github.com/open-telemetry/opentelemetry-go/issues/8906)) ##### Changed - Use the [OpenTelemetry Attribute Collection representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#attribute-collection-representation-for-non-otlp) for metric data diffs in `go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest`. ([#​8993](https://github.com/open-telemetry/opentelemetry-go/issues/8993)) - Apply a maximum depth of 64 by default to span, event, link, log record, and instrumentation scope attribute values in `go.opentelemetry.io/otel/sdk/trace` and `go.opentelemetry.io/otel/sdk/log`. ([#​8938](https://github.com/open-telemetry/opentelemetry-go/issues/8938)) - Reduce allocations when applying attribute value length limits in `go.opentelemetry.io/otel/sdk/trace` and `go.opentelemetry.io/otel/sdk/log` by rebuilding composite values only when truncation is needed. ([#​8912](https://github.com/open-telemetry/opentelemetry-go/issues/8912)) - Decode `traceparent` using a hex lookup table in `go.opentelemetry.io/otel/propagation`, which rejects the specification-disallowed upper-case characters without a separate scan of the header. ([#​8739](https://github.com/open-telemetry/opentelemetry-go/issues/8739)) - Decode all characters at constant indices in `TraceIDFromHex` and `SpanIDFromHex` in `go.opentelemetry.io/otel/trace` to eliminate bounds checks. ([#​8740](https://github.com/open-telemetry/opentelemetry-go/issues/8740)) ##### Fixed - Count valid U+FFFD replacement characters toward attribute value length limits in `go.opentelemetry.io/otel/trace`, `go.opentelemetry.io/otel/sdk/trace`, and `go.opentelemetry.io/otel/sdk/log`. - Truncate string attribute values to empty strings when the configured length limit is zero, including malformed UTF-8, in `go.opentelemetry.io/otel/trace`, `go.opentelemetry.io/otel/sdk/trace`, and `go.opentelemetry.io/otel/sdk/log`. ([#​9054](https://github.com/open-telemetry/opentelemetry-go/issues/9054)) - Fix a data race in `NewPeriodicReader` where `r.inst` was assigned after the background goroutine was launched in `go.opentelemetry.io/otel/sdk/metric`. ([#​9028](https://github.com/open-telemetry/opentelemetry-go/issues/9028)) - Prevent precision loss for large `int64` values in `Sum`, `Histogram`, and `ExponentialHistogram` aggregations in `go.opentelemetry.io/otel/sdk/metric`. ([#​8981](https://github.com/open-telemetry/opentelemetry-go/issues/8981)) - Ensure `grpc.DialOption` values passed via `WithDialOption` take precedence over conflicting internally-computed defaults in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`, and `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. ([#​8805](https://github.com/open-telemetry/opentelemetry-go/issues/8805), [#​8834](https://github.com/open-telemetry/opentelemetry-go/issues/8834), [#​8836](https://github.com/open-telemetry/opentelemetry-go/issues/8836)) - Treat overflowing `OTEL_METRIC_EXPORT_INTERVAL` and `OTEL_METRIC_EXPORT_TIMEOUT` values as invalid in `go.opentelemetry.io/otel/sdk/metric`. ([#​8800](https://github.com/open-telemetry/opentelemetry-go/issues/8800)) - Prevent a panic in `NewFixedSizeReservoir` and `FixedSizeReservoirProvider` when given a negative size in `go.opentelemetry.io/otel/sdk/metric/exemplar`; negative sizes are now clamped to zero, consistent with a size of zero. ([#​8832](https://github.com/open-telemetry/opentelemetry-go/issues/8832)) - Preserve exponential histogram `ZeroThreshold` during OTLP metric export in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#​8801](https://github.com/open-telemetry/opentelemetry-go/issues/8801)) - Ensure metric helpers in `go.opentelemetry.io/otel/semconv/v1.32.0`, `go.opentelemetry.io/otel/semconv/v1.33.0`, and `go.opentelemetry.io/otel/semconv/v1.34.0` record measurements only once when no attributes are provided. ([#​8849](https://github.com/open-telemetry/opentelemetry-go/issues/8849)) - Treat empty `OTEL_TRACES_SAMPLER` and `OTEL_TRACES_SAMPLER_ARG` values as unset in `go.opentelemetry.io/otel/sdk/trace`. ([#​8873](https://github.com/open-telemetry/opentelemetry-go/issues/8873)) - Normalize global `OTEL_EXPORTER_OTLP_ENDPOINT` path joining in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp` so trailing-slash base URLs do not produce double-slash log export paths. ([#​8864](https://github.com/open-telemetry/opentelemetry-go/issues/8864)) - Prevent a deadlock when formatting an error passed to `RecordError` calls back into the span in `go.opentelemetry.io/otel/sdk/trace`. ([#​8815](https://github.com/open-telemetry/opentelemetry-go/issues/8815)) - Prevent `SimpleSpanProcessor.Shutdown` from panicking when constructed with a nil exporter in `go.opentelemetry.io/otel/sdk/trace`. ([#​8844](https://github.com/open-telemetry/opentelemetry-go/issues/8844)) - Propagate invalid exponential histogram scale errors to Prometheus exporter self-observability metrics in `go.opentelemetry.io/otel/exporters/prometheus`. ([#​8839](https://github.com/open-telemetry/opentelemetry-go/issues/8839)) - Retain instrument advisory attributes configured with `go.opentelemetry.io/otel/metric/x.WithDefaultAttributes` when a matching View in `go.opentelemetry.io/otel/sdk/metric` does not specify an attribute filter. ([#​8859](https://github.com/open-telemetry/opentelemetry-go/issues/8859)) - Ignore HTTP URL paths when building OTLP/gRPC metric exporter targets from `OTEL_EXPORTER_OTLP_ENDPOINT` and `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT`, while preserving `unix://` and `unix-abstract://` targets; treat `unix-abstract://` endpoints as insecure in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc` and `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#​8862](https://github.com/open-telemetry/opentelemetry-go/issues/8862)) - Ignore HTTP(S) paths when deriving gRPC trace exporter endpoints from `OTEL_EXPORTER_OTLP_ENDPOINT` and `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. ([#​8852](https://github.com/open-telemetry/opentelemetry-go/issues/8852)) - Bound memory used while parsing dense W3C property metadata by storing it compactly and materializing `Property` values on demand in `go.opentelemetry.io/otel/baggage` and `go.opentelemetry.io/otel/propagation`. ##### Removed - Remove the experimental `OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE` environment variable in `go.opentelemetry.io/otel/sdk/metric`. Use the `WithMaxExportBatchSize` option instead. ([#​8960](https://github.com/open-telemetry/opentelemetry-go/issues/8960)) ##### What's Changed - Prevent panic in FixedSizeReservoir for negative sizes by [@​chiliec](https://github.com/chiliec) in [#​8832](https://github.com/open-telemetry/opentelemetry-go/pull/8832) - fix(metric): reject overflowing export durations by [@​maithilijoshi20](https://github.com/maithilijoshi20) in [#​8800](https://github.com/open-telemetry/opentelemetry-go/pull/8800) - chore(deps): update module github.com/gofrs/flock to v0.13.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8885](https://github.com/open-telemetry/opentelemetry-go/pull/8885) - chore(deps): update module github.com/4meepo/tagalign to v1.4.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8900](https://github.com/open-telemetry/opentelemetry-go/pull/8900) - fix(deps): update googleapis to [`18b4a75`](https://github.com/open-telemetry/opentelemetry-go/commit/18b4a75) by [@​renovate](https://github.com/renovate)\[bot] in [#​8907](https://github.com/open-telemetry/opentelemetry-go/pull/8907) - fix(deps): update module github.com/prometheus/client\_model to v0.6.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8908](https://github.com/open-telemetry/opentelemetry-go/pull/8908) - chore(deps): update module github.com/prometheus/procfs to v0.22.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8894](https://github.com/open-telemetry/opentelemetry-go/pull/8894) - chore(deps): update module github.com/godoc-lint/godoc-lint to v0.11.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8897](https://github.com/open-telemetry/opentelemetry-go/pull/8897) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`d60c349`](https://github.com/open-telemetry/opentelemetry-go/commit/d60c349) by [@​renovate](https://github.com/renovate)\[bot] in [#​8909](https://github.com/open-telemetry/opentelemetry-go/pull/8909) - fix(deps): update module github.com/prometheus/common to v0.71.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8911](https://github.com/open-telemetry/opentelemetry-go/pull/8911) - chore(deps): update golang.org/x/telemetry digest to [`86cb573`](https://github.com/open-telemetry/opentelemetry-go/commit/86cb573) by [@​renovate](https://github.com/renovate)\[bot] in [#​8895](https://github.com/open-telemetry/opentelemetry-go/pull/8895) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`7bb06b0`](https://github.com/open-telemetry/opentelemetry-go/commit/7bb06b0) by [@​renovate](https://github.com/renovate)\[bot] in [#​8902](https://github.com/open-telemetry/opentelemetry-go/pull/8902) - chore(deps): update module github.com/timonwong/loggercheck to v0.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8898](https://github.com/open-telemetry/opentelemetry-go/pull/8898) - \[otlptracegrpc] Grpc dialoption override bug by [@​ps-mir](https://github.com/ps-mir) in [#​8805](https://github.com/open-telemetry/opentelemetry-go/pull/8805) - otlpmetricgrpc: fix preference for user supplied dialOptions by [@​ps-mir](https://github.com/ps-mir) in [#​8834](https://github.com/open-telemetry/opentelemetry-go/pull/8834) - Do not panic on nil exporter in SimpleSpanProcessor.Shutdown by [@​ShreeyashPatil2708](https://github.com/ShreeyashPatil2708) in [#​8844](https://github.com/open-telemetry/opentelemetry-go/pull/8844) - \[chore] Add doc comments to exported internal symbols (1/N) by [@​om7057](https://github.com/om7057) in [#​8752](https://github.com/open-telemetry/opentelemetry-go/pull/8752) - \[chore] Add doc comments to exported internal symbols (3/N) by [@​om7057](https://github.com/om7057) in [#​8869](https://github.com/open-telemetry/opentelemetry-go/pull/8869) - \[chore] docs: mark Logs as release candidate by [@​pellared](https://github.com/pellared) in [#​8910](https://github.com/open-telemetry/opentelemetry-go/pull/8910) - chore(deps): update module github.com/mattn/go-runewidth to v0.0.29 by [@​renovate](https://github.com/renovate)\[bot] in [#​8917](https://github.com/open-telemetry/opentelemetry-go/pull/8917) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`af8eda3`](https://github.com/open-telemetry/opentelemetry-go/commit/af8eda3) by [@​renovate](https://github.com/renovate)\[bot] in [#​8915](https://github.com/open-telemetry/opentelemetry-go/pull/8915) - chore(deps): update github.com/golangci/rowserrcheck digest to [`241134d`](https://github.com/open-telemetry/opentelemetry-go/commit/241134d) by [@​renovate](https://github.com/renovate)\[bot] in [#​8913](https://github.com/open-telemetry/opentelemetry-go/pull/8913) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.66.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8918](https://github.com/open-telemetry/opentelemetry-go/pull/8918) - chore(deps): update otel/weaver docker tag to v0.26.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8922](https://github.com/open-telemetry/opentelemetry-go/pull/8922) - chore(deps): update open-telemetry/shared-workflows action to v0.13.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8921](https://github.com/open-telemetry/opentelemetry-go/pull/8921) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`043ea8a`](https://github.com/open-telemetry/opentelemetry-go/commit/043ea8a) by [@​renovate](https://github.com/renovate)\[bot] in [#​8919](https://github.com/open-telemetry/opentelemetry-go/pull/8919) - fix(otlploggrpc): honor custom dial option precedence by [@​jstar0](https://github.com/jstar0) in [#​8836](https://github.com/open-telemetry/opentelemetry-go/pull/8836) - Define bound instrument API in metric/x by [@​dashpole](https://github.com/dashpole) in [#​8760](https://github.com/open-telemetry/opentelemetry-go/pull/8760) - fix(prometheus): report invalid histogram scale errors by [@​jstar0](https://github.com/jstar0) in [#​8839](https://github.com/open-telemetry/opentelemetry-go/pull/8839) - Add experimental metric Finisher interface by [@​MrAlias](https://github.com/MrAlias) in [#​8906](https://github.com/open-telemetry/opentelemetry-go/pull/8906) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`ae99b73`](https://github.com/open-telemetry/opentelemetry-go/commit/ae99b73) by [@​renovate](https://github.com/renovate)\[bot] in [#​8923](https://github.com/open-telemetry/opentelemetry-go/pull/8923) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8920](https://github.com/open-telemetry/opentelemetry-go/pull/8920) - sdk/trace/x: Add experimental `ProbabilitySampler` by [@​yuanyuanzhao3](https://github.com/yuanyuanzhao3) in [#​8123](https://github.com/open-telemetry/opentelemetry-go/pull/8123) - sdk/trace/x: Adding GoDev badge. by [@​yuanyuanzhao3](https://github.com/yuanyuanzhao3) in [#​8927](https://github.com/open-telemetry/opentelemetry-go/pull/8927) - perf(propagation): use a hex lookup table to decode traceparent by [@​itssaharsh](https://github.com/itssaharsh) in [#​8739](https://github.com/open-telemetry/opentelemetry-go/pull/8739) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`0277a17`](https://github.com/open-telemetry/opentelemetry-go/commit/0277a17) by [@​renovate](https://github.com/renovate)\[bot] in [#​8931](https://github.com/open-telemetry/opentelemetry-go/pull/8931) - fix(deps): update googleapis to [`f8649dd`](https://github.com/open-telemetry/opentelemetry-go/commit/f8649dd) by [@​renovate](https://github.com/renovate)\[bot] in [#​8929](https://github.com/open-telemetry/opentelemetry-go/pull/8929) - chore(deps): update module github.com/dlclark/regexp2/v2 to v2.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8930](https://github.com/open-telemetry/opentelemetry-go/pull/8930) - \[chore] Add doc comments to exported internal symbols (5/N) by [@​om7057](https://github.com/om7057) in [#​8934](https://github.com/open-telemetry/opentelemetry-go/pull/8934) - \[chore] Add doc comments to exported internal symbols (4/N) by [@​om7057](https://github.com/om7057) in [#​8926](https://github.com/open-telemetry/opentelemetry-go/pull/8926) - sdk: optimize composite attribute truncation by [@​pellared](https://github.com/pellared) in [#​8912](https://github.com/open-telemetry/opentelemetry-go/pull/8912) - chore(deps): update module github.com/go-critic/go-critic to v0.15.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8924](https://github.com/open-telemetry/opentelemetry-go/pull/8924) - chore(deps): update module go.augendre.info/fatcontext to v0.10.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8939](https://github.com/open-telemetry/opentelemetry-go/pull/8939) - chore(deps): update module mvdan.cc/gofumpt to v0.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8935](https://github.com/open-telemetry/opentelemetry-go/pull/8935) - chore(deps): update module dev.gaijin.team/go/exhaustruct/v5 to v5.2.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8928](https://github.com/open-telemetry/opentelemetry-go/pull/8928) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8936](https://github.com/open-telemetry/opentelemetry-go/pull/8936) - chore(deps): update module github.com/ghostiam/protogetter to v1.0.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8940](https://github.com/open-telemetry/opentelemetry-go/pull/8940) - fix(trace): avoid reentrant RecordError deadlock by [@​jstar0](https://github.com/jstar0) in [#​8815](https://github.com/open-telemetry/opentelemetry-go/pull/8815) - \[chore] Add doc comments to exported internal symbols (6/6), remove exclusion by [@​om7057](https://github.com/om7057) in [#​8937](https://github.com/open-telemetry/opentelemetry-go/pull/8937) - otlploghttp: normalize global endpoint path joining by [@​RedZapdos123](https://github.com/RedZapdos123) in [#​8864](https://github.com/open-telemetry/opentelemetry-go/pull/8864) - sdk/trace: treat empty sampler env values as unset by [@​RedZapdos123](https://github.com/RedZapdos123) in [#​8873](https://github.com/open-telemetry/opentelemetry-go/pull/8873) - Run full benchmarks weekly by [@​XSAM](https://github.com/XSAM) in [#​8932](https://github.com/open-telemetry/opentelemetry-go/pull/8932) - fix(semconv): avoid duplicate metric recording without attributes by [@​jstar0](https://github.com/jstar0) in [#​8849](https://github.com/open-telemetry/opentelemetry-go/pull/8849) - chore(deps): update module github.com/mattn/go-runewidth to v0.0.30 by [@​renovate](https://github.com/renovate)\[bot] in [#​8946](https://github.com/open-telemetry/opentelemetry-go/pull/8946) - chore(deps): update ubuntu:26.04 docker digest to [`e5a4d62`](https://github.com/open-telemetry/opentelemetry-go/commit/e5a4d62) by [@​renovate](https://github.com/renovate)\[bot] in [#​8945](https://github.com/open-telemetry/opentelemetry-go/pull/8945) - chore(deps): update github/codeql-action action to v4.38.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8944](https://github.com/open-telemetry/opentelemetry-go/pull/8944) - chore(deps): update golang.org/x/telemetry digest to [`55ac43c`](https://github.com/open-telemetry/opentelemetry-go/commit/55ac43c) by [@​renovate](https://github.com/renovate)\[bot] in [#​8943](https://github.com/open-telemetry/opentelemetry-go/pull/8943) - otlptracegrpc: fix env endpoint URL parsing by [@​RedZapdos123](https://github.com/RedZapdos123) in [#​8852](https://github.com/open-telemetry/opentelemetry-go/pull/8852) - otlpmetricgrpc: preserve gRPC env endpoint targets by [@​RedZapdos123](https://github.com/RedZapdos123) in [#​8862](https://github.com/open-telemetry/opentelemetry-go/pull/8862) - chore(deps): update module github.com/sourcegraph/go-diff to v0.9.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8947](https://github.com/open-telemetry/opentelemetry-go/pull/8947) - feat(otlphttp): configure maximum response size by [@​pellared](https://github.com/pellared) in [#​8941](https://github.com/open-telemetry/opentelemetry-go/pull/8941) - fix(otlpmetric): preserve exponential histogram zero threshold by [@​maithilijoshi20](https://github.com/maithilijoshi20) in [#​8801](https://github.com/open-telemetry/opentelemetry-go/pull/8801) - chore(deps): update golang.org/x/telemetry digest to [`15ceca2`](https://github.com/open-telemetry/opentelemetry-go/commit/15ceca2) by [@​renovate](https://github.com/renovate)\[bot] in [#​8948](https://github.com/open-telemetry/opentelemetry-go/pull/8948) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`6c9e17d`](https://github.com/open-telemetry/opentelemetry-go/commit/6c9e17d) by [@​renovate](https://github.com/renovate)\[bot] in [#​8950](https://github.com/open-telemetry/opentelemetry-go/pull/8950) - chore(deps): update module github.com/dave/dst to v0.28.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8949](https://github.com/open-telemetry/opentelemetry-go/pull/8949) - fix(deps): update googleapis to [`f61a6ca`](https://github.com/open-telemetry/opentelemetry-go/commit/f61a6ca) by [@​renovate](https://github.com/renovate)\[bot] in [#​8951](https://github.com/open-telemetry/opentelemetry-go/pull/8951) - chore(deps): update module github.com/nishanths/exhaustive to v0.13.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8953](https://github.com/open-telemetry/opentelemetry-go/pull/8953) - chore(deps): update module github.com/xo/terminfo to v1.2.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8954](https://github.com/open-telemetry/opentelemetry-go/pull/8954) - sdk/log: add queue\_full shutdown regression test by [@​RedZapdos123](https://github.com/RedZapdos123) in [#​8754](https://github.com/open-telemetry/opentelemetry-go/pull/8754) - internal/tools/verifyreadmes: skip hidden dot-directories on Windows by [@​RedZapdos123](https://github.com/RedZapdos123) in [#​8729](https://github.com/open-telemetry/opentelemetry-go/pull/8729) - sdk/metric: add internal finish-aware Sum lifecycle by [@​MrAlias](https://github.com/MrAlias) in [#​8925](https://github.com/open-telemetry/opentelemetry-go/pull/8925) - sdk: limit nested attribute value depth by [@​pellared](https://github.com/pellared) in [#​8938](https://github.com/open-telemetry/opentelemetry-go/pull/8938) - chore(deps): update codecov/codecov-action action to v7.1.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8966](https://github.com/open-telemetry/opentelemetry-go/pull/8966) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.67.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8965](https://github.com/open-telemetry/opentelemetry-go/pull/8965) - chore(deps): update open-telemetry/shared-workflows action to v0.14.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8961](https://github.com/open-telemetry/opentelemetry-go/pull/8961) - Fix Alex Kats emeritus mention by [@​dmathieu](https://github.com/dmathieu) in [#​8933](https://github.com/open-telemetry/opentelemetry-go/pull/8933) - sdk/metric: stabilize max batch size in PeriodicReader by [@​dashpole](https://github.com/dashpole) in [#​8960](https://github.com/open-telemetry/opentelemetry-go/pull/8960) - chore(deps): update ubuntu:26.04 docker digest to [`61ebaa5`](https://github.com/open-telemetry/opentelemetry-go/commit/61ebaa5) by [@​renovate](https://github.com/renovate)\[bot] in [#​8968](https://github.com/open-telemetry/opentelemetry-go/pull/8968) - sdk/metric: Retain advisory attributes when View has no AttributeFilter by [@​dashpole](https://github.com/dashpole) in [#​8859](https://github.com/open-telemetry/opentelemetry-go/pull/8859) - chore(deps): update module github.com/ldez/tagliatelle to v0.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8970](https://github.com/open-telemetry/opentelemetry-go/pull/8970) - sdk/metric: Document nil AttributeFilter behavior by [@​pellared](https://github.com/pellared) in [#​8971](https://github.com/open-telemetry/opentelemetry-go/pull/8971) - chore: fix gofumpt extra-rules warning by [@​dmathieu](https://github.com/dmathieu) in [#​8942](https://github.com/open-telemetry/opentelemetry-go/pull/8942) - chore(deps): update codecov/codecov-action action to v7.1.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8975](https://github.com/open-telemetry/opentelemetry-go/pull/8975) - chore(deps): update module github.com/ldez/gomoddirectives to v0.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8974](https://github.com/open-telemetry/opentelemetry-go/pull/8974) - sdk/trace/x: deduplicate tracestate combination error report in ProbabilitySampler by [@​alex131125](https://github.com/alex131125) in [#​8969](https://github.com/open-telemetry/opentelemetry-go/pull/8969) - \[chore]: fix article and word typos in doc comments by [@​simpleqt](https://github.com/simpleqt) in [#​8972](https://github.com/open-telemetry/opentelemetry-go/pull/8972) - \[chore]: fix two doc comments that name the wrong method by [@​simpleqt](https://github.com/simpleqt) in [#​8973](https://github.com/open-telemetry/opentelemetry-go/pull/8973) - Update googleapis to [`eeb232e`](https://github.com/open-telemetry/opentelemetry-go/commit/eeb232e) by [@​renovate](https://github.com/renovate)\[bot] in [#​8983](https://github.com/open-telemetry/opentelemetry-go/pull/8983) - sdk/metric: extract generic hotColdMap for delta aggregators by [@​dashpole](https://github.com/dashpole) in [#​8756](https://github.com/open-telemetry/opentelemetry-go/pull/8756) - Update github/codeql-action action to v4.38.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8987](https://github.com/open-telemetry/opentelemetry-go/pull/8987) - Update googleapis to [`cecb647`](https://github.com/open-telemetry/opentelemetry-go/commit/cecb647) by [@​renovate](https://github.com/renovate)\[bot] in [#​8986](https://github.com/open-telemetry/opentelemetry-go/pull/8986) - \[chore]: remove CLAUDE.md in favor of AGENTS.md by [@​jarrensj](https://github.com/jarrensj) in [#​8988](https://github.com/open-telemetry/opentelemetry-go/pull/8988) - test(internal/tools/verifyreadmes): add unit tests for verifyReadme by [@​marcschaeferger](https://github.com/marcschaeferger) in [#​8066](https://github.com/open-telemetry/opentelemetry-go/pull/8066) - perf(trace): unroll hex decoders to drop bounds checks by [@​itssaharsh](https://github.com/itssaharsh) in [#​8740](https://github.com/open-telemetry/opentelemetry-go/pull/8740) - sdk/metric: add canonical attribute identity by [@​MrAlias](https://github.com/MrAlias) in [#​8963](https://github.com/open-telemetry/opentelemetry-go/pull/8963) - attribute: add Set.String by [@​iyiola-dev](https://github.com/iyiola-dev) in [#​8347](https://github.com/open-telemetry/opentelemetry-go/pull/8347) - attribute: add String method for KeyValue by [@​pellared](https://github.com/pellared) in [#​8205](https://github.com/open-telemetry/opentelemetry-go/pull/8205) - Update open-telemetry/shared-workflows action to v0.15.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8992](https://github.com/open-telemetry/opentelemetry-go/pull/8992) - Update googleapis to [`b142276`](https://github.com/open-telemetry/opentelemetry-go/commit/b142276) by [@​renovate](https://github.com/renovate)\[bot] in [#​8991](https://github.com/open-telemetry/opentelemetry-go/pull/8991) - Update golang.org/x/telemetry digest to [`bdcd072`](https://github.com/open-telemetry/opentelemetry-go/commit/bdcd072) by [@​renovate](https://github.com/renovate)\[bot] in [#​8990](https://github.com/open-telemetry/opentelemetry-go/pull/8990) - Update module google.golang.org/grpc to v1.84.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8982](https://github.com/open-telemetry/opentelemetry-go/pull/8982) - Update open-telemetry/shared-workflows action to v0.16.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8995](https://github.com/open-telemetry/opentelemetry-go/pull/8995) - Update github.com/opentracing-contrib/go-grpc/test digest to [`c4b3818`](https://github.com/open-telemetry/opentelemetry-go/commit/c4b3818) by [@​renovate](https://github.com/renovate)\[bot] in [#​8994](https://github.com/open-telemetry/opentelemetry-go/pull/8994) - Revert "Update module google.golang.org/grpc to v1.84.0 ([#​8982](https://github.com/open-telemetry/opentelemetry-go/issues/8982))" by [@​dashpole](https://github.com/dashpole) in [#​8997](https://github.com/open-telemetry/opentelemetry-go/pull/8997) - metricdatatest: use attribute collection formatting by [@​pellared](https://github.com/pellared) in [#​8993](https://github.com/open-telemetry/opentelemetry-go/pull/8993) - Update github.com/charmbracelet/ultraviolet digest to [`4e49372`](https://github.com/open-telemetry/opentelemetry-go/commit/4e49372) by [@​renovate](https://github.com/renovate)\[bot] in [#​8998](https://github.com/open-telemetry/opentelemetry-go/pull/8998) - fix(sdk/metric): preserve int64 precision in sum and histogram aggregations by [@​dashpole](https://github.com/dashpole) in [#​8981](https://github.com/open-telemetry/opentelemetry-go/pull/8981) - Update golang.org/x/telemetry digest to [`c6096d2`](https://github.com/open-telemetry/opentelemetry-go/commit/c6096d2) by [@​renovate](https://github.com/renovate)\[bot] in [#​9000](https://github.com/open-telemetry/opentelemetry-go/pull/9000) - Fix OSS-Fuzz issues in FuzzHashKVs, FuzzGetBin, and FuzzSpanIDFromHex by [@​dashpole](https://github.com/dashpole) in [#​8996](https://github.com/open-telemetry/opentelemetry-go/pull/8996) - Update github.com/timakin/bodyclose digest to [`98ded9a`](https://github.com/open-telemetry/opentelemetry-go/commit/98ded9a) by [@​renovate](https://github.com/renovate)\[bot] in [#​9003](https://github.com/open-telemetry/opentelemetry-go/pull/9003) - Update module github.com/ProtonMail/go-crypto to v1.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9004](https://github.com/open-telemetry/opentelemetry-go/pull/9004) - Update module github.com/ProtonMail/go-crypto to v1.5.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​9021](https://github.com/open-telemetry/opentelemetry-go/pull/9021) - Update golang.org/x/telemetry digest to [`9662f6f`](https://github.com/open-telemetry/opentelemetry-go/commit/9662f6f) by [@​renovate](https://github.com/renovate)\[bot] in [#​9020](https://github.com/open-telemetry/opentelemetry-go/pull/9020) - Update module github.com/mgechev/revive to v1.17.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9022](https://github.com/open-telemetry/opentelemetry-go/pull/9022) - Add ps-mir as an approver by [@​MrAlias](https://github.com/MrAlias) in [#​9018](https://github.com/open-telemetry/opentelemetry-go/pull/9018) - Add Marc Schäfer as a project Triager by [@​MrAlias](https://github.com/MrAlias) in [#​9019](https://github.com/open-telemetry/opentelemetry-go/pull/9019) - Update golang.org/x/telemetry digest to [`ed294f9`](https://github.com/open-telemetry/opentelemetry-go/commit/ed294f9) by [@​renovate](https://github.com/renovate)\[bot] in [#​9027](https://github.com/open-telemetry/opentelemetry-go/pull/9027) - Update github/codeql-action action to v4.38.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​9025](https://github.com/open-telemetry/opentelemetry-go/pull/9025) - Update module github.com/golangci/golangci-lint/v2 to v2.14.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9026](https://github.com/open-telemetry/opentelemetry-go/pull/9026) - Update github.com/charmbracelet/ultraviolet digest to [`b78653f`](https://github.com/open-telemetry/opentelemetry-go/commit/b78653f) by [@​renovate](https://github.com/renovate)\[bot] in [#​9036](https://github.com/open-telemetry/opentelemetry-go/pull/9036) - Update github.com/charmbracelet/ultraviolet digest to [`bbf040a`](https://github.com/open-telemetry/opentelemetry-go/commit/bbf040a) by [@​renovate](https://github.com/renovate)\[bot] in [#​9037](https://github.com/open-telemetry/opentelemetry-go/pull/9037) - Update module github.com/golangci/golines to v0.16.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9043](https://github.com/open-telemetry/opentelemetry-go/pull/9043) - Update module github.com/prometheus/common to v0.72.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9044](https://github.com/open-telemetry/opentelemetry-go/pull/9044) - Update module go.opentelemetry.io/collector/pdata to v1.68.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9046](https://github.com/open-telemetry/opentelemetry-go/pull/9046) - Update module github.com/uudashr/iface to v1.5.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​9042](https://github.com/open-telemetry/opentelemetry-go/pull/9042) - Update module github.com/ProtonMail/go-crypto to v1.5.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​9040](https://github.com/open-telemetry/opentelemetry-go/pull/9040) - Update open-telemetry/shared-workflows action to v0.17.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9047](https://github.com/open-telemetry/opentelemetry-go/pull/9047) - Update github.com/golangci/canonicalheader digest to [`e18e5c5`](https://github.com/open-telemetry/opentelemetry-go/commit/e18e5c5) by [@​renovate](https://github.com/renovate)\[bot] in [#​9039](https://github.com/open-telemetry/opentelemetry-go/pull/9039) - Update googleapis to [`8a89bd6`](https://github.com/open-telemetry/opentelemetry-go/commit/8a89bd6) by [@​renovate](https://github.com/renovate)\[bot] in [#​9041](https://github.com/open-telemetry/opentelemetry-go/pull/9041) - Update github.com/charmbracelet/ultraviolet digest to [`666ce5e`](https://github.com/open-telemetry/opentelemetry-go/commit/666ce5e) by [@​renovate](https://github.com/renovate)\[bot] in [#​9051](https://github.com/open-telemetry/opentelemetry-go/pull/9051) - Remove retired Go Report Card badge from README by [@​kijimad](https://github.com/kijimad) in [#​9050](https://github.com/open-telemetry/opentelemetry-go/pull/9050) - fix(sdk/metric): Fix data race with initialization of NewPeriodicReader by [@​CTrando](https://github.com/CTrando) in [#​9028](https://github.com/open-telemetry/opentelemetry-go/pull/9028) - Update module github.com/dlclark/regexp2/v2 to v2.8.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​9061](https://github.com/open-telemetry/opentelemetry-go/pull/9061) - Update github.com/charmbracelet/ultraviolet digest to [`270558f`](https://github.com/open-telemetry/opentelemetry-go/commit/270558f) by [@​renovate](https://github.com/renovate)\[bot] in [#​9060](https://github.com/open-telemetry/opentelemetry-go/pull/9060) - chore: Replace deprecated gofumpt extra-rules with extra options by [@​kijimad](https://github.com/kijimad) in [#​9062](https://github.com/open-telemetry/opentelemetry-go/pull/9062) - Update module github.com/pjbgf/sha1cd to v0.7.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​9064](https://github.com/open-telemetry/opentelemetry-go/pull/9064) - Update github.com/golangci/rowserrcheck digest to [`f772fe6`](https://github.com/open-telemetry/opentelemetry-go/commit/f772fe6) by [@​renovate](https://github.com/renovate)\[bot] in [#​9066](https://github.com/open-telemetry/opentelemetry-go/pull/9066) - Update github.com/charmbracelet/ultraviolet digest to [`8786532`](https://github.com/open-telemetry/opentelemetry-go/commit/8786532) by [@​renovate](https://github.com/renovate)\[bot] in [#​9065](https://github.com/open-telemetry/opentelemetry-go/pull/9065) - Fix zero attribute value length for malformed UTF-8 by [@​pellared](https://github.com/pellared) in [#​9054](https://github.com/open-telemetry/opentelemetry-go/pull/9054) - Update module github.com/uudashr/iface to v1.5.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​9067](https://github.com/open-telemetry/opentelemetry-go/pull/9067) - Update ubuntu:26.04 Docker digest to [`88a381d`](https://github.com/open-telemetry/opentelemetry-go/commit/88a381d) by [@​renovate](https://github.com/renovate)\[bot] in [#​9069](https://github.com/open-telemetry/opentelemetry-go/pull/9069) - Release 1.47.0/0.69.0/0.23.0/0.1.0 by [@​pellared](https://github.com/pellared) in [#​9024](https://github.com/open-telemetry/opentelemetry-go/pull/9024) ##### New Contributors - [@​chiliec](https://github.com/chiliec) made their first contribution in [#​8832](https://github.com/open-telemetry/opentelemetry-go/pull/8832) - [@​maithilijoshi20](https://github.com/maithilijoshi20) made their first contribution in [#​8800](https://github.com/open-telemetry/opentelemetry-go/pull/8800) - [@​ps-mir](https://github.com/ps-mir) made their first contribution in [#​8805](https://github.com/open-telemetry/opentelemetry-go/pull/8805) - [@​ShreeyashPatil2708](https://github.com/ShreeyashPatil2708) made their first contribution in [#​8844](https://github.com/open-telemetry/opentelemetry-go/pull/8844) - [@​alex131125](https://github.com/alex131125) made their first contribution in [#​8969](https://github.com/open-telemetry/opentelemetry-go/pull/8969) - [@​simpleqt](https://github.com/simpleqt) made their first contribution in [#​8972](https://github.com/open-telemetry/opentelemetry-go/pull/8972) - [@​jarrensj](https://github.com/jarrensj) made their first contribution in [#​8988](https://github.com/open-telemetry/opentelemetry-go/pull/8988) - [@​iyiola-dev](https://github.com/iyiola-dev) made their first contribution in [#​8347](https://github.com/open-telemetry/opentelemetry-go/pull/8347) - [@​kijimad](https://github.com/kijimad) made their first contribution in [#​9050](https://github.com/open-telemetry/opentelemetry-go/pull/9050) - [@​CTrando](https://github.com/CTrando) made their first contribution in [#​9028](https://github.com/open-telemetry/opentelemetry-go/pull/9028) **Full Changelog**: <https://github.com/open-telemetry/opentelemetry-go/compare/v1.47.0-rc.1...v1.47.0> </details> <details> <summary>open-telemetry/opentelemetry-proto-go (go.opentelemetry.io/proto/otlp)</summary> ### [`v1.11.1`](https://github.com/open-telemetry/opentelemetry-proto-go/releases/tag/v1.11.1): /v0.4.1 [Compare Source](https://github.com/open-telemetry/opentelemetry-proto-go/compare/v1.11.0...v1.11.1) Generated Go code for the [`v1.11.1`][otlp] version of the OTLP. [otlp]: https://github.com/open-telemetry/opentelemetry-proto/releases/tag/v1.11.1 #### What's Changed - chore(deps): update module github.com/go-git/go-billy/v5 to v5.9.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​664](https://github.com/open-telemetry/opentelemetry-proto-go/pull/664) - chore(deps): update ossf/scorecard-action action to v2.4.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​663](https://github.com/open-telemetry/opentelemetry-proto-go/pull/663) - chore(deps): update googleapis to [`3fe39f3`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/3fe39f3) by [@​renovate](https://github.com/renovate)\[bot] in [#​662](https://github.com/open-telemetry/opentelemetry-proto-go/pull/662) - chore(deps): update googleapis to [`b2f2020`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/b2f2020) by [@​renovate](https://github.com/renovate)\[bot] in [#​665](https://github.com/open-telemetry/opentelemetry-proto-go/pull/665) - chore(deps): update module go.yaml.in/yaml/v3 to v3.0.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​666](https://github.com/open-telemetry/opentelemetry-proto-go/pull/666) - chore(deps): update googleapis to [`6c54ddd`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/6c54ddd) by [@​renovate](https://github.com/renovate)\[bot] in [#​667](https://github.com/open-telemetry/opentelemetry-proto-go/pull/667) - chore(deps): update google.golang.org/genproto/googleapis/api digest to [`8efbd57`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/8efbd57) by [@​renovate](https://github.com/renovate)\[bot] in [#​670](https://github.com/open-telemetry/opentelemetry-proto-go/pull/670) - chore(deps): update module github.com/go-git/go-git/v5 to v5.19.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​669](https://github.com/open-telemetry/opentelemetry-proto-go/pull/669) - chore(deps): update google.golang.org/genproto/googleapis/rpc digest to [`8efbd57`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/8efbd57) by [@​renovate](https://github.com/renovate)\[bot] in [#​671](https://github.com/open-telemetry/opentelemetry-proto-go/pull/671) - chore(deps): update github/codeql-action action to v4.37.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​673](https://github.com/open-telemetry/opentelemetry-proto-go/pull/673) - fix(deps): update module google.golang.org/grpc to v1.83.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​672](https://github.com/open-telemetry/opentelemetry-proto-go/pull/672) - chore: Change Renovate configuration to best practices by [@​thompson-tomo](https://github.com/thompson-tomo) in [#​674](https://github.com/open-telemetry/opentelemetry-proto-go/pull/674) - chore(deps): pin dependencies by [@​renovate](https://github.com/renovate)\[bot] in [#​677](https://github.com/open-telemetry/opentelemetry-proto-go/pull/677) - chore(deps): update github/codeql-action action to v4.37.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​676](https://github.com/open-telemetry/opentelemetry-proto-go/pull/676) - chore(deps): update googleapis to [`6ac0973`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/6ac0973) by [@​renovate](https://github.com/renovate)\[bot] in [#​678](https://github.com/open-telemetry/opentelemetry-proto-go/pull/678) - chore(deps): update github/codeql-action action to v4.37.6 by [@​renovate](https://github.com/renovate)\[bot] in [#​679](https://github.com/open-telemetry/opentelemetry-proto-go/pull/679) - ci: add shared security scanning workflow by [@​opentelemetrybot](https://github.com/opentelemetrybot) in [#​675](https://github.com/open-telemetry/opentelemetry-proto-go/pull/675) - chore(deps): update open-telemetry/shared-workflows action to v0.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​682](https://github.com/open-telemetry/opentelemetry-proto-go/pull/682) - chore(deps): update module github.com/cloudflare/circl to v1.6.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​681](https://github.com/open-telemetry/opentelemetry-proto-go/pull/681) - fix(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.30.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​680](https://github.com/open-telemetry/opentelemetry-proto-go/pull/680) - chore(deps): update googleapis to [`c8921c7`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/c8921c7) by [@​renovate](https://github.com/renovate)\[bot] in [#​684](https://github.com/open-telemetry/opentelemetry-proto-go/pull/684) - chore(deps): update open-telemetry/shared-workflows action to v0.6.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​683](https://github.com/open-telemetry/opentelemetry-proto-go/pull/683) - chore(deps): update googleapis to [`ec0a776`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/ec0a776) by [@​renovate](https://github.com/renovate)\[bot] in [#​685](https://github.com/open-telemetry/opentelemetry-proto-go/pull/685) - fix(deps): update module google.golang.org/protobuf to v1.36.12 by [@​renovate](https://github.com/renovate)\[bot] in [#​686](https://github.com/open-telemetry/opentelemetry-proto-go/pull/686) - chore(deps): update module golang.org/x/mod to v0.39.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​687](https://github.com/open-telemetry/opentelemetry-proto-go/pull/687) - ci: use shared OSSF Scorecard workflow by [@​opentelemetrybot](https://github.com/opentelemetrybot) in [#​688](https://github.com/open-telemetry/opentelemetry-proto-go/pull/688) - chore(deps): update all golang.org/x packages by [@​renovate](https://github.com/renovate)\[bot] in [#​689](https://github.com/open-telemetry/opentelemetry-proto-go/pull/689) - chore(deps): update otel/build-protobuf docker tag to v0.26.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​668](https://github.com/open-telemetry/opentelemetry-proto-go/pull/668) - chore(deps): update module golang.org/x/mod to v0.40.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​690](https://github.com/open-telemetry/opentelemetry-proto-go/pull/690) - chore(deps): update open-telemetry/shared-workflows action to v0.7.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​691](https://github.com/open-telemetry/opentelemetry-proto-go/pull/691) - chore(deps): update googleapis to [`ac3dfec`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/ac3dfec) by [@​renovate](https://github.com/renovate)\[bot] in [#​692](https://github.com/open-telemetry/opentelemetry-proto-go/pull/692) - chore(deps): update googleapis to [`1b09341`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/1b09341) by [@​renovate](https://github.com/renovate)\[bot] in [#​693](https://github.com/open-telemetry/opentelemetry-proto-go/pull/693) - fix(deps): update module google.golang.org/grpc to v1.83.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​694](https://github.com/open-telemetry/opentelemetry-proto-go/pull/694) - chore(deps): update googleapis to [`08b0e42`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/08b0e42) by [@​renovate](https://github.com/renovate)\[bot] in [#​695](https://github.com/open-telemetry/opentelemetry-proto-go/pull/695) - chore(deps): update open-telemetry/shared-workflows action to v0.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​696](https://github.com/open-telemetry/opentelemetry-proto-go/pull/696) - chore(deps): update open-telemetry/shared-workflows action to v0.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​697](https://github.com/open-telemetry/opentelemetry-proto-go/pull/697) - chore(deps): update open-telemetry/shared-workflows action to v0.11.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​698](https://github.com/open-telemetry/opentelemetry-proto-go/pull/698) - chore(deps): update googleapis to [`da73d73`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/da73d73) by [@​renovate](https://github.com/renovate)\[bot] in [#​700](https://github.com/open-telemetry/opentelemetry-proto-go/pull/700) - fix(deps): update module google.golang.org/grpc to v1.83.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​699](https://github.com/open-telemetry/opentelemetry-proto-go/pull/699) - chore(deps): update module github.com/skeema/knownhosts to v1.3.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​702](https://github.com/open-telemetry/opentelemetry-proto-go/pull/702) - chore(deps): update open-telemetry/shared-workflows action to v0.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​701](https://github.com/open-telemetry/opentelemetry-proto-go/pull/701) - chore(deps): update googleapis to [`18b4a75`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/18b4a75) by [@​renovate](https://github.com/renovate)\[bot] in [#​703](https://github.com/open-telemetry/opentelemetry-proto-go/pull/703) - chore(deps): update open-telemetry/shared-workflows action to v0.13.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​704](https://github.com/open-telemetry/opentelemetry-proto-go/pull/704) - chore(deps): update googleapis to [`f8649dd`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/f8649dd) by [@​renovate](https://github.com/renovate)\[bot] in [#​706](https://github.com/open-telemetry/opentelemetry-proto-go/pull/706) - chore(deps): update googleapis to [`f61a6ca`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/f61a6ca) by [@​renovate](https://github.com/renovate)\[bot] in [#​708](https://github.com/open-telemetry/opentelemetry-proto-go/pull/708) - Make slim OTLP descriptors coexist with canonical OTLP by [@​pellared](https://github.com/pellared) in [#​707](https://github.com/open-telemetry/opentelemetry-proto-go/pull/707) - chore(deps): update open-telemetry/shared-workflows action to v0.14.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​710](https://github.com/open-telemetry/opentelemetry-proto-go/pull/710) - Drop support for Go 1.25 by [@​pellared](https://github.com/pellared) in [#​711](https://github.com/open-telemetry/opentelemetry-proto-go/pull/711) - chore(deps): update all golang.org/x packages by [@​renovate](https://github.com/renovate)\[bot] in [#​709](https://github.com/open-telemetry/opentelemetry-proto-go/pull/709) - chore(deps): update googleapis to [`eeb232e`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/eeb232e) by [@​renovate](https://github.com/renovate)\[bot] in [#​713](https://github.com/open-telemetry/opentelemetry-proto-go/pull/713) - fix(deps): update module google.golang.org/grpc to v1.84.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​712](https://github.com/open-telemetry/opentelemetry-proto-go/pull/712) - chore(deps): update googleapis to [`cecb647`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/cecb647) by [@​renovate](https://github.com/renovate)\[bot] in [#​714](https://github.com/open-telemetry/opentelemetry-proto-go/pull/714) - chore(deps): update googleapis to [`b142276`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/b142276) by [@​renovate](https://github.com/renovate)\[bot] in [#​715](https://github.com/open-telemetry/opentelemetry-proto-go/pull/715) - chore(deps): update open-telemetry/shared-workflows action to v0.15.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​716](https://github.com/open-telemetry/opentelemetry-proto-go/pull/716) - chore(deps): update open-telemetry/shared-workflows action to v0.16.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​717](https://github.com/open-telemetry/opentelemetry-proto-go/pull/717) - chore(deps): update module github.com/protonmail/go-crypto to v1.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​718](https://github.com/open-telemetry/opentelemetry-proto-go/pull/718) - chore(deps): update module github.com/protonmail/go-crypto to v1.5.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​719](https://github.com/open-telemetry/opentelemetry-proto-go/pull/719) - fix(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.31.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​720](https://github.com/open-telemetry/opentelemetry-proto-go/pull/720) - chore(deps): update googleapis to [`8a89bd6`](https://github.com/open-telemetry/opentelemetry-proto-go/commit/8a89bd6) by [@​renovate](https://github.com/renovate)\[bot] in [#​723](https://github.com/open-telemetry/opentelemetry-proto-go/pull/723) - chore(deps): update open-telemetry/shared-workflows action to v0.17.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​722](https://github.com/open-telemetry/opentelemetry-proto-go/pull/722) - chore(deps): update module github.com/protonmail/go-crypto to v1.5.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​721](https://github.com/open-telemetry/opentelemetry-proto-go/pull/721) - Release v1.11.1 by [@​pellared](https://github.com/pellared) in [#​724](https://github.com/open-telemetry/opentelemetry-proto-go/pull/724) #### New Contributors - [@​thompson-tomo](https://github.com/thompson-tomo) made their first contribution in [#​674](https://github.com/open-telemetry/opentelemetry-proto-go/pull/674) **Full Changelog**: <https://github.com/open-telemetry/opentelemetry-proto-go/compare/v1.11.0...v1.11.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1308 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Botandsilverwind
|
b741335222 |
fix(deps): update module golang.org/x/net to v0.60.0 [security] (#1292)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.59.0` → `v0.60.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.59.0...refs/tags/v0.60.0) |  |  | --- ### HTTP/2 server memory exhaustion due to Trailer headers in net/http [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) / [GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603) <details> <summary>More information</summary> #### Details When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently. #### Severity Unknown #### References - [https://go.dev/cl/847185](https://go.dev/cl/847185) - [https://go.dev/cl/847314](https://go.dev/cl/847314) - [https://go.dev/issue/81857](https://go.dev/issue/81857) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6603) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 transport accepts malformed framing-related headers in net/http [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) / [GO-2026-6610](https://pkg.go.dev/vuln/GO-2026-6610) <details> <summary>More information</summary> #### Details Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling. #### Severity Unknown #### References - [https://go.dev/cl/835145](https://go.dev/cl/835145) - [https://go.dev/cl/836385](https://go.dev/cl/836385) - [https://go.dev/issue/81115](https://go.dev/issue/81115) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6610) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Excessive CPU consumption from repeated initial window changes in net/http [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) / [GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611) <details> <summary>More information</summary> #### Details A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. #### Severity Unknown #### References - [https://go.dev/cl/847186](https://go.dev/cl/847186) - [https://go.dev/cl/847308](https://go.dev/cl/847308) - [https://go.dev/issue/81742](https://go.dev/issue/81742) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6611) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Double flow control refund on HTTP/2 server streams in net/http [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) / [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) <details> <summary>More information</summary> #### Details The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control. #### Severity Unknown #### References - [https://go.dev/cl/847187](https://go.dev/cl/847187) - [https://go.dev/cl/847310](https://go.dev/cl/847310) - [https://go.dev/issue/81743](https://go.dev/issue/81743) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6612) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 server crash due to HPACK encoder race in net/http [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) / [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617) <details> <summary>More information</summary> #### Details HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server. #### Severity Unknown #### References - [https://go.dev/cl/847188](https://go.dev/cl/847188) - [https://go.dev/cl/847313](https://go.dev/cl/847313) - [https://go.dev/issue/81867](https://go.dev/issue/81867) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6617) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1292 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
20143c9558 |
fix(deps): update go toolchain directive to v1.27.2 [security] (#1291)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.27.1` → `1.27.2` | --- ### Reset context tracking on consecutive template expressions in html/template [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) / [GO-2026-6599](https://pkg.go.dev/vuln/GO-2026-6599) <details> <summary>More information</summary> #### Details When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped. #### Severity Unknown #### References - [https://go.dev/cl/839866](https://go.dev/cl/839866) - [https://go.dev/issue/81821](https://go.dev/issue/81821) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6599) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Recognize yield as regexp preceder keyword in html/template [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) / [GO-2026-6600](https://pkg.go.dev/vuln/GO-2026-6600) <details> <summary>More information</summary> #### Details A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped. #### Severity Unknown #### References - [https://go.dev/cl/840925](https://go.dev/cl/840925) - [https://go.dev/issue/81823](https://go.dev/issue/81823) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6600) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 server memory exhaustion due to Trailer headers in net/http [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) / [GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603) <details> <summary>More information</summary> #### Details When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently. #### Severity Unknown #### References - [https://go.dev/cl/847185](https://go.dev/cl/847185) - [https://go.dev/cl/847314](https://go.dev/cl/847314) - [https://go.dev/issue/81857](https://go.dev/issue/81857) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6603) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Root.Mkdir(All) can follow junctions out of the root on Windows in os [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) / [GO-2026-6604](https://pkg.go.dev/vuln/GO-2026-6604) <details> <summary>More information</summary> #### Details On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target). #### Severity Unknown #### References - [https://go.dev/cl/847305](https://go.dev/cl/847305) - [https://go.dev/issue/81739](https://go.dev/issue/81739) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6604) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/1 client connection desynchronization after CONNECT rejection in net/http [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) / [GO-2026-6605](https://pkg.go.dev/vuln/GO-2026-6605) <details> <summary>More information</summary> #### Details When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning. #### Severity Unknown #### References - [https://go.dev/cl/847306](https://go.dev/cl/847306) - [https://go.dev/issue/81740](https://go.dev/issue/81740) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6605) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Reject malformed ECH outer extension references in crypto/tls [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) / [GO-2026-6607](https://pkg.go.dev/vuln/GO-2026-6607) <details> <summary>More information</summary> #### Details Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result. #### Severity Unknown #### References - [https://go.dev/cl/847312](https://go.dev/cl/847312) - [https://go.dev/issue/81855](https://go.dev/issue/81855) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6607) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) / [GO-2026-6608](https://pkg.go.dev/vuln/GO-2026-6608) <details> <summary>More information</summary> #### Details Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. #### Severity Unknown #### References - [https://go.dev/cl/847307](https://go.dev/cl/847307) - [https://go.dev/issue/81741](https://go.dev/issue/81741) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6608) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Lack of limit on size of parsed Range headers in net/http [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) / [GO-2026-6609](https://pkg.go.dev/vuln/GO-2026-6609) <details> <summary>More information</summary> #### Details When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU. #### Severity Unknown #### References - [https://go.dev/cl/847309](https://go.dev/cl/847309) - [https://go.dev/issue/81858](https://go.dev/issue/81858) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6609) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 transport accepts malformed framing-related headers in net/http [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) / [GO-2026-6610](https://pkg.go.dev/vuln/GO-2026-6610) <details> <summary>More information</summary> #### Details Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling. #### Severity Unknown #### References - [https://go.dev/cl/835145](https://go.dev/cl/835145) - [https://go.dev/cl/836385](https://go.dev/cl/836385) - [https://go.dev/issue/81115](https://go.dev/issue/81115) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6610) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Excessive CPU consumption from repeated initial window changes in net/http [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) / [GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611) <details> <summary>More information</summary> #### Details A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. #### Severity Unknown #### References - [https://go.dev/cl/847186](https://go.dev/cl/847186) - [https://go.dev/cl/847308](https://go.dev/cl/847308) - [https://go.dev/issue/81742](https://go.dev/issue/81742) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6611) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Double flow control refund on HTTP/2 server streams in net/http [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) / [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) <details> <summary>More information</summary> #### Details The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control. #### Severity Unknown #### References - [https://go.dev/cl/847187](https://go.dev/cl/847187) - [https://go.dev/cl/847310](https://go.dev/cl/847310) - [https://go.dev/issue/81743](https://go.dev/issue/81743) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6612) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) / [GO-2026-6613](https://pkg.go.dev/vuln/GO-2026-6613) <details> <summary>More information</summary> #### Details When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP. #### Severity Unknown #### References - [https://go.dev/cl/847311](https://go.dev/cl/847311) - [https://go.dev/issue/81744](https://go.dev/issue/81744) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6613) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### HTTP/2 server crash due to HPACK encoder race in net/http [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) / [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617) <details> <summary>More information</summary> #### Details HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server. #### Severity Unknown #### References - [https://go.dev/cl/847188](https://go.dev/cl/847188) - [https://go.dev/cl/847313](https://go.dev/cl/847313) - [https://go.dev/issue/81867](https://go.dev/issue/81867) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6617) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1291 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
 
|
711b72735b |
chore(deps): update dependencies (#1288)
Co-authored-by: bircni <[email protected]> Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1288 Reviewed-by: bircni <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Botandsilverwind
|
5a38a3d0c4 |
chore(deps): update dependencies (#1254)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | |---|---|---|---|---|---| | [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar) | `v4.10.0` → `v4.10.2` |  |  | require | patch | | [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) | `v0.5.16` → `v0.5.17` |  |  | | patch | | nginx | `62ff208` → `df221db` | | | | digest | --- ### Release Notes <details> <summary>bmatcuk/doublestar (github.com/bmatcuk/doublestar/v4)</summary> ### [`v4.10.2`](https://github.com/bmatcuk/doublestar/releases/tag/v4.10.2): Better support for Windows "Junctions" [Compare Source](https://github.com/bmatcuk/doublestar/compare/v4.10.1...v4.10.2) Has improved support for reading "junctions" in Windows (ie, Windows' version of symlinks). Thanks [@​x0Lazarus](https://github.com/x0Lazarus) for the PR! #### What's Changed - Fix Windows junction traversal with Go 1.23 and later by [@​x0Lazarus](https://github.com/x0Lazarus) in [#​117](https://github.com/bmatcuk/doublestar/pull/117) #### New Contributors - [@​x0Lazarus](https://github.com/x0Lazarus) made their first contribution in [#​117](https://github.com/bmatcuk/doublestar/pull/117) **Full Changelog**: <https://github.com/bmatcuk/doublestar/compare/v4.10.1...v4.10.2> ### [`v4.10.1`](https://github.com/bmatcuk/doublestar/releases/tag/v4.10.1): Fixed issue with alternatives and character classes [Compare Source](https://github.com/bmatcuk/doublestar/compare/v4.10.0...v4.10.1) There was an issue where commas or ending curly brackets inside a character class would cause code looking for the next alternative (commas) or the end of alternatives (ending curly brackets) to erroneously match those characters inside the character classes. Thanks to [@​sidsri14](https://github.com/sidsri14) for the fix! #### What's Changed - fix brace alternation scanning with character classes by [@​sidsri14](https://github.com/sidsri14) in [#​115](https://github.com/bmatcuk/doublestar/pull/115) #### New Contributors - [@​sidsri14](https://github.com/sidsri14) made their first contribution in [#​115](https://github.com/bmatcuk/doublestar/pull/115) **Full Changelog**: <https://github.com/bmatcuk/doublestar/compare/v4.10.0...v4.10.1> </details> <details> <summary>ulikunitz/xz (github.com/ulikunitz/xz)</summary> ### [`v0.5.17`](https://github.com/ulikunitz/xz/compare/v0.5.16...v0.5.17) [Compare Source](https://github.com/ulikunitz/xz/compare/v0.5.16...v0.5.17) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1254 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
58ed5921f3 |
chore(deps): update dependencies (#1236)
This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [docker/build-push-action](https://github.com/docker/build-push-action) ([changelog](https://github.com/docker/build-push-action/compare/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a..c3c9e263c25d99ce0380d002d59b67737d91b0dc)) | action | digest | `53b7df9` → `c3c9e26` | | | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) ([changelog](https://github.com/docker/setup-buildx-action/compare/37fe631027851001ddb9b187196cc803df7f5f0e..f87e5991a6d7451dcb8d9637bfbc97413f497069)) | action | digest | `37fe631` → `f87e599` | | | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) ([changelog](https://github.com/docker/setup-qemu-action/compare/1f40c72289eff860ee54a304f1438e3cff362e0a..99012661954931238ded8c8b007157a8430204e1)) | action | digest | `1f40c72` → `9901266` | | | | [github.com/docker/cli](https://github.com/docker/cli) | require | patch | `v29.8.0+incompatible` → `v29.8.1+incompatible` |  |  | | nginx | | digest | `72ba65e` → `62ff208` | | | | [node](https://github.com/nodejs/node) | | digest | `6dac556` → `64af381` | | | | [node](https://github.com/nodejs/node) | | digest | `2fe369e` → `0e0ff40` | | | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.8.1+incompatible`](https://github.com/docker/cli/compare/v29.8.0...v29.8.1) [Compare Source](https://github.com/docker/cli/compare/v29.8.0...v29.8.1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1236 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
69d5c22300 |
chore(deps): update dependencies (#1223)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | |---|---|---|---|---|---| | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `v1.20.0` → `v1.21.0` |  |  | require | minor | | [github.com/docker/cli](https://github.com/docker/cli) | `v29.7.2+incompatible` → `v29.8.0+incompatible` |  |  | require | minor | | [github.com/moby/moby/api](https://github.com/moby/moby) | `v1.55.0` → `v1.56.0` |  |  | require | minor | | [github.com/moby/moby/client](https://github.com/moby/moby) | `v0.5.1` → `v0.6.0` |  |  | require | minor | | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.58.0` → `v0.59.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.58.0...refs/tags/v0.59.0) |  |  | require | minor | | [golang.org/x/sync](https://pkg.go.dev/golang.org/x/sync) | [`v0.22.0` → `v0.23.0`](https://cs.opensource.google/go/x/sync/+/refs/tags/v0.22.0...refs/tags/v0.23.0) |  |  | require | minor | | [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) | [`v0.47.0` → `v0.48.0`](https://cs.opensource.google/go/x/sys/+/refs/tags/v0.47.0...refs/tags/v0.48.0) |  |  | require | minor | | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.45.0` → `v0.46.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.45.0...refs/tags/v0.46.0) |  |  | require | minor | | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | [`v0.41.0` → `v0.42.0`](https://cs.opensource.google/go/x/text/+/refs/tags/v0.41.0...refs/tags/v0.42.0) |  |  | require | minor | | golang.org/x/vuln | `v1.7.0` → `v1.8.0` |  |  | | minor | | [node](https://github.com/nodejs/node) | `be23f54` → `6dac556` | | | | digest | | [node](https://github.com/nodejs/node) | `ba849c6` → `2fe369e` | | | | digest | | [tags.cncf.io/container-device-interface](https://github.com/cncf-tags/container-device-interface) | `v1.1.0` → `v1.1.1` |  |  | require | patch | --- ### Release Notes <details> <summary>connectrpc/connect-go (connectrpc.com/connect)</summary> ### [`v1.21.0`](https://github.com/connectrpc/connect-go/releases/tag/v1.21.0) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.20.0...v1.21.0) #### What's Changed > \[!IMPORTANT] > > This release adds a security-related feature for servers. The new handler option [`WithRequestGate`](https://pkg.go.dev/connectrpc.com/connect#WithRequestGate) runs after the request headers are available and before any message is received. Use this new option to register checks (e.g. authentication) that should happen before the request is decompressed or unmarshaled, and before any interceptors are run. See the [documentation for details](https://connectrpc.com/docs/go/interceptors/#authentication). ##### Governance - Add pkwarren as a maintainer by [@​bufdev](https://github.com/bufdev) in [#​929](https://github.com/connectrpc/connect-go/pull/929) 🎉 ##### Enhancements - Add WithRequestGate handler option by [@​emcfarlane](https://github.com/emcfarlane) in [#​962](https://github.com/connectrpc/connect-go/pull/962) - Create release binary for protoc-gen-connect-go by [@​emcfarlane](https://github.com/emcfarlane) in [#​966](https://github.com/connectrpc/connect-go/pull/966) ##### Bugfixes - Fix issue with user-agent getting inappropriately injected into request headers by [@​jhump](https://github.com/jhump) in [#​934](https://github.com/connectrpc/connect-go/pull/934) - Fix client streaming operations blocking indefinitely after context cancellation by [@​haru0017](https://github.com/haru0017) in [#​937](https://github.com/connectrpc/connect-go/pull/937) - Fix flaky HTTP2 testcase assertion by [@​emcfarlane](https://github.com/emcfarlane) in [#​940](https://github.com/connectrpc/connect-go/pull/940) - Fix data race and connection leak in duplexHTTPCall by [@​emcfarlane](https://github.com/emcfarlane) in [#​938](https://github.com/connectrpc/connect-go/pull/938) - Fix off-by-one in WithHTTPGetMaxURLSize URL length check by [@​fchimpan](https://github.com/fchimpan) in [#​955](https://github.com/connectrpc/connect-go/pull/955) - Fix connect.WithGRPC typo in the missing client option error by [@​NotAFlightRisk](https://github.com/NotAFlightRisk) in [#​956](https://github.com/connectrpc/connect-go/pull/956) - Only send a 304 when the request was a GET by [@​NotAFlightRisk](https://github.com/NotAFlightRisk) in [#​957](https://github.com/connectrpc/connect-go/pull/957) - Fix panic in stream Spec and Peer when client construction failed by [@​NotAFlightRisk](https://github.com/NotAFlightRisk) in [#​959](https://github.com/connectrpc/connect-go/pull/959) - Fix dropped headers on errStreamingClientConn by [@​mohit-bhandari45](https://github.com/mohit-bhandari45) in [#​964](https://github.com/connectrpc/connect-go/pull/964) #### New Contributors - [@​haru0017](https://github.com/haru0017) made their first contribution in [#​937](https://github.com/connectrpc/connect-go/pull/937) - [@​dongjiang1989](https://github.com/dongjiang1989) made their first contribution in [#​945](https://github.com/connectrpc/connect-go/pull/945) - [@​fchimpan](https://github.com/fchimpan) made their first contribution in [#​955](https://github.com/connectrpc/connect-go/pull/955) - [@​NotAFlightRisk](https://github.com/NotAFlightRisk) made their first contribution in [#​956](https://github.com/connectrpc/connect-go/pull/956) - [@​mohit-bhandari45](https://github.com/mohit-bhandari45) made their first contribution in [#​964](https://github.com/connectrpc/connect-go/pull/964) **Full Changelog**: <https://github.com/connectrpc/connect-go/compare/v1.20.0...v1.21.0> </details> <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.8.0+incompatible`](https://github.com/docker/cli/compare/v29.7.2...v29.8.0) [Compare Source](https://github.com/docker/cli/compare/v29.7.2...v29.8.0) </details> <details> <summary>moby/moby (github.com/moby/moby/client)</summary> ### [`v0.6.0`](https://github.com/moby/moby/compare/v0.5.1...v0.6.0) [Compare Source](https://github.com/moby/moby/compare/v0.5.1...v0.6.0) </details> <details> <summary>cncf-tags/container-device-interface (tags.cncf.io/container-device-interface)</summary> ### [`v1.1.1`](https://github.com/cncf-tags/container-device-interface/releases/tag/v1.1.1) [Compare Source](https://github.com/cncf-tags/container-device-interface/compare/v1.1.0...v1.1.1) #### What's Changed - spec: Fix comment to reference containerEdits field by [@​zrezke](https://github.com/zrezke) in [#​303](https://github.com/cncf-tags/container-device-interface/pull/303) - cdi: inject mount UID/GID mappings if user NS is in use. by [@​klihub](https://github.com/klihub) in [#​288](https://github.com/cncf-tags/container-device-interface/pull/288) - cdi,SPECS.md: allow empty cgroup permissions. by [@​klihub](https://github.com/klihub) in [#​301](https://github.com/cncf-tags/container-device-interface/pull/301) - .github: bump golangci-lint to v2.9.0. by [@​klihub](https://github.com/klihub) in [#​307](https://github.com/cncf-tags/container-device-interface/pull/307) - add local build and install procedure in README.md. by [@​fujitatomoya](https://github.com/fujitatomoya) in [#​305](https://github.com/cncf-tags/container-device-interface/pull/305) - Revert to default spec dirs if none are specified by [@​elezar](https://github.com/elezar) in [#​310](https://github.com/cncf-tags/container-device-interface/pull/310) - SPEC.md: fix a few typos/clarify a sentence. by [@​klihub](https://github.com/klihub) in [#​312](https://github.com/cncf-tags/container-device-interface/pull/312) - add beginner's tutorial to see how CDI works. by [@​fujitatomoya](https://github.com/fujitatomoya) in [#​311](https://github.com/cncf-tags/container-device-interface/pull/311) - Makefile: add GO\_EXTRAFLAGS to go build call by [@​koenkooi](https://github.com/koenkooi) in [#​313](https://github.com/cncf-tags/container-device-interface/pull/313) - Remove runtime-tools dependency by [@​elezar](https://github.com/elezar) in [#​317](https://github.com/cncf-tags/container-device-interface/pull/317) - schema: add validation for top-level container edits by [@​marquiz](https://github.com/marquiz) in [#​323](https://github.com/cncf-tags/container-device-interface/pull/323) - parser: guard single-character vendor and class names against a slice-bounds panic by [@​thc1006](https://github.com/thc1006) in [#​321](https://github.com/cncf-tags/container-device-interface/pull/321) - chore(deps): replace deprecated gopkg.in/yaml.v3 for go.yaml.in/yaml/v3 by [@​thaJeztah](https://github.com/thaJeztah) in [#​328](https://github.com/cncf-tags/container-device-interface/pull/328) - schema: make validation error private by [@​thaJeztah](https://github.com/thaJeztah) in [#​329](https://github.com/cncf-tags/container-device-interface/pull/329) - pkg/cdi: stop embedding Cache mutex by [@​thaJeztah](https://github.com/thaJeztah) in [#​335](https://github.com/cncf-tags/container-device-interface/pull/335) - build(deps): bump actions/stale from 10 to 11 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​327](https://github.com/cncf-tags/container-device-interface/pull/327) - specs-go: add test coverage by [@​thaJeztah](https://github.com/thaJeztah) in [#​332](https://github.com/cncf-tags/container-device-interface/pull/332) - replace strings.Split for strings.Cut by [@​thaJeztah](https://github.com/thaJeztah) in [#​336](https://github.com/cncf-tags/container-device-interface/pull/336) - schema, validation: minor fixes and modernization by [@​thaJeztah](https://github.com/thaJeztah) in [#​330](https://github.com/cncf-tags/container-device-interface/pull/330) - pkg/cdi: deprecate ErrStopScan and use os.ReadDir for scanning Spec directories by [@​thaJeztah](https://github.com/thaJeztah) in [#​339](https://github.com/cncf-tags/container-device-interface/pull/339) - Bump actions/checkout from 6 to 7 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​318](https://github.com/cncf-tags/container-device-interface/pull/318) - pkg/cdi: synchronize access to specDirs by [@​thaJeztah](https://github.com/thaJeztah) in [#​337](https://github.com/cncf-tags/container-device-interface/pull/337) - schema: migrate to github.com/santhosh-tekuri/jsonschema/v6 by [@​thaJeztah](https://github.com/thaJeztah) in [#​331](https://github.com/cncf-tags/container-device-interface/pull/331) - pkg/cdi: fix deprecations, add doc-links and "go fix" by [@​thaJeztah](https://github.com/thaJeztah) in [#​338](https://github.com/cncf-tags/container-device-interface/pull/338) - internal/validation/k8s: remove unused validation helpers by [@​thaJeztah](https://github.com/thaJeztah) in [#​334](https://github.com/cncf-tags/container-device-interface/pull/334) - specs-go: remove x/mod semver dependency by [@​thaJeztah](https://github.com/thaJeztah) in [#​333](https://github.com/cncf-tags/container-device-interface/pull/333) - chore(deps): github.com/stretchr/testify v1.12.1 by [@​thaJeztah](https://github.com/thaJeztah) in [#​342](https://github.com/cncf-tags/container-device-interface/pull/342) - ci: update golangci-lint to v2.13, and fix linting by [@​thaJeztah](https://github.com/thaJeztah) in [#​352](https://github.com/cncf-tags/container-device-interface/pull/352) - ci: apply zizmor hardening fixes by [@​thaJeztah](https://github.com/thaJeztah) in [#​350](https://github.com/cncf-tags/container-device-interface/pull/350) - specs-go: fix benchmark compatibility with go1.19 by [@​thaJeztah](https://github.com/thaJeztah) in [#​353](https://github.com/cncf-tags/container-device-interface/pull/353) - pkg/cdi: fix flaky TestRefreshCache by [@​thaJeztah](https://github.com/thaJeztah) in [#​355](https://github.com/cncf-tags/container-device-interface/pull/355) - ci: test against oldest supported, oldstable, and stable Go versions by [@​thaJeztah](https://github.com/thaJeztah) in [#​351](https://github.com/cncf-tags/container-device-interface/pull/351) - pkg/cdi: TestRefreshCache: consolidate cache state checks by [@​thaJeztah](https://github.com/thaJeztah) in [#​357](https://github.com/cncf-tags/container-device-interface/pull/357) - build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​349](https://github.com/cncf-tags/container-device-interface/pull/349) - remove "sigs.k8s.io/yaml" dependency by [@​thaJeztah](https://github.com/thaJeztah) in [#​340](https://github.com/cncf-tags/container-device-interface/pull/340) - build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​348](https://github.com/cncf-tags/container-device-interface/pull/348) - build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​346](https://github.com/cncf-tags/container-device-interface/pull/346) - build(deps): bump codespell-project/actions-codespell from 2.1 to 2.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​347](https://github.com/cncf-tags/container-device-interface/pull/347) - pkg/cdi: fix, and cleanup some locks, and use RWMutex by [@​thaJeztah](https://github.com/thaJeztah) in [#​345](https://github.com/cncf-tags/container-device-interface/pull/345) - update minimum go version to go1.23 and modernize some code by [@​thaJeztah](https://github.com/thaJeztah) in [#​354](https://github.com/cncf-tags/container-device-interface/pull/354) - chore(deps): github.com/fsnotify/fsnotify v1.7.0 by [@​thaJeztah](https://github.com/thaJeztah) in [#​359](https://github.com/cncf-tags/container-device-interface/pull/359) - pkg/cdi: clean up watcher lifecycle handling and simplify refresh logic by [@​thaJeztah](https://github.com/thaJeztah) in [#​358](https://github.com/cncf-tags/container-device-interface/pull/358) - pkg/cdi: fix cache refresh handling for filesystem events by [@​thaJeztah](https://github.com/thaJeztah) in [#​344](https://github.com/cncf-tags/container-device-interface/pull/344) - Bump version to v1.1.1 by [@​elezar](https://github.com/elezar) in [#​361](https://github.com/cncf-tags/container-device-interface/pull/361) #### New Contributors - [@​zrezke](https://github.com/zrezke) made their first contribution in [#​303](https://github.com/cncf-tags/container-device-interface/pull/303) - [@​fujitatomoya](https://github.com/fujitatomoya) made their first contribution in [#​305](https://github.com/cncf-tags/container-device-interface/pull/305) - [@​koenkooi](https://github.com/koenkooi) made their first contribution in [#​313](https://github.com/cncf-tags/container-device-interface/pull/313) - [@​thc1006](https://github.com/thc1006) made their first contribution in [#​321](https://github.com/cncf-tags/container-device-interface/pull/321) **Full Changelog**: <https://github.com/cncf-tags/container-device-interface/compare/v1.1.0...v1.1.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1223 Reviewed-by: bircni <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Botandsilverwind
|
ba4d3c5b4f |
chore(deps): update dependencies and tweak make checks (#1212)
1. Dependency updates: gobwas/glob v1.0.0, which replaced its `Glob` interface with `*Pattern`, logrus v1.10.2, prometheus/client_model v0.6.3, golangci-lint v2.13.2, Go 1.27.1, docker/setup-qemu-action and nginx digests. 2. `make fmt-check` and `make tidy-check` report only what the formatter or `go mod tidy` would change, so unrelated uncommitted work no longer fails `make checks`. --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1212 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
7f53eca716 |
fix(deps): update module golang.org/x/crypto to v0.56.0 [security] (#1205)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) | [`v0.55.0` → `v0.56.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.55.0...refs/tags/v0.56.0) |  |  | --- ### Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh [CVE-2026-78662](https://nvd.nist.gov/vuln/detail/CVE-2026-78662) / [GO-2026-6354](https://pkg.go.dev/vuln/GO-2026-6354) <details> <summary>More information</summary> #### Details Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection. #### Severity Unknown #### References - [https://go.dev/issue/81316](https://go.dev/issue/81316) - [https://go.dev/cl/826504](https://go.dev/cl/826504) - [https://groups.google.com/g/golang-announce/c/1y3fb2np35U](https://groups.google.com/g/golang-announce/c/1y3fb2np35U) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6354) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh [CVE-2026-56855](https://nvd.nist.gov/vuln/detail/CVE-2026-56855) / [GO-2026-6355](https://pkg.go.dev/vuln/GO-2026-6355) <details> <summary>More information</summary> #### Details Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking. #### Severity Unknown #### References - [https://go.dev/issue/81317](https://go.dev/issue/81317) - [https://go.dev/cl/826524](https://go.dev/cl/826524) - [https://groups.google.com/g/golang-announce/c/1y3fb2np35U](https://groups.google.com/g/golang-announce/c/1y3fb2np35U) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6355) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1205 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
6c77065295 |
chore(deps): update dependencies (#1198)
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://github.com/nodejs/node) | digest | `934240a` → `be23f54` | | [node](https://github.com/nodejs/node) | digest | `3638d9a` → `ba849c6` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1198 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Botandsilverwind
|
e30c2fed62 |
chore: update deps, adapt lint, use json v2 (#1185)
- Raised go to 1.27 - Adopted json v2 - Sync lint config from gitea - Fixed all issues Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1185 Reviewed-by: bircni <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
e78123cee3 |
fix(deps): update go toolchain directive to v1.26.6 [security] (#1183)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://github.com/golang/go)) | toolchain | patch | `1.26.5` → `1.26.6` | --- ### Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) / [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026) <details> <summary>More information</summary> #### Details The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". #### Severity Unknown #### References - [https://go.dev/cl/767220](https://go.dev/cl/767220) - [https://go.dev/issue/78760](https://go.dev/issue/78760) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5026) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage BIT-golang-2026-46600 / [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) / [GO-2026-5942](https://pkg.go.dev/vuln/GO-2026-5942) <details> <summary>More information</summary> #### Details Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. #### Severity Unknown #### References - [https://go.dev/cl/786345](https://go.dev/cl/786345) - [https://go.dev/issue/79795](https://go.dev/issue/79795) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5942) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Enforce maximum recursion depth in encoding/asn1 BIT-golang-2026-33818 / [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) / [GO-2026-5972](https://pkg.go.dev/vuln/GO-2026-5972) <details> <summary>More information</summary> #### Details Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. #### Severity Unknown #### References - [https://go.dev/issue/80405](https://go.dev/issue/80405) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) - [https://go.dev/cl/814980](https://go.dev/cl/814980) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5972) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Add recursion depth guard during decode in encoding/xml BIT-golang-2026-56859 / [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) / [GO-2026-6088](https://pkg.go.dev/vuln/GO-2026-6088) <details> <summary>More information</summary> #### Details Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. #### Severity Unknown #### References - [https://go.dev/issue/80481](https://go.dev/issue/80481) - [https://go.dev/cl/803320](https://go.dev/cl/803320) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6088) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http BIT-golang-2026-56853 / [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) / [GO-2026-6089](https://pkg.go.dev/vuln/GO-2026-6089) <details> <summary>More information</summary> #### Details When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. #### Severity Unknown #### References - [https://go.dev/issue/80205](https://go.dev/issue/80205) - [https://go.dev/cl/795540](https://go.dev/cl/795540) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6089) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Limit handshake messages we are willing to accept post-handshake in crypto/tls BIT-golang-2026-56862 / [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) / [GO-2026-6090](https://pkg.go.dev/vuln/GO-2026-6090) <details> <summary>More information</summary> #### Details Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. #### Severity Unknown #### References - [https://go.dev/issue/80528](https://go.dev/issue/80528) - [https://go.dev/cl/804261](https://go.dev/cl/804261) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6090) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Fix Javascript regexp context tracking in html/template BIT-golang-2026-56858 / [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) / [GO-2026-6091](https://pkg.go.dev/vuln/GO-2026-6091) <details> <summary>More information</summary> #### Details Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. #### Severity Unknown #### References - [https://go.dev/issue/80435](https://go.dev/issue/80435) - [https://go.dev/cl/807100](https://go.dev/cl/807100) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6091) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Avoid quadratic complexity in resolvePath in net/url BIT-golang-2026-56860 / [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) / [GO-2026-6218](https://pkg.go.dev/vuln/GO-2026-6218) <details> <summary>More information</summary> #### Details Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations. #### Severity Unknown #### References - [https://go.dev/cl/803681](https://go.dev/cl/803681) - [https://go.dev/issue/80494](https://go.dev/issue/80494) - [https://groups.google.com/g/golang-announce/c/94pEornpRlI](https://groups.google.com/g/golang-announce/c/94pEornpRlI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6218) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1183 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
dbd9a892f8 |
chore(deps): update dependencies (#1160)
This PR contains the following updates: | Package | Type | Update | Change | Pending | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---|---| | docker | stage | minor | `29.6.2-dind-rootless` → `29.7.1-dind-rootless` | |  |  | | docker | stage | minor | `29.6.2-dind` → `29.7.1-dind` | |  |  | | [github.com/docker/cli](https://github.com/docker/cli) | require | minor | `v29.6.2+incompatible` → `v29.7.1+incompatible` | `v29.7.2+incompatible` |  |  | | [github.com/moby/go-archive](https://github.com/moby/go-archive) | require | minor | `v0.2.1` → `v0.3.2` | `v0.3.3` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.7.1+incompatible`](https://github.com/docker/cli/compare/v29.7.0...v29.7.1) [Compare Source](https://github.com/docker/cli/compare/v29.7.0...v29.7.1) ### [`v29.7.0+incompatible`](https://github.com/docker/cli/compare/v29.6.2...v29.7.0) [Compare Source](https://github.com/docker/cli/compare/v29.6.2...v29.7.0) </details> <details> <summary>moby/go-archive (github.com/moby/go-archive)</summary> ### [`v0.3.2`](https://github.com/moby/go-archive/releases/tag/v0.3.2) [Compare Source](https://github.com/moby/go-archive/compare/v0.3.1...v0.3.2) #### What's Changed Fix a regression introduced in v0.3.0 that caused archive extraction to fail when paths traversed absolute symlinks inside the destination root, such as `var/run -> /run`. Absolute symlink targets are now resolved relative to the extraction root while relative symlink escapes remain rejected. [#​93](https://github.com/moby/go-archive/pull/93) **Full Changelog**: <https://github.com/moby/go-archive/compare/v0.3.1...v0.3.2> ### [`v0.3.1`](https://github.com/moby/go-archive/releases/tag/v0.3.1) [Compare Source](https://github.com/moby/go-archive/compare/v0.3.0...v0.3.1) #### Fixes This patch release fixes a regression introduced in v0.2.1 where archive extraction could fail when an archive omitted explicit entries for parent directories. For example, extracting `etc/dnf/` without a preceding `etc/` entry could return `mkdirat etc/dnf: no such file or directory`. This prevented affected images from being extracted. Archive extraction now creates implied parent directories for both file and directory entries. #### What's Changed - archive: create implied parents for directory entries [#​92](https://github.com/moby/go-archive/pull/92) - archive: Tarballer.Go: suppress io.ErrClosedPipe logs on close [#​94](https://github.com/moby/go-archive/pull/94) **Full Changelog**: <https://github.com/moby/go-archive/compare/v0.3.0...v0.3.1> ### [`v0.3.0`](https://github.com/moby/go-archive/releases/tag/v0.3.0) [Compare Source](https://github.com/moby/go-archive/compare/v0.2.1...v0.3.0) #### Security This release fixes **CVE-2026-17106** / **[GHSA-hfg8-hc9c-6c3h](https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h)**, where a crafted tar archive could use links to cause extraction operations to create or overwrite files outside the intended destination directory. The issue affected `Unpack`, `UnpackLayer`, `Untar`, `UntarUncompressed`, and the `ApplyLayer` helpers. Users should upgrade and avoid extracting untrusted archives with earlier versions. #### What's Changed - archive: harden tar extraction against path traversal [#​45](https://github.com/moby/go-archive/pull/45) - archive: do not follow reparse points in chtimes [#​90](https://github.com/moby/go-archive/pull/90) - archive: fix creation time updates on Windows [#​79](https://github.com/moby/go-archive/pull/79) - archive: minor cleanups and godoc touch-up [#​87](https://github.com/moby/go-archive/pull/87) - archive: RebaseArchiveEntries: fix archive path rebasing [#​43](https://github.com/moby/go-archive/pull/43) #### Test and CI changes - ci: enable dependabot for actions [#​81](https://github.com/moby/go-archive/pull/81) - archive: make breakoutErr unwrap its cause [#​91](https://github.com/moby/go-archive/pull/91) - archive: use filepath for filesystem paths in tests [#​80](https://github.com/moby/go-archive/pull/80) - archive: use filepath for filesystem paths in tests [#​80](https://github.com/moby/go-archive/pull/80) **Full Changelog**: <https://github.com/moby/go-archive/compare/v0.2.1...v0.3.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1160 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Botandsilverwind
|
b66433e667 |
fix(deps): update module github.com/go-git/go-git/v5 to v5.19.2 [security] (#1156)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.19.1` → `v5.19.2` |  |  | --- ### go-git: Worktree operations may follow symlinks [CVE-2026-71556](https://nvd.nist.gov/vuln/detail/CVE-2026-71556) / [GHSA-hc8v-wwc9-vgxm](https://github.com/advisories/GHSA-hc8v-wwc9-vgxm) <details> <summary>More information</summary> #### Details ##### Impact A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended worktree path. The `worktreeFilesystem` wrapper rejected dangerous path strings, including paths containing `.git`, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree. As a result, a path that is safe when evaluated as a string could still resolve into the repository's Git metadata directory. For example, if `s` is a symbolic link to `.git`, writing to `s/config` would modify `.git/config`. A symbolic link at the final path component could also be followed. For example, if `s` points directly to `.git/config`, opening `s` for writing with truncation could overwrite the repository configuration. Exploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path. Applications using `storage/memory` for their Storer, or `go-billy/memfs` for their `Worktree`, are not affected by this vulnerability. ##### Patches The issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary. Worktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component. Users of filesystem-backed worktrees should upgrade to a patched version. ##### Credits Thanks to @​kodareef5 for reporting this issue and working with the go-git security team toward its resolution. 🥇 We would also like to thank @​HughLewis20, who independently reported the same issue while a fix was already in progress. #### Severity - CVSS Score: 7.1 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L` #### References - [https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm](https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm) - [https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab](https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab) - [https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac](https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac) - [https://github.com/go-git/go-git](https://github.com/go-git/go-git) - [https://github.com/go-git/go-git/releases/tag/v5.19.2](https://github.com/go-git/go-git/releases/tag/v5.19.2) - [https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5](https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-hc8v-wwc9-vgxm) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### go-git: Malicious reference names may modify files outside the reference storage [CVE-2026-71557](https://nvd.nist.gov/vuln/detail/CVE-2026-71557) / [GHSA-qgq7-7hm3-q39j](https://github.com/advisories/GHSA-qgq7-7hm3-q39j) <details> <summary>More information</summary> #### Details ##### Impact A path traversal issue in `go-git` could allow malicious reference names to access files outside the repository's intended reference storage. Loose references are stored under `.git/<reference-name>`. The reference name was previously used as a path without verifying that the resolved path remained within the reference storage. A name such as `refs/heads/../../config` could therefore resolve to unrelated repository metadata such as `.git/config` or `.git/HEAD`. A malicious Git server could advertise such a reference name. The name may also survive refspec mapping; for example, it could be mapped to `refs/remotes/origin/../../config` during a clone or fetch operation. This vulnerability affects filesystem-backed repositories using the `storage/filesystem` package and its `dotgit` reference storage. Users relying exclusively on the in-memory storage implementation, `storage/memory`, are not affected, because reference names are not resolved as filesystem paths. Exploitation requires an application using `go-git` with filesystem-backed storage to interact with a malicious Git server or otherwise process attacker-controlled reference names. ##### Patches The issue has been addressed by validating reference names at the `dotgit` storage entry points and rejecting names whose resolved paths could escape the reference storage. Users of filesystem-backed storage should upgrade to a patched version. ##### Workarounds Applications that exclusively use `storage/memory` are not affected and do not require a workaround for this vulnerability. For applications using filesystem-backed storage, avoid cloning from or fetching from untrusted Git servers until an upgrade is possible. Applications that directly construct or process reference names may also validate them before passing them to filesystem-backed `go-git` storage. Application-level validation should only be considered a temporary mitigation and does not replace upgrading to a patched version. ##### References - Fixes: - https://github.com/go-git/go-git/pull/2247 - https://github.com/go-git/go-git/pull/2254 ##### Credits Thanks to @​Saku0512 for reporting this issue and @​Sahana2524 for proposing the initial fix. 🙇 #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L` #### References - [https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j](https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j) - [https://github.com/go-git/go-git/pull/2247](https://github.com/go-git/go-git/pull/2247) - [https://github.com/go-git/go-git/pull/2254](https://github.com/go-git/go-git/pull/2254) - [https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7](https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7) - [https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36](https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36) - [https://github.com/go-git/go-git](https://github.com/go-git/go-git) - [https://github.com/go-git/go-git/releases/tag/v5.19.2](https://github.com/go-git/go-git/releases/tag/v5.19.2) - [https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5](https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-qgq7-7hm3-q39j) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.19.2`](https://github.com/go-git/go-git/releases/tag/v5.19.2) [Compare Source](https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2) #### What's Changed - build: Update module golang.org/x/crypto to v0.52.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2150](https://github.com/go-git/go-git/pull/2150) - build: Update module github.com/go-git/go-git/v5 to v5.19.1 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2141](https://github.com/go-git/go-git/pull/2141) - build: Update module golang.org/x/net to v0.55.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2152](https://github.com/go-git/go-git/pull/2152) - git: Worktree: Add stores index entires with backslashes on Windows by [@​joshblum](https://github.com/joshblum) in [#​2262](https://github.com/go-git/go-git/pull/2262) - storage: dotgit, reject path traversal in reference names by [@​pjbgf](https://github.com/pjbgf) in [#​2254](https://github.com/go-git/go-git/pull/2254) - build: Update module golang.org/x/net to v0.56.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2267](https://github.com/go-git/go-git/pull/2267) - build: Update module golang.org/x/text to v0.39.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2268](https://github.com/go-git/go-git/pull/2268) - \[v5] git: worktree, make the filesystem wrapper a symlink-safe boundary by [@​pjbgf](https://github.com/pjbgf) in [#​2277](https://github.com/go-git/go-git/pull/2277) **Full Changelog**: <https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1156 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
55a625f733 |
chore(deps): update dependencies (#1138)
Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
2398d4a527 |
fix(deps): update module github.com/ulikunitz/xz to v0.5.15 [security] (#1127)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) | `v0.5.10` → `v0.5.15` |  |  | --- ### github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives [CVE-2025-58058](https://nvd.nist.gov/vuln/detail/CVE-2025-58058) / [GHSA-jc7w-c686-c4v9](https://github.com/advisories/GHSA-jc7w-c686-c4v9) / [GO-2025-3922](https://pkg.go.dev/vuln/GO-2025-3922) <details> <summary>More information</summary> #### Details ##### Summary It is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn't include a magic number or has a checksum to detect such an issue according to the [specification](https://github.com/jljusten/LZMA-SDK/blob/master/DOC/lzma-specification.txt). Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. ##### Mitigations The release v0.5.15 includes following mitigations: - The ReaderConfig DictCap field is now interpreted as a limit for the dictionary size. - The default is 2 Gigabytes - 1 byte (2^31-1 bytes). - Users can check with the [Reader.Header] method what the actual values are in their LZMA files and set a smaller limit using ReaderConfig. - The dictionary size will not exceed the larger of the file size and the minimum dictionary size. This is another measure to prevent huge memory allocations for the dictionary. - The code supports stream sizes only up to a pebibyte (1024^5). Note that the original v0.5.14 version had a compiler error for 32 bit platforms, which has been fixed by v0.5.15. ##### Methods affected Only software that uses [lzma.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#NewReader) or [lzma.ReaderConfig.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#ReaderConfig.NewReader) is affected. There is no issue for software using the xz functionality. I thank @​GregoryBuligin for his report, which is provided below. ##### Summary When unpacking a large number of LZMA archives, even in a single goroutine, if the first byte of the archive file is 0 (a zero byte added to the beginning), an error __writeMatch: distance out of range__ occurs. Memory consumption spikes sharply, and the GC clearly cannot handle this situation. ##### Details Judging by the error __writeMatch: distance out of range__, the problems occur in the code around this function. https://github.com/ulikunitz/xz/blob/c8314b8f21e9c5e25b52da07544cac14db277e89/lzma/decoderdict.go#L81 ##### PoC Run a function similar to this one in 1 or several goroutines on a multitude of LZMA archives that have a 0 (a zero byte) added to the beginning. ``` const ProjectLocalPath = "some/path" const TmpDir = "tmp" func UnpackLZMA(lzmaFile string) error { file, err := os.Open(lzmaFile) if err != nil { return err } defer file.Close() reader, err := lzma.NewReader(bufio.NewReader(file)) if err != nil { return err } tmpFile, err := os.CreateTemp(TmpDir, TmpLZMAPrefix) if err != nil { return err } defer func() { tmpFile.Close() _ = os.Remove(tmpFile.Name()) }() sha256Hasher := sha256.New() multiWriter := io.MultiWriter(tmpFile, sha256Hasher) if _, err = io.Copy(multiWriter, reader); err != nil { return err } unpackHash := hex.EncodeToString(sha256Hasher.Sum(nil)) unpackDir := filepath.Join( ProjectLocalPath, unpackHash[:2], ) _ = os.MkdirAll(unpackDir, DirPerm) unpackPath := filepath.Join(unpackDir, unpackHash) return os.Rename(tmpFile.Name(), unpackPath) } ``` ##### Impact Servers with a small amount of RAM that download and unpack a large number of unverified LZMA archives #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` #### References - [https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9](https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9) - [https://nvd.nist.gov/vuln/detail/CVE-2025-58058](https://nvd.nist.gov/vuln/detail/CVE-2025-58058) - [https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2](https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2) - [https://github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jc7w-c686-c4v9) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz [CVE-2025-58058](https://nvd.nist.gov/vuln/detail/CVE-2025-58058) / [GHSA-jc7w-c686-c4v9](https://github.com/advisories/GHSA-jc7w-c686-c4v9) / [GO-2025-3922](https://pkg.go.dev/vuln/GO-2025-3922) <details> <summary>More information</summary> #### Details Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz #### Severity Unknown #### References - [https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9](https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9) - [https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2](https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2025-3922) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>ulikunitz/xz (github.com/ulikunitz/xz)</summary> ### [`v0.5.15`](https://github.com/ulikunitz/xz/compare/v0.5.14...v0.5.15) [Compare Source](https://github.com/ulikunitz/xz/compare/v0.5.14...v0.5.15) ### [`v0.5.14`](https://github.com/ulikunitz/xz/compare/v0.5.13...v0.5.14) [Compare Source](https://github.com/ulikunitz/xz/compare/v0.5.13...v0.5.14) ### [`v0.5.13`](https://github.com/ulikunitz/xz/compare/v0.5.12...v0.5.13) [Compare Source](https://github.com/ulikunitz/xz/compare/v0.5.12...v0.5.13) ### [`v0.5.12`](https://github.com/ulikunitz/xz/compare/v0.5.11...v0.5.12) [Compare Source](https://github.com/ulikunitz/xz/compare/v0.5.11...v0.5.12) ### [`v0.5.11`](https://github.com/ulikunitz/xz/compare/v0.5.10...v0.5.11) [Compare Source](https://github.com/ulikunitz/xz/compare/v0.5.10...v0.5.11) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1127 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Botandsilverwind
|
78a74f78f8 |
chore(deps): pin dependencies (#1117)
This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [actions/checkout](https://github.com/actions/checkout) | action | pinDigest | → `3d3c42e` | | | | [actions/setup-go](https://github.com/actions/setup-go) | action | pinDigest | → `b7ad1da` | | | | [actions/setup-node](https://github.com/actions/setup-node) | action | pinDigest | → `8207627` | | | | [crazy-max/ghaction-import-gpg](https://github.com/crazy-max/ghaction-import-gpg) | action | pinDigest | → `2dc316d` | | | | [docker/build-push-action](https://github.com/docker/build-push-action) | action | pinDigest | → `53b7df9` | | | | [docker/login-action](https://github.com/docker/login-action) | action | pinDigest | → `abd2ef4` | | | | [docker/metadata-action](https://github.com/docker/metadata-action) | action | pinDigest | → `dc80280` | | | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | action | pinDigest | → `bb05f3f` | | | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | action | pinDigest | → `96fe6ef` | | | | [go.yaml.in/yaml/v4](https://github.com/yaml/go-yaml) | require | patch | `v4.0.0-rc.3` → `v4.0.0-rc.6` |  |  | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | action | pinDigest | → `f06c13b` | | | | ubuntu | final | major | `24.04` → `26.04` |  |  | --- ### Release Notes <details> <summary>yaml/go-yaml (go.yaml.in/yaml/v4)</summary> ### [`v4.0.0-rc.6`](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.5...v4.0.0-rc.6) [Compare Source](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.5...v4.0.0-rc.6) ### [`v4.0.0-rc.5`](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.4...v4.0.0-rc.5) [Compare Source](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.4...v4.0.0-rc.5) ### [`v4.0.0-rc.4`](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.3...v4.0.0-rc.4) [Compare Source](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.3...v4.0.0-rc.4) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1117 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
|
8c519ce318 |
fix(deps): update module github.com/prometheus/client_golang to v1.24.0 (#1113)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `v1.23.2` → `v1.24.0` |  |  | --- ### Release Notes <details> <summary>prometheus/client_golang (github.com/prometheus/client_golang)</summary> ### [`v1.24.0`](https://github.com/prometheus/client_golang/releases/tag/v1.24.0): - 2026-07-20 [Compare Source](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0) ##### Changes - \[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. [#​1862](https://github.com/prometheus/client_golang/issues/1862) - \[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated `model.NameValidationScheme` global. Default behavior is unchanged; code that set `NameValidationScheme = LegacyValidation` no longer gets legacy enforcement at metric, label, and push-grouping construction. [#​2051](https://github.com/prometheus/client_golang/issues/2051) - \[CHANGE] api/prometheus/v1: Support matchers (`matches[]` parameter) in `Rules` method (`Rules(ctx context.Context, matches []string) (RulesResult, error)`). [#​1843](https://github.com/prometheus/client_golang/issues/1843) - \[CHANGE] api/prometheus/v1: Refactor `LabelNames` method to return `model.LabelNames` instead of `[]string` for consistency across the API. [#​1850](https://github.com/prometheus/client_golang/issues/1850) - \[CHANGE] exp/api/remote: Simplify `Store` interface, rename `Handler` to `WriteHandler`, and encapsulate write response handling. [#​1855](https://github.com/prometheus/client_golang/issues/1855) - \[FEATURE] prometheus: Add new Go 1.26 runtime metrics (`/sched/goroutines-created:goroutines`, `/sched/goroutines/not-in-go:goroutines`, `/sched/goroutines/runnable:goroutines`, `/sched/goroutines/running:goroutines`, `/sched/goroutines/waiting:goroutines`, `/sched/threads/total:threads`). [#​1942](https://github.com/prometheus/client_golang/issues/1942) - \[FEATURE] prometheus: Add `WithUnit(unit string)` option and explicit OpenMetrics unit support in `CounterOpts`, `GaugeOpts`, `SummaryOpts`, and `HistogramOpts`. [#​1392](https://github.com/prometheus/client_golang/issues/1392) - \[FEATURE] prometheus: Expose descriptor construction error through public `Err()` method on `Desc`. [#​1902](https://github.com/prometheus/client_golang/issues/1902) - \[FEATURE] promhttp: Add opt-in `HandlerOpts.CoalesceGather` to deduplicate concurrent `Gather` calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. [#​1969](https://github.com/prometheus/client_golang/issues/1969) - \[FEATURE] promhttp: HTTP handlers created by `promhttp` package now support metrics filtering by providing one or more `name[]` query parameters. The default behavior when none are provided remains the same, returning all metrics. [#​1925](https://github.com/prometheus/client_golang/issues/1925) - \[FEATURE] api/prometheus/v1: Add query formatting endpoint support (`/format_query`) and `FormatQuery(ctx context.Context, query string) (string, error)` method. [#​1846](https://github.com/prometheus/client_golang/issues/1846), [#​1856](https://github.com/prometheus/client_golang/issues/1856) - \[FEATURE] api/prometheus/v1: Add support for `/status/tsdb/blocks` endpoint via `TSDBBlocks(ctx context.Context) ([]TSDBBlock, error)` method. [#​1896](https://github.com/prometheus/client_golang/issues/1896) - \[FEATURE] exp/api/remote: Export `BackoffConfig` to allow customization when using `WithAPIBackoff`. [#​1895](https://github.com/prometheus/client_golang/issues/1895) - \[FEATURE] exp/api/remote: Add `RetryCallBack` to allow custom logging or handling on retry attempts in the remote write client. [#​1888](https://github.com/prometheus/client_golang/issues/1888), [#​1890](https://github.com/prometheus/client_golang/issues/1890) - \[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. [#​1860](https://github.com/prometheus/client_golang/issues/1860) - \[ENHANCEMENT] api: Use cloned `http.DefaultTransport` when constructing default HTTP clients to prevent accidental mutations of shared global transport state. [#​1885](https://github.com/prometheus/client_golang/issues/1885) - \[BUGFIX] prometheus: Recover from collector panics during `Gather()` and return an error instead of crashing the process. [#​1961](https://github.com/prometheus/client_golang/issues/1961) - \[BUGFIX] prometheus: Fix `cpu-seconds` unit suffix handling for metric `go_cpu_classes_gc_mark_assist_cpu_seconds`. [#​1991](https://github.com/prometheus/client_golang/issues/1991) - \[BUGFIX] promhttp: `InstrumentHandlerDuration` and `InstrumentHandlerCounter` no longer panic when given an observer/counter that does not implement `ExemplarObserver`/`ExemplarAdder` (e.g. a `SummaryVec`). The exemplar is dropped and the value is recorded via the plain `Observe`/`Add` path, matching the safe-cast already used by `Timer.ObserveDurationWithExemplar`. [#​2005](https://github.com/prometheus/client_golang/issues/2005) - \[BUGFIX] api/prometheus/v1: Fall back to `GET` requests when `POST` requests return `403 Forbidden` or method not allowed. [#​2030](https://github.com/prometheus/client_golang/issues/2030) - \[BUGFIX] api: Respect context cancellation inside `httpClient.Do`. [#​1971](https://github.com/prometheus/client_golang/issues/1971) - \[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. [#​1889](https://github.com/prometheus/client_golang/issues/1889) - \[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. [#​1917](https://github.com/prometheus/client_golang/issues/1917) - \[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. [#​1927](https://github.com/prometheus/client_golang/issues/1927) <details> <summary> All commits </summary> - build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1839](https://github.com/prometheus/client_golang/pull/1839) - build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1838](https://github.com/prometheus/client_golang/pull/1838) - prometheus/collectors: use godoc link for runtime/metrics supported metrics by [@​xieyuschen](https://github.com/xieyuschen) in [#​1844](https://github.com/prometheus/client_golang/pull/1844) - Fix doc typo by [@​torrca](https://github.com/torrca) in [#​1849](https://github.com/prometheus/client_golang/pull/1849) - Merge release-1.23 into main by [@​vesari](https://github.com/vesari) in [#​1851](https://github.com/prometheus/client_golang/pull/1851) - build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1852](https://github.com/prometheus/client_golang/pull/1852) - Refactor LabelNames to return model.LabelNames type for consistency by [@​yshngg](https://github.com/yshngg) in [#​1850](https://github.com/prometheus/client_golang/pull/1850) - remote: simplified Store interface; renamed Handler to WriteHandler by [@​bwplotka](https://github.com/bwplotka) in [#​1855](https://github.com/prometheus/client_golang/pull/1855) - feat(api/prometheus): add format\_query endpoint for query formatting by [@​yshngg](https://github.com/yshngg) in [#​1846](https://github.com/prometheus/client_golang/pull/1846) - feat(api): add FormatQuery method to Prometheus v1 API by [@​yshngg](https://github.com/yshngg) in [#​1856](https://github.com/prometheus/client_golang/pull/1856) - Support matchers in rules API by [@​jotak](https://github.com/jotak) in [#​1843](https://github.com/prometheus/client_golang/pull/1843) - Use prometheus/common.expfmt.NewTextParser by [@​aknuds1](https://github.com/aknuds1) in [#​1859](https://github.com/prometheus/client_golang/pull/1859) - Merge release-1.23 into main by [@​aknuds1](https://github.com/aknuds1) in [#​1861](https://github.com/prometheus/client_golang/pull/1861) - chore: Drop support for \<go1.22 by [@​mrueg](https://github.com/mrueg) in [#​1862](https://github.com/prometheus/client_golang/pull/1862) - collectors/version: Allow custom additional labels by [@​mrueg](https://github.com/mrueg) in [#​1860](https://github.com/prometheus/client_golang/pull/1860) - build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.0 by [@​ywwg](https://github.com/ywwg) in [#​1865](https://github.com/prometheus/client_golang/pull/1865) - Sync release-1.23 into main by [@​aknuds1](https://github.com/aknuds1) in [#​1868](https://github.com/prometheus/client_golang/pull/1868) - Sync main with release-1.23 by [@​aknuds1](https://github.com/aknuds1) in [#​1871](https://github.com/prometheus/client_golang/pull/1871) - chore: clean up golangci-lint configuration by [@​mmorel-35](https://github.com/mmorel-35) in [#​1802](https://github.com/prometheus/client_golang/pull/1802) - build(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1880](https://github.com/prometheus/client_golang/pull/1880) - build(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.9 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1882](https://github.com/prometheus/client_golang/pull/1882) - build(deps): bump github.com/prometheus/common from 0.65.0 to 0.66.1 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1883](https://github.com/prometheus/client_golang/pull/1883) - build(deps): bump the github-actions group with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1881](https://github.com/prometheus/client_golang/pull/1881) - Fix typo in remote api err msg by [@​SungJin1212](https://github.com/SungJin1212) in [#​1878](https://github.com/prometheus/client_golang/pull/1878) - chore: Update metrics for new Go version by [@​github-actions](https://github.com/github-actions)\[bot] in [#​1864](https://github.com/prometheus/client_golang/pull/1864) - Add RetryCallBack to remote\_api.go by [@​pipiland2612](https://github.com/pipiland2612) in [#​1888](https://github.com/prometheus/client_golang/pull/1888) - bug(remote\_write): Fix compression buffer pooling by [@​fpetkovski](https://github.com/fpetkovski) in [#​1889](https://github.com/prometheus/client_golang/pull/1889) - Change RetryCallBack initialized by [@​pipiland2612](https://github.com/pipiland2612) in [#​1890](https://github.com/prometheus/client_golang/pull/1890) - Fix CI bug by [@​pipiland2612](https://github.com/pipiland2612) in [#​1892](https://github.com/prometheus/client_golang/pull/1892) - Use cloned http.DefaultTransport. issue-1857 by [@​karthikkondapally](https://github.com/karthikkondapally) in [#​1885](https://github.com/prometheus/client_golang/pull/1885) - Public backoff config to allow usage of WithAPIBackoff by [@​pipiland2612](https://github.com/pipiland2612) in [#​1895](https://github.com/prometheus/client_golang/pull/1895) - Clarify exp library stability by [@​pipiland2612](https://github.com/pipiland2612) in [#​1894](https://github.com/prometheus/client_golang/pull/1894) - feat: add support for `/status/tsdb/blocks` endpoint by [@​tjhop](https://github.com/tjhop) in [#​1896](https://github.com/prometheus/client_golang/pull/1896) - minor refactor of replaceInvalidRune() in bridge.go by [@​karthikkondapally](https://github.com/karthikkondapally) in [#​1897](https://github.com/prometheus/client_golang/pull/1897) - build(deps): bump github.com/prometheus/procfs from 0.17.0 to 0.19.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1903](https://github.com/prometheus/client_golang/pull/1903) - build(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1906](https://github.com/prometheus/client_golang/pull/1906) - build(deps): bump golang.org/x/sys from 0.35.0 to 0.37.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1904](https://github.com/prometheus/client_golang/pull/1904) - build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1907](https://github.com/prometheus/client_golang/pull/1907) - build(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1911](https://github.com/prometheus/client_golang/pull/1911) - build(deps): bump google.golang.org/protobuf from 1.36.9 to 1.36.10 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1909](https://github.com/prometheus/client_golang/pull/1909) - build(deps): bump github.com/prometheus/common from 0.66.1 to 0.67.2 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1910](https://github.com/prometheus/client_golang/pull/1910) - build(deps): bump the github-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1908](https://github.com/prometheus/client_golang/pull/1908) - chore(ci): Add CRLF detection and fix targets to prevent CRLF contamination by [@​kakkoyun](https://github.com/kakkoyun) in [#​1898](https://github.com/prometheus/client_golang/pull/1898) - chore(ci): Use stable names for CI steps by [@​kakkoyun](https://github.com/kakkoyun) in [#​1914](https://github.com/prometheus/client_golang/pull/1914) - build(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1920](https://github.com/prometheus/client_golang/pull/1920) - build(deps): bump github.com/prometheus/common from 0.67.2 to 0.67.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1921](https://github.com/prometheus/client_golang/pull/1921) - build(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1922](https://github.com/prometheus/client_golang/pull/1922) - build(deps): bump github.com/prometheus/common from 0.67.2 to 0.67.4 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1923](https://github.com/prometheus/client_golang/pull/1923) - build(deps): bump github.com/klauspost/compress from 1.18.1 to 1.18.2 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1924](https://github.com/prometheus/client_golang/pull/1924) - build(deps): bump the github-actions group with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1919](https://github.com/prometheus/client_golang/pull/1919) - feat: expose Desc error through public Err() method by [@​duricanikolic](https://github.com/duricanikolic) in [#​1902](https://github.com/prometheus/client_golang/pull/1902) - Allow `/metrics` handler output filtering via `name[]` query param by [@​colega](https://github.com/colega) in [#​1925](https://github.com/prometheus/client_golang/pull/1925) - Prevent OOM from malformed snappy payloads by validating decoded length by [@​makasim](https://github.com/makasim) in [#​1917](https://github.com/prometheus/client_golang/pull/1917) - Ensure remote write v2 headers cannot be returned on v1 requests by [@​kgeckhart](https://github.com/kgeckhart) in [#​1927](https://github.com/prometheus/client_golang/pull/1927) - build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1932](https://github.com/prometheus/client_golang/pull/1932) - build(deps): bump golang.org/x/sys from 0.38.0 to 0.39.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1933](https://github.com/prometheus/client_golang/pull/1933) - build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1935](https://github.com/prometheus/client_golang/pull/1935) - build(deps): bump the github-actions group with 5 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1934](https://github.com/prometheus/client_golang/pull/1934) - promhttp/zstd: add unit tests for zstd writer registration by [@​90ashish](https://github.com/90ashish) in [#​1929](https://github.com/prometheus/client_golang/pull/1929) - feat(collector): add Go 1.26 new runtime metrics by [@​kakkoyun](https://github.com/kakkoyun) in [#​1942](https://github.com/prometheus/client_golang/pull/1942) - build(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1948](https://github.com/prometheus/client_golang/pull/1948) - build(deps): bump the github-actions group with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1946](https://github.com/prometheus/client_golang/pull/1946) - build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1944](https://github.com/prometheus/client_golang/pull/1944) - build(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1945](https://github.com/prometheus/client_golang/pull/1945) - build(deps): bump github.com/klauspost/compress from 1.18.2 to 1.18.3 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1947](https://github.com/prometheus/client_golang/pull/1947) - chore(test): bump 1.25, tests with synctest and check not panic by [@​manute](https://github.com/manute) in [#​1950](https://github.com/prometheus/client_golang/pull/1950) - build(deps): bump github.com/prometheus/procfs from 0.19.2 to 0.20.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1954](https://github.com/prometheus/client_golang/pull/1954) - build(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1957](https://github.com/prometheus/client_golang/pull/1957) - build(deps): bump github.com/klauspost/compress from 1.18.3 to 1.18.4 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1955](https://github.com/prometheus/client_golang/pull/1955) - build(deps): bump go.opentelemetry.io/otel/sdk from 1.34.0 to 1.40.0 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1959](https://github.com/prometheus/client_golang/pull/1959) - build(deps): bump github.com/prometheus/common from 0.67.4 to 0.67.5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1956](https://github.com/prometheus/client_golang/pull/1956) - build(deps): bump the github-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1958](https://github.com/prometheus/client_golang/pull/1958) - chore(collectors/go): generate the tests after new metric by [@​kakkoyun](https://github.com/kakkoyun) in [#​1962](https://github.com/prometheus/client_golang/pull/1962) - Remove Arthur from the list of maintainers by [@​ArthurSens](https://github.com/ArthurSens) in [#​1964](https://github.com/prometheus/client_golang/pull/1964) - build(deps): bump google.golang.org/grpc from 1.69.4 to 1.79.3 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1965](https://github.com/prometheus/client_golang/pull/1965) - fix: recover from collector panic and return error in Gather by [@​Saflaski](https://github.com/Saflaski) in [#​1961](https://github.com/prometheus/client_golang/pull/1961) - prometheus: clarify MetricVec delete semantics in godoc by [@​Retr0-XD](https://github.com/Retr0-XD) in [#​1967](https://github.com/prometheus/client_golang/pull/1967) - build(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1973](https://github.com/prometheus/client_golang/pull/1973) - build(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1974](https://github.com/prometheus/client_golang/pull/1974) - build(deps): bump github.com/klauspost/compress from 1.18.4 to 1.18.5 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1976](https://github.com/prometheus/client_golang/pull/1976) - Optionally add OM unit by [@​vesari](https://github.com/vesari) in [#​1392](https://github.com/prometheus/client_golang/pull/1392) - fix: respect context cancellation in httpClient.Do by [@​pedrampdd](https://github.com/pedrampdd) in [#​1971](https://github.com/prometheus/client_golang/pull/1971) - build(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1978](https://github.com/prometheus/client_golang/pull/1978) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1977](https://github.com/prometheus/client_golang/pull/1977) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1980](https://github.com/prometheus/client_golang/pull/1980) - examples: add native histogram usage example by [@​thegdsks](https://github.com/thegdsks) in [#​1981](https://github.com/prometheus/client_golang/pull/1981) - chore(ci): add macOS, Windows and arm64 test runners by [@​kakkoyun](https://github.com/kakkoyun) in [#​1968](https://github.com/prometheus/client_golang/pull/1968) - prometheus: honor PidFn on windows and darwin by [@​Retr0-XD](https://github.com/Retr0-XD) in [#​1966](https://github.com/prometheus/client_golang/pull/1966) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1984](https://github.com/prometheus/client_golang/pull/1984) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1985](https://github.com/prometheus/client_golang/pull/1985) - promhttp: implement WithXFromContext in terms of WithXFromRequest by [@​tie](https://github.com/tie) in [#​1863](https://github.com/prometheus/client_golang/pull/1863) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​1988](https://github.com/prometheus/client_golang/pull/1988) - Fix bug unit cpu-seconds not a suffix of metric go\_cpu\_classes\_gc\_mark\_assist\_cpu\_seconds by [@​vesari](https://github.com/vesari) in [#​1991](https://github.com/prometheus/client_golang/pull/1991) - build(deps): bump golang.org/x/sys from 0.42.0 to 0.43.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1993](https://github.com/prometheus/client_golang/pull/1993) - build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1992](https://github.com/prometheus/client_golang/pull/1992) - build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1995](https://github.com/prometheus/client_golang/pull/1995) - exp/api/remote: limit request body size in SnappyDecodeMiddleware by [@​roidelapluie](https://github.com/roidelapluie) in [#​1996](https://github.com/prometheus/client_golang/pull/1996) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2001](https://github.com/prometheus/client_golang/pull/2001) - build(deps): bump the github-actions group across 1 directory with 4 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1994](https://github.com/prometheus/client_golang/pull/1994) - ci(update-go-versions): declare permissions for the monthly chore PR by [@​arpitjain099](https://github.com/arpitjain099) in [#​2003](https://github.com/prometheus/client_golang/pull/2003) - docs: fix godoc indentation and typos in timer.go and wrap.go by [@​immanuwell](https://github.com/immanuwell) in [#​2009](https://github.com/prometheus/client_golang/pull/2009) - ci: harden actions/checkout with persist-credentials: false by [@​roidelapluie](https://github.com/roidelapluie) in [#​2011](https://github.com/prometheus/client_golang/pull/2011) - fix(registry): prevent file descriptor leak in WriteToTextfile by [@​ProjectMutilation](https://github.com/ProjectMutilation) in [#​2010](https://github.com/prometheus/client_golang/pull/2010) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2008](https://github.com/prometheus/client_golang/pull/2008) - promhttp: add regression test for concurrent map writes ([#​1274](https://github.com/prometheus/client_golang/issues/1274)) by [@​pedrampdd](https://github.com/pedrampdd) in [#​2000](https://github.com/prometheus/client_golang/pull/2000) - build(deps): bump github.com/prometheus/common from 0.67.6-0.20260224092343-e4c38a0aea47 to 0.68.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2015](https://github.com/prometheus/client_golang/pull/2015) - build(deps): bump the github-actions group with 2 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2016](https://github.com/prometheus/client_golang/pull/2016) - build(deps): bump golang.org/x/sys from 0.43.0 to 0.45.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2014](https://github.com/prometheus/client_golang/pull/2014) - build(deps): bump github.com/prometheus/common from 0.67.5 to 0.68.0 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2017](https://github.com/prometheus/client_golang/pull/2017) - promhttp: fix grammar in exemplar option doc comments by [@​s3onghyun](https://github.com/s3onghyun) in [#​2023](https://github.com/prometheus/client_golang/pull/2023) - fix: use keyed fields in SamplePair struct literals in api\_test.go by [@​immanuwell](https://github.com/immanuwell) in [#​2012](https://github.com/prometheus/client_golang/pull/2012) - refactor: replace interface{} with any (Go 1.18+) by [@​MD-Mushfiqur123](https://github.com/MD-Mushfiqur123) in [#​2021](https://github.com/prometheus/client_golang/pull/2021) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2013](https://github.com/prometheus/client_golang/pull/2013) - build(deps): bump github.com/prometheus/common from 0.68.0 to 0.69.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2025](https://github.com/prometheus/client_golang/pull/2025) - build(deps): bump github.com/prometheus/common from 0.68.0 to 0.69.0 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2027](https://github.com/prometheus/client_golang/pull/2027) - build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2026](https://github.com/prometheus/client_golang/pull/2026) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2028](https://github.com/prometheus/client_golang/pull/2028) - build(deps): bump github.com/prometheus/procfs from 0.20.1 to 0.21.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2033](https://github.com/prometheus/client_golang/pull/2033) - build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2036](https://github.com/prometheus/client_golang/pull/2036) - build(deps): bump github.com/prometheus/procfs from 0.21.0 to 0.21.1 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2035](https://github.com/prometheus/client_golang/pull/2035) - build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.18.7 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2038](https://github.com/prometheus/client_golang/pull/2038) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2041](https://github.com/prometheus/client_golang/pull/2041) - fix(api): fall back to GET on forbidden POSTs by [@​immanuwell](https://github.com/immanuwell) in [#​2030](https://github.com/prometheus/client_golang/pull/2030) - build(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /tutorials/whatsup by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2042](https://github.com/prometheus/client_golang/pull/2042) - build(deps): bump the github-actions group across 1 directory with 5 updates by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2043](https://github.com/prometheus/client_golang/pull/2043) - chores: remove example Dockerfile and container\_description.yaml by [@​bwplotka](https://github.com/bwplotka) in [#​2044](https://github.com/prometheus/client_golang/pull/2044) - Update dependabot config by [@​SuperQ](https://github.com/SuperQ) in [#​2046](https://github.com/prometheus/client_golang/pull/2046) - build(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 in /exp by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2048](https://github.com/prometheus/client_golang/pull/2048) - build(deps): bump github.com/klauspost/compress from 1.18.7 to 1.19.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​2047](https://github.com/prometheus/client_golang/pull/2047) - promhttp: don't panic when instrumenting with non-exemplar observers by [@​spor3006](https://github.com/spor3006) in [#​2005](https://github.com/prometheus/client_golang/pull/2005) - Replace deprecated model.NameValidationScheme with explicit UTF8Validation by [@​kakkoyun](https://github.com/kakkoyun) in [#​2051](https://github.com/prometheus/client_golang/pull/2051) - test: fix two flaky tests (darwin start\_time regex, memstats HeapReleased drift) by [@​kakkoyun](https://github.com/kakkoyun) in [#​2050](https://github.com/prometheus/client_golang/pull/2050) - fix: correct typos in comments and test error messages by [@​maxtaran2010](https://github.com/maxtaran2010) in [#​2049](https://github.com/prometheus/client_golang/pull/2049) - examples: improve simple main.go example by [@​dhanudhanushree](https://github.com/dhanudhanushree) in [#​1999](https://github.com/prometheus/client_golang/pull/1999) - Synchronize common files from prometheus/prometheus by [@​prombot](https://github.com/prombot) in [#​2055](https://github.com/prometheus/client_golang/pull/2055) - feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather calls by [@​kakkoyun](https://github.com/kakkoyun) in [#​1969](https://github.com/prometheus/client_golang/pull/1969) - build(deps): update all Go dependencies in all go.mod files by [@​bwplotka](https://github.com/bwplotka) in [#​2059](https://github.com/prometheus/client_golang/pull/2059) - Cut v1.24.0-rc.0 by [@​bwplotka](https://github.com/bwplotka) in [#​2058](https://github.com/prometheus/client_golang/pull/2058) </details> #### New Contributors * @​xieyuschen made their first contribution in https://github.com/prometheus/client_golang/pull/1844 * @​torrca made their first contribution in https://github.com/prometheus/client_golang/pull/1849 * @​yshngg made their first contribution in https://github.com/prometheus/client_golang/pull/1850 * @​jotak made their first contribution in https://github.com/prometheus/client_golang/pull/1843 * @​SungJin1212 made their first contribution in https://github.com/prometheus/client_golang/pull/1878 * @​github-actions[bot] made their first contribution in https://github.com/prometheus/client_golang/pull/1864 * @​pipiland2612 made their first contribution in https://github.com/prometheus/client_golang/pull/1888 * @​fpetkovski made their first contribution in https://github.com/prometheus/client_golang/pull/1889 * @​karthikkondapally made their first contribution in https://github.com/prometheus/client_golang/pull/1885 * @​tjhop made their first contribution in https://github.com/prometheus/client_golang/pull/1896 * @​duricanikolic made their first contribution in https://github.com/prometheus/client_golang/pull/1902 * @​makasim made their first contribution in https://github.com/prometheus/client_golang/pull/1917 * @​kgeckhart made their first contribution in https://github.com/prometheus/client_golang/pull/1927 * @​90ashish made their first contribution in https://github.com/prometheus/client_golang/pull/1929 * @​manute made their first contribution in https://github.com/prometheus/client_golang/pull/1950 * @​Saflaski made their first contribution in https://github.com/prometheus/client_golang/pull/1961 * @​Retr0-XD made their first contribution in https://github.com/prometheus/client_golang/pull/1967 * @​pedrampdd made their first contribution in https://github.com/prometheus/client_golang/pull/1971 * @​thegdsks made their first contribution in https://github.com/prometheus/client_golang/pull/1981 * @​tie made their first contribution in https://github.com/prometheus/client_golang/pull/1863 * @​arpitjain099 made their first contribution in https://github.com/prometheus/client_golang/pull/2003 * @​immanuwell made their first contribution in https://github.com/prometheus/client_golang/pull/2009 * @​ProjectMutilation made their first contribution in https://github.com/prometheus/client_golang/pull/2010 * @​s3onghyun made their first contribution in https://github.com/prometheus/client_golang/pull/2023 * @​MD-Mushfiqur123 made their first contribution in https://github.com/prometheus/client_golang/pull/2021 * @​spor3006 made their first contribution in https://github.com/prometheus/client_golang/pull/2005 * @​maxtaran2010 made their first contribution in https://github.com/prometheus/client_golang/pull/2049 * @​dhanudhanushree made their first contribution in https://github.com/prometheus/client_golang/pull/1999 **Full Changelog**: <https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <[email protected]> Co-authored-by: bircni <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1113 Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Botandsilverwind
|
de43c84203 |
fix(deps): update module go.opentelemetry.io/otel to v1.44.0 [security] (#1115)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `v1.43.0` → `v1.44.0` |  |  | --- ### Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel [CVE-2026-41178](https://nvd.nist.gov/vuln/detail/CVE-2026-41178) / [GHSA-5wrp-cwcj-q835](https://github.com/advisories/GHSA-5wrp-cwcj-q835) / [GO-2026-5158](https://pkg.go.dev/vuln/GO-2026-5158) <details> <summary>More information</summary> #### Details Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel #### Severity Unknown #### References - [https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835) - [https://github.com/open-telemetry/opentelemetry-go/pull/7880](https://github.com/open-telemetry/opentelemetry-go/pull/7880) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5158) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)</summary> ### [`v1.44.0`](https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.44.0): /v0.66.0/v0.20.0/v0.0.17 [Compare Source](https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0) ##### Added - Add `ByteSlice` and `ByteSliceValue` functions for new `BYTESLICE` attribute type in `go.opentelemetry.io/otel/attribute`. ([#​7948](https://github.com/open-telemetry/opentelemetry-go/issues/7948)) - Apply attribute value limit to the `KindBytes` attribute type in `go.opentelemetry.io/otel/sdk/log`. ([#​7990](https://github.com/open-telemetry/opentelemetry-go/issues/7990)) - Apply attribute value limit to the `BYTESLICE` attribute type in `go.opentelemetry.io/otel/sdk/trace`. ([#​7990](https://github.com/open-telemetry/opentelemetry-go/issues/7990)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/trace`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. ([#​8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Add `String` method for `Value` type in `go.opentelemetry.io/otel/attribute`. ([#​8142](https://github.com/open-telemetry/opentelemetry-go/issues/8142)) - Add `Slice` and `SliceValue` functions for new `SLICE` attribute type in `go.opentelemetry.io/otel/attribute`. ([#​8166](https://github.com/open-telemetry/opentelemetry-go/issues/8166)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. ([#​8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Apply `AttributeValueLengthLimit` to `attribute.SLICE` type attribute values in `go.opentelemetry.io/otel/sdk/trace`, recursively truncating contained string values. ([#​8217](https://github.com/open-telemetry/opentelemetry-go/issues/8217)) - Add `Error` field on `Record` type in `go.opentelemetry.io/otel/log/logtest`. ([#​8148](https://github.com/open-telemetry/opentelemetry-go/issues/8148)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `Settable` to `go.opentelemetry.io/otel/metric/x` to allow reusing attribute options. ([#​8178](https://github.com/open-telemetry/opentelemetry-go/issues/8178)) - Add experimental support for splitting metric data across multiple batches in `go.opentelemetry.io/otel/sdk/metric`. Set `OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size>` to enable for all periodic readers. See `go.opentelemetry.io/otel/sdk/metric/internal/x` for feature documentation. ([#​8071](https://github.com/open-telemetry/opentelemetry-go/issues/8071)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x` for feature documentation. ([#​8192](https://github.com/open-telemetry/opentelemetry-go/issues/8192)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x` for feature documentation. ([#​8194](https://github.com/open-telemetry/opentelemetry-go/issues/8194)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/stdout/stdoutlog`. Enable with `OTEL_GO_X_SELF_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/stdout/stdoutlog/internal/x` for feature documentation. ([#​8263](https://github.com/open-telemetry/opentelemetry-go/issues/8263)) - Add `WithDefaultAttributes` to `go.opentelemetry.io/otel/metric/x` to support setting default attributes on instruments. ([#​8135](https://github.com/open-telemetry/opentelemetry-go/issues/8135)) - Add `go.opentelemetry.io/otel/semconv/v1.41.0` package. The package contains semantic conventions from the `v1.41.0` version of the OpenTelemetry Semantic Conventions. See the [migration documentation](./semconv/v1.41.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.40.0`. ([#​8324](https://github.com/open-telemetry/opentelemetry-go/issues/8324)) - Add Observable variants of instruments to `go.opentelemetry.io/otel/semconv/v1.41.0` package. ([#​8350](https://github.com/open-telemetry/opentelemetry-go/issues/8350)) - Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in `go.opentelemetry.io/otel/semconv/v1.41.0`. ([#​8002](https://github.com/open-telemetry/opentelemetry-go/issues/8002)) ##### Changed - ⚠️ **Breaking Change:** `go.opentelemetry.io/otel/sdk/metric` now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation. New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing `attribute.Bool("otel.metric.overflow", true)`. This can break users who relied on the previous unlimited default. Set `WithCardinalityLimit(0)` or the deprecated `OTEL_GO_X_CARDINALITY_LIMIT=0` environment variable to preserve unlimited cardinality. Note that support for `OTEL_GO_X_CARDINALITY_LIMIT` may be removed in a future release. ([#​8247](https://github.com/open-telemetry/opentelemetry-go/issues/8247)) - `ErrorType` in `go.opentelemetry.io/otel/semconv` now unwraps errors created with `fmt.Errorf` when deriving the `error.type` attribute. ([#​8133](https://github.com/open-telemetry/opentelemetry-go/issues/8133)) - `go.opentelemetry.io/otel/sdk/log` now unwraps error chains created with `fmt.Errorf` when deriving the `error.type` attribute from errors on log records. ([#​8133](https://github.com/open-telemetry/opentelemetry-go/issues/8133)) - `Set.MarshalLog` method in `go.opentelemetry.io/otel/attribute` now uses `Value.String` formatting following the [OpenTelemetry AnyValue representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#anyvalue). ([#​8169](https://github.com/open-telemetry/opentelemetry-go/issues/8169)) - Optimize `go.opentelemetry.io/otel/sdk/metric` to return a drop reservoir and short-circuit `Offer` calls to the exemplar reservoir when `exemplar.AlwaysOffFilter` is configured. ([#​8211](https://github.com/open-telemetry/opentelemetry-go/issues/8211)) ([#​8267](https://github.com/open-telemetry/opentelemetry-go/issues/8267)) - Optimize `go.opentelemetry.io/otel/sdk/metric` to return a drop reservoir for asynchronous instruments when `exemplar.TraceBasedFilter` is configured. ([#​8286](https://github.com/open-telemetry/opentelemetry-go/issues/8286)) ##### Deprecated - Deprecate `Value.Emit` method in `go.opentelemetry.io/otel/attribute`. Use `Value.String` instead. ([#​8176](https://github.com/open-telemetry/opentelemetry-go/issues/8176)) ##### Fixed - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#​8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#​8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Fix gzipped request body replay on redirect in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#​8135](https://github.com/open-telemetry/opentelemetry-go/issues/8135)) - Fix gzipped request body replay on redirect in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8152](https://github.com/open-telemetry/opentelemetry-go/issues/8152)) - `go.opentelemetry.io/otel/exporters/prometheus` now uses `Value.String` formatting for label values following the [OpenTelemetry AnyValue representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#anyvalue). ([#​8170](https://github.com/open-telemetry/opentelemetry-go/issues/8170)) - Propagate errors from the exporter when calling `Shutdown` on `BatchSpanProcessor` in `go.opentelemetry.io/otel/sdk/trace`. ([#​8197](https://github.com/open-telemetry/opentelemetry-go/issues/8197)) - Fix stale status code reporting on self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8226](https://github.com/open-telemetry/opentelemetry-go/issues/8226)) - Fix a concurrent `Collect` data race and potential panic in `go.opentelemetry.io/otel/exporters/prometheus` when `WithResourceAsConstantLabels` option is used. ([#​8227](https://github.com/open-telemetry/opentelemetry-go/issues/8227)) - Fix race condition in `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` by reverting [#​7447](https://github.com/open-telemetry/opentelemetry-go/issues/7447). ([#​8249](https://github.com/open-telemetry/opentelemetry-go/issues/8249)) - Fix `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` to safely handle zero size. A capacity check in the constructor initializes the reservoir safely and skips initialization for zero-cap; early returns in `Offer()` and `Collect()` ensure no-op behavior. ([#​8295](https://github.com/open-telemetry/opentelemetry-go/issues/8295)) - Fix counting of spans and logs in self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#​8254](https://github.com/open-telemetry/opentelemetry-go/issues/8254)) - Drop conflicting scope attributes named `name`, `version`, or `schema_url` from metric labels in `go.opentelemetry.io/otel/exporters/prometheus`, preserving the dedicated `otel_scope_name`, `otel_scope_version`, and `otel_scope_schema_url` labels. ([#​8264](https://github.com/open-telemetry/opentelemetry-go/issues/8264)) - Close schema files opened by `ParseFile` in `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1`. ([GHSA-995v-fvrw-c78m](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m)) - Enforce the 8192-byte baggage size limit during extraction/parsing, changing behavior when the limit is exceeded in `go.opentelemetry.io/otel/baggage` and `go.opentelemetry.io/otel/propagation`. ([#​8222](https://github.com/open-telemetry/opentelemetry-go/issues/8222)) - Fix `go.opentelemetry.io/otel/semconv/v1.41.0` to include `Attr*` helper methods for required attributes on observable instruments. ([#​8361](https://github.com/open-telemetry/opentelemetry-go/issues/8361)) - Limit baggage extraction error reporting in `go.opentelemetry.io/otel/propagation` to prevent malformed or oversized baggage headers from flooding logs. ([GHSA-5wrp-cwcj-q835](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835)) #### What's Changed - Document how to implement experimental features by [@​dashpole](https://github.com/dashpole) in [#​8124](https://github.com/open-telemetry/opentelemetry-go/pull/8124) - Add support for experimental options in the metrics API by [@​dashpole](https://github.com/dashpole) in [#​8111](https://github.com/open-telemetry/opentelemetry-go/pull/8111) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`e5db982`](https://github.com/open-telemetry/opentelemetry-go/commit/e5db982) by [@​renovate](https://github.com/renovate)\[bot] in [#​8136](https://github.com/open-telemetry/opentelemetry-go/pull/8136) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`32cd848`](https://github.com/open-telemetry/opentelemetry-go/commit/32cd848) by [@​renovate](https://github.com/renovate)\[bot] in [#​8141](https://github.com/open-telemetry/opentelemetry-go/pull/8141) - fix(deps): update googleapis to [`6f92a3b`](https://github.com/open-telemetry/opentelemetry-go/commit/6f92a3b) by [@​renovate](https://github.com/renovate)\[bot] in [#​8140](https://github.com/open-telemetry/opentelemetry-go/pull/8140) - chore(deps): update module github.com/jgautheron/goconst to v1.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8134](https://github.com/open-telemetry/opentelemetry-go/pull/8134) - attribute: add BYTESLICE type support by [@​NesterovYehor](https://github.com/NesterovYehor) in [#​7948](https://github.com/open-telemetry/opentelemetry-go/pull/7948) - unwrap error chains created with fmt.Errorf by [@​pellared](https://github.com/pellared) in [#​8133](https://github.com/open-telemetry/opentelemetry-go/pull/8133) - log/logtest: add Error field to Record type by [@​pellared](https://github.com/pellared) in [#​8148](https://github.com/open-telemetry/opentelemetry-go/pull/8148) - attribute: add String method for Value type by [@​pellared](https://github.com/pellared) in [#​8142](https://github.com/open-telemetry/opentelemetry-go/pull/8142) - fix(deps): update module golang.org/x/sys to v0.43.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8156](https://github.com/open-telemetry/opentelemetry-go/pull/8156) - chore(deps): update codspeedhq/action action to v4.13.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8155](https://github.com/open-telemetry/opentelemetry-go/pull/8155) - fix(otlploghttp): replay gzipped bodies on redirect by [@​MrAlias](https://github.com/MrAlias) in [#​8152](https://github.com/open-telemetry/opentelemetry-go/pull/8152) - Improve test coverage for exponential histogram edge cases by [@​dashpole](https://github.com/dashpole) in [#​8129](https://github.com/open-telemetry/opentelemetry-go/pull/8129) - Add example test for the prometheus exporter by [@​dashpole](https://github.com/dashpole) in [#​8137](https://github.com/open-telemetry/opentelemetry-go/pull/8137) - chore(deps): update golang.org/x/telemetry digest to [`93c7c8a`](https://github.com/open-telemetry/opentelemetry-go/commit/93c7c8a) by [@​renovate](https://github.com/renovate)\[bot] in [#​8158](https://github.com/open-telemetry/opentelemetry-go/pull/8158) - chore(deps): update module github.com/mattn/go-runewidth to v0.0.23 by [@​renovate](https://github.com/renovate)\[bot] in [#​8161](https://github.com/open-telemetry/opentelemetry-go/pull/8161) - chore(deps): update module github.com/mattn/go-isatty to v0.0.21 by [@​renovate](https://github.com/renovate)\[bot] in [#​8159](https://github.com/open-telemetry/opentelemetry-go/pull/8159) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`6b4d2bc`](https://github.com/open-telemetry/opentelemetry-go/commit/6b4d2bc) by [@​renovate](https://github.com/renovate)\[bot] in [#​8160](https://github.com/open-telemetry/opentelemetry-go/pull/8160) - Add experimental support for batching in periodic reader by [@​dashpole](https://github.com/dashpole) in [#​8071](https://github.com/open-telemetry/opentelemetry-go/pull/8071) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8165](https://github.com/open-telemetry/opentelemetry-go/pull/8165) - Support `BYTESLICE` attributes across trace and exporter paths by [@​MrAlias](https://github.com/MrAlias) in [#​8153](https://github.com/open-telemetry/opentelemetry-go/pull/8153) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8171](https://github.com/open-telemetry/opentelemetry-go/pull/8171) - fix(deps): update module golang.org/x/tools to v0.44.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8173](https://github.com/open-telemetry/opentelemetry-go/pull/8173) - metricdatatest: support BYTESLICE attribute comparisons by [@​pellared](https://github.com/pellared) in [#​8167](https://github.com/open-telemetry/opentelemetry-go/pull/8167) - test: add test case for ByteSlice in TestValueFromAttribute by [@​pellared](https://github.com/pellared) in [#​8168](https://github.com/open-telemetry/opentelemetry-go/pull/8168) - attribute: Set.MarshalLog to use Value.String instead of Value.Emit by [@​pellared](https://github.com/pellared) in [#​8169](https://github.com/open-telemetry/opentelemetry-go/pull/8169) - prometheus: use Value.String instead of Value.Emit by [@​pellared](https://github.com/pellared) in [#​8170](https://github.com/open-telemetry/opentelemetry-go/pull/8170) - fix(deps): update golang.org/x to [`746e56f`](https://github.com/open-telemetry/opentelemetry-go/commit/746e56f) by [@​renovate](https://github.com/renovate)\[bot] in [#​8175](https://github.com/open-telemetry/opentelemetry-go/pull/8175) - Add support for the development attributes advisory parameter by [@​dashpole](https://github.com/dashpole) in [#​8135](https://github.com/open-telemetry/opentelemetry-go/pull/8135) - chore(deps): update actions/upload-artifact action to v7.0.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8177](https://github.com/open-telemetry/opentelemetry-go/pull/8177) - attribute: deprecate Value.Emit by [@​pellared](https://github.com/pellared) in [#​8176](https://github.com/open-telemetry/opentelemetry-go/pull/8176) - chore(deps): update module github.com/manuelarte/funcorder to v0.6.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8181](https://github.com/open-telemetry/opentelemetry-go/pull/8181) - chore(deps): update module github.com/ashanbrown/makezero/v2 to v2.2.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8180](https://github.com/open-telemetry/opentelemetry-go/pull/8180) - chore(deps): update module github.com/ashanbrown/forbidigo/v2 to v2.3.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8182](https://github.com/open-telemetry/opentelemetry-go/pull/8182) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.56.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8184](https://github.com/open-telemetry/opentelemetry-go/pull/8184) - Update semconv template and 1.40.0 to use Enabled for metrics by [@​dashpole](https://github.com/dashpole) in [#​8172](https://github.com/open-telemetry/opentelemetry-go/pull/8172) - Add x.Settable to allow reusing attribute options by [@​dashpole](https://github.com/dashpole) in [#​8178](https://github.com/open-telemetry/opentelemetry-go/pull/8178) - chore(deps): update actions/cache action to v5.0.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​8187](https://github.com/open-telemetry/opentelemetry-go/pull/8187) - fix(deps): update googleapis to [`3e5c5a5`](https://github.com/open-telemetry/opentelemetry-go/commit/3e5c5a5) by [@​renovate](https://github.com/renovate)\[bot] in [#​8190](https://github.com/open-telemetry/opentelemetry-go/pull/8190) - fix(otlpmetrichttp): replay gzipped bodies on redirect by [@​pellared](https://github.com/pellared) in [#​8185](https://github.com/open-telemetry/opentelemetry-go/pull/8185) - fix(deps): update module golang.org/x/vuln to v1.2.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8193](https://github.com/open-telemetry/opentelemetry-go/pull/8193) - fix(deps): update googleapis to [`afd174a`](https://github.com/open-telemetry/opentelemetry-go/commit/afd174a) by [@​renovate](https://github.com/renovate)\[bot] in [#​8195](https://github.com/open-telemetry/opentelemetry-go/pull/8195) - chore(deps): update module github.com/dave/dst to v0.27.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8198](https://github.com/open-telemetry/opentelemetry-go/pull/8198) - Fix exemplar tests in containerized environments by [@​dashpole](https://github.com/dashpole) in [#​8188](https://github.com/open-telemetry/opentelemetry-go/pull/8188) - Update contributing to recommend using Enabled by [@​dashpole](https://github.com/dashpole) in [#​8189](https://github.com/open-telemetry/opentelemetry-go/pull/8189) - otlptracehttp: reset pooled gzip writer before reuse by [@​pellared](https://github.com/pellared) in [#​8196](https://github.com/open-telemetry/opentelemetry-go/pull/8196) - chore(deps): update golang.org/x/telemetry digest to [`fac6e1c`](https://github.com/open-telemetry/opentelemetry-go/commit/fac6e1c) by [@​renovate](https://github.com/renovate)\[bot] in [#​8202](https://github.com/open-telemetry/opentelemetry-go/pull/8202) - fix(deps): update module github.com/opentracing-contrib/go-grpc to v0.1.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8207](https://github.com/open-telemetry/opentelemetry-go/pull/8207) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`07c9668`](https://github.com/open-telemetry/opentelemetry-go/commit/07c9668) by [@​renovate](https://github.com/renovate)\[bot] in [#​8206](https://github.com/open-telemetry/opentelemetry-go/pull/8206) - attribute: make TestHashKVs linear-time by [@​pellared](https://github.com/pellared) in [#​8204](https://github.com/open-telemetry/opentelemetry-go/pull/8204) - chore(deps): update github/codeql-action action to v4.35.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8208](https://github.com/open-telemetry/opentelemetry-go/pull/8208) - sdk/trace: propagate SpanExporter.Shutdown error from BatchSpanProcessor by [@​alliasgher](https://github.com/alliasgher) in [#​8197](https://github.com/open-telemetry/opentelemetry-go/pull/8197) - add GitHub Copilot code review instructions by [@​pellared](https://github.com/pellared) in [#​8212](https://github.com/open-telemetry/opentelemetry-go/pull/8212) - chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.29.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8214](https://github.com/open-telemetry/opentelemetry-go/pull/8214) - attribute: add SLICE type support by [@​pellared](https://github.com/pellared) in [#​8166](https://github.com/open-telemetry/opentelemetry-go/pull/8166) - Fix typos found by copilot by [@​dashpole](https://github.com/dashpole) in [#​8221](https://github.com/open-telemetry/opentelemetry-go/pull/8221) - chore(deps): update module github.com/go-git/go-git/v5 to v5.18.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8223](https://github.com/open-telemetry/opentelemetry-go/pull/8223) - docs: add agent guide for autonomous coding agents by [@​pellared](https://github.com/pellared) in [#​8215](https://github.com/open-telemetry/opentelemetry-go/pull/8215) - test: truncate attribute string values using Unicode rune count by [@​pellared](https://github.com/pellared) in [#​8219](https://github.com/open-telemetry/opentelemetry-go/pull/8219) - sdk/trace: apply AttributeValueLengthLimit to attribute.SLICE by [@​pellared](https://github.com/pellared) in [#​8217](https://github.com/open-telemetry/opentelemetry-go/pull/8217) - chore(deps): update module github.com/dlclark/regexp2 to v1.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8229](https://github.com/open-telemetry/opentelemetry-go/pull/8229) - prometheus: fix Collect data race for constant resource labels by [@​pellared](https://github.com/pellared) in [#​8227](https://github.com/open-telemetry/opentelemetry-go/pull/8227) - exporters: support SLICE attributes by [@​pellared](https://github.com/pellared) in [#​8216](https://github.com/open-telemetry/opentelemetry-go/pull/8216) - chore(deps): update codspeedhq/action action to v4.14.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8234](https://github.com/open-telemetry/opentelemetry-go/pull/8234) - Fix stale status code reporting on self-observability metrics by [@​dashpole](https://github.com/dashpole) in [#​8226](https://github.com/open-telemetry/opentelemetry-go/pull/8226) - fix(deps): update googleapis to [`e10c466`](https://github.com/open-telemetry/opentelemetry-go/commit/e10c466) by [@​renovate](https://github.com/renovate)\[bot] in [#​8241](https://github.com/open-telemetry/opentelemetry-go/pull/8241) - fix(deps): update build-tools to v0.30.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8244](https://github.com/open-telemetry/opentelemetry-go/pull/8244) - \[chore] changelog: re-run workflow on PR title edits by [@​cijothomas](https://github.com/cijothomas) in [#​8246](https://github.com/open-telemetry/opentelemetry-go/pull/8246) - stdlog observ: remove partial success handling by [@​yumosx](https://github.com/yumosx) in [#​8174](https://github.com/open-telemetry/opentelemetry-go/pull/8174) - feat: add self-observability metrics to otlpmetrichttp metric exporters by [@​dashpole](https://github.com/dashpole) in [#​8194](https://github.com/open-telemetry/opentelemetry-go/pull/8194) - chore(deps): update golang.org/x/telemetry digest to [`392afab`](https://github.com/open-telemetry/opentelemetry-go/commit/392afab) by [@​renovate](https://github.com/renovate)\[bot] in [#​8248](https://github.com/open-telemetry/opentelemetry-go/pull/8248) - Use a DropReservoir when an exemplar.AlwaysOffFilter is provided by [@​dashpole](https://github.com/dashpole) in [#​8211](https://github.com/open-telemetry/opentelemetry-go/pull/8211) - metric: clarify sync vs observable Gauge in package godoc by [@​alliasgher](https://github.com/alliasgher) in [#​8225](https://github.com/open-telemetry/opentelemetry-go/pull/8225) - sdk/metric: apply default cardinality limit of 2000 by [@​pellared](https://github.com/pellared) in [#​8247](https://github.com/open-telemetry/opentelemetry-go/pull/8247) - Revert "Optimize fixedsize reservoir ([#​7447](https://github.com/open-telemetry/opentelemetry-go/issues/7447))" by [@​dashpole](https://github.com/dashpole) in [#​8249](https://github.com/open-telemetry/opentelemetry-go/pull/8249) - fix(deps): update module golang.org/x/vuln to v1.3.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8256](https://github.com/open-telemetry/opentelemetry-go/pull/8256) - chore(deps): update otel/weaver docker tag to v0.23.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8255](https://github.com/open-telemetry/opentelemetry-go/pull/8255) - Run benchmarks using Settable for more accurate comparrisons by [@​dashpole](https://github.com/dashpole) in [#​8252](https://github.com/open-telemetry/opentelemetry-go/pull/8252) - Add MaxRequestSize option to OTLP exporters by [@​pellared](https://github.com/pellared) in [#​8157](https://github.com/open-telemetry/opentelemetry-go/pull/8157) - fix counting of spans/logs in self-observability metrics in otlp trace and log exporters by [@​dashpole](https://github.com/dashpole) in [#​8254](https://github.com/open-telemetry/opentelemetry-go/pull/8254) - fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to [`2f88a58`](https://github.com/open-telemetry/opentelemetry-go/commit/2f88a58) by [@​renovate](https://github.com/renovate)\[bot] in [#​8260](https://github.com/open-telemetry/opentelemetry-go/pull/8260) - chore(deps): update golang.org/x/telemetry digest to [`329d219`](https://github.com/open-telemetry/opentelemetry-go/commit/329d219) by [@​renovate](https://github.com/renovate)\[bot] in [#​8259](https://github.com/open-telemetry/opentelemetry-go/pull/8259) - chore(deps): update module github.com/sourcegraph/go-diff to v0.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8262](https://github.com/open-telemetry/opentelemetry-go/pull/8262) - chore(deps): update module github.com/mattn/go-isatty to v0.0.22 by [@​renovate](https://github.com/renovate)\[bot] in [#​8265](https://github.com/open-telemetry/opentelemetry-go/pull/8265) - chore(deps): update module go.uber.org/zap to v1.28.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8269](https://github.com/open-telemetry/opentelemetry-go/pull/8269) - fix(deps): update googleapis to [`7cedc36`](https://github.com/open-telemetry/opentelemetry-go/commit/7cedc36) by [@​renovate](https://github.com/renovate)\[bot] in [#​8266](https://github.com/open-telemetry/opentelemetry-go/pull/8266) - chore(deps): update module github.com/securego/gosec/v2 to v2.26.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8270](https://github.com/open-telemetry/opentelemetry-go/pull/8270) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.57.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8275](https://github.com/open-telemetry/opentelemetry-go/pull/8275) - chore(deps): update codspeedhq/action action to v4.15.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8272](https://github.com/open-telemetry/opentelemetry-go/pull/8272) - chore(deps): update golang.org/x/telemetry digest to [`76f71b9`](https://github.com/open-telemetry/opentelemetry-go/commit/76f71b9) by [@​renovate](https://github.com/renovate)\[bot] in [#​8271](https://github.com/open-telemetry/opentelemetry-go/pull/8271) - Apply attribute value limit for BYTESLICE and KindBytes by [@​NesterovYehor](https://github.com/NesterovYehor) in [#​7990](https://github.com/open-telemetry/opentelemetry-go/pull/7990) - chore(deps): update module github.com/alecthomas/chroma/v2 to v2.24.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8277](https://github.com/open-telemetry/opentelemetry-go/pull/8277) - chore(deps): update module github.com/fsnotify/fsnotify to v1.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8280](https://github.com/open-telemetry/opentelemetry-go/pull/8280) - chore(deps): update module github.com/alecthomas/chroma/v2 to v2.24.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8281](https://github.com/open-telemetry/opentelemetry-go/pull/8281) - Prometheus Exporter: Drop Scope attributes name, version and schema\_url by [@​ArthurSens](https://github.com/ArthurSens) in [#​8264](https://github.com/open-telemetry/opentelemetry-go/pull/8264) - attribute: split HashKVs benchmark by value type by [@​pellared](https://github.com/pellared) in [#​8268](https://github.com/open-telemetry/opentelemetry-go/pull/8268) - \[chore] metric: document Enabled and WithAttributeSet in package docs by [@​cijothomas](https://github.com/cijothomas) in [#​8245](https://github.com/open-telemetry/opentelemetry-go/pull/8245) - chore(deps): update module github.com/bombsimon/wsl/v5 to v5.8.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8287](https://github.com/open-telemetry/opentelemetry-go/pull/8287) - fix(deps): update module github.com/masterminds/semver/v3 to v3.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8283](https://github.com/open-telemetry/opentelemetry-go/pull/8283) - chore(deps): update module github.com/pjbgf/sha1cd to v0.6.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8288](https://github.com/open-telemetry/opentelemetry-go/pull/8288) - Optimize metrics sdk measurement with AlwaysOff exemplar filter by [@​dashpole](https://github.com/dashpole) in [#​8267](https://github.com/open-telemetry/opentelemetry-go/pull/8267) - fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8290](https://github.com/open-telemetry/opentelemetry-go/pull/8290) - chore(deps): update github/codeql-action action to v4.35.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8289](https://github.com/open-telemetry/opentelemetry-go/pull/8289) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`6603726`](https://github.com/open-telemetry/opentelemetry-go/commit/6603726) by [@​renovate](https://github.com/renovate)\[bot] in [#​8291](https://github.com/open-telemetry/opentelemetry-go/pull/8291) - chore(deps): update github.com/golangci/rowserrcheck digest to [`8d53bbc`](https://github.com/open-telemetry/opentelemetry-go/commit/8d53bbc) by [@​renovate](https://github.com/renovate)\[bot] in [#​8292](https://github.com/open-telemetry/opentelemetry-go/pull/8292) - chore(deps): update module github.com/pelletier/go-toml/v2 to v2.3.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8293](https://github.com/open-telemetry/opentelemetry-go/pull/8293) - fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8294](https://github.com/open-telemetry/opentelemetry-go/pull/8294) - chore(deps): update module github.com/ryancurrah/gomodguard/v2 to v2.1.3 by [@​renovate](https://github.com/renovate)\[bot] in [#​8296](https://github.com/open-telemetry/opentelemetry-go/pull/8296) - fix(deps): update module google.golang.org/grpc to v1.81.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8298](https://github.com/open-telemetry/opentelemetry-go/pull/8298) - chore(deps): update module github.com/fsnotify/fsnotify to v1.10.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8300](https://github.com/open-telemetry/opentelemetry-go/pull/8300) - chore(deps): update module github.com/uudashr/iface to v1.4.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8301](https://github.com/open-telemetry/opentelemetry-go/pull/8301) - fix(deps): update googleapis to [`60b97b3`](https://github.com/open-telemetry/opentelemetry-go/commit/60b97b3) by [@​renovate](https://github.com/renovate)\[bot] in [#​8303](https://github.com/open-telemetry/opentelemetry-go/pull/8303) - chore(deps): update codspeedhq/action action to v4.15.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8307](https://github.com/open-telemetry/opentelemetry-go/pull/8307) - fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.12.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8308](https://github.com/open-telemetry/opentelemetry-go/pull/8308) - chore(deps): update golang.org/x/telemetry digest to [`5a0966d`](https://github.com/open-telemetry/opentelemetry-go/commit/5a0966d) by [@​renovate](https://github.com/renovate)\[bot] in [#​8310](https://github.com/open-telemetry/opentelemetry-go/pull/8310) - chore(deps): update module github.com/ghostiam/protogetter to v0.3.21 by [@​renovate](https://github.com/renovate)\[bot] in [#​8311](https://github.com/open-telemetry/opentelemetry-go/pull/8311) - chore(deps): update module github.com/go-git/go-billy/v5 to v5.9.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8312](https://github.com/open-telemetry/opentelemetry-go/pull/8312) - chore(deps): update module github.com/jgautheron/goconst to v1.10.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8315](https://github.com/open-telemetry/opentelemetry-go/pull/8315) - chore(deps): update github/codeql-action action to v4.35.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8318](https://github.com/open-telemetry/opentelemetry-go/pull/8318) - chore(deps): update golang.org/x/telemetry digest to [`e88f59f`](https://github.com/open-telemetry/opentelemetry-go/commit/e88f59f) by [@​renovate](https://github.com/renovate)\[bot] in [#​8317](https://github.com/open-telemetry/opentelemetry-go/pull/8317) - chore(deps): update module github.com/raeperd/recvcheck to v0.3.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8314](https://github.com/open-telemetry/opentelemetry-go/pull/8314) - fix(deps): update module golang.org/x/sys to v0.44.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8322](https://github.com/open-telemetry/opentelemetry-go/pull/8322) - chore(deps): update module github.com/go-git/go-git/v5 to v5.19.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8313](https://github.com/open-telemetry/opentelemetry-go/pull/8313) - chore(deps): update module github.com/abirdcfly/dupword to v0.1.8 by [@​renovate](https://github.com/renovate)\[bot] in [#​8316](https://github.com/open-telemetry/opentelemetry-go/pull/8316) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8323](https://github.com/open-telemetry/opentelemetry-go/pull/8323) - docs: Expand SIG meeting welcoming language by [@​cijothomas](https://github.com/cijothomas) in [#​8319](https://github.com/open-telemetry/opentelemetry-go/pull/8319) - chore(deps): update module mvdan.cc/gofumpt to v0.10.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8304](https://github.com/open-telemetry/opentelemetry-go/pull/8304) - chore(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8325](https://github.com/open-telemetry/opentelemetry-go/pull/8325) - chore(deps): update golang.org/x/telemetry digest to [`42602be`](https://github.com/open-telemetry/opentelemetry-go/commit/42602be) by [@​renovate](https://github.com/renovate)\[bot] in [#​8326](https://github.com/open-telemetry/opentelemetry-go/pull/8326) - Fix benchmark ci by [@​XSAM](https://github.com/XSAM) in [#​8282](https://github.com/open-telemetry/opentelemetry-go/pull/8282) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8327](https://github.com/open-telemetry/opentelemetry-go/pull/8327) - chore(deps): update module go.opentelemetry.io/collector/featuregate to v1.58.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8328](https://github.com/open-telemetry/opentelemetry-go/pull/8328) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.58.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8329](https://github.com/open-telemetry/opentelemetry-go/pull/8329) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`c840852`](https://github.com/open-telemetry/opentelemetry-go/commit/c840852) by [@​renovate](https://github.com/renovate)\[bot] in [#​8331](https://github.com/open-telemetry/opentelemetry-go/pull/8331) - fix(deps): update googleapis to [`3700d41`](https://github.com/open-telemetry/opentelemetry-go/commit/3700d41) by [@​renovate](https://github.com/renovate)\[bot] in [#​8332](https://github.com/open-telemetry/opentelemetry-go/pull/8332) - fix: clear cached objects to enable GC by [@​ash2k](https://github.com/ash2k) in [#​8233](https://github.com/open-telemetry/opentelemetry-go/pull/8233) - Generate and upgrade to `semconv/v1.41.0` by [@​MrAlias](https://github.com/MrAlias) in [#​8324](https://github.com/open-telemetry/opentelemetry-go/pull/8324) - chore(deps): update module github.com/go-git/go-git/v5 to v5.19.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8345](https://github.com/open-telemetry/opentelemetry-go/pull/8345) - chore: Skip benchmark workflow when only non-Go files change by [@​cijothomas](https://github.com/cijothomas) in [#​8346](https://github.com/open-telemetry/opentelemetry-go/pull/8346) - chore(deps): update github/codeql-action action to v4.35.5 by [@​renovate](https://github.com/renovate)\[bot] in [#​8341](https://github.com/open-telemetry/opentelemetry-go/pull/8341) - Add max baggage length as limitation by [@​XSAM](https://github.com/XSAM) in [#​8222](https://github.com/open-telemetry/opentelemetry-go/pull/8222) - Generating histogram boundaries from weaver.yaml by [@​itssaharsh](https://github.com/itssaharsh) in [#​8015](https://github.com/open-telemetry/opentelemetry-go/pull/8015) - chore(deps): update codecov/codecov-action action to v6.0.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8342](https://github.com/open-telemetry/opentelemetry-go/pull/8342) - chore(deps): update module github.com/kisielk/errcheck to v1.20.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8333](https://github.com/open-telemetry/opentelemetry-go/pull/8333) - Add observable instrument variants to semconv v1.41.0 by [@​dashpole](https://github.com/dashpole) in [#​8350](https://github.com/open-telemetry/opentelemetry-go/pull/8350) - fix(semconv): clear pooled slices to enable GC by [@​pellared](https://github.com/pellared) in [#​8352](https://github.com/open-telemetry/opentelemetry-go/pull/8352) - chore(deps): update actions/stale action to v10.3.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8355](https://github.com/open-telemetry/opentelemetry-go/pull/8355) - chore(deps): update module github.com/uudashr/iface to v1.4.4 by [@​renovate](https://github.com/renovate)\[bot] in [#​8335](https://github.com/open-telemetry/opentelemetry-go/pull/8335) - fix(deps): update module google.golang.org/grpc to v1.81.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8340](https://github.com/open-telemetry/opentelemetry-go/pull/8340) - chore(deps): update module 4d63.com/gocheckcompilerdirectives to v1.4.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8334](https://github.com/open-telemetry/opentelemetry-go/pull/8334) - chore(deps): update golang.org/x/telemetry digest to [`eab6ae5`](https://github.com/open-telemetry/opentelemetry-go/commit/eab6ae5) by [@​renovate](https://github.com/renovate)\[bot] in [#​8348](https://github.com/open-telemetry/opentelemetry-go/pull/8348) - fix(deps): update googleapis to [`aa98bba`](https://github.com/open-telemetry/opentelemetry-go/commit/aa98bba) by [@​renovate](https://github.com/renovate)\[bot] in [#​8344](https://github.com/open-telemetry/opentelemetry-go/pull/8344) - Fix semconv generation to include Attr helpers for required attributes on observable instruments by [@​dashpole](https://github.com/dashpole) in [#​8361](https://github.com/open-telemetry/opentelemetry-go/pull/8361) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8363](https://github.com/open-telemetry/opentelemetry-go/pull/8363) - chore(deps): update module github.com/antonboom/nilnil to v1.1.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8360](https://github.com/open-telemetry/opentelemetry-go/pull/8360) - chore(deps): update module github.com/antonboom/errname to v1.1.2 by [@​renovate](https://github.com/renovate)\[bot] in [#​8359](https://github.com/open-telemetry/opentelemetry-go/pull/8359) - chore(deps): update module github.com/uudashr/iface to v1.5.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8362](https://github.com/open-telemetry/opentelemetry-go/pull/8362) - Fix Extrema failure test by [@​mujib77](https://github.com/mujib77) in [#​8338](https://github.com/open-telemetry/opentelemetry-go/pull/8338) - Fix receiver-naming issues from revive by [@​mmorel-35](https://github.com/mmorel-35) in [#​8093](https://github.com/open-telemetry/opentelemetry-go/pull/8093) - docs: clarify that View attribute filters do not apply to Exemplars by [@​Dipanshusinghh](https://github.com/Dipanshusinghh) in [#​8339](https://github.com/open-telemetry/opentelemetry-go/pull/8339) - Disable exemplar reservoir for asynchronous instruments by default by [@​dashpole](https://github.com/dashpole) in [#​8286](https://github.com/open-telemetry/opentelemetry-go/pull/8286) - fix: handle FixedSizeReservoir size=0 without panic by [@​muskiteer](https://github.com/muskiteer) in [#​8295](https://github.com/open-telemetry/opentelemetry-go/pull/8295) - fix(deps): update module go.opentelemetry.io/collector/pdata to v1.59.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8373](https://github.com/open-telemetry/opentelemetry-go/pull/8373) - chore(deps): update github/codeql-action action to v4.36.0 by [@​renovate](https://github.com/renovate)\[bot] in [#​8367](https://github.com/open-telemetry/opentelemetry-go/pull/8367) - chore(deps): update module github.com/clickhouse/clickhouse-go-linter to v1.2.1 by [@​renovate](https://github.com/renovate)\[bot] in [#​8366](https://github.com/open-telemetry/opentelemetry-go/pull/8366) - chore(deps): update github.com/charmbracelet/ultraviolet digest to [`948f455`](https://github.com/open-telemetry/opentelemetry-go/commit/948f455) by [@​renovate](https://github.com/renovate)\[bot] in [#​8374](https://github.com/open-telemetry/opentelemetry-go/pull/8374) - fix(deps): update googleapis to [`0a33c5d`](https://github.com/open-telemetry/opentelemetry-go/commit/0a33c5d) by [@​renovate](https://github.com/renovate)\[bot] in [#​8369](https://github.com/open-telemetry/opentelemetry-go/pull/8369) - add self observability for stdout exporter by [@​yumosx](https://github.com/yumosx) in [#​8263](https://github.com/open-telemetry/opentelemetry-go/pull/8263) - sdk/metric: document unit-sensitivity of DefaultAggregationSelector by [@​alliasgher](https://github.com/alliasgher) in [#​8224](https://github.com/open-telemetry/opentelemetry-go/pull/8224) - semconvkit: add invariant test for histogram-exclusion rule by [@​thealpha93](https://github.com/thealpha93) in [#​8370](https://github.com/open-telemetry/opentelemetry-go/pull/8370) - exporters/otlp: default max request size to 64 MiB by [@​pellared](https://github.com/pellared) in [#​8365](https://github.com/open-telemetry/opentelemetry-go/pull/8365) - fix(deps): update googleapis to [`3dc84a4`](https://github.com/open-telemetry/opentelemetry-go/commit/3dc84a4) by [@​renovate](https://github.com/renovate)\[bot] in [#​8375](https://github.com/open-telemetry/opentelemetry-go/pull/8375) - fix(deps): update golang.org/x by [@​renovate](https://github.com/renovate)\[bot] in [#​8377](https://github.com/open-telemetry/opentelemetry-go/pull/8377) - feat: add self-observability metrics to otlpmetricgrpc metric exporters by [@​dashpole](https://github.com/dashpole) in [#​8192](https://github.com/open-telemetry/opentelemetry-go/pull/8192) - chore(deps): update golang.org/x/telemetry digest to [`5997936`](https://github.com/open-telemetry/opentelemetry-go/commit/5997936) by [@​renovate](https://github.com/renovate)\[bot] in [#​8379](https://github.com/open-telemetry/opentelemetry-go/pull/8379) - Release 1.44.0 by [@​pellared](https://github.com/pellared) in [#​8376](https://github.com/open-telemetry/opentelemetry-go/pull/8376) #### New Contributors - [@​alliasgher](https://github.com/alliasgher) made their first contribution in [#​8197](https://github.com/open-telemetry/opentelemetry-go/pull/8197) - [@​mujib77](https://github.com/mujib77) made their first contribution in [#​8338](https://github.com/open-telemetry/opentelemetry-go/pull/8338) - [@​Dipanshusinghh](https://github.com/Dipanshusinghh) made their first contribution in [#​8339](https://github.com/open-telemetry/opentelemetry-go/pull/8339) - [@​muskiteer](https://github.com/muskiteer) made their first contribution in [#​8295](https://github.com/open-telemetry/opentelemetry-go/pull/8295) - [@​thealpha93](https://github.com/thealpha93) made their first contribution in [#​8370](https://github.com/open-telemetry/opentelemetry-go/pull/8370) **Full Changelog**: <https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.44.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1115 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
3c5ef1721a |
fix(deps): update module golang.org/x/net to v0.56.0 [security] (#1116)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.54.0` → `v0.56.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.54.0...refs/tags/v0.56.0) |  |  | --- ### Go Net HTML parser is vulnerable to denial of service [CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) / [GHSA-5cv4-jp36-h3mw](https://github.com/advisories/GHSA-5cv4-jp36-h3mw) / [GO-2026-5028](https://pkg.go.dev/vuln/GO-2026-5028) <details> <summary>More information</summary> #### Details In Go Net (`golang.org/x/net`) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. #### Severity - CVSS Score: 6.5 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) - [https://go.dev/cl/781702](https://go.dev/cl/781702) - [https://go.dev/issue/79573](https://go.dev/issue/79573) - [https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472](https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472) - [https://go.googlesource.com/net/+/refs/tags/v0.55.0](https://go.googlesource.com/net/+/refs/tags/v0.55.0) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://pkg.go.dev/vuln/GO-2026-5028](https://pkg.go.dev/vuln/GO-2026-5028) - [cs.opensource.google/go/x/net](cs.opensource.google/go/x/net) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-5cv4-jp36-h3mw) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html [CVE-2026-42506](https://nvd.nist.gov/vuln/detail/CVE-2026-42506) / [GO-2026-5025](https://pkg.go.dev/vuln/GO-2026-5025) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79571](https://go.dev/issue/79571) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781700](https://go.dev/cl/781700) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5025) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) / [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026) <details> <summary>More information</summary> #### Details The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". #### Severity Unknown #### References - [https://go.dev/cl/767220](https://go.dev/cl/767220) - [https://go.dev/issue/78760](https://go.dev/issue/78760) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5026) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html [CVE-2026-42502](https://nvd.nist.gov/vuln/detail/CVE-2026-42502) / [GO-2026-5027](https://pkg.go.dev/vuln/GO-2026-5027) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79572](https://go.dev/issue/79572) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781701](https://go.dev/cl/781701) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5027) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html [CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) / [GHSA-5cv4-jp36-h3mw](https://github.com/advisories/GHSA-5cv4-jp36-h3mw) / [GO-2026-5028](https://pkg.go.dev/vuln/GO-2026-5028) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. #### Severity Unknown #### References - [https://go.dev/cl/781702](https://go.dev/cl/781702) - [https://go.dev/issue/79573](https://go.dev/issue/79573) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5028) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html [CVE-2026-25681](https://nvd.nist.gov/vuln/detail/CVE-2026-25681) / [GO-2026-5029](https://pkg.go.dev/vuln/GO-2026-5029) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79574](https://go.dev/issue/79574) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781703](https://go.dev/cl/781703) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5029) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking duplicate attributes can cause XSS in golang.org/x/net/html [CVE-2026-27136](https://nvd.nist.gov/vuln/detail/CVE-2026-27136) / [GO-2026-5030](https://pkg.go.dev/vuln/GO-2026-5030) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79575](https://go.dev/issue/79575) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781685](https://go.dev/cl/781685) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5030) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) / [GO-2026-5942](https://pkg.go.dev/vuln/GO-2026-5942) <details> <summary>More information</summary> #### Details Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. #### Severity Unknown #### References - [https://go.dev/cl/786345](https://go.dev/cl/786345) - [https://go.dev/issue/79795](https://go.dev/issue/79795) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5942) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1116 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
b1a02cdd5d |
chore(deps): update docker docker tag to v29.6.2 (#1101)
Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
0fd8602ac3 |
chore(deps): update actions/setup-go action to v7 (#1102)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-go](https://github.com/actions/setup-go) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-go (actions/setup-go)</summary> ### [`v7.0.0`](https://github.com/actions/setup-go/releases/tag/v7.0.0) [Compare Source](https://github.com/actions/setup-go/compare/v7.0.0...v7.0.0) ##### What's Changed - Migrate to ESM and upgrade dependencies by [@​priyagupta108](https://github.com/priyagupta108) in [#​763](https://github.com/actions/setup-go/pull/763) - chore(deps): bump [@​actions/cache](https://github.com/actions/cache) to 6.2.0 by [@​philip-gai](https://github.com/philip-gai) in [#​771](https://github.com/actions/setup-go/pull/771) ##### New Contributors - [@​philip-gai](https://github.com/philip-gai) made their first contribution in [#​771](https://github.com/actions/setup-go/pull/771) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v7.0.0> ### [`v7`](https://github.com/actions/setup-go/compare/v6.5.0...v7.0.0) [Compare Source](https://github.com/actions/setup-go/compare/v6.5.0...v7.0.0) ### [`v6.5.0`](https://github.com/actions/setup-go/releases/tag/v6.5.0) [Compare Source](https://github.com/actions/setup-go/compare/v6.4.0...v6.5.0) ##### What's Changed ##### Dependency update - Upgrade actions dependencies by [@​priyagupta108](https://github.com/priyagupta108) with [@​Copilot](https://github.com/Copilot) in [#​744](https://github.com/actions/setup-go/pull/744) - Upgrade [@​types/node](https://github.com/types/node) and typescript-eslint dependencies to resolve npm audit findings by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​755](https://github.com/actions/setup-go/pull/755) - Upgrade [@​actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@​jasongin](https://github.com/jasongin) in [#​758](https://github.com/actions/setup-go/pull/758) - Upgrade version to 6.5.0 in package.json and package-lock.json by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​762](https://github.com/actions/setup-go/pull/762) ##### New Contributors - [@​priyagupta108](https://github.com/priyagupta108) with [@​Copilot](https://github.com/Copilot) made their first contribution in [#​744](https://github.com/actions/setup-go/pull/744) - [@​jasongin](https://github.com/jasongin) made their first contribution in [#​758](https://github.com/actions/setup-go/pull/758) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v6.5.0> ### [`v6.4.0`](https://github.com/actions/setup-go/releases/tag/v6.4.0) [Compare Source](https://github.com/actions/setup-go/compare/v6.3.0...v6.4.0) ##### What's Changed ##### Enhancement - Add go-download-base-url input for custom Go distributions by [@​gdams](https://github.com/gdams) in [#​721](https://github.com/actions/setup-go/pull/721) ##### Dependency update - Upgrade minimatch from 3.1.2 to 3.1.5 by [@​dependabot](https://github.com/dependabot) in [#​727](https://github.com/actions/setup-go/pull/727) ##### Documentation update - Rearrange README.md, add advanced-usage.md by [@​priyagupta108](https://github.com/priyagupta108) in [#​724](https://github.com/actions/setup-go/pull/724) - Fix Microsoft build of Go link by [@​gdams](https://github.com/gdams) in [#​734](https://github.com/actions/setup-go/pull/734) ##### New Contributors - [@​gdams](https://github.com/gdams) made their first contribution in [#​721](https://github.com/actions/setup-go/pull/721) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v6.4.0> ### [`v6.3.0`](https://github.com/actions/setup-go/releases/tag/v6.3.0) [Compare Source](https://github.com/actions/setup-go/compare/v6.2.0...v6.3.0) ##### What's Changed - Update default Go module caching to use go.mod by [@​priyagupta108](https://github.com/priyagupta108) in [#​705](https://github.com/actions/setup-go/pull/705) - Fix golang download url to go.dev by [@​178inaba](https://github.com/178inaba) in [#​469](https://github.com/actions/setup-go/pull/469) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v6.3.0> ### [`v6.2.0`](https://github.com/actions/setup-go/releases/tag/v6.2.0) [Compare Source](https://github.com/actions/setup-go/compare/v6.1.0...v6.2.0) ##### What's Changed ##### Enhancements - Example for restore-only cache in documentation by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​696](https://github.com/actions/setup-go/pull/696) - Update Node.js version in action.yml by [@​ccoVeille](https://github.com/ccoVeille) in [#​691](https://github.com/actions/setup-go/pull/691) - Documentation update of actions/checkout by [@​deining](https://github.com/deining) in [#​683](https://github.com/actions/setup-go/pull/683) ##### Dependency updates - Upgrade js-yaml from 3.14.1 to 3.14.2 by [@​dependabot](https://github.com/dependabot) in [#​682](https://github.com/actions/setup-go/pull/682) - Upgrade [@​actions/cache](https://github.com/actions/cache) to v5 by [@​salmanmkc](https://github.com/salmanmkc) in [#​695](https://github.com/actions/setup-go/pull/695) - Upgrade actions/checkout from 5 to 6 by [@​dependabot](https://github.com/dependabot) in [#​686](https://github.com/actions/setup-go/pull/686) - Upgrade qs from 6.14.0 to 6.14.1 by [@​dependabot](https://github.com/dependabot) in [#​703](https://github.com/actions/setup-go/pull/703) ##### New Contributors - [@​ccoVeille](https://github.com/ccoVeille) made their first contribution in [#​691](https://github.com/actions/setup-go/pull/691) - [@​deining](https://github.com/deining) made their first contribution in [#​683](https://github.com/actions/setup-go/pull/683) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-go/releases/tag/v6.1.0) [Compare Source](https://github.com/actions/setup-go/compare/v6...v6.1.0) ##### What's Changed ##### Enhancements - Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang by [@​nicholasngai](https://github.com/nicholasngai) in [#​665](https://github.com/actions/setup-go/pull/665) - Add support for .tool-versions file and update workflow by [@​priya-kinthali](https://github.com/priya-kinthali) in [#​673](https://github.com/actions/setup-go/pull/673) - Add comprehensive breaking changes documentation for v6 by [@​mahabaleshwars](https://github.com/mahabaleshwars) in [#​674](https://github.com/actions/setup-go/pull/674) ##### Dependency updates - Upgrade eslint-config-prettier from 10.0.1 to 10.1.8 and document breaking changes in v6 by [@​dependabot](https://github.com/dependabot) in [#​617](https://github.com/actions/setup-go/pull/617) - Upgrade actions/publish-action from 0.3.0 to 0.4.0 by [@​dependabot](https://github.com/dependabot) in [#​641](https://github.com/actions/setup-go/pull/641) - Upgrade semver and [@​types/semver](https://github.com/types/semver) by [@​dependabot](https://github.com/dependabot) in [#​652](https://github.com/actions/setup-go/pull/652) ##### New Contributors - [@​nicholasngai](https://github.com/nicholasngai) made their first contribution in [#​665](https://github.com/actions/setup-go/pull/665) - [@​priya-kinthali](https://github.com/priya-kinthali) made their first contribution in [#​673](https://github.com/actions/setup-go/pull/673) - [@​mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#​674](https://github.com/actions/setup-go/pull/674) **Full Changelog**: <https://github.com/actions/setup-go/compare/v6...v6.1.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1102 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
46f22c78d2 |
fix(deps): update module github.com/mattn/go-isatty to v0.0.23 (#1097)
Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
068afc3996 |
fix(deps): update module github.com/docker/cli to v29.6.2+incompatible (#1096)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.6.1+incompatible` → `v29.6.2+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.6.2+incompatible`](https://github.com/docker/cli/compare/v29.6.1...v29.6.2) [Compare Source](https://github.com/docker/cli/compare/v29.6.1...v29.6.2) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1096 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
0c08b0f2da |
chore(deps): update actions/setup-node action to v7 (#1094)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://github.com/actions/setup-node) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v7.0.0`](https://github.com/actions/setup-node/releases/tag/v7.0.0) [Compare Source](https://github.com/actions/setup-node/compare/v7.0.0...v7.0.0) #### What's Changed ##### Enhancements: - Add cache-primary-key and cache-matched-key as outputs by [@​gowridurgad](https://github.com/gowridurgad) in [#​1577](https://github.com/actions/setup-node/pull/1577) - Migrate to ESM and upgrade dependencies by [@​gowridurgad](https://github.com/gowridurgad) in [#​1574](https://github.com/actions/setup-node/pull/1574) ##### Bug fixes: - Remove dummy NODE\_AUTH\_TOKEN export by [@​gowridurgad](https://github.com/gowridurgad) in [#​1558](https://github.com/actions/setup-node/pull/1558) - Only use `mirrorToken` in `getManifest` if it's provided by [@​deiga](https://github.com/deiga) in [#​1548](https://github.com/actions/setup-node/pull/1548) ##### Documentation updates: - Add documentation for publishing to npm with Trusted Publisher (OIDC) by [@​chiranjib-swain](https://github.com/chiranjib-swain) in [#​1536](https://github.com/actions/setup-node/pull/1536) - docs: Update restore-only cache documentation by [@​priya-kinthali](https://github.com/priya-kinthali) in [#​1550](https://github.com/actions/setup-node/pull/1550) - docs: Update caching recommendations to mitigate cache poisoning risks by [@​chiranjib-swain](https://github.com/chiranjib-swain) in [#​1567](https://github.com/actions/setup-node/pull/1567) ##### Dependency update: - Upgrade [@​actions/cache](https://github.com/actions/cache) to 5.1.0, log cache write denied by [@​jasongin](https://github.com/jasongin) in [#​1569](https://github.com/actions/setup-node/pull/1569) #### New Contributors - [@​chiranjib-swain](https://github.com/chiranjib-swain) made their first contribution in [#​1536](https://github.com/actions/setup-node/pull/1536) - [@​deiga](https://github.com/deiga) made their first contribution in [#​1548](https://github.com/actions/setup-node/pull/1548) - [@​jasongin](https://github.com/jasongin) made their first contribution in [#​1569](https://github.com/actions/setup-node/pull/1569) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v7.0.0> ### [`v7`](https://github.com/actions/setup-node/compare/v6.5.0...v7.0.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.5.0...v7.0.0) ### [`v6.5.0`](https://github.com/actions/setup-node/releases/tag/v6.5.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0) #### What's Changed - Update [@​actions/cache](https://github.com/actions/cache) to 5.1.0 and add security overrides for undici and fast-xml-parser by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​1579](https://github.com/actions/setup-node/pull/1579) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0> ### [`v6.4.0`](https://github.com/actions/setup-node/releases/tag/v6.4.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.3.0...v6.4.0) #### What's Changed ##### Dependency updates: - Upgrade [@​actions](https://github.com/actions) dependencies by [@​Copilot](https://github.com/Copilot) in [#​1525](https://github.com/actions/setup-node/pull/1525) - Update Node.js versions in versions.yml and bump package to v6.4.0 by [@​priya-kinthali](https://github.com/priya-kinthali) in [#​1533](https://github.com/actions/setup-node/pull/1533) #### New Contributors - [@​Copilot](https://github.com/Copilot) made their first contribution in [#​1525](https://github.com/actions/setup-node/pull/1525) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.4.0> ### [`v6.3.0`](https://github.com/actions/setup-node/releases/tag/v6.3.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.2.0...v6.3.0) #### What's Changed ##### Enhancements: - Support parsing `devEngines` field by [@​susnux](https://github.com/susnux) in [#​1283](https://github.com/actions/setup-node/pull/1283) > When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node. ##### Dependency updates: - Fix npm audit issues by [@​gowridurgad](https://github.com/gowridurgad) in [#​1491](https://github.com/actions/setup-node/pull/1491) - Replace uuid with crypto.randomUUID() by [@​trivikr](https://github.com/trivikr) in [#​1378](https://github.com/actions/setup-node/pull/1378) - Upgrade minimatch from 3.1.2 to 3.1.5 by [@​dependabot](https://github.com/dependabot) in [#​1498](https://github.com/actions/setup-node/pull/1498) ##### Bug fixes: - Remove hardcoded bearer for mirror-url [@​marco-ippolito](https://github.com/marco-ippolito) in [#​1467](https://github.com/actions/setup-node/pull/1467) - Scope test lockfiles by package manager and update cache tests by [@​gowridurgad](https://github.com/gowridurgad) in [#​1495](https://github.com/actions/setup-node/pull/1495) #### New Contributors - [@​susnux](https://github.com/susnux) made their first contribution in [#​1283](https://github.com/actions/setup-node/pull/1283) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.3.0> ### [`v6.2.0`](https://github.com/actions/setup-node/releases/tag/v6.2.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.1.0...v6.2.0) #### What's Changed ##### Documentation - Documentation update related to absence of Lockfile by [@​mahabaleshwars](https://github.com/mahabaleshwars) in [#​1454](https://github.com/actions/setup-node/pull/1454) - Correct mirror option typos by [@​MikeMcC399](https://github.com/MikeMcC399) in [#​1442](https://github.com/actions/setup-node/pull/1442) - Readme update on checkout version v6 by [@​deining](https://github.com/deining) in [#​1446](https://github.com/actions/setup-node/pull/1446) - Readme typo fixes [@​munyari](https://github.com/munyari) in [#​1226](https://github.com/actions/setup-node/pull/1226) - Advanced document update on checkout version v6 by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​1468](https://github.com/actions/setup-node/pull/1468) ##### Dependency updates: - Upgrade [@​actions/cache](https://github.com/actions/cache) to v5.0.1 by [@​salmanmkc](https://github.com/salmanmkc) in [#​1449](https://github.com/actions/setup-node/pull/1449) #### New Contributors - [@​mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#​1454](https://github.com/actions/setup-node/pull/1454) - [@​MikeMcC399](https://github.com/MikeMcC399) made their first contribution in [#​1442](https://github.com/actions/setup-node/pull/1442) - [@​deining](https://github.com/deining) made their first contribution in [#​1446](https://github.com/actions/setup-node/pull/1446) - [@​munyari](https://github.com/munyari) made their first contribution in [#​1226](https://github.com/actions/setup-node/pull/1226) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-node/releases/tag/v6.1.0) [Compare Source](https://github.com/actions/setup-node/compare/v6...v6.1.0) #### What's Changed ##### Enhancement: - Remove always-auth configuration handling by [@​priyagupta108](https://github.com/priyagupta108) in [#​1436](https://github.com/actions/setup-node/pull/1436) ##### Dependency updates: - Upgrade [@​actions/cache](https://github.com/actions/cache) from 4.0.3 to 4.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1384](https://github.com/actions/setup-node/pull/1384) - Upgrade actions/checkout from 5 to 6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1439](https://github.com/actions/setup-node/pull/1439) - Upgrade js-yaml from 3.14.1 to 3.14.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1435](https://github.com/actions/setup-node/pull/1435) ##### Documentation update: - Add example for restore-only cache in documentation by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​1419](https://github.com/actions/setup-node/pull/1419) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.1.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1094 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
ad967330a8 |
fix(deps): update module golang.org/x/text to v0.40.0 (#1091)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | [`v0.37.0` → `v0.40.0`](https://cs.opensource.google/go/x/text/+/refs/tags/v0.37.0...refs/tags/v0.40.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1091 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
554b3b7671 |
fix(deps): update module golang.org/x/term to v0.45.0 (#1081)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.44.0` → `v0.45.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.44.0...refs/tags/v0.45.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1081 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
b12d02c25f |
fix(deps): update module golang.org/x/sys to v0.47.0 (#1073)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/sys](https://pkg.go.dev/golang.org/x/sys) | [`v0.46.0` → `v0.47.0`](https://cs.opensource.google/go/x/sys/+/refs/tags/v0.46.0...refs/tags/v0.47.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->Reviewed-on: https://gitea.com/gitea/runner/pulls/1073 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
e774003c18 |
chore(deps): update docker docker tag to v29.6.1 (#1063)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | docker | stage | patch | `29.6.0-dind-rootless` → `29.6.1-dind-rootless` | | docker | stage | patch | `29.6.0-dind` → `29.6.1-dind` | Co-authored-by: Renovate Bot <[email protected]> |
||
 Renovate BotandLunny Xiao
|
eba33e178d |
fix(deps): update module github.com/docker/cli to v29.6.1+incompatible (#1060)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.6.0+incompatible` → `v29.6.1+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.6.1+incompatible`](https://github.com/docker/cli/compare/v29.6.0...v29.6.1) [Compare Source](https://github.com/docker/cli/compare/v29.6.0...v29.6.1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1060 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
4e7fd1c68a |
fix(deps): update module github.com/moby/moby/client to v0.5.0 (#1049)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/moby/moby/client](https://github.com/moby/moby) | `v0.4.1` → `v0.5.0` |  |  | --- ### Release Notes <details> <summary>moby/moby (github.com/moby/moby/client)</summary> ### [`v0.5.0`](https://github.com/moby/moby/compare/v0.4.1...v0.5.0) [Compare Source](https://github.com/moby/moby/compare/v0.4.1...v0.5.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1049 Reviewed-by: Nicolas <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
bd41a367fe |
fix(deps): update module github.com/docker/cli to v29.6.0+incompatible (#1045)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.5.3+incompatible` → `v29.6.0+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.6.0+incompatible`](https://github.com/docker/cli/compare/v29.5.3...v29.6.0) [Compare Source](https://github.com/docker/cli/compare/v29.5.3...v29.6.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1045 Reviewed-by: Nicolas <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
c566013db4 |
chore(deps): update docker docker tag to v29.6.0 (#1044)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | docker | stage | minor | `29.5.3-dind-rootless` → `29.6.0-dind-rootless` | | docker | stage | minor | `29.5.3-dind` → `29.6.0-dind` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1044 Reviewed-by: Nicolas <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
40e021309a |
chore(deps): update actions/checkout action to v7 (#1042)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1042 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
d3b3519dea |
fix(deps): update module go.etcd.io/bbolt to v1.5.0 (#1040)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.etcd.io/bbolt](https://github.com/etcd-io/bbolt) | `v1.4.3` → `v1.5.0` |  |  | --- ### Release Notes <details> <summary>etcd-io/bbolt (go.etcd.io/bbolt)</summary> ### [`v1.5.0`](https://github.com/etcd-io/bbolt/releases/tag/v1.5.0): v0.5.0 [Compare Source](https://github.com/etcd-io/bbolt/compare/v1.4.3...v1.5.0) See the [CHANGELOG/v1.5.0](https://github.com/etcd-io/bbolt/blob/main/CHANGELOG/CHANGELOG-1.5.md#v1502026-06-21) for more details. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/1040 Reviewed-by: techknowlogick <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
56979e6ab8 |
fix(deps): update module golang.org/x/term to v0.44.0 (#1031)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1031 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
bf99e6a758 |
chore(deps): update alpine docker tag to v3.24 (#1030)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1030 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
526c46b485 |
chore(deps): update docker docker tag to v29.5.3 (#1021)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1021 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
e583b0706b |
fix(deps): update module golang.org/x/sys to v0.46.0 (#1019)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1019 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
8ad84cd96a |
fix(deps): update module github.com/docker/cli to v29.5.3+incompatible (#1018)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1018 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandNicolas
|
443b0e336c |
fix(deps): update module github.com/opencontainers/selinux to v1.15.1 (#1017)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) | `v1.15.0` → `v1.15.1` |  |  | --- ### Release Notes <details> <summary>opencontainers/selinux (github.com/opencontainers/selinux)</summary> ### [`v1.15.1`](https://github.com/opencontainers/selinux/releases/tag/v1.15.1) [Compare Source](https://github.com/opencontainers/selinux/compare/v1.15.0...v1.15.1) #### What's Changed - ReserveLabelV2: ignore labels without MCS by [@​kolyshkin](https://github.com/kolyshkin) in [#​272](https://github.com/opencontainers/selinux/pull/272) **Full Changelog**: <https://github.com/opencontainers/selinux/compare/v1.15.0...v1.15.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Nicolas <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1017 Reviewed-by: Nicolas <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
ff7d9ca8d0 |
fix(deps): update module golang.org/x/sys to v0.45.0 (#1012)
Reviewed-on: https://gitea.com/gitea/runner/pulls/1012 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandNicolas
|
984b47c716 |
fix(deps): update module code.gitea.io/actions-proto-go to gitea.dev/actions-proto-go v0.5.0 (#1009)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | code.gitea.io/actions-proto-go | `v0.4.1` → `v0.5.0` |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Nicolas <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/1009 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
47ee45412a |
fix(deps): update module github.com/opencontainers/selinux to v1.15.0 (#990)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) | `v1.14.1` → `v1.15.0` |  |  | --- ### Release Notes <details> <summary>opencontainers/selinux (github.com/opencontainers/selinux)</summary> ### [`v1.15.0`](https://github.com/opencontainers/selinux/releases/tag/v1.15.0) [Compare Source](https://github.com/opencontainers/selinux/compare/v1.14.1...v1.15.0) This release adds a new function, SetProcessKind, which is to be used instead of KVMProcessLabel\[s] and InitProcessLabel\[s] in case the user only wants to change the type of the existing label, not generate a new one. It also fixes an CI issue and optimizes label.InitLabels for a few common cases. #### What's Changed - ci: set timeout for vm jobs by [@​kolyshkin](https://github.com/kolyshkin) in [#​270](https://github.com/opencontainers/selinux/pull/270) - label.InitLabels: optimize by [@​kolyshkin](https://github.com/kolyshkin) in [#​269](https://github.com/opencontainers/selinux/pull/269) - Add SetProcessKind by [@​kolyshkin](https://github.com/kolyshkin) in [#​271](https://github.com/opencontainers/selinux/pull/271) **Full Changelog**: <https://github.com/opencontainers/selinux/compare/v1.14.1...v1.15.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/990 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
1c62c0635f |
chore(deps): update actions/setup-node action to v6 (#991)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/setup-node](https://github.com/actions/setup-node) | action | major | `v4` → `v6` | --- ### Release Notes <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v6.4.0`](https://github.com/actions/setup-node/releases/tag/v6.4.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.3.0...v6.4.0) #### What's Changed ##### Dependency updates: - Upgrade [@​actions](https://github.com/actions) dependencies by [@​Copilot](https://github.com/Copilot) in [#​1525](https://github.com/actions/setup-node/pull/1525) - Update Node.js versions in versions.yml and bump package to v6.4.0 by [@​priya-kinthali](https://github.com/priya-kinthali) in [#​1533](https://github.com/actions/setup-node/pull/1533) #### New Contributors - [@​Copilot](https://github.com/Copilot) made their first contribution in [#​1525](https://github.com/actions/setup-node/pull/1525) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.4.0> ### [`v6.3.0`](https://github.com/actions/setup-node/releases/tag/v6.3.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.2.0...v6.3.0) #### What's Changed ##### Enhancements: - Support parsing `devEngines` field by [@​susnux](https://github.com/susnux) in [#​1283](https://github.com/actions/setup-node/pull/1283) > When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node. ##### Dependency updates: - Fix npm audit issues by [@​gowridurgad](https://github.com/gowridurgad) in [#​1491](https://github.com/actions/setup-node/pull/1491) - Replace uuid with crypto.randomUUID() by [@​trivikr](https://github.com/trivikr) in [#​1378](https://github.com/actions/setup-node/pull/1378) - Upgrade minimatch from 3.1.2 to 3.1.5 by [@​dependabot](https://github.com/dependabot) in [#​1498](https://github.com/actions/setup-node/pull/1498) ##### Bug fixes: - Remove hardcoded bearer for mirror-url [@​marco-ippolito](https://github.com/marco-ippolito) in [#​1467](https://github.com/actions/setup-node/pull/1467) - Scope test lockfiles by package manager and update cache tests by [@​gowridurgad](https://github.com/gowridurgad) in [#​1495](https://github.com/actions/setup-node/pull/1495) #### New Contributors - [@​susnux](https://github.com/susnux) made their first contribution in [#​1283](https://github.com/actions/setup-node/pull/1283) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.3.0> ### [`v6.2.0`](https://github.com/actions/setup-node/releases/tag/v6.2.0) [Compare Source](https://github.com/actions/setup-node/compare/v6.1.0...v6.2.0) #### What's Changed ##### Documentation - Documentation update related to absence of Lockfile by [@​mahabaleshwars](https://github.com/mahabaleshwars) in [#​1454](https://github.com/actions/setup-node/pull/1454) - Correct mirror option typos by [@​MikeMcC399](https://github.com/MikeMcC399) in [#​1442](https://github.com/actions/setup-node/pull/1442) - Readme update on checkout version v6 by [@​deining](https://github.com/deining) in [#​1446](https://github.com/actions/setup-node/pull/1446) - Readme typo fixes [@​munyari](https://github.com/munyari) in [#​1226](https://github.com/actions/setup-node/pull/1226) - Advanced document update on checkout version v6 by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​1468](https://github.com/actions/setup-node/pull/1468) ##### Dependency updates: - Upgrade [@​actions/cache](https://github.com/actions/cache) to v5.0.1 by [@​salmanmkc](https://github.com/salmanmkc) in [#​1449](https://github.com/actions/setup-node/pull/1449) #### New Contributors - [@​mahabaleshwars](https://github.com/mahabaleshwars) made their first contribution in [#​1454](https://github.com/actions/setup-node/pull/1454) - [@​MikeMcC399](https://github.com/MikeMcC399) made their first contribution in [#​1442](https://github.com/actions/setup-node/pull/1442) - [@​deining](https://github.com/deining) made their first contribution in [#​1446](https://github.com/actions/setup-node/pull/1446) - [@​munyari](https://github.com/munyari) made their first contribution in [#​1226](https://github.com/actions/setup-node/pull/1226) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.2.0> ### [`v6.1.0`](https://github.com/actions/setup-node/releases/tag/v6.1.0) [Compare Source](https://github.com/actions/setup-node/compare/v6...v6.1.0) #### What's Changed ##### Enhancement: - Remove always-auth configuration handling by [@​priyagupta108](https://github.com/priyagupta108) in [#​1436](https://github.com/actions/setup-node/pull/1436) ##### Dependency updates: - Upgrade [@​actions/cache](https://github.com/actions/cache) from 4.0.3 to 4.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1384](https://github.com/actions/setup-node/pull/1384) - Upgrade actions/checkout from 5 to 6 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1439](https://github.com/actions/setup-node/pull/1439) - Upgrade js-yaml from 3.14.1 to 3.14.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1435](https://github.com/actions/setup-node/pull/1435) ##### Documentation update: - Add example for restore-only cache in documentation by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​1419](https://github.com/actions/setup-node/pull/1419) **Full Changelog**: <https://github.com/actions/setup-node/compare/v6...v6.1.0> ### [`v6.0.0`](https://github.com/actions/setup-node/releases/tag/v6.0.0) [Compare Source](https://github.com/actions/setup-node/compare/v6...v6) #### What's Changed **Breaking Changes** - Limit automatic caching to npm, update workflows and documentation by [@​priyagupta108](https://github.com/priyagupta108) in [#​1374](https://github.com/actions/setup-node/pull/1374) **Dependency Upgrades** - Upgrade ts-jest from 29.1.2 to 29.4.1 and document breaking changes in v5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1336](https://github.com/actions/setup-node/pull/1336) - Upgrade prettier from 2.8.8 to 3.6.2 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1334](https://github.com/actions/setup-node/pull/1334) - Upgrade actions/publish-action from 0.3.0 to 0.4.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1362](https://github.com/actions/setup-node/pull/1362) **Full Changelog**: <https://github.com/actions/setup-node/compare/v5...v6.0.0> ### [`v6`](https://github.com/actions/setup-node/compare/v5.0.0...v6) [Compare Source](https://github.com/actions/setup-node/compare/v5.0.0...v6) ### [`v5.0.0`](https://github.com/actions/setup-node/releases/tag/v5.0.0) [Compare Source](https://github.com/actions/setup-node/compare/v5.0.0...v5.0.0) #### What's Changed ##### Breaking Changes - Enhance caching in setup-node with automatic package manager detection by [@​priya-kinthali](https://github.com/priya-kinthali) in [#​1348](https://github.com/actions/setup-node/pull/1348) This update, introduces automatic caching when a valid `packageManager` field is present in your `package.json`. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set `package-manager-cache: false` ```yaml steps: - uses: actions/checkout@v5 - uses: actions/setup-node@v5 with: package-manager-cache: false ``` - Upgrade action to use node24 by [@​salmanmkc](https://github.com/salmanmkc) in [#​1325](https://github.com/actions/setup-node/pull/1325) Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. [See Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1) ##### Dependency Upgrades - Upgrade [@​octokit/request-error](https://github.com/octokit/request-error) and [@​actions/github](https://github.com/actions/github) by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1227](https://github.com/actions/setup-node/pull/1227) - Upgrade uuid from 9.0.1 to 11.1.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1273](https://github.com/actions/setup-node/pull/1273) - Upgrade undici from 5.28.5 to 5.29.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1295](https://github.com/actions/setup-node/pull/1295) - Upgrade form-data to bring in fix for critical vulnerability by [@​gowridurgad](https://github.com/gowridurgad) in [#​1332](https://github.com/actions/setup-node/pull/1332) - Upgrade actions/checkout from 4 to 5 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​1345](https://github.com/actions/setup-node/pull/1345) #### New Contributors - [@​priya-kinthali](https://github.com/priya-kinthali) made their first contribution in [#​1348](https://github.com/actions/setup-node/pull/1348) - [@​salmanmkc](https://github.com/salmanmkc) made their first contribution in [#​1325](https://github.com/actions/setup-node/pull/1325) **Full Changelog**: <https://github.com/actions/setup-node/compare/v4...v5.0.0> ### [`v5`](https://github.com/actions/setup-node/compare/v4.4.0...v5.0.0) [Compare Source](https://github.com/actions/setup-node/compare/v4.4.0...v5.0.0) ### [`v4.4.0`](https://github.com/actions/setup-node/releases/tag/v4.4.0) [Compare Source](https://github.com/actions/setup-node/compare/v4.3.0...v4.4.0) #### What's Changed ##### Bug fixes: - Make eslint-compact matcher compatible with Stylelint by [@​FloEdelmann](https://github.com/FloEdelmann) in [#​98](https://github.com/actions/setup-node/pull/98) - Add support for indented eslint output by [@​fregante](https://github.com/fregante) in [#​1245](https://github.com/actions/setup-node/pull/1245) ##### Enhancement: - Support private mirrors by [@​marco-ippolito](https://github.com/marco-ippolito) in [#​1240](https://github.com/actions/setup-node/pull/1240) ##### Dependency update: - Upgrade [@​action/cache](https://github.com/action/cache) from 4.0.2 to 4.0.3 by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​1262](https://github.com/actions/setup-node/pull/1262) #### New Contributors - [@​FloEdelmann](https://github.com/FloEdelmann) made their first contribution in [#​98](https://github.com/actions/setup-node/pull/98) - [@​fregante](https://github.com/fregante) made their first contribution in [#​1245](https://github.com/actions/setup-node/pull/1245) - [@​marco-ippolito](https://github.com/marco-ippolito) made their first contribution in [#​1240](https://github.com/actions/setup-node/pull/1240) **Full Changelog**: <https://github.com/actions/setup-node/compare/v4...v4.4.0> ### [`v4.3.0`](https://github.com/actions/setup-node/releases/tag/v4.3.0) [Compare Source](https://github.com/actions/setup-node/compare/v4.2.0...v4.3.0) #### What's Changed ##### Dependency updates - Upgrade [@​actions/glob](https://github.com/actions/glob) from 0.4.0 to 0.5.0 by [@​dependabot](https://github.com/dependabot) in [#​1200](https://github.com/actions/setup-node/pull/1200) - Upgrade [@​action/cache](https://github.com/action/cache) from 4.0.0 to 4.0.2 by [@​gowridurgad](https://github.com/gowridurgad) in [#​1251](https://github.com/actions/setup-node/pull/1251) - Upgrade [@​vercel/ncc](https://github.com/vercel/ncc) from 0.38.1 to 0.38.3 by [@​dependabot](https://github.com/dependabot) in [#​1203](https://github.com/actions/setup-node/pull/1203) - Upgrade [@​actions/tool-cache](https://github.com/actions/tool-cache) from 2.0.1 to 2.0.2 by [@​dependabot](https://github.com/dependabot) in [#​1220](https://github.com/actions/setup-node/pull/1220) #### New Contributors - [@​gowridurgad](https://github.com/gowridurgad) made their first contribution in [#​1251](https://github.com/actions/setup-node/pull/1251) **Full Changelog**: <https://github.com/actions/setup-node/compare/v4...v4.3.0> ### [`v4.2.0`](https://github.com/actions/setup-node/releases/tag/v4.2.0) [Compare Source](https://github.com/actions/setup-node/compare/v4.1.0...v4.2.0) #### What's Changed - Enhance workflows and upgrade publish-actions from 0.2.2 to 0.3.0 by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​1174](https://github.com/actions/setup-node/pull/1174) - Add recommended permissions section to readme by [@​benwells](https://github.com/benwells) in [#​1193](https://github.com/actions/setup-node/pull/1193) - Configure Dependabot settings by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​1192](https://github.com/actions/setup-node/pull/1192) - Upgrade `@actions/cache` to `^4.0.0` by [@​priyagupta108](https://github.com/priyagupta108) in [#​1191](https://github.com/actions/setup-node/pull/1191) - Upgrade pnpm/action-setup from 2 to 4 by [@​dependabot](https://github.com/dependabot) in [#​1194](https://github.com/actions/setup-node/pull/1194) - Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by [@​dependabot](https://github.com/dependabot) in [#​1195](https://github.com/actions/setup-node/pull/1195) - Upgrade semver from 7.6.0 to 7.6.3 by [@​dependabot](https://github.com/dependabot) in [#​1196](https://github.com/actions/setup-node/pull/1196) - Upgrade [@​types/jest](https://github.com/types/jest) from 29.5.12 to 29.5.14 by [@​dependabot](https://github.com/dependabot) in [#​1201](https://github.com/actions/setup-node/pull/1201) - Upgrade undici from 5.28.4 to 5.28.5 by [@​dependabot](https://github.com/dependabot) in [#​1205](https://github.com/actions/setup-node/pull/1205) #### New Contributors - [@​benwells](https://github.com/benwells) made their first contribution in [#​1193](https://github.com/actions/setup-node/pull/1193) **Full Changelog**: <https://github.com/actions/setup-node/compare/v4...v4.2.0> ### [`v4.1.0`](https://github.com/actions/setup-node/releases/tag/v4.1.0) [Compare Source](https://github.com/actions/setup-node/compare/v4.0.4...v4.1.0) #### What's Changed - Resolve High Security Alerts by upgrading Dependencies by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​1132](https://github.com/actions/setup-node/pull/1132) - Upgrade IA Publish by [@​Jcambass](https://github.com/Jcambass) in [#​1134](https://github.com/actions/setup-node/pull/1134) - Revise `isGhes` logic by [@​jww3](https://github.com/jww3) in [#​1148](https://github.com/actions/setup-node/pull/1148) - Add architecture to cache key by [@​pengx17](https://github.com/pengx17) in [#​843](https://github.com/actions/setup-node/pull/843) This addresses issues with caching by adding the architecture (arch) to the cache key, ensuring that cache keys are accurate to prevent conflicts. Note: This change may break previous cache keys as they will no longer be compatible with the new format. #### New Contributors - [@​jww3](https://github.com/jww3) made their first contribution in [#​1148](https://github.com/actions/setup-node/pull/1148) - [@​pengx17](https://github.com/pengx17) made their first contribution in [#​843](https://github.com/actions/setup-node/pull/843) **Full Changelog**: <https://github.com/actions/setup-node/compare/v4...v4.1.0> ### [`v4.0.4`](https://github.com/actions/setup-node/releases/tag/v4.0.4) [Compare Source](https://github.com/actions/setup-node/compare/v4.0.3...v4.0.4) #### What's Changed - Add workflow file for publishing releases to immutable action package by [@​Jcambass](https://github.com/Jcambass) in [#​1125](https://github.com/actions/setup-node/pull/1125) - Enhance Windows ARM64 Setup and Update micromatch Dependency by [@​priyagupta108](https://github.com/priyagupta108) in [#​1126](https://github.com/actions/setup-node/pull/1126) ##### Documentation changes: - Documentation update in the README file by [@​suyashgaonkar](https://github.com/suyashgaonkar) in [#​1106](https://github.com/actions/setup-node/pull/1106) - Correct invalid 'lts' version string reference by [@​fulldecent](https://github.com/fulldecent) in [#​1124](https://github.com/actions/setup-node/pull/1124) #### New Contributors - [@​suyashgaonkar](https://github.com/suyashgaonkar) made their first contribution in [#​1106](https://github.com/actions/setup-node/pull/1106) - [@​priyagupta108](https://github.com/priyagupta108) made their first contribution in [#​1126](https://github.com/actions/setup-node/pull/1126) - [@​Jcambass](https://github.com/Jcambass) made their first contribution in [#​1125](https://github.com/actions/setup-node/pull/1125) - [@​fulldecent](https://github.com/fulldecent) made their first contribution in [#​1124](https://github.com/actions/setup-node/pull/1124) **Full Changelog**: <https://github.com/actions/setup-node/compare/v4...v4.0.4> ### [`v4.0.3`](https://github.com/actions/setup-node/releases/tag/v4.0.3) [Compare Source](https://github.com/actions/setup-node/compare/v4.0.2...v4.0.3) #### What's Changed ##### Bug fixes: - Fix macos latest check failures by [@​HarithaVattikuti](https://github.com/HarithaVattikuti) in [#​1041](https://github.com/actions/setup-node/pull/1041) ##### Documentation changes: - Documentation update to update default Node version to 20 by [@​bengreeley](https://github.com/bengreeley) in [#​949](https://github.com/actions/setup-node/pull/949) ##### Dependency updates: - Bump undici from 5.26.5 to 5.28.3 by [@​dependabot](https://github.com/dependabot) in [#​965](https://github.com/actions/setup-node/pull/965) - Bump braces from 3.0.2 to 3.0.3 and other dependency updates by [@​dependabot](https://github.com/dependabot) in [#​1087](https://github.com/actions/setup-node/pull/1087) #### New Contributors - [@​bengreeley](https://github.com/bengreeley) made their first contribution in [#​949](https://github.com/actions/setup-node/pull/949) - [@​HarithaVattikuti](https://github.com/HarithaVattikuti) made their first contribution in [#​1041](https://github.com/actions/setup-node/pull/1041) **Full Changelog**: <https://github.com/actions/setup-node/compare/v4...v4.0.3> ### [`v4.0.2`](https://github.com/actions/setup-node/releases/tag/v4.0.2) [Compare Source](https://github.com/actions/setup-node/compare/v4.0.1...v4.0.2) #### What's Changed - Add support for `volta.extends` by [@​ThisIsManta](https://github.com/ThisIsManta) in [#​921](https://github.com/actions/setup-node/pull/921) - Add support for arm64 Windows by [@​dmitry-shibanov](https://github.com/dmitry-shibanov) in [#​927](https://github.com/actions/setup-node/pull/927) #### New Contributors - [@​ThisIsManta](https://github.com/ThisIsManta) made their first contribution in [#​921](https://github.com/actions/setup-node/pull/921) **Full Changelog**: <https://github.com/actions/setup-node/compare/v4.0.1...v4.0.2> ### [`v4.0.1`](https://github.com/actions/setup-node/releases/tag/v4.0.1) [Compare Source](https://github.com/actions/setup-node/compare/v4...v4.0.1) #### What's Changed - Ignore engines in Yarn 1 e2e-cache tests by [@​trivikr](https://github.com/trivikr) in [#​882](https://github.com/actions/setup-node/pull/882) - Update setup-node references in the README.md file to setup-node\@​v4 by [@​jwetzell](https://github.com/jwetzell) in [#​884](https://github.com/actions/setup-node/pull/884) - Update reusable workflows to use Node.js v20 by [@​MaksimZhukov](https://github.com/MaksimZhukov) in [#​889](https://github.com/actions/setup-node/pull/889) - Add fix for cache to resolve slow post action step by [@​aparnajyothi-y](https://github.com/aparnajyothi-y) in [#​917](https://github.com/actions/setup-node/pull/917) - Fix README.md by [@​takayamaki](https://github.com/takayamaki) in [#​898](https://github.com/actions/setup-node/pull/898) - Add `package.json` to `node-version-file` list of examples. by [@​TWiStErRob](https://github.com/TWiStErRob) in [#​879](https://github.com/actions/setup-node/pull/879) - Fix node-version-file interprets entire package.json as a version by [@​NullVoxPopuli](https://github.com/NullVoxPopuli) in [#​865](https://github.com/actions/setup-node/pull/865) #### New Contributors - [@​trivikr](https://github.com/trivikr) made their first contribution in [#​882](https://github.com/actions/setup-node/pull/882) - [@​jwetzell](https://github.com/jwetzell) made their first contribution in [#​884](https://github.com/actions/setup-node/pull/884) - [@​aparnajyothi-y](https://github.com/aparnajyothi-y) made their first contribution in [#​917](https://github.com/actions/setup-node/pull/917) - [@​takayamaki](https://github.com/takayamaki) made their first contribution in [#​898](https://github.com/actions/setup-node/pull/898) - [@​TWiStErRob](https://github.com/TWiStErRob) made their first contribution in [#​879](https://github.com/actions/setup-node/pull/879) - [@​NullVoxPopuli](https://github.com/NullVoxPopuli) made their first contribution in [#​865](https://github.com/actions/setup-node/pull/865) **Full Changelog**: <https://github.com/actions/setup-node/compare/v4...v4.0.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/991 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
7b5ebe9618 |
fix(deps): update module connectrpc.com/connect to v1.20.0 (#985)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `v1.19.2` → `v1.20.0` |  |  | --- ### Release Notes <details> <summary>connectrpc/connect-go (connectrpc.com/connect)</summary> ### [`v1.20.0`](https://github.com/connectrpc/connect-go/releases/tag/v1.20.0) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.19.2...v1.20.0) #### What's Changed ##### Other changes - Bump minimum supported Go version to 1.25 by [@​jonbodner-buf](https://github.com/jonbodner-buf) in [#​922](https://github.com/connectrpc/connect-go/issues/922) - Update Unary-Get query parameter order to match spec recommendation by [@​oliversun9](https://github.com/oliversun9) in [#​926](https://github.com/connectrpc/connect-go/issues/926) #### New Contributors - [@​jonbodner-buf](https://github.com/jonbodner-buf) made their first contribution in [#​922](https://github.com/connectrpc/connect-go/issues/922) **Full Changelog**: <https://github.com/connectrpc/connect-go/compare/v1.19.2...v1.20.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODYuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Ni4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/985 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
10475db58a |
fix(deps): update module github.com/docker/cli to v29.5.1+incompatible (#979)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.5.0+incompatible` → `v29.5.1+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.5.1+incompatible`](https://github.com/docker/cli/compare/v29.5.0...v29.5.1) [Compare Source](https://github.com/docker/cli/compare/v29.5.0...v29.5.1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/979 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
9e738c203c |
fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 (#980)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.19.0` → `v5.19.1` |  |  | --- ### Release Notes <details> <summary>go-git/go-git (github.com/go-git/go-git/v5)</summary> ### [`v5.19.1`](https://github.com/go-git/go-git/releases/tag/v5.19.1) [Compare Source](https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1) #### What's Changed - v5: plumbing: transport/ssh, Shell-quote path by [@​hiddeco](https://github.com/hiddeco) in [#​2068](https://github.com/go-git/go-git/pull/2068) - v5: git: submodule, Fix relative URL resolution by [@​hiddeco](https://github.com/hiddeco) in [#​2070](https://github.com/go-git/go-git/pull/2070) - v5: git: submodule, canonical remote for relative URLs by [@​hiddeco](https://github.com/hiddeco) in [#​2074](https://github.com/go-git/go-git/pull/2074) - v5: git: submodule, error on remote without URLs by [@​hiddeco](https://github.com/hiddeco) in [#​2078](https://github.com/go-git/go-git/pull/2078) - v5: plumbing: format/idxfile, Validate offset64 indices by [@​hiddeco](https://github.com/hiddeco) in [#​2084](https://github.com/go-git/go-git/pull/2084) - v5: \*: Reject malformed variable-length integers by [@​hiddeco](https://github.com/hiddeco) in [#​2092](https://github.com/go-git/go-git/pull/2092) - v5: plumbing: format/packfile, Tighten delta validation by [@​hiddeco](https://github.com/hiddeco) in [#​2091](https://github.com/go-git/go-git/pull/2091) - v5: Add `worktreeFilesystem` wrapper for worktree and hardening by [@​hiddeco](https://github.com/hiddeco) in [#​2100](https://github.com/go-git/go-git/pull/2100) - v5: config: validate submodule names by [@​hiddeco](https://github.com/hiddeco) in [#​2082](https://github.com/go-git/go-git/pull/2082) - build: Update module github.com/go-git/go-git/v5 to v5.19.0 \[SECURITY] (releases/v5.x) by [@​go-git-renovate](https://github.com/go-git-renovate)\[bot] in [#​2111](https://github.com/go-git/go-git/pull/2111) - v5: git: Allow MkdirAll on worktree-root paths by [@​hiddeco](https://github.com/hiddeco) in [#​2117](https://github.com/go-git/go-git/pull/2117) - v5: git: Stop validating symlink target paths by [@​pjbgf](https://github.com/pjbgf) in [#​2116](https://github.com/go-git/go-git/pull/2116) - v5: plumbing: format decoder input bounds and contracts by [@​hiddeco](https://github.com/hiddeco) in [#​2125](https://github.com/go-git/go-git/pull/2125) - plumbing: format/packfile, cap delta chain depth in parser by [@​pjbgf](https://github.com/pjbgf) in [#​2137](https://github.com/go-git/go-git/pull/2137) **Full Changelog**: <https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/980 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
880e9755d9 |
chore(deps): update workflow dependencies (major) (#968)
Reviewed-on: https://gitea.com/gitea/runner/pulls/968 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
8d7cf48a6f |
fix(deps): update module github.com/docker/cli to v29.5.0+incompatible (#969)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v29.4.3+incompatible` → `v29.5.0+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v29.5.0+incompatible`](https://github.com/docker/cli/compare/v29.4.3...v29.5.0) [Compare Source](https://github.com/docker/cli/compare/v29.4.3...v29.5.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzkuNCIsInVwZGF0ZWRJblZlciI6IjQzLjE3OS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/969 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
f23605c614 |
chore(deps): update workflow dependencies (major) (#967)
Reviewed-on: https://gitea.com/gitea/runner/pulls/967 Reviewed-by: techknowlogick <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
a1f13cb970 |
fix(deps): update module github.com/opencontainers/selinux to v1.14.1 (#955)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) | `v1.14.0` → `v1.14.1` |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/856) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMjAiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzAuMjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> Reviewed-on: https://gitea.com/gitea/runner/pulls/955 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
8088df52b9 |
fix(deps): update module golang.org/x/term to v0.43.0 (#948)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.42.0` → `v0.43.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.42.0...refs/tags/v0.43.0) |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/856) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjkuNCIsInVwZGF0ZWRJblZlciI6IjQzLjE2OS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/948 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
dff63b3ecc |
fix(deps): update module github.com/go-git/go-git/v5 to v5.19.0 (#934)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `v5.18.0` → `v5.19.0` |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/856) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/934 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
a5d9fe9651 |
fix(deps): update module github.com/opencontainers/selinux to v1.14.0 (#928)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux) | `v1.13.1` → `v1.14.0` |  |  | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/856) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjMuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE2My4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/928 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandLunny Xiao
|
dfeb463904 |
chore(deps): update docker docker tag to v29 (#924)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | docker | stage | major | `28-dind-rootless` → `29-dind-rootless` | | docker | stage | major | `28-dind` → `29-dind` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/856) for more information. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjAuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE2MC42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/924 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
b68ecf2580 |
chore(deps): update crazy-max/ghaction-import-gpg action to v7 (#923)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [crazy-max/ghaction-import-gpg](https://github.com/crazy-max/ghaction-import-gpg) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>crazy-max/ghaction-import-gpg (crazy-max/ghaction-import-gpg)</summary> ### [`v7`](https://github.com/crazy-max/ghaction-import-gpg/compare/v7.0.0...v7.0.0) [Compare Source](https://github.com/crazy-max/ghaction-import-gpg/compare/v7.0.0...v7.0.0) ### [`v7.0.0`](https://github.com/crazy-max/ghaction-import-gpg/releases/tag/v7.0.0) [Compare Source](https://github.com/crazy-max/ghaction-import-gpg/compare/v6.3.0...v7.0.0) - Node 24 as default runtime (requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later) by [@​crazy-max](https://github.com/crazy-max) in [#​241](https://github.com/crazy-max/ghaction-import-gpg/pull/241) - Switch to ESM and update config/test wiring by [@​crazy-max](https://github.com/crazy-max) in [#​239](https://github.com/crazy-max/ghaction-import-gpg/pull/239) - Bump [@​actions/core](https://github.com/actions/core) from 1.11.1 to 3.0.0 in [#​232](https://github.com/crazy-max/ghaction-import-gpg/pull/232) - Bump [@​actions/exec](https://github.com/actions/exec) from 1.1.1 to 3.0.0 in [#​242](https://github.com/crazy-max/ghaction-import-gpg/pull/242) - Bump brace-expansion from 1.1.11 to 1.1.12 in [#​221](https://github.com/crazy-max/ghaction-import-gpg/pull/221) - Bump minimatch from 3.1.2 to 3.1.5 in [#​240](https://github.com/crazy-max/ghaction-import-gpg/pull/240) - Bump openpgp from 6.1.0 to 6.3.0 in [#​233](https://github.com/crazy-max/ghaction-import-gpg/pull/233) **Full Changelog**: <https://github.com/crazy-max/ghaction-import-gpg/compare/v6.3.0...v7.0.0> ### [`v6.3.0`](https://github.com/crazy-max/ghaction-import-gpg/releases/tag/v6.3.0) [Compare Source](https://github.com/crazy-max/ghaction-import-gpg/compare/v6.2.0...v6.3.0) - Bump openpgp from 5.11.2 to 6.1.0 in [#​215](https://github.com/crazy-max/ghaction-import-gpg/pull/215) - Bump cross-spawn from 7.0.3 to 7.0.6 in [#​212](https://github.com/crazy-max/ghaction-import-gpg/pull/212) **Full Changelog**: <https://github.com/crazy-max/ghaction-import-gpg/compare/v6.2.0...v6.3.0> ### [`v6.2.0`](https://github.com/crazy-max/ghaction-import-gpg/releases/tag/v6.2.0) [Compare Source](https://github.com/crazy-max/ghaction-import-gpg/compare/v6.1.0...v6.2.0) - Bump [@​actions/core](https://github.com/actions/core) from 1.10.1 to 1.11.1 in [#​209](https://github.com/crazy-max/ghaction-import-gpg/pull/209) - Bump braces from 3.0.2 to 3.0.3 in [#​203](https://github.com/crazy-max/ghaction-import-gpg/pull/203) - Bump ip from 2.0.0 to 2.0.1 in [#​196](https://github.com/crazy-max/ghaction-import-gpg/pull/196) - Bump micromatch from 4.0.4 to 4.0.8 in [#​207](https://github.com/crazy-max/ghaction-import-gpg/pull/207) - Bump openpgp from 5.11.0 to 5.11.2 in [#​205](https://github.com/crazy-max/ghaction-import-gpg/pull/205) - Bump tar from 6.1.14 to 6.2.1 in [#​198](https://github.com/crazy-max/ghaction-import-gpg/pull/198) **Full Changelog**: <https://github.com/crazy-max/ghaction-import-gpg/compare/v6.1.0...v6.2.0> ### [`v6.1.0`](https://github.com/crazy-max/ghaction-import-gpg/releases/tag/v6.1.0) [Compare Source](https://github.com/crazy-max/ghaction-import-gpg/compare/v6...v6.1.0) - Bump [@​actions/core](https://github.com/actions/core) from 1.10.0 to 1.10.1 in [#​186](https://github.com/crazy-max/ghaction-import-gpg/pull/186) - Bump [@​babel/traverse](https://github.com/babel/traverse) from 7.17.3 to 7.23.2 in [#​191](https://github.com/crazy-max/ghaction-import-gpg/pull/191) - Bump debug from 4.1.1 to 4.3.4 in [#​190](https://github.com/crazy-max/ghaction-import-gpg/pull/190) - Bump openpgp from 5.10.1 to 5.11.0 in [#​192](https://github.com/crazy-max/ghaction-import-gpg/pull/192) **Full Changelog**: <https://github.com/crazy-max/ghaction-import-gpg/compare/v6.0.0...v6.1.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjAuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE2MC42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/923 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
d1434237c2 |
fix(deps): update module golang.org/x/term to v0.42.0 (#920)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/term](https://pkg.go.dev/golang.org/x/term) | [`v0.41.0` → `v0.42.0`](https://cs.opensource.google/go/x/term/+/refs/tags/v0.41.0...refs/tags/v0.42.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [x] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjAuNCIsInVwZGF0ZWRJblZlciI6IjQzLjE2MC40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/920 Reviewed-by: Nicolas <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
35c65e2b14 |
chore(deps): update actions/hello-world-docker-action action to v2 (#921)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/hello-world-docker-action](https://github.com/actions/hello-world-docker-action) | action | major | `v1` → `v2` | --- ### Release Notes <details> <summary>actions/hello-world-docker-action (actions/hello-world-docker-action)</summary> ### [`v2`](https://github.com/actions/hello-world-docker-action/releases/tag/v2): Version v2 [Compare Source](https://github.com/actions/hello-world-docker-action/compare/v1...v2) Update action to use the new environment file method for setting outputs. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjAuNCIsInVwZGF0ZWRJblZlciI6IjQzLjE2MC40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/921 Reviewed-by: Nicolas <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandNicolas
|
68d9fc45c9 |
chore(deps): update dependency @vercel/ncc to ^0.38.0 (#881)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@vercel/ncc](https://github.com/vercel/ncc) | [`^0.24.1` → `^0.38.0`](https://renovatebot.com/diffs/npm/@vercel%2fncc/0.24.1/0.38.4) |  |  | --- ### Release Notes <details> <summary>vercel/ncc (@​vercel/ncc)</summary> ### [`v0.38.4`](https://github.com/vercel/ncc/releases/tag/0.38.4) [Compare Source](https://github.com/vercel/ncc/compare/0.38.3...0.38.4) ##### Bug Fixes - **cjs-build:** enable evaluating import.meta in cjs build ([#​1236](https://github.com/vercel/ncc/issues/1236)) ([e72d34d](https://github.com/vercel/ncc/commit/e72d34d97e7cb2348af19993b6cdb6fec5374ac9)), closes [/github.com/vercel/ncc/pull/897#discussion\_r836916315](https://github.com//github.com/vercel/ncc/pull/897/issues/discussion_r836916315) [#​1019](https://github.com/vercel/ncc/issues/1019) ### [`v0.38.3`](https://github.com/vercel/ncc/releases/tag/0.38.3) [Compare Source](https://github.com/vercel/ncc/compare/0.38.2...0.38.3) ##### Bug Fixes - add missing `--asset-builds` to cli help message ([#​1228](https://github.com/vercel/ncc/issues/1228)) ([84f8c52](https://github.com/vercel/ncc/commit/84f8c52872621be2fe45d7d837f1e4cc06e8a490)) ### [`v0.38.2`](https://github.com/vercel/ncc/releases/tag/0.38.2) [Compare Source](https://github.com/vercel/ncc/compare/0.38.1...0.38.2) ##### Bug Fixes - **deps:** update webpack to v5.94.0, terser to v5.33.0 ([#​1213](https://github.com/vercel/ncc/issues/1213)) ([158a1fd](https://github.com/vercel/ncc/commit/158a1fdcbc32d198a9a0a09d477c9559e7219ed0)), closes [#​1193](https://github.com/vercel/ncc/issues/1193) [#​1194](https://github.com/vercel/ncc/issues/1194) [#​1177](https://github.com/vercel/ncc/issues/1177) [#​1204](https://github.com/vercel/ncc/issues/1204) [#​1195](https://github.com/vercel/ncc/issues/1195) Huge thanks to [@​theoludwig](https://github.com/theoludwig) 🎉 ### [`v0.38.1`](https://github.com/vercel/ncc/releases/tag/0.38.1) [Compare Source](https://github.com/vercel/ncc/compare/0.38.0...0.38.1) ##### Bug Fixes - sourcemap sources removes webpack path ([#​1122](https://github.com/vercel/ncc/issues/1122)) ([ce5984e](https://github.com/vercel/ncc/commit/ce5984e4b07103b4e1123539ebb9fb82daf1344d)), closes [#​1011](https://github.com/vercel/ncc/issues/1011) [#​1121](https://github.com/vercel/ncc/issues/1121) ### [`v0.38.0`](https://github.com/vercel/ncc/releases/tag/0.38.0) [Compare Source](https://github.com/vercel/ncc/compare/0.37.0...0.38.0) ##### Features - Log minification error when `--debug` ([#​1102](https://github.com/vercel/ncc/issues/1102)) ([e2779f4](https://github.com/vercel/ncc/commit/e2779f42031569f9b4b47bb8a302f48ef852405b)) ### [`v0.37.0`](https://github.com/vercel/ncc/releases/tag/0.37.0) [Compare Source](https://github.com/vercel/ncc/compare/0.36.1...0.37.0) ##### Features - add support for TypeScript 5.0's array extends in tsconfig ([#​1105](https://github.com/vercel/ncc/issues/1105)) ([f898f8e](https://github.com/vercel/ncc/commit/f898f8ea85f940208925dfd2e2162b9de8d4843e)) ### [`v0.36.1`](https://github.com/vercel/ncc/releases/tag/0.36.1) [Compare Source](https://github.com/vercel/ncc/compare/0.36.0...0.36.1) ##### Bug Fixes - add missing pr title lint action ([#​1032](https://github.com/vercel/ncc/issues/1032)) ([c2d03cf](https://github.com/vercel/ncc/commit/c2d03cf6dbf24e1f06f9e3f4448b76718a7c44e4)) - add `ncc --version` and `ncc --help` ([#​1030](https://github.com/vercel/ncc/issues/1030)) ([d38b619](https://github.com/vercel/ncc/commit/d38b61955476b960242a540f26c24a994f241185)) ### [`v0.36.0`](https://github.com/vercel/ncc/releases/tag/0.36.0) [Compare Source](https://github.com/vercel/ncc/compare/0.34.0...0.36.0) ##### Bug Fixes - gitignore should include release.config.js ([#​1016](https://github.com/vercel/ncc/issues/1016)) ([44e2eac](https://github.com/vercel/ncc/commit/44e2eac6c966f2f5a2404fcf33a575f2a918ab24)) - node 18 by update source-map used by Terser to 0.7.4 ([#​999](https://github.com/vercel/ncc/issues/999)) ([2f69f83](https://github.com/vercel/ncc/commit/2f69f838aa7387018dc8760b79ae99e613c45874)) ##### Features - add semantic-release to autopublish ([#​1015](https://github.com/vercel/ncc/issues/1015)) ([be3405d](https://github.com/vercel/ncc/commit/be3405dbc36c862d2e79f43478b56bc4dd1df200)), closes [#​1000](https://github.com/vercel/ncc/issues/1000) ### [`v0.34.0`](https://github.com/vercel/ncc/releases/tag/0.34.0) [Compare Source](https://github.com/vercel/ncc/compare/0.33.4...0.34.0) ##### Changes Add support for TS 4.7 - Chore(deps-dev): bump ts-loader from 8.3.0 to 9.3.0: [#​921](https://github.com/vercel/ncc/issues/921) - Chore(deps-dev): bump express from 4.17.1 to 4.18.1: [#​917](https://github.com/vercel/ncc/issues/917) - Chore: add `memory-fs` to the devDependencies: [#​927](https://github.com/vercel/ncc/issues/927) ##### Credits Huge thanks to [@​stscoundrel](https://github.com/stscoundrel) and [@​shogo82148](https://github.com/shogo82148) for helping! ### [`v0.33.4`](https://github.com/vercel/ncc/releases/tag/0.33.4) [Compare Source](https://github.com/vercel/ncc/compare/0.33.3...0.33.4) ##### Changes - Fix: Add missing variable declaration: [#​773](https://github.com/vercel/ncc/issues/773) - Chore: add windows to CI: [#​896](https://github.com/vercel/ncc/issues/896) - Chore: bump webpack-asset-relocator-loader to 1.7.2: [#​912](https://github.com/vercel/ncc/issues/912) - Chore(deps-dev): bump vm2 from 3.9.4 to 3.9.6: [#​872](https://github.com/vercel/ncc/issues/872) - Chore(deps): bump url-parse from 1.5.3 to 1.5.7: [#​875](https://github.com/vercel/ncc/issues/875) - Chore(deps): bump url-parse from 1.5.7 to 1.5.10: [#​879](https://github.com/vercel/ncc/issues/879) - Chore(deps-dev): bump stripe from 8.167.0 to 8.205.0: [#​882](https://github.com/vercel/ncc/issues/882) - Chore(deps-dev): bump typescript from 4.4.2 to 4.6.2: [#​881](https://github.com/vercel/ncc/issues/881) - Chore(deps-dev): bump twilio from 3.66.1 to 3.75.0: [#​884](https://github.com/vercel/ncc/issues/884) - Chore(deps): bump actions/setup-node from 2 to 3: [#​880](https://github.com/vercel/ncc/issues/880) - Chore(deps-dev): bump graphql from 15.5.1 to 15.8.0: [#​885](https://github.com/vercel/ncc/issues/885) - Chore: replace deprecated String.prototype.substr(): [#​894](https://github.com/vercel/ncc/issues/894) - Chore(deps): bump actions/checkout from 2 to 3: [#​902](https://github.com/vercel/ncc/issues/902) - Chore(deps-dev): bump [@​azure/cosmos](https://github.com/azure/cosmos) from 3.12.3 to 3.15.1: [#​905](https://github.com/vercel/ncc/issues/905) - Chore(deps-dev): bump stripe from 8.205.0 to 8.214.0: [#​906](https://github.com/vercel/ncc/issues/906) - Chore(deps-dev): bump [@​google-cloud/bigquery](https://github.com/google-cloud/bigquery) from 5.7.0 to 5.12.0: [#​903](https://github.com/vercel/ncc/issues/903) - Chore(deps-dev): bump tsconfig-paths from 3.10.1 to 3.14.1: [#​904](https://github.com/vercel/ncc/issues/904) ##### Credits Huge thanks to [@​CommanderRoot](https://github.com/CommanderRoot) for helping! ### [`v0.33.3`](https://github.com/vercel/ncc/releases/tag/0.33.3) [Compare Source](https://github.com/vercel/ncc/compare/0.33.2...0.33.3) ##### Patches - Fix: bump license-webpack-plugin: [#​871](https://github.com/vercel/ncc/issues/871) - Chore(deps): bump follow-redirects from 1.14.7 to 1.14.8: [#​870](https://github.com/vercel/ncc/issues/870) ### [`v0.33.2`](https://github.com/vercel/ncc/releases/tag/0.33.2) [Compare Source](https://github.com/vercel/ncc/compare/0.33.1...0.33.2) ##### Patches - Fix: use `sha256` instead of deprecated `md5` for hash algorithm: [#​868](https://github.com/vercel/ncc/issues/868) - Fix: typo in build script: [#​835](https://github.com/vercel/ncc/issues/835) - Chore(test) Add Node.js 16 to CI: [#​801](https://github.com/vercel/ncc/issues/801) - Chore(deps): bump nodemailer from 6.5.0 to 6.7.2: [#​833](https://github.com/vercel/ncc/issues/833) - Chore(deps-dev): bump terser from 5.7.1 to 5.10.0: [#​840](https://github.com/vercel/ncc/issues/840) - Chore(deps-dev): bump passport from 0.4.1 to 0.5.2: [#​839](https://github.com/vercel/ncc/issues/839) - Chore(deps-dev): bump sequelize from 6.6.5 to 6.12.4: [#​843](https://github.com/vercel/ncc/issues/843) - Chore(deps-dev): bump analytics-node from 5.0.0 to 6.0.0: [#​838](https://github.com/vercel/ncc/issues/838) - Chore(deps): bump follow-redirects from 1.14.5 to 1.14.7: [#​846](https://github.com/vercel/ncc/issues/846) - Chore(deps): bump cached-path-relative from 1.0.2 to 1.1.0: [#​854](https://github.com/vercel/ncc/issues/854) - Chore(deps-dev): bump license-webpack-plugin from 2.3.20 to 4.0.1: [#​859](https://github.com/vercel/ncc/issues/859) - Chore(deps): bump simple-get from 3.1.0 to 3.1.1: [#​864](https://github.com/vercel/ncc/issues/864) - Chore(deps-dev): bump aws-sdk from 2.1024.0 to 2.1068.0: [#​867](https://github.com/vercel/ncc/issues/867) ##### Credits Huge thanks to [@​shakefu](https://github.com/shakefu) for helping! ### [`v0.33.1`](https://github.com/vercel/ncc/releases/tag/0.33.1) [Compare Source](https://github.com/vercel/ncc/compare/0.33.0...0.33.1) ##### Patches - Allow configuring mainFields for nccing browser modules: [#​832](https://github.com/vercel/ncc/issues/832) ### [`v0.33.0`](https://github.com/vercel/ncc/releases/tag/0.33.0) [Compare Source](https://github.com/vercel/ncc/compare/0.32.0...0.33.0) ##### Minor Changes - Chore(deps-dev): bump [@​vercel/webpack-asset-relocator-loader](https://github.com/vercel/webpack-asset-relocator-loader): [#​826](https://github.com/vercel/ncc/issues/826) - Fix: Fix source maps: [#​818](https://github.com/vercel/ncc/issues/818) - Feat: Allow using matches from externals for regex matching: [#​825](https://github.com/vercel/ncc/issues/825) ##### Patches - Chore(deps-dev): bump koa from 2.13.1 to 2.13.4: [#​822](https://github.com/vercel/ncc/issues/822) - Chore(deps-dev): bump mariadb from 2.5.4 to 2.5.5: [#​823](https://github.com/vercel/ncc/issues/823) ##### Credits Huge thanks to [@​fenix20113](https://github.com/fenix20113) for helping! ### [`v0.32.0`](https://github.com/vercel/ncc/releases/tag/0.32.0) [Compare Source](https://github.com/vercel/ncc/compare/0.31.1...0.32.0) ##### Changes - Feat: bump to webpack\@​5.61.0: [#​809](https://github.com/vercel/ncc/issues/809) - Docs: add debug command description: [#​800](https://github.com/vercel/ncc/issues/800) - Chore(deps): bump object-path from 0.11.7 to 0.11.8: [#​778](https://github.com/vercel/ncc/issues/778) - Chore(deps): bump tmpl from 1.0.4 to 1.0.5: [#​779](https://github.com/vercel/ncc/issues/779) - Chore(deps-dev): bump vm2 from 3.9.3 to 3.9.4: [#​795](https://github.com/vercel/ncc/issues/795) - Chore(deps-dev): bump axios from 0.21.1 to 0.21.2: [#​810](https://github.com/vercel/ncc/issues/810) - Chore(deps-dev): bump aws-sdk from 2.958.0 to 2.1024.0: [#​812](https://github.com/vercel/ncc/issues/812) - Chore(deps-dev): bump webpack from 5.61.0 to 5.62.1: [#​813](https://github.com/vercel/ncc/issues/813) - Chore(deps): bump passport-oauth2 from 1.5.0 to 1.6.1: [#​811](https://github.com/vercel/ncc/issues/811) - Chore(deps): bump url-parse from 1.5.1 to 1.5.3: [#​815](https://github.com/vercel/ncc/issues/815) ##### Credits Huge thanks to [@​fireairforce](https://github.com/fireairforce) and [@​jesec](https://github.com/jesec) for helping! ### [`v0.31.1`](https://github.com/vercel/ncc/releases/tag/0.31.1) [Compare Source](https://github.com/vercel/ncc/compare/0.31.0...0.31.1) ##### Patches - Fix `tsconfig.json` detection: [#​770](https://github.com/vercel/ncc/issues/770) ### [`v0.31.0`](https://github.com/vercel/ncc/releases/tag/0.31.0) [Compare Source](https://github.com/vercel/ncc/compare/0.30.0...0.31.0) ##### Changes - Fix `compilerOptions` from `tsconfig.json`: [#​766](https://github.com/vercel/ncc/issues/766) - Bump typescript to 4.4.2: [#​767](https://github.com/vercel/ncc/issues/767) - Chore(deps-dev): bump graceful-fs from 4.2.6 to 4.2.8: [#​761](https://github.com/vercel/ncc/issues/761) - Chore(deps): bump tar from 4.4.15 to 4.4.19: [#​763](https://github.com/vercel/ncc/issues/763) - Chore(deps): bump object-path from 0.11.5 to 0.11.7: [#​764](https://github.com/vercel/ncc/issues/764) ### [`v0.30.0`](https://github.com/vercel/ncc/releases/tag/0.30.0) [Compare Source](https://github.com/vercel/ncc/compare/0.29.2...0.30.0) ##### Changes - Major: Change asset builds to opt-in with new option `--asset-builds`: [#​756](https://github.com/vercel/ncc/issues/756) - Chore: bump typescript from 3.9.9 to 4.3.5: [#​739](https://github.com/vercel/ncc/issues/739) - Chore: bump codecov to 3.8.3: [#​752](https://github.com/vercel/ncc/issues/752) ##### Description Previous, `fs.readFile('./asset.js')` would compile `asset.js` instead of including as an asset. With this release, the default behavior has been changed to include `asset.js` as an asset only. If you want the old behavior, you can use the `--asset-builds` option. ##### Credits Huge thanks to [@​guybedford](https://github.com/guybedford) for helping! ### [`v0.29.2`](https://github.com/vercel/ncc/releases/tag/0.29.2) [Compare Source](https://github.com/vercel/ncc/compare/0.29.1...0.29.2) ##### Patches - Fix: ensure nested builds of `__nccwpck_require__`: [#​751](https://github.com/vercel/ncc/issues/751) ##### Credits Huge thanks to [@​guybedford](https://github.com/guybedford) for helping! ### [`v0.29.1`](https://github.com/vercel/ncc/releases/tag/0.29.1) [Compare Source](https://github.com/vercel/ncc/compare/0.29.0...0.29.1) ##### Patches - Fix: add stringify-loader: [#​742](https://github.com/vercel/ncc/issues/742) - Fix: package.json asset type module setting: [#​733](https://github.com/vercel/ncc/issues/733) - Chore(deps): update dependencies: [#​736](https://github.com/vercel/ncc/issues/736) - Chore(deps): bump tar from 4.4.13 to 4.4.15: [#​743](https://github.com/vercel/ncc/issues/743) - Chore(deps): bump path-parse from 1.0.6 to 1.0.7: [#​745](https://github.com/vercel/ncc/issues/745) - Chore(deps-dev): bump pdfkit from 0.12.1 to 0.12.3: [#​740](https://github.com/vercel/ncc/issues/740) ##### Credits Huge thanks to [@​guybedford](https://github.com/guybedford), [@​mmorel-35](https://github.com/mmorel-35), and [@​jpcloureiro](https://github.com/jpcloureiro) for helping! ### [`v0.29.0`](https://github.com/vercel/ncc/releases/tag/0.29.0) [Compare Source](https://github.com/vercel/ncc/compare/0.28.6...0.29.0) ##### Changes - Major: output ESM for `.mjs` or `type=module` builds: [#​720](https://github.com/vercel/ncc/issues/720) - Feat: update to webpack-asset-reloactor-loader\@​1.5.0: [#​718](https://github.com/vercel/ncc/issues/718) - Feat: update to webpack\@​5.42.0: [#​723](https://github.com/vercel/ncc/issues/723) - Feat: update to webpack\@​5.43.0: [#​724](https://github.com/vercel/ncc/issues/724) - Chore: bump set-getter from 0.1.0 to 0.1.1: [#​719](https://github.com/vercel/ncc/issues/719) - Fix: typo in readme: [#​712](https://github.com/vercel/ncc/issues/712) ##### Credits Huge thanks to [@​rethab](https://github.com/rethab) and [@​guybedford](https://github.com/guybedford) for helping! ### [`v0.28.6`](https://github.com/vercel/ncc/releases/tag/0.28.6) [Compare Source](https://github.com/vercel/ncc/compare/0.28.5...0.28.6) ##### Patches - Fix: Update to webpack\@​5.36.2: [#​707](https://github.com/vercel/ncc/issues/707) - Fix: Update ts-loader to fix webpack warning: [#​710](https://github.com/vercel/ncc/issues/710) - Deps: Bump hosted-git-info from 2.8.8 to 2.8.9: [#​708](https://github.com/vercel/ncc/issues/708) ##### Credits Huge thanks to [@​adriencohen](https://github.com/adriencohen) and [@​huozhi](https://github.com/huozhi) for helping! ### [`v0.28.5`](https://github.com/vercel/ncc/releases/tag/0.28.5) [Compare Source](https://github.com/vercel/ncc/compare/0.28.4...0.28.5) ##### Patches - Fix: handle terser error: [#​703](https://github.com/vercel/ncc/issues/703) - Fix: treat compilation.errors as a set: [#​705](https://github.com/vercel/ncc/issues/705) - Fix: unify `target` arg description, add `transpile-only` arg to readme: [#​702](https://github.com/vercel/ncc/issues/702) ##### Credits Huge thanks to [@​guybedford](https://github.com/guybedford) and [@​Simek](https://github.com/Simek) for helping! ### [`v0.28.4`](https://github.com/vercel/ncc/releases/tag/0.28.4) [Compare Source](https://github.com/vercel/ncc/compare/0.28.3...0.28.4) ##### Patches - Fix: Adjust caching to use hashes: [#​698](https://github.com/vercel/ncc/issues/698) - Fix: support top-level await: [#​700](https://github.com/vercel/ncc/issues/700) - Fix: publish should build without cache: [#​701](https://github.com/vercel/ncc/issues/701) - Chore: redis from 2.8.0 to 3.1.1: [#​699](https://github.com/vercel/ncc/issues/699) - Chore: Bump ssri from 6.0.1 to 6.0.2: [#​695](https://github.com/vercel/ncc/issues/695) - Chore: rename master to main: [#​694](https://github.com/vercel/ncc/issues/694) ##### Credits Huge thanks to [@​guybedford](https://github.com/guybedford) for helping! ### [`v0.28.3`](https://github.com/vercel/ncc/releases/tag/0.28.3) [Compare Source](https://github.com/vercel/ncc/compare/0.28.2...0.28.3) ##### Patches - Fix: lock license plugin version: [#​692](https://github.com/vercel/ncc/issues/692) ##### Credits Huge thanks to [@​huozhi](https://github.com/huozhi) for helping! ### [`v0.28.2`](https://github.com/vercel/ncc/releases/tag/0.28.2) [Compare Source](https://github.com/vercel/ncc/compare/0.28.1...0.28.2) ##### Patches - Fix: unknown compiler option `incremental`: [#​685](https://github.com/vercel/ncc/issues/685) - Fix: replace .npmignore with "files" prop: [#​688](https://github.com/vercel/ncc/issues/688) ##### Credits Huge thanks to [@​Songkeys](https://github.com/Songkeys) for helping! ### [`v0.28.1`](https://github.com/vercel/ncc/releases/tag/0.28.1) [Compare Source](https://github.com/vercel/ncc/compare/0.28.0...0.28.1) ##### Patches - Fix: Rebuild bundle to fix [#​684](https://github.com/vercel/ncc/issues/684) - Deps: Bump codecov to 3.8.1: [#​683](https://github.com/vercel/ncc/issues/683) ### [`v0.28.0`](https://github.com/vercel/ncc/releases/tag/0.28.0) [Compare Source](https://github.com/vercel/ncc/compare/0.27.0...0.28.0) ##### Minor Changes - Feat: `exports` conditions semantics: [#​665](https://github.com/vercel/ncc/issues/665) - Feat: `imports` support, webpack upgrade: [#​672](https://github.com/vercel/ncc/issues/672) - Feat: Support Regexp externals: [#​654](https://github.com/vercel/ncc/issues/654) - Fix: TS interop test and fix: [#​671](https://github.com/vercel/ncc/issues/671) - Fix: Upgrade local TS: [#​674](https://github.com/vercel/ncc/issues/674) - Chore: Interop test case: [#​667](https://github.com/vercel/ncc/issues/667) - Chore: add console output when minifying fails: [#​648](https://github.com/vercel/ncc/issues/648) - Chore: Add Node.js 14 to CI: [#​659](https://github.com/vercel/ncc/issues/659) - Docs: Fix out \[file] → out \[dir]: [#​675](https://github.com/vercel/ncc/issues/675) - Deps: Update to webpack\@​5.30.0: [#​681](https://github.com/vercel/ncc/issues/681) - Deps: Update to webpack\@​5.26.3: [#​664](https://github.com/vercel/ncc/issues/664) - Deps: Update to webpack\@​5.24.4: [#​658](https://github.com/vercel/ncc/issues/658) - Deps: Update to webpack-asset-relocator-loader\@​1.3.0: [#​682](https://github.com/vercel/ncc/issues/682) - Deps: Upgrade to webpack-asset-relocator-loader\@​1.2.4: [#​673](https://github.com/vercel/ncc/issues/673) - Deps: Update to webpack-asset-relocator\@​1.2.3: [#​662](https://github.com/vercel/ncc/issues/662) - Deps: Upgrade to terser\@​5.6.1: [#​669](https://github.com/vercel/ncc/issues/669) - Deps: Bump socket.io from 2.2.0 to 2.4.0: [#​645](https://github.com/vercel/ncc/issues/645) - Deps: Bump pug from 2.0.3 to 3.0.1: [#​656](https://github.com/vercel/ncc/issues/656) - Deps: Bump elliptic from 6.5.3 to 6.5.4: [#​657](https://github.com/vercel/ncc/issues/657) - Deps: Bump msgpack5 from 4.2.1 to 4.5.1: [#​660](https://github.com/vercel/ncc/issues/660) - Deps: Bump y18n from 3.2.1 to 3.2.2: [#​678](https://github.com/vercel/ncc/issues/678) ##### Credits Huge thanks to [@​guybedford](https://github.com/guybedford), [@​Songkeys](https://github.com/Songkeys), [@​adriencohen](https://github.com/adriencohen), and [@​huozhi](https://github.com/huozhi) for helping! ### [`v0.27.0`](https://github.com/vercel/ncc/releases/tag/0.27.0) [Compare Source](https://github.com/vercel/ncc/compare/0.26.2...0.27.0) ##### Changes - Feat: support customEmit ncc option: [#​634](https://github.com/vercel/ncc/issues/634) - Fix: correct declaration output dir: [#​627](https://github.com/vercel/ncc/issues/627) - Update to webpack-asset-relocator\@​1.2.0: [#​640](https://github.com/vercel/ncc/issues/640) ##### Credits Huge thanks to [@​guybedford](https://github.com/guybedford) and [@​zeroooooooo](https://github.com/zeroooooooo) for helping! ### [`v0.26.2`](https://github.com/vercel/ncc/releases/tag/0.26.2) [Compare Source](https://github.com/vercel/ncc/compare/0.26.1...0.26.2) ##### Patches - Enable minification for sourcemap-register.js: [#​631](https://github.com/vercel/ncc/issues/631) - Avoid **webpack\_require** conflicts: [#​633](https://github.com/vercel/ncc/issues/633) - Bump axios from 0.18.1 to 0.21.1: [#​636](https://github.com/vercel/ncc/issues/636) - Fix: skip typechecking on sub-builds: [#​637](https://github.com/vercel/ncc/issues/637) ##### Credits Huge thanks to [@​xom9ikk](https://github.com/xom9ikk) and [@​guybedford](https://github.com/guybedford) for helping! ### [`v0.26.1`](https://github.com/vercel/ncc/releases/tag/0.26.1) [Compare Source](https://github.com/vercel/ncc/compare/0.26.0...0.26.1) ##### Patches - Ensure separate asset compilation states in subbuilds: [#​630](https://github.com/vercel/ncc/issues/630) ##### Credits Huge thanks to [@​guybedford](https://github.com/guybedford) for helping! ### [`v0.26.0`](https://github.com/vercel/ncc/releases/tag/0.26.0) [Compare Source](https://github.com/vercel/ncc/compare/0.25.1...0.26.0) ##### Changes - Asset subbundle builds: [#​625](https://github.com/vercel/ncc/issues/625) - Bump ini from 1.3.5 to 1.3.7: [#​624](https://github.com/vercel/ncc/issues/624) - Update example with missing TypeScript dependency: [#​623](https://github.com/vercel/ncc/issues/623) - Update readme with missing TS and ES options: [#​615](https://github.com/vercel/ncc/issues/615) ##### Credits Huge thanks to [@​restuwahyu13](https://github.com/restuwahyu13) and [@​guybedford](https://github.com/guybedford) for helping! ### [`v0.25.1`](https://github.com/vercel/ncc/releases/tag/0.25.1) [Compare Source](https://github.com/vercel/ncc/compare/0.25.0...0.25.1) ##### Changes - Allow passing `target`: [#​614](https://github.com/vercel/ncc/issues/614) ##### Credits Huge thanks to [@​ijjk](https://github.com/ijjk) for helping! ### [`v0.25.0`](https://github.com/vercel/ncc/releases/tag/0.25.0) [Compare Source](https://github.com/vercel/ncc/compare/0.24.1...0.25.0) ##### Changes - Bump `webpack` from `5.0.0-beta.28` to `5.2.0`: [#​602](https://github.com/vercel/ncc/issues/602) - Bump `npm-user-validate` from `1.0.0` to `1.0.1`: [#​604](https://github.com/vercel/ncc/issues/604) - Bump `object-path` from `0.11.4` to `0.11.5`: [#​607](https://github.com/vercel/ncc/issues/607) - Fix `--quiet` flag on ts build: [#​605](https://github.com/vercel/ncc/issues/605) - Add integration test for `@slack/web-api`: [#​591](https://github.com/vercel/ncc/issues/591) ##### Credits Huge thanks to [@​huozhi](https://github.com/huozhi) and [@​ataylorme](https://github.com/ataylorme) for helping! </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE1MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Nicolas <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/881 Reviewed-by: Nicolas <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
b1c873a66b |
chore(deps): update dependency @actions/core to v1.11.1 (#880)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@actions/core](https://github.com/actions/toolkit/tree/main/packages/core) ([source](https://github.com/actions/toolkit/tree/HEAD/packages/core)) | [`1.10.0` → `1.11.1`](https://renovatebot.com/diffs/npm/@actions%2fcore/1.10.0/1.11.1) |  |  | --- ### Release Notes <details> <summary>actions/toolkit (@​actions/core)</summary> ### [`v1.11.1`](https://github.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#1111) - Fix uses of `crypto.randomUUID` on Node 18 and earlier [#​1842](https://github.com/actions/toolkit/pull/1842) ##### 1.11.0 - Add platform info utilities [#​1551](https://github.com/actions/toolkit/pull/1551) - Remove dependency on `uuid` package [#​1824](https://github.com/actions/toolkit/pull/1824) ##### 1.10.1 - Fix error message reference in oidc utils [#​1511](https://github.com/actions/toolkit/pull/1511) ##### 1.10.0 - `saveState` and `setOutput` now use environment files if available [#​1178](https://github.com/actions/toolkit/pull/1178) - `getMultilineInput` now correctly trims whitespace by default [#​1185](https://github.com/actions/toolkit/pull/1185) ##### 1.9.1 - Randomize delimiter when calling `core.exportVariable` ##### 1.9.0 - Added `toPosixPath`, `toWin32Path` and `toPlatformPath` utilities [#​1102](https://github.com/actions/toolkit/pull/1102) ##### 1.8.2 - Update to v2.0.1 of `@actions/http-client` [#​1087](https://github.com/actions/toolkit/pull/1087) ##### 1.8.1 - Update to v2.0.0 of `@actions/http-client` ##### 1.8.0 - Deprecate `markdownSummary` extension export in favor of `summary` - [#​1072](https://github.com/actions/toolkit/pull/1072) - [#​1073](https://github.com/actions/toolkit/pull/1073) ##### 1.7.0 - [Added `markdownSummary` extension](https://github.com/actions/toolkit/pull/1014) ##### 1.6.0 - [Added OIDC Client function `getIDToken`](https://github.com/actions/toolkit/pull/919) - [Added `file` parameter to `AnnotationProperties`](https://github.com/actions/toolkit/pull/896) ##### 1.5.0 - [Added support for notice annotations and more annotation fields](https://github.com/actions/toolkit/pull/855) ##### 1.4.0 - [Added the `getMultilineInput` function](https://github.com/actions/toolkit/pull/829) ##### 1.3.0 - [Added the trimWhitespace option to getInput](https://github.com/actions/toolkit/pull/802) - [Added the getBooleanInput function](https://github.com/actions/toolkit/pull/725) ##### 1.2.7 - [Prepend newline for set-output](https://github.com/actions/toolkit/pull/772) ##### 1.2.6 - [Update `exportVariable` and `addPath` to use environment files](https://github.com/actions/toolkit/pull/571) ##### 1.2.5 - [Correctly bundle License File with package](https://github.com/actions/toolkit/pull/548) ##### 1.2.4 - [Be more lenient in accepting non-string command inputs](https://github.com/actions/toolkit/pull/405) - [Add Echo commands](https://github.com/actions/toolkit/pull/411) ##### 1.2.3 - [IsDebug logging](README.md#logging) ##### 1.2.2 - [Fix escaping for runner commands](https://github.com/actions/toolkit/pull/302) ##### 1.2.1 - [Remove trailing comma from commands](https://github.com/actions/toolkit/pull/263) - [Add "types" to package.json](https://github.com/actions/toolkit/pull/221) ##### 1.2.0 - saveState and getState functions for wrapper tasks (on finally entry points that run post job) ##### 1.1.3 - setSecret added to register a secret with the runner to be masked from the logs - exportSecret which was not implemented and never worked was removed after clarification from product. ##### 1.1.1 - Add support for action input variables with multiple spaces [#​127](https://github.com/actions/toolkit/issues/127) - Switched ## commands to :: commands (should have no noticeable impact) \[[#​110](https://github.com/actions/toolkit/issues/110))([#​110](https://github.com/actions/toolkit/pull/110)) ##### 1.1.0 - Added helpers for `group` and `endgroup` [#​98](https://github.com/actions/toolkit/pull/98) ##### 1.0.0 - Initial release ### [`v1.11.0`](https://github.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#1110) - Add platform info utilities [#​1551](https://github.com/actions/toolkit/pull/1551) - Remove dependency on `uuid` package [#​1824](https://github.com/actions/toolkit/pull/1824) ### [`v1.10.1`](https://github.com/actions/toolkit/blob/HEAD/packages/core/RELEASES.md#1101) - Fix error message reference in oidc utils [#​1511](https://github.com/actions/toolkit/pull/1511) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE1MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/runner/pulls/880 Reviewed-by: Nicolas <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate BotandLunny Xiao
|
1d6e7879c8 |
fix(deps): update module github.com/rhysd/actionlint to v1.7.12 (#873)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/rhysd/actionlint](https://github.com/rhysd/actionlint) | `v1.7.11` → `v1.7.12` |  |  | --- ### Release Notes <details> <summary>rhysd/actionlint (github.com/rhysd/actionlint)</summary> ### [`v1.7.12`](https://github.com/rhysd/actionlint/blob/HEAD/CHANGELOG.md#v1712---2026-03-30) [Compare Source](https://github.com/rhysd/actionlint/compare/v1.7.11...v1.7.12) - Support the [`timezone` configuration in `on.schedule`](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#onschedule) with checks for IANA timezone string. See the [documentation](https://github.com/rhysd/actionlint/blob/main/docs/checks.md#check-cron-syntax-and-timezone) for more details. Note that actionlint starts to embed the timezone database in the executables from this version so the binary sizes slightly increase. ([#​641](https://github.com/rhysd/actionlint/issues/641), thanks [@​martincostello](https://github.com/martincostello)) ```yaml on: schedule: # ERROR: The timezone is not a valid IANA timezone string - cron: '*/5 * * * *' timezone: 'Asia/Somewhere' ``` - Support the [`jobs.<job_name>.environment.deployment` configuration](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/control-deployments#using-environments-without-deployments). ([#​639](https://github.com/rhysd/actionlint/issues/639), thanks [@​springmeyer](https://github.com/springmeyer)) - Support the [`macos-26-intel` runner label](https://github.blog/changelog/2026-02-26-macos-26-is-now-generally-available-for-github-hosted-runners/). ([#​629](https://github.com/rhysd/actionlint/issues/629), thanks [@​hugovk](https://github.com/hugovk)) - Fix the [table of webhook activity types](https://github.com/rhysd/actionlint/blob/main/all_webhooks.go) are outdated by rebuilding the [script to scrape the table](https://github.com/rhysd/actionlint/tree/main/scripts/generate-webhook-events) from scratch. - Support Go 1.26 and drop the support for Go 1.24. Now supported versions are 1.25 and 1.26. - Tests are run on arm64 Windows in CI. - Update the popular actions data set to the latest. \[Changes]\[v1.7.12] <a id="v1.7.11"></a> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE1MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/runner/pulls/873 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
35834bf817 |
fix(deps): update module github.com/moby/patternmatcher to v0.6.1 (#868)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/moby/patternmatcher](https://github.com/moby/patternmatcher) | `v0.6.0` → `v0.6.1` |  |  | --- ### Release Notes <details> <summary>moby/patternmatcher (github.com/moby/patternmatcher)</summary> ### [`v0.6.1`](https://github.com/moby/patternmatcher/releases/tag/v0.6.1) [Compare Source](https://github.com/moby/patternmatcher/compare/v0.6.0...v0.6.1) #### What's Changed - fix panic / nil pointer dereference on invalid patterns [#​9](https://github.com/moby/patternmatcher/pull/9) - ci: update actions and test against "oldest", "oldstable" and "stable" [#​8](https://github.com/moby/patternmatcher/pull/8) **Full Changelog**: <https://github.com/moby/patternmatcher/compare/v0.6.0...v0.6.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDUuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE0NS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/act_runner/pulls/868 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
11a5dc8936 |
fix(deps): update module github.com/docker/docker to v25.0.15+incompatible (#867)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/docker](https://github.com/docker/docker) | `v25.0.14+incompatible` → `v25.0.15+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/docker (github.com/docker/docker)</summary> ### [`v25.0.15+incompatible`](https://github.com/docker/docker/compare/v25.0.14...v25.0.15) [Compare Source](https://github.com/docker/docker/compare/v25.0.14...v25.0.15) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDUuMCIsInVwZGF0ZWRJblZlciI6IjQzLjE0NS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/act_runner/pulls/867 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
3f05040438 |
fix(deps): update module github.com/mattn/go-isatty to v0.0.22 (#863)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) | `v0.0.20` → `v0.0.22` |  |  | --- ### Release Notes <details> <summary>mattn/go-isatty (github.com/mattn/go-isatty)</summary> ### [`v0.0.22`](https://github.com/mattn/go-isatty/compare/v0.0.21...v0.0.22) [Compare Source](https://github.com/mattn/go-isatty/compare/v0.0.21...v0.0.22) ### [`v0.0.21`](https://github.com/mattn/go-isatty/compare/v0.0.20...v0.0.21) [Compare Source](https://github.com/mattn/go-isatty/compare/v0.0.20...v0.0.21) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/act_runner/pulls/863 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
59d90bff26 |
fix(deps): update module github.com/docker/docker to v25.0.14+incompatible (#862)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/docker](https://github.com/docker/docker) | `v25.0.13+incompatible` → `v25.0.14+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/docker (github.com/docker/docker)</summary> ### [`v25.0.14+incompatible`](https://github.com/docker/docker/compare/v25.0.13...v25.0.14) [Compare Source](https://github.com/docker/docker/compare/v25.0.13...v25.0.14) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/act_runner/pulls/862 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
589db33e70 |
fix(deps): update module github.com/docker/cli to v25.0.7+incompatible (#855)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/docker/cli](https://github.com/docker/cli) | `v25.0.3+incompatible` → `v25.0.7+incompatible` |  |  | --- ### Release Notes <details> <summary>docker/cli (github.com/docker/cli)</summary> ### [`v25.0.7+incompatible`](https://github.com/docker/cli/compare/v25.0.6...v25.0.7) [Compare Source](https://github.com/docker/cli/compare/v25.0.6...v25.0.7) ### [`v25.0.6+incompatible`](https://github.com/docker/cli/compare/v25.0.5...v25.0.6) [Compare Source](https://github.com/docker/cli/compare/v25.0.5...v25.0.6) ### [`v25.0.5+incompatible`](https://github.com/docker/cli/compare/v25.0.4...v25.0.5) [Compare Source](https://github.com/docker/cli/compare/v25.0.4...v25.0.5) ### [`v25.0.4+incompatible`](https://github.com/docker/cli/compare/v25.0.3...v25.0.4) [Compare Source](https://github.com/docker/cli/compare/v25.0.3...v25.0.4) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/act_runner/pulls/855 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
1032f857a1 |
fix(deps): update module connectrpc.com/connect to v1.19.2 (#854)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `v1.19.1` → `v1.19.2` |  |  | --- ### Release Notes <details> <summary>connectrpc/connect-go (connectrpc.com/connect)</summary> ### [`v1.19.2`](https://github.com/connectrpc/connect-go/releases/tag/v1.19.2) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.19.1...v1.19.2) #### What's Changed ##### Governance - Add [@​timostamm](https://github.com/timostamm) as a maintainer in [#​905](https://github.com/connectrpc/connect-go/pull/905) 🎉 ##### Bugfixes - Use 'deadline\_exceeded' instead of 'canceled' on HTTP/2 cancelation when appropriate by [@​jhump](https://github.com/jhump) in [#​904](https://github.com/connectrpc/connect-go/pull/904) - Fix nil pointer deref in duplexHTTPCall under concurrent Send + CloseAndReceive by [@​simonferquel](https://github.com/simonferquel) in [#​919](https://github.com/connectrpc/connect-go/pull/919) ##### Other changes - Refactor memhttptest to work with Go 1.25 synctest by [@​codefromthecrypt](https://github.com/codefromthecrypt) in [#​881](https://github.com/connectrpc/connect-go/pull/881) - Doc clarifications by [@​emcfarlane](https://github.com/emcfarlane) ([#​911](https://github.com/connectrpc/connect-go/issues/911), [#​912](https://github.com/connectrpc/connect-go/issues/912)) and [@​stefanvanburen](https://github.com/stefanvanburen) ([#​906](https://github.com/connectrpc/connect-go/issues/906)) #### New Contributors - [@​codefromthecrypt](https://github.com/codefromthecrypt) made their first contribution in [#​881](https://github.com/connectrpc/connect-go/pull/881) - [@​simonferquel](https://github.com/simonferquel) made their first contribution in [#​919](https://github.com/connectrpc/connect-go/pull/919) **Full Changelog**: </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Reviewed-on: https://gitea.com/gitea/act_runner/pulls/854 Reviewed-by: silverwind <[email protected]> Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
8c8a8ce401 |
fix(deps): update module github.com/avast/retry-go/v4 to v4.5.1 (#411)
Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
08c681be0c |
fix(deps): update module golang.org/x/time to v0.5.0 (#429)
Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
91bfe4c186 |
fix(deps): update module golang.org/x/time to v0.4.0 (#424)
Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
825c6f97b7 |
fix(deps): update module github.com/mattn/go-isatty to v0.0.20 (#414)
Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
2f3e5c7125 |
fix(deps): update module github.com/docker/docker to v24.0.7+incompatible (#413)
Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
4d9de6ca8c |
fix(deps): update module github.com/spf13/cobra to v1.8.0 (#416)
Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
feb39666cc |
fix(deps): update module code.gitea.io/gitea-vet to v0.2.3 (#410)
Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
0adfc1c7cc |
chore(deps): update actions/setup-go action to v4 (#418)
Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
e3c68668fa |
chore(deps): update docker/build-push-action action to v5 (#419)
Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
f1b27d5274 |
chore(deps): update docker/login-action action to v3 (#420)
Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
655a39fd61 |
chore(deps): update docker/setup-buildx-action action to v3 (#421)
Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |
||
|
Renovate Bot
|
cca7d54117 |
chore(deps): update docker/setup-qemu-action action to v3 (#422)
Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]> |