Skip to content

chore(deps): bump the go-dependencies group across 1 directory with 13 updates - #4429

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-d21696d16c
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-d21696d16c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 13 updates in the / directory:

Package From To
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob 1.8.0 1.8.1
github.com/aws/aws-sdk-go-v2 1.45.1 1.47.0
github.com/aws/aws-sdk-go-v2/config 1.33.2 1.33.4
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue 1.21.2 1.21.4
github.com/aws/aws-sdk-go-v2/service/dynamodb 1.66.0 1.68.0
github.com/aws/aws-sdk-go-v2/service/ecr 1.63.0 1.65.0
github.com/aws/aws-sdk-go-v2/service/secretsmanager 1.47.0 1.49.0
github.com/go-jose/go-jose/v4 4.1.4 4.1.5
github.com/google/go-containerregistry 0.22.0 0.22.1
github.com/sigstore/sigstore 1.10.9 1.10.10
github.com/zitadel/oidc/v3 3.49.4 3.49.6
golang.org/x/crypto 0.56.0 0.57.0
sigs.k8s.io/controller-runtime 0.24.1 0.25.0

Updates github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1.8.0 to 1.8.1

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/storage/azblob's releases.

sdk/storage/azblob/v1.8.1

1.8.1 (2026-09-09)

Known Issues

  • The default x-ms-version was updated to 2026-12-06, which is not yet supported by all Azure Storage stamps. Affected storage accounts may return 400 InvalidHeaderValue errors. The rollout is expected to complete across all public regions by early October 2026. In the meantime, either pin to v1.8.0 or inject a per-retry pipeline policy that sets x-ms-version to 2026-10-06.

Breaking Changes

  • DownloadBuffer and DownloadFile now use ETag locking to ensure consistency across parallel chunk requests when the blob size is not specified upfront (i.e., Range.Count is zero). If a blob is modified during a multi-chunk download, subsequent requests will fail with ConditionNotMet instead of silently returning data from mixed blob versions.

Bugs Fixed

  • Fixed CRLF injection vulnerability in Blob Batch subrequest serialization. Header values containing CR or LF characters are now rejected before serialization, preventing header injection in batch requests.
  • Fixed WASM compilation by using heap-allocated buffers on JS targets.
  • Fixed Structured Message CRC64 download validation being skipped when the final payload byte exactly fills the caller's read buffer; the trailing segment footer and message trailer CRC64 are now drained and validated in the same Read.
  • Fixed transient net.Error/io.ErrUnexpectedEOF failures during a Structured Message download not being retried: the decoder now preserves the error chain with %w and the retry reader classifies retryable errors with errors.Is/errors.As.
  • Structured Message download now rejects a response missing the negotiated CRC64 flag instead of silently skipping validation.
  • Fixed the Structured Message encoder emitting a valid, complete message when the source returned a non-EOF error exactly on a segment boundary; such errors are now propagated.
  • Structured Message decoding now rejects a payload that declares fewer segments and appends unvalidated trailing bytes (SMDecode requires the parsed message to consume the entire input, and the streaming decoder validates the consumed byte count against the declared message length).
  • Fixed the Structured Message encoder returning io.EOF when the source ends before the declared content length; a premature EOF is now surfaced as io.ErrUnexpectedEOF so callers do not accept a truncated message.
  • Fixed Structured Message decoder discarding errors (including net.Error and io.EOF) when the returned bytes exactly complete a segment; such errors are now propagated so RetryReader can retry transient failures at segment boundaries.
  • Premature EOF during Structured Message framing reads (header, segment footer, or message trailer) now wraps io.ErrUnexpectedEOF so RetryReader classifies truncated framing as retryable.

Other Changes

  • Optimized DownloadBuffer and DownloadFile to use an initial GET request instead of a HEAD (GetProperties) call for blob size discovery. For small blobs (<=4MB), the entire content is returned in a single request, reducing download latency by ~50%.
  • Updated azcore to v1.23.1.

sdk/storage/azblob/v1.8.1-beta.1

1.8.1-beta.1 (2026-07-24)

Features Added

  • Added support for Structured Message CRC64 content validation on upload and download operations using TransferValidationTypeComputeStructuredMessageCRC64.
  • Added StorageResponseFormat enum (Auto, XML, Arrow) for list blobs operations. Set ResponseFormat on ListBlobsFlatOptions/ListBlobsHierarchyOptions to opt into Apache Arrow format for improved performance. Auto defaults to XML for this release.
  • Added AccessTier, AccessTierInferred, AccessTierChangeTime, and SmartAccessTier fields to blob download response.
  • Blob put operations now return both ContentMD5 and ContentCRC64 in the response when a Content-MD5 header is provided (service version 2026-10-06+).

Bugs Fixed

  • Fixed UploadFile/UploadBuffer responses not including ContentCRC64 when returned by the service.

Other Changes

  • Updated code generator to @autorest/go@4.0.0-preview.80.
  • Default upload/download concurrency is now based on CPU core count (clamped between 8 and 96) instead of the fixed value of 5. Set AZURE_STORAGE_USE_LEGACY_DEFAULT_CONCURRENCY=true to revert to previous defaults.
  • Updated azidentity version to 1.14.0
Commits
  • d5e09ea Prepare azidentity v1.8.1 for release (#23954)
  • af8249d Increment package version after release of storage/azblob (#23940)
  • 8b21042 Increment package version after release of storage/azdatalake (#23958)
  • a44e152 Release storage stg96 azdatalake preview (#23957)
  • b11c1a5 Relax tenant verification for credentials having optional tenant IDs (#23951)
  • e557039 remove erroneous package inclusion during package-properties evaluation (#23948)
  • 0fb4336 Increment package version after release of messaging/azservicebus (#23950)
  • b1480a2 Updating docs.microsoft.com to learn.microsoft.com (#23934)
  • 786b0be Credential chains continue iterating after unexpected IMDS responses (#23894)
  • 7d4721b add liftr base package dep to emitter dep list (#23938)
  • Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.45.1 to 1.47.0

Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.2 to 1.33.4

Commits

Updates github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue from 1.21.2 to 1.21.4

Commits

Updates github.com/aws/aws-sdk-go-v2/service/dynamodb from 1.66.0 to 1.68.0

Commits

Updates github.com/aws/aws-sdk-go-v2/service/ecr from 1.63.0 to 1.65.0

Commits

Updates github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.47.0 to 1.49.0

Commits

Updates github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.5

Fixed security issues

  • cipher/cbc_hmac: don't panic on empty ciphertext (#292)
  • cipher/cbc_hmac: don't panic on invalid key (#291)
  • json: limit stack depth (#290)
  • jwt: reject out-of-range NumericDate values (#278)
  • Check alg against pubkey curve during verify. (#293)
  • Reject malformed Ed25519 JWKs (#250)
  • jws: choose verification key per-signature (#243)

Changed

  • Verify OpaqueSigner's Public() return is public (#260)
  • jws: skip signature on ErrJWKSKidNotFound (#248)
  • Handle JWE JSON without protected header (#240)
  • jws: don't strip internal whitespace before parsing JSON (#239)
  • jws: fewer calls to OpaqueSigner.Public() (#224)
  • Return a specific error when parsing empty string (#216)
  • Reject typed nil at Verify time (#285)
Commits

Updates github.com/google/go-containerregistry from 0.22.0 to 0.22.1

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.22.1

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.22.0...v0.22.1

Commits
  • 8a72a42 remote: copy manifest annotations to referrers fallback tag descriptors (#2441)
  • 5765c35 build(deps): bump the go-deps group across 2 directories with 3 updates (#2439)
  • 969402f fix(mutate): make Time layer updates lazy (#2429)
  • 25c682e flatten: preserve config and layer media types when flattening (#2438)
  • 79af990 remote: add SSRF redirect protection to writer-side HTTP clients (#2432)
  • 4b9b3c7 fix(release): honor declared Go toolchain (#2435)
  • e033b9c fix(build): install binaries to /ko-app and add to PATH (#2424) (#2436)
  • 8bd7902 name: return a helpful error when a reference contains a URL scheme (#2431)
  • 163134d validate: support index attestation manifests and empty configs (#2414)
  • 44f7ea3 fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml (#2434)
  • Additional commits viewable in compare view

Updates github.com/sigstore/sigstore from 1.10.9 to 1.10.10

Release notes

Sourced from github.com/sigstore/sigstore's releases.

v1.10.10

What's Changed

New Contributors

Full Changelog: sigstore/sigstore@v1.10.9...v1.10.10

Commits
  • 49e21e5 build(deps): Bump github.com/google/go-containerregistry from 0.21.9 to 0.22....
  • eda3b60 build(deps): Bump the gomod group across 4 directories with 4 updates (#2413)
  • b3e2728 Adjust mldsa error handling (#2417)
  • bfbf63e Support for ML-DSA keys (#2416)
  • 538e3fa Bump go to 1.27 and fix linter and api issues (#2415)
  • e8841f5 build(deps): Bump hashicorp/vault in /test/e2e in the all group (#2412)
  • 5b3d739 Fix Azure KMS ECDSA signature verification (r||s ordering + padding) (#2410)
  • ba4de68 build(deps): Bump github.com/aws/aws-sdk-go-v2/config (#2406)
  • 1abcedd build(deps): Bump github.com/Azure/azure-sdk-for-go/sdk/azcore (#2407)
  • d579148 build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2404)
  • Additional commits viewable in compare view

Updates github.com/zitadel/oidc/v3 from 3.49.4 to 3.49.6

Release notes

Sourced from github.com/zitadel/oidc/v3's releases.

v3.49.6

3.49.6 (2026-09-04)

Bug Fixes

  • oidc: map ErrSubjectInvalid to invalid_grant instead of server_error (#950) (cb9e7df), closes #945

v3.49.5

3.49.5 (2026-09-03)

Bug Fixes

Commits
  • cb9e7df fix(oidc): map ErrSubjectInvalid to invalid_grant instead of server_error (#950)
  • 2d0c9cb fix(op): stop double-decoding redirect_uri in authorization requests (#969)
  • 24d9a1b chore(deps): bump github/codeql-action from 4.37.8 to 4.37.9 (#970)
  • See full diff in compare view

Updates golang.org/x/crypto from 0.56.0 to 0.57.0

Commits

Updates sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.25.0

Highlights

This version of controller-runtime introduces a new experimental ReadYourWritesConsistency feature, which ensures that all writes are reflected in subsequent reads from the default cache-backed client. Stale client reads are arguably the biggest source of friction and sometimes bugs for controller authors, providing this functionality at the library level eliminates that class of problems entirely.

Try it out by setting Client.EnableReadYourWritesConsistency: new(true) in your manager and leave any feedback you may have on the tracking issue.

⚠️ Breaking Changes

✨ New Features

  • Client: Add a read-your-own-writes client (#3472)
  • Fakeclient: Add WithGlobalResourceVersionCounter (#3581)
  • Fakeclient: Add scale subresource support for Apply (#3569)
  • Metrics: Allow opt-in for client-go REST client metrics (#3510)
  • Metrics: Allow overriding client-go REST client metrics latency histogram buckets (#3573)
  • Source: Add TypedInformer source (#3520)
  • Webhooks: Allow to disable the webhook server by setting the port to -1 (#3481)

🐛 Bug Fixes

  • Cache: Fix goroutine leaks in cache Start() methods (#3565)
  • Client: Fix regression in Apply typed error handling (#3515)
  • Controller: Unlock when Controller.Start() returns with error (#3545)
  • Envtest: Fix envtest process stop on Windows (#3519)
  • Fakeclient: Allow updating managedFields through Update (#3585)
  • Fakeclient: Fix AddIndex panic when wrapped with an interceptor (#3583)
  • Fakeclient: Fix PartialObjectMeta handling (#3571)
  • Fakeclient: Support scale subresource get/update for unstructured objects (#3546)
  • Fakeclient: Update object on subresource apply (#3570)
  • PriorityQueue: Fix PriorityQueue deadlock on shutdown (#3540)
  • Testing/Process: Fix process Stop timeout error handling (#3523)

🌱 Others

  • LeaderElection: Pass Managers Logger to Leader Elector via Context (#3576)

🌱 CI & linters

  • Add copyright header validation & fix findings (#3544)
  • Bump to golangci-lint v2.12.1 (#3514)
  • Bump to golangci-lint v2.12.2 (#3532)
  • Bump to golangci-lint v2.13.1 (#3580)

... (truncated)

Commits
  • e8f9455 🐛 fakeclient: Allow updating managedFields through Update (#3585)
  • 0cc1315 Merge pull request #3565 from dongjiang1989/fix-leak
  • fa96780 🐛 Fix goroutine leaks in cache Start() methods
  • 1f5514b ✨ Add a read-your-own-write client (#3472)
  • df386c7 🌱 Bump to golangci-lint v2.13.1 (#3580)
  • dc7618f Merge pull request #3583 from pujitha24/auto/issue-3582
  • 37fe235 🐛 fake: fix AddIndex panic when client is wrapped with an interceptor
  • 01c7782 ✨ Allow overriding REST client latency histogram buckets (#3573)
  • 857be80 Merge pull request #3576 from demirdilek/fix-leaderelection-contextual-logging
  • b1387be Merge pull request #3581 from alvaroaleman/fake-consistent
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 17, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 17, 2026
Comment thread go.mod
module zotregistry.dev/zot/v2

go 1.26.3
go 1.27.0

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This bumps go version

…3 updates

Bumps the go-dependencies group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/Azure/azure-sdk-for-go/sdk/storage/azblob](https://github.com/Azure/azure-sdk-for-go) | `1.8.0` | `1.8.1` |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.45.1` | `1.47.0` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.33.2` | `1.33.4` |
| [github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue](https://github.com/aws/aws-sdk-go-v2) | `1.21.2` | `1.21.4` |
| [github.com/aws/aws-sdk-go-v2/service/dynamodb](https://github.com/aws/aws-sdk-go-v2) | `1.66.0` | `1.68.0` |
| [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2) | `1.63.0` | `1.65.0` |
| [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.47.0` | `1.49.0` |
| [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.1.4` | `4.1.5` |
| [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.22.0` | `0.22.1` |
| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.10.9` | `1.10.10` |
| [github.com/zitadel/oidc/v3](https://github.com/zitadel/oidc) | `3.49.4` | `3.49.6` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.56.0` | `0.57.0` |
| [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) | `0.24.1` | `0.25.0` |



Updates `github.com/Azure/azure-sdk-for-go/sdk/storage/azblob` from 1.8.0 to 1.8.1
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.8.0...sdk/azidentity/v1.8.1)

Updates `github.com/aws/aws-sdk-go-v2` from 1.45.1 to 1.47.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.45.1...v1.47.0)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.33.2 to 1.33.4
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.33.2...config/v1.33.4)

Updates `github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue` from 1.21.2 to 1.21.4
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.21.2...service/pi/v1.21.4)

Updates `github.com/aws/aws-sdk-go-v2/service/dynamodb` from 1.66.0 to 1.68.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.66.0...service/s3/v1.68.0)

Updates `github.com/aws/aws-sdk-go-v2/service/ecr` from 1.63.0 to 1.65.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.63.0...service/s3/v1.65.0)

Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.47.0 to 1.49.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.47.0...service/s3/v1.49.0)

Updates `github.com/go-jose/go-jose/v4` from 4.1.4 to 4.1.5
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](go-jose/go-jose@v4.1.4...v4.1.5)

Updates `github.com/google/go-containerregistry` from 0.22.0 to 0.22.1
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.22.0...v0.22.1)

Updates `github.com/sigstore/sigstore` from 1.10.9 to 1.10.10
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.10.9...v1.10.10)

Updates `github.com/zitadel/oidc/v3` from 3.49.4 to 3.49.6
- [Release notes](https://github.com/zitadel/oidc/releases)
- [Commits](zitadel/oidc@v3.49.4...v3.49.6)

Updates `golang.org/x/crypto` from 0.56.0 to 0.57.0
- [Commits](golang/crypto@v0.56.0...v0.57.0)

Updates `sigs.k8s.io/controller-runtime` from 0.24.1 to 0.25.0
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.24.1...v0.25.0)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue
  dependency-version: 1.21.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/dynamodb
  dependency-version: 1.68.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
  dependency-version: 1.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager
  dependency-version: 1.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/storage/azblob
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/sigstore/sigstore
  dependency-version: 1.10.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/zitadel/oidc/v3
  dependency-version: 3.49.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the go-dependencies group with 13 updates chore(deps): bump the go-dependencies group across 1 directory with 13 updates Sep 18, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-dependencies-d21696d16c branch from fc78064 to e8ad57b Compare September 18, 2026 07:55
@dependabot @github

dependabot Bot commented on behalf of github Sep 19, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 19, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/go-dependencies-d21696d16c branch September 19, 2026 07:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant