chore(deps): update go dependencies by red-hat-konflux[bot] · Pull Request #605 · securesign/trillian

red-hat-konflux · 2026-03-30T10:36:51Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
cel.dev/expr	indirect	patch	`v0.25.1` → `v0.25.2`
cloud.google.com/go/auth	indirect	minor	`v0.19.0` → `v0.20.0`
cloud.google.com/go/iam	indirect	minor	`v1.6.0` → `v1.11.0`
cloud.google.com/go/longrunning	indirect	major	`v0.8.0` → `v1.0.0`
cloud.google.com/go/monitoring	indirect	minor	`v1.24.3` → `v1.29.0`
cloud.google.com/go/profiler	indirect	minor	`v0.4.3` → `v0.6.0`
cloud.google.com/go/spanner	require	minor	`v1.89.0` → `v1.92.0`
cloud.google.com/go/storage	indirect	minor	`v1.58.0` → `v1.62.3`	`v1.63.0`
cloud.google.com/go/trace	indirect	minor	`v1.11.7` → `v1.16.0`
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp	indirect	minor	`v1.30.0` → `v1.33.0`
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric	indirect	minor	`v0.55.0` → `v0.57.0`
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping	indirect	minor	`v0.55.0` → `v0.57.0`
github.com/apache/beam/sdks/v2	require	minor	`v2.71.0` → `v2.74.0`
github.com/avast/retry-go/v4	indirect	major	`v4.7.0` → `v5.0.0`
github.com/aws/aws-sdk-go	indirect	patch	`v1.55.7` → `v1.55.8`
github.com/cenkalti/backoff/v5	indirect	major	`v5.0.3` → `v6.0.1`
github.com/cheggaaa/pb/v3	indirect	patch	`v3.1.6` → `v3.1.7`
github.com/clipperhouse/uax29/v2	indirect	minor	`v2.2.0` → `v2.7.0`
github.com/coreos/go-systemd/v22	indirect	minor	`v22.6.0` → `v22.7.0`
github.com/docker/go-connections	indirect	minor	`v0.6.0` → `v0.7.0`
github.com/emicklei/go-restful/v3	indirect	minor	`v3.12.2` → `v3.13.0`
github.com/envoyproxy/go-control-plane/envoy	indirect	minor	`v1.36.0` → `v1.37.0`
github.com/fatih/color	indirect	minor	`v1.18.0` → `v1.19.0`
github.com/felixge/httpsnoop	indirect	minor	`v1.0.4` → `v1.1.0`
github.com/fxamacker/cbor/v2	indirect	patch	`v2.9.0` → `v2.9.2`
github.com/go-jose/go-jose/v4	indirect	patch	`v4.1.3` → `v4.1.4`
github.com/go-openapi/jsonpointer	indirect	minor	`v0.22.5` → `v0.23.1`
github.com/go-openapi/jsonreference	indirect	patch	`v0.21.5` → `v0.21.6`
github.com/go-openapi/swag	indirect	minor	`v0.25.5` → `v0.26.1`
github.com/go-openapi/swag/cmdutils	indirect	minor	`v0.25.5` → `v0.26.1`
github.com/go-openapi/swag/conv	indirect	minor	`v0.25.5` → `v0.26.1`
github.com/go-openapi/swag/fileutils	indirect	minor	`v0.25.5` → `v0.26.1`
github.com/go-openapi/swag/jsonname	indirect	minor	`v0.25.5` → `v0.26.1`
github.com/go-openapi/swag/jsonutils	indirect	minor	`v0.25.5` → `v0.26.1`
github.com/go-openapi/swag/loading	indirect	minor	`v0.25.5` → `v0.26.1`
github.com/go-openapi/swag/mangling	indirect	minor	`v0.25.5` → `v0.26.1`
github.com/go-openapi/swag/netutils	indirect	minor	`v0.25.5` → `v0.26.1`
github.com/go-openapi/swag/stringutils	indirect	minor	`v0.25.5` → `v0.26.1`
github.com/go-openapi/swag/typeutils	indirect	minor	`v0.25.5` → `v0.26.1`
github.com/go-openapi/swag/yamlutils	indirect	minor	`v0.25.5` → `v0.26.1`
github.com/go-sql-driver/mysql	require	minor	`v1.9.3` → `v1.10.0`
github.com/golang-cz/devslog	indirect	patch	`v0.0.15` → `v0.0.17`
github.com/google/pprof	indirect	digest	`a15ffb7` → `7023385`
github.com/googleapis/enterprise-certificate-proxy	indirect	patch	`v0.3.14` → `v0.3.16`	`v0.3.17`
github.com/googleapis/gax-go/v2	indirect	minor	`v2.19.0` → `v2.22.0`
github.com/grpc-ecosystem/go-grpc-middleware	require	major	`v1.4.0` → `v2.3.3`
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus	indirect	minor	`v1.0.1` → `v1.1.0`
github.com/grpc-ecosystem/go-grpc-middleware/v2	indirect	minor	`v2.1.0` → `v2.3.3`
github.com/grpc-ecosystem/grpc-gateway/v2	indirect	minor	`v2.28.0` → `v2.29.0`
github.com/huandu/xstrings	indirect	minor	`v1.2.0` → `v1.5.0`
github.com/imdario/mergo	indirect	major	`v0.3.4` → `v1.0.2`
github.com/jackc/pgx/v4	indirect	major	`v4.18.3` → `v5.10.0`
github.com/jackc/pgx/v5	require	minor	`v5.9.1` → `v5.10.0`
github.com/jhump/protoreflect/v2	indirect	patch	`v2.0.0-beta.1` → `v2.0.0-beta.2`
github.com/letsencrypt/pkcs11key/v4	require	patch	`v4.0.0` → `v4.0.1`
github.com/lib/pq	require	patch	`v1.12.0` → `v1.12.3`
github.com/mattn/go-colorable	indirect	patch	`v0.1.14` → `v0.1.15`
github.com/mattn/go-isatty	indirect	patch	`v0.0.20` → `v0.0.22`
github.com/mattn/go-runewidth	indirect	patch	`v0.0.21` → `v0.0.24`
github.com/olekukonko/errors	indirect	major	`v0.0.0-20250405072817-4e6d85265da6` → `v1.3.0`
github.com/olekukonko/ll	indirect	minor	`v0.0.8-0.20250516010636-22ea57d81985` → `v0.1.8`
github.com/olekukonko/tablewriter	indirect	minor	`v1.0.6` → `v1.1.4`
github.com/prometheus/common	indirect	minor	`v0.67.5` → `v0.69.0`
github.com/prometheus/prometheus	indirect	minor	`v0.304.2` → `v0.312.0`
github.com/spiffe/go-spiffe/v2	indirect	minor	`v2.6.0` → `v2.8.1`
go.etcd.io/bbolt	indirect	minor	`v1.4.3` → `v1.5.0`
go.etcd.io/etcd/api/v3	indirect	patch	`v3.6.9` → `v3.6.12`
go.etcd.io/etcd/client/pkg/v3	indirect	patch	`v3.6.9` → `v3.6.12`
go.etcd.io/etcd/client/v3	require	patch	`v3.6.9` → `v3.6.12`
go.etcd.io/etcd/etcdctl/v3	require	patch	`v3.6.9` → `v3.6.12`
go.etcd.io/etcd/etcdutl/v3	indirect	patch	`v3.6.9` → `v3.6.12`
go.etcd.io/etcd/pkg/v3	indirect	patch	`v3.6.9` → `v3.6.12`
go.etcd.io/etcd/server/v3	require	patch	`v3.6.9` → `v3.6.12`
go.etcd.io/etcd/tests/v3	indirect	patch	`v3.6.9` → `v3.6.12`
go.etcd.io/etcd/v3	require	patch	`v3.6.9` → `v3.6.12`
go.etcd.io/raft/v3	indirect	minor	`v3.6.0` → `v3.7.0`
go.opentelemetry.io/contrib/detectors/gcp	indirect	minor	`v1.39.0` → `v1.44.0`
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	indirect	minor	`v0.67.0` → `v0.69.0`
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	indirect	minor	`v0.67.0` → `v0.69.0`
go.opentelemetry.io/otel	indirect	minor	`v1.42.0` → `v1.44.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace	indirect	minor	`v1.40.0` → `v1.44.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	indirect	minor	`v1.40.0` → `v1.44.0`
go.opentelemetry.io/otel/metric	indirect	minor	`v1.42.0` → `v1.44.0`
go.opentelemetry.io/otel/sdk	indirect	minor	`v1.42.0` → `v1.44.0`
go.opentelemetry.io/otel/sdk/metric	indirect	minor	`v1.42.0` → `v1.44.0`
go.opentelemetry.io/otel/trace	indirect	minor	`v1.42.0` → `v1.44.0`
go.uber.org/zap	indirect	minor	`v1.27.1` → `v1.28.0`
go.yaml.in/yaml/v2	indirect	major	`v2.4.3` → `v3.0.4`
golang.org/x/crypto	indirect	minor	`v0.49.0` → `v0.53.0`
golang.org/x/exp	indirect	digest	`7ab1446` → `c48552f`
golang.org/x/mod	indirect	minor	`v0.34.0` → `v0.37.0`
golang.org/x/net	indirect	minor	`v0.52.0` → `v0.56.0`
golang.org/x/sync	require	minor	`v0.20.0` → `v0.21.0`
golang.org/x/sys	require	minor	`v0.42.0` → `v0.46.0`
golang.org/x/term	indirect	minor	`v0.41.0` → `v0.44.0`
golang.org/x/text	indirect	minor	`v0.35.0` → `v0.38.0`
golang.org/x/tools	require	minor	`v0.43.0` → `v0.46.0`	`v0.47.0`
google.golang.org/api	require	minor	`v0.273.0` → `v0.286.0`
google.golang.org/genproto	require	digest	`d00831a` → `b703f56`
google.golang.org/genproto/googleapis/api	require	digest	`d00831a` → `b703f56`
google.golang.org/genproto/googleapis/rpc	require	digest	`d00831a` → `b703f56`
google.golang.org/grpc	require	minor	`v1.79.3` → `v1.81.1`
google.golang.org/grpc/cmd/protoc-gen-go-grpc	require	patch	`v1.6.1` → `v1.6.2`
gopkg.in/evanphx/json-patch.v4	indirect	major	`v4.13.0` → `v5.9.11`
gopkg.in/yaml.v2	require	major	`v2.4.0` → `v3.0.1`
k8s.io/api	require	minor	`v0.35.3` → `v0.36.2`
k8s.io/apimachinery	require	minor	`v0.35.3` → `v0.36.2`
k8s.io/client-go	require	minor	`v0.35.3` → `v0.36.2`
k8s.io/utils	require	digest	`28399d8` → `a95e086`
sigs.k8s.io/structured-merge-diff/v6	indirect	minor	`v6.3.0` → `v6.4.0`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

google/cel-spec (cel.dev/expr)

`v0.25.2`

Compare Source

What's Changed

Add conformance tests for (string).reverse() by @jnthntatum in #491
Updates to the conformance tests for integer values in %e and %f format directives by @TristonianJones in #495
Add automated BCR publishing on release tags by @mmorel-35 in #498
Add clarification on scoping rules. by @jnthntatum in #506
Networking extension conformance tests by @TristonianJones in #507
Add conformance test cases for null assignability around repeated fields and maps by @l46kok in #510

New Contributors

@mmorel-35 made their first contribution in #498

Full Changelog: cel-expr/cel-spec@v0.25.1...v0.25.2

googleapis/google-cloud-go (cloud.google.com/go/auth)

`v0.20.0`

Compare Source

bigquery: Support SchemaUpdateOptions for load jobs.
bigtable:
- Add SampleRowKeys.
- cbt: Support union, intersection GCPolicy.
- Retry admin RPCS.
- Add trace spans to retries.
datastore: Add OpenCensus tracing.
firestore:
- Fix queries involving Null and NaN.
- Allow Timestamp protobuffers for time values.
logging: Add a WriteTimeout option.
spanner: Support Batch API.
storage: Add OpenCensus tracing.

GoogleCloudPlatform/opentelemetry-operations-go (github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric)

`v0.57.0`: v1.33.0/v0.57.0

Compare Source

What's Changed

Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] by @renovate-bot in #1146
Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] by @renovate-bot in #1145
Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] by @renovate-bot in #1144
[chore] retry_on_failure is removed from our exporter by @braydonk in #1151
downgrade davecgh/go-spew, pmezard/go-difflib to tagged releases by @thaJeztah in #1152
Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY] by @renovate-bot in #1149
Update e2e-testing image to fix presubmits by @dashpole in #1155
Update go.opentelemetry.io/collector by @renovate-bot in #1073
Auto comment /gcbrun for dependency updates by @dashpole in #1154
Revert "Auto comment /gcbrun for dependency updates" by @dashpole in #1157
Update module github.com/prometheus/common to v0.67.5 by @renovate-bot in #1156
Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.4.0 in /tools by @dependabot[bot] in #1118
Update golang.org/x by @renovate-bot in #1008
Combine dependency bumps by @dashpole in #1158
Update All Dependencies by @renovate-bot in #1161
Update all major dependencies by @dashpole in #1164
Update All Dependencies by @renovate-bot in #1163
Add AGENTS.md by @dashpole in #1165
Fix CodeQL permissions to allow uploading results by @dashpole in #1166
collector: bump golang.org/x/net to v0.55.0 to fix GO-2026-5026 by @dashpole in #1170
Migrate impersonate to use cloud.google.com/go/auth by @dashpole in #1169
fix: Support OTLP event_name field in logs exporter by @putcho01 in #1088
exporter/collector/logs: accept string-typed line in sourceLocation by @alliasgher in #1142
exporter/collector/logs: use parsed httpRequest.protocol instead of hardcoded HTTP/1.1 by @alliasgher in #1143
exporter/trace: sanitize invalid UTF-8 in span fields by @alliasgher in #1141
chore: update E2E tests to use centralized async cleanup 0.22.0 by @aabmass in #1171
Add support for cloud run worker pools by @dashpole in #1112
Prerelease 1.33.0/v0.57.0 by @avilevy18 in #1173

New Contributors

@thaJeztah made their first contribution in #1152
@putcho01 made their first contribution in #1088
@alliasgher made their first contribution in #1142

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.56.0...v0.57.0

`v0.56.0`: v1.32.0/v0.56.0

Compare Source

What's Changed

Support universe domains in collector exporter client configuration by @dashpole in #1097
Don't pass credentials fetched using FindDefaultCredentials by @dashpole in #1098
googleclientauthextension: support Proxy-Authorization header by @lindeskar in #1105
Improve unit tests for gcp auth extension by @dashpole in #1103
Allow providing a context to create the monitoring client by @dashpole in #1096
Add support for go 1.26 by @dashpole in #1107
chore(deps): update module golang.org/x/crypto to v0.45.0 [security] by @renovate-bot in #1102
Don't allow modifying the default scopes by @dashpole in #1109
Ignore versions in the user agent header when comparing fixtures by @dashpole in #1115
Bump go version to resolve govulncheck failures by @dashpole in #1114
Separate out govulncheck into its own CI job by @dashpole in #1113
Normalize user agents in span attributes as well by @dashpole in #1117
fix(deps): update module google.golang.org/grpc to v1.79.3 [security] by @jefferbrecht in #1131
Prepare for v1.32.0/v0.56.0 by @dashpole in #1132

New Contributors

@lindeskar made their first contribution in #1105
@jefferbrecht made their first contribution in #1131

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.55.0...v0.56.0

apache/beam (github.com/apache/beam/sdks/v2)

`v2.74.0`: Beam 2.74.0 release

Compare Source

We are happy to present the new 2.74.0 release of Beam.
This release includes both improvements and new functionality.
See the download page for this release.

For more information on changes in 2.74.0, check out the detailed release notes.

Highlights

Spark 4 runner support for Java SDK (#38255).

I/Os

IcebergIO: support declaring a table's sort order on dynamic table creation via the new sort_fields config (#38269).
IcebergIO: support writing with hash distribution mode, and with autosharding (#38061).

New Features / Improvements

Capability introduces an indicator for aggregations and timers firing during a pipeline drain, allowing users and sinks to recognize and appropriately handle potentially incomplete or partial data (#36884).
Added support for setting disk provisioned IOPS and throughput in Dataflow runner via --diskProvisionedIops and --diskProvisionedThroughputMibps pipeline options (Java/Go/Python) (#38349).
TriggerStateMachineRunner changes from BitSetCoder to SentinelBitSetCoder to
encode finished bitset. SentinelBitSetCoder and BitSetCoder are state
compatible. Both coders can decode encoded bytes from the other coder
(#38139).
(Python) Added type alias for with_exception_handling to be used for typehints. (#38173).
(Java) BatchElements transform for Java SDK (#38369)
Added plugin mechanism to support different Lineage implementations (Java) (#36790).
(Python) Supported Python user type in Beam SQL. For example, SQL statements like SELECT some_field from PCOLLECTION can now operate a PCollection of Beam Row containing pickable Python user type (#20738).
(Python) Introduced beam.coders.registry.register_row as preferred API to register a named tuple or dataclass with a Beam Row. At pipelne runtime, the original type associated with the registered row are preserved across the serialization boundary (#38108).

Breaking Changes

(Python) Made Beartype the default fallback type checking tool. This can be disabled with the --disable_beartype pipeline option. (#38275)

Deprecations

Dropped Java 8 support (#31678).
Removed Samza Runner support (#35448).

Bugfixes

Fixed BigQueryEnrichmentHandler batch mode dropping earlier requests when multiple requests share the same enrichment key (Python) (#38035).
Added max_batch_duration_secs passthrough support in Python Enrichment BigQuery and CloudSQL handlers so batching duration can be forwarded to BatchElements (#38243).

According to git shortlog, the following people contributed to the 2.74.0 release. Thank you to all contributors!

Abdelrahman Ibrahim, Ahmed Abualsaud, Andrew Crites, Andrew Kabas, Arran Cudbard-Bell, Arun Pandian, Asish Kumar, Bentsi Leviav, Blake Jones, Bruno Volpato, Chris Jordan, Danny McCormick, Deji Ibrahim, Derrick Williams, Elia LIU, Ganesh Sivakumar, Jack McCluskey, Kenneth Knowles, Lalit Yadav, M Junaid Shaukat, Matej Aleksandrov, Prabhnoor Singh, Radek Stankiewicz, Radosław Stankiewicz, Reuven Lax, RuiLong J., Sam Whittle, Shunping Huang, Subramanya V, Tarun Annapareddy, Tobias Kaymak, TongruiLi, Valentyn Tymofieiev, Vitaly Terentyev, XQ Hu, Yi Hu, ZIHAN DAI, apanich, bambadiouf1, chenxuesdu, claudevdm, harshadkhetpal, johnjcasey, parveensania, tianz101

`v2.73.0`: Beam 2.73.0 release

Compare Source

We are happy to present the new 2.73.0 release of Beam.
This release includes both improvements and new functionality.
See the download page for this release.

For more information on changes in 2.73.0, check out the detailed release notes.

Highlights

I/Os

DebeziumIO (Java): added OffsetRetainer interface and FileSystemOffsetRetainer implementation to persist and restore CDC offsets across pipeline restarts, and exposed withStartOffset / withOffsetRetainer on DebeziumIO.Read and the cross-language ReadBuilder (#28248).

New Features / Improvements

(Python) Added BigQuery CDC streaming source (#37724)
Added ADKAgentModelHandler for running Google Agent Development Kit (ADK) agents (Python) (#37917).
(Python) Added exception chaining to preserve error context in CloudSQLEnrichmentHandler, processes utilities, and core transforms (#37422).
(Python) Added a pipeline option --experiments=pip_no_build_isolation to disable build isolation when installing dependencies in the runtime environment (#37331).
(Go) Added OrderedListState support to the Go SDK stateful DoFn API (#37629).
Added support for large pipeline options via a file (Python) (#37370).
Supported infer schema from dataclass (Python) (#22085). Default coder for typehint-ed (or set with_output_type) for non-frozen dataclasses changed to RowCoder. To preserve the old behavior (fast primitive coder), explicitly register the type with FastPrimitiveCoder.
Updates minimum Go version to 1.26.1 (#37897).
(Python) Added image embedding support in apache_beam.ml.rag package (#37628).
(Python) Added support for Python version 3.14 (#37247).

Breaking Changes

The Python SDK container's boot.go now passes pipeline options through a file instead of the PIPELINE_OPTIONS environment variable. If a user pairs a new Python SDK container with an older SDK version (which does not support the file-based approach), the pipeline options will not be recognized and the pipeline will fail. Users must ensure their SDK and container versions are synchronized (#37370).
Python DoFn.with_exception_handling now respects user DoFn typehints. This can break update compatibility if coders change. It can also break pipeline compilation if existing typehints are incorrect. To update safely sepcify the pipeline option --update_compatibility_version=2.72.0. To fix typehints replace any incorrect typehints that were previously ignored (#37590)

Bugfixes

Fixed ProcessManager not reaping child processes, causing zombie process accumulation on long-running Flink deployments (Java) (#37930).

Security Fixes

Fixed CVE-2023-46604 (CVSS 10.0) and CVE-2022-41678 by upgrading ActiveMQ from 5.14.5 to 5.19.2 (Java) (#37943).
Fixed CVE-2024-1597, CVE-2022-31197, and CVE-2022-21724 by upgrading PostgreSQL JDBC Driver from 42.2.16 to 42.6.2 (Java) (#37942).

List of Contributors

According to git shortlog, the following people contributed to the 2.73.0 release. Thank you to all contributors!

Abdelrahman Ibrahim, Ahmed Abualsaud, Alex Malao, Alexander Nieuwenhuijse, Andres Tiko, Andrew Crites, Arun Pandian, Bentsi Leviav, Bruno Volpato, Chamikara Jayalath, Chandra Kiran Bolla, Danny McCormick, Deji Ibrahim, Derrick Williams, Elia LIU, Esmelealem, Hannes Gustafsson, Jack McCluskey, Joey Tran, Kenneth Knowles, M Junaid Shaukat, Mansi Singh, Matej Aleksandrov, Mathijs Deelen, Mattie Fu, Praneet Nadella, Radek Stankiewicz, Radosław Stankiewicz, Reuven Lax, RuiLong J., S. Veyrié, Sakthivel Subramanian, Sam Whittle, Shubham Thakur, Shunping Huang, Subramanya V, Tarun Annapareddy, Tobias Kaymak, Valentyn Tymofieiev, Vitaly Terentyev, XQ Hu, Yi Hu, ZIHAN DAI, claudevdm, kishorepola, parveensania

`v2.72.0`: Beam 2.72.0 release

Compare Source

We are happy to present the new 2.72.0 release of Beam.
This release includes both improvements and new functionality.
See the download page for this release.

For more information on changes in 2.72.0, check out the detailed release notes.

Highlights

Flink 2.0 support (#36947).

I/Os

Add Datadog IO support (Java) (#37318).
Remove Pubsublite IO support, since service will be deprecated in March 2026. (#37375).
(Java) ClickHouse - migrating from the legacy JDBC driver (v0.6.3) to ClickHouse Java Client v2 (v0.9.6). See the class documentation for migration guide (#37610).
(Java) Upgraded GoogleAdsIO to use GoogleAdsIO API v23 (#37620).

New Features / Improvements

(Python) Added exception chaining to preserve error context in CloudSQLEnrichmentHandler, processes utilities, and core transforms (#37422).
(Python) Added a pipeline option --experiments=pip_no_build_isolation to disable build isolation when installing dependencies in the runtime environment (#37331).

Deprecations

(Python) Removed previously deprecated list_prefix method for filesystem interfaces (#37587).

Bugfixes

Fixed (Yaml) issue with validate compatible method (#37588).
Fixed (Yaml) issue with Create transform dealing with different type elements (#37585).

Security Fixes

Fixed CVE-2024-28397 by switching from js2py to pythonmonkey (Yaml) (#37560).

List of Contributors

According to git shortlog, the following people contributed to the 2.72.0 release. Thank you to all contributors!

Abdelrahman Ibrahim, Ahmed Abualsaud, Andrew Crites, Arun Pandian, Ben Feinstein, Bentsi Leviav, Celeste Zeng, Danny McCormick, Danny Mccormick, Derrick Williams, Elia LIU, Ganesh, Jack McCluskey, Kenneth Knowles, Labesse Kévin, M Junaid Shaukat, Mansi Singh, Mattie Fu, Nayan Mathur, Pablo Estrada, Pirzada Ahmad Faraz, Radek Stankiewicz, Radosław Stankiewicz, Robert Bradshaw, Rohan Sah, RuiLong J., Sakthivel Subramanian, Sam Whittle, Shaheer Amjad, Shunping Huang, Steven van Rossum, Tarun Annapareddy, Tobias Kaymak, Valentyn Tymofieiev, Vitaly Terentyev, Yi Hu, XQ Hu, ZIHAN DAI, apanich, chenxuesdu, claudevdm, franzonia137

avast/retry-go (github.com/avast/retry-go/v4)

`v5.0.0`

Compare Source

What's Changed

Use Makefile lint target instead of blocked GitHub Action by @JaSei in #143
default type is combination of backoff and random by @JaSei in #144
Enhance readme + coverage by @JaSei in #146
default branch is main by @JaSei in #147
Proposal for v5 API: retry.New(...).Do(func) by @msf in #148
upgrade to v5.0.0 with Go 1.20 multiple error wrapping support by @JaSei in #149

New Contributors

@msf made their first contribution in #148

Full Changelog: avast/retry-go@4.7.0...v5.0.0

aws/aws-sdk-go (github.com/aws/aws-sdk-go)

`v1.55.8`

Compare Source

SDK Features

Mark the module and all packages as deprecated.
- This SDK has entered end-of-support.

cenkalti/backoff (github.com/cenkalti/backoff/v5)

`v6.0.1`

Compare Source

`v6.0.0`

Compare Source

cheggaaa/pb (github.com/cheggaaa/pb/v3)

`v3.1.7`

Compare Source

clipperhouse/uax29 (github.com/clipperhouse/uax29/v2)

What's Changed

Unicode 17 by @aymanbagabas in #44
Fast paths for ASCII by @clipperhouse in #42

Breaking change

The returned iterator type from FromString() and FromBytes() is now a pointer. This will not present a problem if you are just using it in the typical way, which is assigning to a local variable and iterating.

If you are embedding this iterator into another object, and therefore declaring its type, this change might break your compilation. You’ll need to change to a pointer type. Apologies if so — this seems like a small enough change that a v3 would be a bit much.

New Contributors

@aymanbagabas made their first contribution in #44

Full Changelog: clipperhouse/uax29@v2.4.0...v2.5.0

`v2.4.0`

Compare Source

Adds Unicode 16 support

What's Changed

Unicode 16 by @clipperhouse in #41

Full Changelog: clipperhouse/uax29@v2.3.0...v2.4.0

`v2.3.1`

Compare Source

`v2.3.0`

Compare Source

coreos/go-systemd (github.com/coreos/go-systemd/v22)

`v22.7.0`

Compare Source

This release fixes an issue with multiple calls to (e.g.) StopUnit, simplifies and improves code and documentation, and adds a few new methods.

What's Changed

build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #473
Fixing error on negative value of LISTEN_FDS by @vporoshok in #472
Misc error reporting improvements by @kolyshkin in #475
daemon: add SdNotifyMonotonicUsec helper function by @corhere in #435
build(deps): bump golangci/golangci-lint-action from 8 to 9 by @dependabot[bot] in #481
build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #483
dbus: fix TestSetUnitProperties wrt systemd >= 252 by @kolyshkin in #489
Sync repo templates ⚙ by @coreosbot-releng in #486
unit: simplify escape character by @huww98 in #485
machine1: add missing close method to conn. by @maartensson in #487
subscription: Added context cancellation and sync to subscription set by @NotSoFancyName in #480
ci: improvements by @kolyshkin in #490
import1: add missing close method to conn by @maartensson in #492
sdjournal: fix copyrights by @kolyshkin in #499
activation: simplify ListenersWithNames by @kolyshkin in #498
dbus: allow multiple calls for the same unit to *Unit by @haircommander in #496
Documentation nits by @kolyshkin in #500
dbus: dedup result conversion code by @kolyshkin in #493
add FilesWithNames() to activation by @MayCXC in #497
Add support for transient units with auxiliary units by @gwenya in #495
activation: stub out for plan9 by @flokli in #440

New Contributors

@vporoshok made their first contribution in #472
@corhere made their first contribution in #435
@huww98 made their first contribution in #485
@maartensson made their first contribution in #487
@haircommander made their first contribution in #496
@MayCXC made their first contribution in #497
@gwenya made their first contribution in #495
@flokli made their first contribution in #440

Full Changelog: coreos/go-systemd@v22.6.0...v22.7.0

docker/go-connections (github.com/docker/go-connections)

`v0.7.0`

Compare Source

emicklei/go-restful (github.com/emicklei/go-restful/v3)

`v3.13.0`

Compare Source

optimize performance of path matching in CurlyRouter ( thanks @wenhuang, Wen Huang)

fatih/color (github.com/fatih/color)

`v1.19.0`

Compare Source

What's Changed

Bump golang.org/x/sys from 0.25.0 to 0.28.0 by @dependabot[bot] in #246
Fix for issue #230 set/unsetwriter symmetric wrt color support detection by @ataypamart in #243
chore: go mod cleanup by @sashamelentyev in #244
Bump golang.org/x/sys from 0.28.0 to 0.30.0 by @dependabot[bot] in #249
Bump github.com/mattn/go-colorable from 0.1.13 to 0.1.14 by @dependabot[bot] in #248
Update CI and go deps by @fatih in #254
Bump golang.org/x/sys from 0.31.0 to 0.37.0 by @dependabot[bot] in #268
fix: include escape codes in byte counts from Fprint, Fprintf by @qualidafial in #282
Bump golang.org/x/sys from 0.37.0 to 0.40.0 by @dependabot[bot] in #277
fix: add nil check for os.Stdout to prevent panic on Windows services by @majiayu000 in #275
Bump dominikh/staticcheck-action from 1.3.1 to 1.4.0 by @dependabot[bot] in #259
Bump actions/checkout from 4 to 6 by @dependabot[bot] in #273
Optimize Color.Equals performance (O(n²) → O(n)) by @UnSubble in #269
Bump actions/setup-go from 5 to 6 by @dependabot[bot] in #266

New Contributors

@ataypamart made their first contribution in #243
@sashamelentyev made their first contribution in #244
@qualidafial made their first contribution in #282
@majiayu000 made their first contribution in #275
[@UnSubble](https://redirect.

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

red-hat-konflux · 2026-03-30T10:36:53Z

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

5 additional dependencies were updated

Details:

Package	Change
`cloud.google.com/go/spanner`	`v1.88.0` -> `v1.89.0`
`github.com/olekukonko/errors`	`v0.0.0-20250405072817-4e6d85265da6` -> `v1.2.0`
`cloud.google.com/go/storage`	`v1.56.0` -> `v1.61.3`
`github.com/clipperhouse/uax29/v2`	`v2.2.0` -> `v2.6.0`
`github.com/googleapis/gax-go/v2`	`v2.19.0` -> `v2.20.0`

red-hat-konflux · 2026-04-02T23:44:50Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

6 additional dependencies were updated

Details:

Package	Change
`google.golang.org/genproto`	`v0.0.0-20260319201613-d00831a3d3e7` -> `v0.0.0-20260519071638-aa98bba5eb94`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260319201613-d00831a3d3e7` -> `v0.0.0-20260526163538-3dc84a4a5aaa`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260319201613-d00831a3d3e7` -> `v0.0.0-20260610212136-7ab31c22f7ad`
`google.golang.org/protobuf`	`v1.36.11` -> `v1.36.12-0.20260120151049-f2248ac996af`
`github.com/google/pprof`	`v0.0.0-20260302011040-a15ffb7f9dcc` -> `v0.0.0-20260507013755-92041b743c96`
`golang.org/x/telemetry`	`v0.0.0-20260311193753-579e4da9a98c` -> `v0.0.0-20260610154732-fb80ec83bdd9`

red-hat-konflux · 2026-06-20T02:23:41Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: github.com/imdario/mergo@v1.0.2: parsing go.mod:
	module declares its path as: dario.cat/mergo
	        but was required as: github.com/imdario/mergo

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot added the dependencies label Mar 30, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch 10 times, most recently from d4f51ff to a877c81 Compare April 2, 2026 18:54

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch 17 times, most recently from f85ffe1 to 7e7a584 Compare April 7, 2026 22:22

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch 23 times, most recently from c21538c to 5d4d4d8 Compare April 18, 2026 02:18

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch 5 times, most recently from 02ef21e to 6cf1688 Compare April 18, 2026 22:18

chore(deps): update go dependencies

5ddc76f

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update go dependencies#605

chore(deps): update go dependencies#605
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/go-deps

red-hat-konflux Bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented Apr 2, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented Jun 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

red-hat-konflux Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

v0.57.0: v1.33.0/v0.57.0

What's Changed

New Contributors

v0.56.0: v1.32.0/v0.56.0

What's Changed

New Contributors

v2.74.0: Beam 2.74.0 release

Highlights

I/Os

New Features / Improvements

Breaking Changes

Deprecations

Bugfixes

v2.73.0: Beam 2.73.0 release

Highlights

I/Os

New Features / Improvements

Breaking Changes

Bugfixes

Security Fixes

List of Contributors

v2.72.0: Beam 2.72.0 release

Highlights

I/Os

New Features / Improvements

Deprecations

Bugfixes

Security Fixes

List of Contributors

What's Changed

New Contributors

SDK Features

What's Changed

Breaking change

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

Configuration

Documentation

Uh oh!

red-hat-konflux Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ Artifact update notice

File name: go.mod

Uh oh!

red-hat-konflux Bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

red-hat-konflux Bot commented Jun 20, 2026

⚠️ Artifact update problem

File name: go.sum

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

red-hat-konflux Bot commented Mar 30, 2026 •

edited

Loading

`v0.57.0`: v1.33.0/v0.57.0

`v0.56.0`: v1.32.0/v0.56.0

`v2.74.0`: Beam 2.74.0 release

`v2.73.0`: Beam 2.73.0 release

`v2.72.0`: Beam 2.72.0 release

red-hat-konflux Bot commented Mar 30, 2026 •

edited

Loading

red-hat-konflux Bot commented Apr 2, 2026 •

edited

Loading