Skip to content

Bump the go-deps group across 1 directory with 8 updates #1000

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump the go-deps group across 1 directory with 8 updates #1000

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 8, 2026

Bumps the go-deps group with 8 updates in the / directory:

Package From To
github.com/cyphar/filepath-securejoin 0.6.0 0.6.1
github.com/fluxcd/pkg/apis/meta 1.23.0 1.24.0
github.com/fluxcd/pkg/auth 0.33.0 0.34.0
github.com/fluxcd/pkg/runtime 0.90.0 0.93.0
github.com/go-git/go-billy/v5 5.6.2 5.7.0
github.com/go-git/go-git/v5 5.16.3 5.16.4
github.com/google/go-containerregistry 0.20.6 0.20.7
github.com/onsi/gomega 1.38.2 1.38.3

Updates github.com/cyphar/filepath-securejoin from 0.6.0 to 0.6.1

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.6.1] - 2025-11-19

At last up jumped the cunning spider, and fiercely held her fast.

Fixed

  • Our logic for deciding whether to use openat2(2) or fallback to an O_PATH resolver would cache the result to avoid doing needless test runs of openat2(2). However, this causes issues when pathrs-lite is being used by a program that applies new seccomp-bpf filters onto itself -- if the filter denies openat2(2) then we would return that error rather than falling back to the O_PATH resolver. To resolve this issue, we no longer cache the result if openat2(2) was successful, only if there was an error.
  • A file descriptor leak in our openat2 wrapper (when doing the necessary dup for RESOLVE_IN_ROOT) has been removed.

[0.5.2] - 2025-11-19

"Will you walk into my parlour?" said a spider to a fly.

Fixed

  • Our logic for deciding whether to use openat2(2) or fallback to an O_PATH resolver would cache the result to avoid doing needless test runs of openat2(2). However, this causes issues when pathrs-lite is being used by a program that applies new seccomp-bpf filters onto itself -- if the filter denies openat2(2) then we would return that error rather than falling back to the O_PATH resolver. To resolve this issue, we no longer cache the result if openat2(2) was successful, only if there was an error.
  • A file descriptor leak in our openat2 wrapper (when doing the necessary dup for RESOLVE_IN_ROOT) has been removed.
Commits
  • 9c4135b VERSION: release 0.6.1
  • d952bef merge v0.5.x branch into main
  • deb72a4 CHANGELOG: fix unreleased links
  • 336bf8f merge #87 into cyphar/filepath-securejoin:v0.5.x
  • 23c6e21 VERSION: back to development
  • 6311ca8 VERSION: release v0.5.2
  • 91da803 merge #86 into cyphar/filepath-securejoin:v0.5.x
  • 4dbce7c gopathrs: close the fd after dup in openat2
  • 1eaadd6 merge #85 into cyphar/filepath-securejoin:main
  • c1c2a53 gopathrs: close the fd after dup in openat2
  • Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/apis/meta from 1.23.0 to 1.24.0

Commits
  • f3c7b60 Merge pull request #1042 from fluxcd/add-queue
  • 9b058c8 Prepare for release
  • 4f7f34b runtime/controller: add support for detecting enqueue events while reconciling
  • 22fc427 Merge pull request #1060 from arvatoaws-labs/main
  • aa1f17c feat: add support for aws eusc domain
  • a65ff96 Merge pull request #1059 from fluxcd/improve-job-kstatus
  • 077fa74 runtime/statusreaders: improve Job status reader
  • cac5502 Merge pull request #1054 from cappyzawa/proxy-url-validation
  • e4755ca Prepare for release
  • 8a1b950 runtime/secrets: validate proxy URL scheme and length
  • Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/auth from 0.33.0 to 0.34.0

Commits
  • c866cff Merge pull request #980 from fluxcd/fix-typo
  • 72ea7ac github: Remove redundant options
  • 66a0184 Merge pull request #979 from fluxcd/preview-release
  • e9a43c6 Add Preview Release workflow
  • 6d798f4 Merge pull request #960 from fluxcd/restconfig
  • 8bef64b [RFC-0010] Introduce authentication for clusters
  • 97cc6ae Merge pull request #978 from fluxcd/make-sops-secret
  • e4649ae runtime/secrets: Add MakeSOPSSecret
  • 5d6f266 Merge pull request #977 from fluxcd/set-secret-gvk
  • 5aaefdf runtime/secrets: Set GVK on generated secrets
  • Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.90.0 to 0.93.0

Commits
  • f3c7b60 Merge pull request #1042 from fluxcd/add-queue
  • 9b058c8 Prepare for release
  • 4f7f34b runtime/controller: add support for detecting enqueue events while reconciling
  • 22fc427 Merge pull request #1060 from arvatoaws-labs/main
  • aa1f17c feat: add support for aws eusc domain
  • a65ff96 Merge pull request #1059 from fluxcd/improve-job-kstatus
  • 077fa74 runtime/statusreaders: improve Job status reader
  • cac5502 Merge pull request #1054 from cappyzawa/proxy-url-validation
  • e4755ca Prepare for release
  • 8a1b950 runtime/secrets: validate proxy URL scheme and length
  • Additional commits viewable in compare view

Updates github.com/go-git/go-billy/v5 from 5.6.2 to 5.7.0

Release notes

Sourced from github.com/go-git/go-billy/v5's releases.

v5.7.0

What's Changed

Full Changelog: go-git/go-billy@v5.6.2...v5.7.0

Commits
  • cc50ee7 Merge pull request #177 from go-git/renovate/releases/v5.x-go-golang.org-x-ne...
  • c3a9003 build: Update module golang.org/x/net to v0.38.0 [SECURITY]
  • 9263834 Merge pull request #171 from bitfehler/releases/v5.x
  • 94b84fc Add support for Chmod on billy.Filesystem
  • See full diff in compare view

Updates github.com/go-git/go-git/v5 from 5.16.3 to 5.16.4

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.16.4

What's Changed

Full Changelog: go-git/go-git@v5.16.3...v5.16.4

Commits
  • de8ecc3 Merge pull request #1743 from go-git/renovate/releases/v5.x-go-github.com-go-...
  • 3e752f0 build: Update module github.com/go-git/go-git/v5 to v5.13.0 [SECURITY]
  • 3a31754 Merge pull request #1741 from go-git/renovate/releases/v5.x-go-github.com-clo...
  • acc28f1 build: Update module github.com/cloudflare/circl to v1.6.1 [SECURITY]
  • 95f3880 Merge pull request #1742 from go-git/renovate/releases/v5.x-go-golang.org-x-n...
  • 329f926 build: Update module golang.org/x/net to v0.38.0 [SECURITY]
  • 399e04b Merge pull request #1734 from pjbgf/fix-ci
  • 2025eae build: test, Fix build on Windows.
  • fb6806f Merge pull request #1732 from swills/find-hash-panic-fix-backport
  • 382530f plumbing: format/idxfile, prevent panic
  • See full diff in compare view

Updates github.com/google/go-containerregistry from 0.20.6 to 0.20.7

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.20.7

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.20.6...v0.20.7

Commits
  • e075f20 go mod tidy on dependabot update (#2171)
  • 45aacf4 Bump the actions group across 1 directory with 3 updates (#2170)
  • 073b936 Update dependencies and deprecate DockerVersion field (#2164)
  • 390dacd Bump golang.org/x/crypto from 0.38.0 to 0.45.0 in /cmd/krane (#2163)
  • ca44d47 Bump golang.org/x/crypto from 0.38.0 to 0.45.0 in /pkg/authn/k8schain (#2162)
  • 999cc1f Bump github.com/docker/docker (#2161)
  • d1809c8 Build artifacts for riscv64 (#2159)
  • 7471efd Bump the auxiliary-deps group across 3 directories with 4 updates (#2156)
  • 2bb5bb0 Bump the actions group with 5 updates (#2155)
  • 16371c1 Remove manual vendor setting for dependabot (#2151)
  • Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.38.2 to 1.38.3

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.38.3

1.38.3

Fixes

make string formatitng more consistent for users who use format.Object directly

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.38.3

Fixes

make string formatitng more consistent for users who use format.Object directly

Commits
  • a3ca2ca v1.38.3
  • 4dada36 fix failing have http tests
  • d40c691 make string formatitng more consistent for users who use format.Object directly
  • 2a37b46 doc: fix typos
  • ee26170 docs: fix HaveValue example
  • cc85c05 Bump actions/setup-go from 5 to 6 (#866)
  • 8905788 Bump github.com/onsi/ginkgo/v2 from 2.25.1 to 2.25.3 (#865)
  • 67552c5 chore: apply fixes from Go modernize command
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the go-deps group across 1 directory with 8 updates
07b407a 
Bumps the go-deps group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.6.0` | `0.6.1` |
| [github.com/fluxcd/pkg/apis/meta](https://github.com/fluxcd/pkg) | `1.23.0` | `1.24.0` |
| [github.com/fluxcd/pkg/auth](https://github.com/fluxcd/pkg) | `0.33.0` | `0.34.0` |
| [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.90.0` | `0.93.0` |
| [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) | `5.6.2` | `5.7.0` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.16.3` | `5.16.4` |
| [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.20.6` | `0.20.7` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.38.2` | `1.38.3` |



Updates `github.com/cyphar/filepath-securejoin` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/cyphar/filepath-securejoin/releases)
- [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md)
- [Commits](cyphar/filepath-securejoin@v0.6.0...v0.6.1)

Updates `github.com/fluxcd/pkg/apis/meta` from 1.23.0 to 1.24.0
- [Commits](fluxcd/pkg@apis/meta/v1.23.0...apis/meta/v1.24.0)

Updates `github.com/fluxcd/pkg/auth` from 0.33.0 to 0.34.0
- [Commits](fluxcd/pkg@git/v0.33.0...git/v0.34.0)

Updates `github.com/fluxcd/pkg/runtime` from 0.90.0 to 0.93.0
- [Commits](fluxcd/pkg@runtime/v0.90.0...runtime/v0.93.0)

Updates `github.com/go-git/go-billy/v5` from 5.6.2 to 5.7.0
- [Release notes](https://github.com/go-git/go-billy/releases)
- [Commits](go-git/go-billy@v5.6.2...v5.7.0)

Updates `github.com/go-git/go-git/v5` from 5.16.3 to 5.16.4
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](go-git/go-git@v5.16.3...v5.16.4)

Updates `github.com/google/go-containerregistry` from 0.20.6 to 0.20.7
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.20.6...v0.20.7)

Updates `github.com/onsi/gomega` from 1.38.2 to 1.38.3
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.38.2...v1.38.3)

---
updated-dependencies:
- dependency-name: github.com/cyphar/filepath-securejoin
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/fluxcd/pkg/apis/meta
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/fluxcd/pkg/auth
  dependency-version: 0.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/fluxcd/pkg/runtime
  dependency-version: 0.93.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/go-git/go-billy/v5
  dependency-version: 5.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.16.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.20.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency label Jan 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant