fix(deps): update go-libraries by renovate-bot · Pull Request #5779 · google/osv.dev

renovate-bot · 2026-08-04T14:03:34Z

This PR contains the following updates:

Package	Change	Age	Confidence
cloud.google.com/go/datastore	`v1.25.0` → `v1.26.0`
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace	`v1.34.0` → `v1.35.0`
github.com/go-git/go-git/v6	`v6.0.0-alpha.4` → `v6.0.0-alpha.5`
github.com/klauspost/compress	`v1.19.0` → `v1.19.1`
github.com/yuin/goldmark	`v1.8.4` → `v1.8.5`
google.golang.org/api	`v0.287.1` → `v0.291.0`
google.golang.org/grpc	`v1.82.1` → `v1.83.0`

Release Notes

go-git/go-git (github.com/go-git/go-git/v6)

`v6.0.0-alpha.5`

Compare Source

What's Changed

plumbing: format/packfile, allow injecting a custom ObjectSelector by @Soph in #2142
storage: pool .pack file descriptors via internal/packhandle by @hiddeco in #2132
build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (main) by @go-git-renovate[bot] in #2148
build: Update module golang.org/x/net to v0.55.0 [SECURITY] (main) by @go-git-renovate[bot] in #2151
plumbing, storage: add CloseIdleDescriptors soft-close primitive by @hiddeco in #2133
*: harden format parsers against unbounded loops by @hiddeco in #2162
storage: pack read optimisations and storage-wide LRU FD pool by @hiddeco in #2134
plumbing: format/packfile, fix delta-base parsing bugs by @hiddeco in #2163
git: worktree, hoist Config() calls out of per-file loops by @cedric-appdirect in #1990
storage: filesystem, pool FSObject reads via PackHandle by @hiddeco in #2154
plumbing: format/index, accept empty trailing checksum on decode by @pjbgf in #2181
build: Update golang (main) by @go-git-renovate[bot] in #2182
build: Update module golang.org/x/net to v0.56.0 (main) by @go-git-renovate[bot] in #2191
*: speed up multi-pack reads via Index fanout probes by @hiddeco in #2147
Fix URL insteadOf to use longest match when multiple values exist by @AriehSchneier in #2189
transport/http, backend, utils/ioutil: fix HTTP data races on the fetch and serve paths by @georg in #2128
plumbing: protocol/packp, handle shallow-only no-op push in UpdateRequests.Decode by @yuzhuo in #2172
git: signer, add context.Context to Sign by @pjbgf in #2202
plumbing: transport/http, Expose typed auth error for Azure DevOps /_signin redirects by @jfjrh2014 in #2201
plumbing: format, faster diff patch generation by @pjbgf in #2186
plumbing: transport, Protocol v2 for upload-pack by @blmayer in #2188
plumbing: pktline, use Scanner for decoding by @aymanbagabas in #2038
internal: server/git, Fix TestGitServer_Timeout flakiness on Windows CI by @aymanbagabas in #2129
plumbing: packp, validate push options to prevent invalid characters by @aymanbagabas in #2057
plumbing: packp/capability, Zero-value-safe types and capability cleanup (1/11) by @aymanbagabas in #2206
plumbing: object, skip path validation in tree diff walk by @pjbgf in #2222
plumbing: packp/transport, Slice-based AdvRefs and v1 handling (2/11) by @aymanbagabas in #2225
plumbing: transport, Add options and result struct to GetRemoteRefs (3/11) by @aymanbagabas in #2226
git: Expose AlternatesFS on PlainOpenOptions by @andrew in #2101
plumbing: packp, Protocol v2 wire types with caller-owned packfile streaming (4/11) by @aymanbagabas in #2227
plumbing/transport: receive_pack, add ReceivePackHooks with PreReceive/PostReceive by @andrew in #2236
plumbing: transport, Protocol v2 session handshake and Command (5/11) by @aymanbagabas in #2228
plumbing: transport, ls-refs over Protocol v2 for GetRemoteRefs (6/11) by @aymanbagabas in #2229
plumbing: transport, fetch over Protocol v2 with caller-owned packfile (7/11) by @aymanbagabas in #2230
plumbing: transport, Wire Protocol v2 across HTTP and share the client core (8/11) by @aymanbagabas in #2231
plumbing: transport, Refactor server-side Protocol v2 onto packp types (9/11) by @aymanbagabas in #2232
plumbing: transport, git archive over HTTP (10/11) by @aymanbagabas in #2233
plumbing: transport, Run the upload-pack suite across v0/v1/v2 (11/11) by @aymanbagabas in #2234
plumbing: optimize Tree.Decode with ReadSlice and io.ReadFull by @Bluebugs in #1736
plumbing: object, Isolate tests from host git config. by @cedric-appdirect in #2122
plumbing: default to wire protocol v2 and close client/server conformance gaps by @pjbgf in #2237
build: Update module golang.org/x/text to v0.39.0 (main) by @go-git-renovate[bot] in #2241
build: Update golang (main) by @go-git-renovate[bot] in #2246
plumbing: object, include submodules in patches by @upuddu in #2243
storage: dotgit, reject path traversal in reference names by @Sahana2524 in #2247
plumbing: transport/http, redact credentials in error messages by @Sahana2524 in #2252
git: worktree, checkout reuse a single os.Root per reset. by @cedric-appdirect in #2259
git: Worktree: Add stores index entires with backslashes on Windows by @joshblum in #2253
storage: dotgit, align reference-name safety with refname_is_safe by @pjbgf in #2257
git: fetch, refuse to clobber existing tags by @Sahana2524 in #2250
internal: v2, skip closeReader on a cancelled context by @georg in #2269
git: include shallow references in object walker by @erka in #1792
plumbing: protocol/packp, reject control bytes in daemon request by @Sahana2524 in #2263
plumbing: protocol/packp, compare zero object ids by value in Action by @Sahana2524 in #2264
plumbing: gitignore, Clarify pattern and matcher parameters by @ahmojo in #2248
storage: filesystem, Make ObjectStorage a pointer field by @AriehSchneier in #2118
plumbing: format/index, sort entries by Name and Stage by @wacky6 in #2158
Fix CodeQL warnings by @AriehSchneier in #2126
git: worktree, fix RemoveGlob on root-level files by @NoahStarkenburg in #2219
internal: revision, fix resolution for tags containing @ and / by @tmchow in #1957
git: submodule, skip .gitmodules entries missing from the index by @gecube in #2256
build: Update module github.com/go-git/go-billy/v6 to v6.0.0-alpha.2 (main) by @go-git-renovate[bot] in #2270
build: re-enable go-billy renovate updates on v5.x by @pjbgf in #2272
build: Update github-actions (main) by @go-git-renovate[bot] in #2273
build: Update github-actions to v7 (main) (major) by @go-git-renovate[bot] in #2274
plumbing: format/gitignore, fix trailing ** matching unrelated paths by @glitch-ux in #2279
build: Update github-actions (main) by @go-git-renovate[bot] in #2280
git: worktree, make the filesystem wrapper a symlink-safe boundary by @pjbgf in #2276

New Contributors

@jfjrh2014 made their first contribution in #2201
@upuddu made their first contribution in #2243
@Sahana2524 made their first contribution in #2247
@erka made their first contribution in #1792
@ahmojo made their first contribution in #2248
@wacky6 made their first contribution in #2158
@NoahStarkenburg made their first contribution in #2219
@gecube made their first contribution in #2256
@glitch-ux made their first contribution in #2279

Full Changelog: go-git/go-git@v6.0.0-alpha.4...v6.0.0-alpha.5

klauspost/compress (github.com/klauspost/compress)

`v1.19.1`

Compare Source

What's Changed

zstd: Validate SnappyConverter literal copies by @klauspost in #1170
flate: use Peek instead of ReadByte for the bufio.Reader decode path by @joechenrh in #1169
zstd: bump avo pin, regenerate arm64 asm by @lizthegrey in #1167

New Contributors

@joechenrh made their first contribution in #1169

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

yuin/goldmark (github.com/yuin/goldmark)

`v1.8.5`

Compare Source

fix: #568

googleapis/google-api-go-client (google.golang.org/api)

`v0.291.0`

Compare Source

Features

all: Auto-regenerate discovery clients (#3666) (e3721ba)
all: Auto-regenerate discovery clients (#3670) (4067374)
all: Auto-regenerate discovery clients (#3674) (432658c)
all: Auto-regenerate discovery clients (#3676) (9998a11)
all: Auto-regenerate discovery clients (#3678) (b5c5526)
all: Auto-regenerate discovery clients (#3679) (499d9b1)

Bug Fixes

transport: Use ds.GetUniverseDomain() instead of raw ds.UniverseDomain field (#3660) (6bad358)

`v0.290.0`

Compare Source

Features

all: Auto-regenerate discovery clients (#3661) (dea11c2)
all: Auto-regenerate discovery clients (#3663) (93d30d4)

`v0.289.0`

Compare Source

Features

all: Auto-regenerate discovery clients (#3649) (6e259cb)
all: Auto-regenerate discovery clients (#3652) (5116a48)
all: Auto-regenerate discovery clients (#3653) (6c876b4)
all: Auto-regenerate discovery clients (#3655) (69af635)
all: Auto-regenerate discovery clients (#3656) (1fc8f45)
all: Auto-regenerate discovery clients (#3657) (aa8d256)
all: Auto-regenerate discovery clients (#3659) (af8d033)

`v0.288.0`

Compare Source

Features

all: Auto-regenerate discovery clients (#3647) (510a0c1)

grpc/grpc-go (google.golang.org/grpc)

`v1.83.0`: Release 1.83.0

Compare Source

Security

server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

New Features

xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
- Special Thanks: @hnefatl
xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
- This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
xds: Add support for xDS-based HTTP CONNECT proxies.
- This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)
- Special Thanks: @Yusufihsangorgel

Configuration

📅 Schedule: (in timezone Australia/Sydney)

Branch creation
- "before 6am on wednesday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

forking-renovate · 2026-08-04T14:03:36Z

ℹ️ Artifact update notice

File name: bindings/go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

1 additional dependency was updated

Details:

Package	Change
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260523011958-0a33c5d7ca68` -> `v0.0.0-20260526163538-3dc84a4a5aaa`

File name: go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

8 additional dependencies were updated

Details:

Package	Change
`cel.dev/expr`	`v0.25.1` -> `v0.25.2`
`cloud.google.com/go/auth`	`v0.20.0` -> `v0.22.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.32.0` -> `v1.33.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.58.0` -> `v0.59.0`
`github.com/go-git/go-billy/v6`	`v6.0.0-alpha.1` -> `v6.0.0-alpha.2`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.17` -> `v0.3.19`
`github.com/spiffe/go-spiffe/v2`	`v2.6.0` -> `v2.7.0`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260706201446-f0a921348800` -> `v0.0.0-20260724162435-b2f20204f0df`

forking-renovate Bot added the dependencies Pull requests that update a dependency file label Aug 4, 2026

renovate-bot force-pushed the renovate/go-libraries branch 2 times, most recently from f6c8465 to 9e4ef98 Compare August 5, 2026 10:42

fix(deps): update go-libraries

d96e0fb

renovate-bot force-pushed the renovate/go-libraries branch from 9e4ef98 to d96e0fb Compare August 6, 2026 04:36

Navigation Menu

Uh oh!

fix(deps): update go-libraries - #5779

fix(deps): update go-libraries#5779
renovate-bot wants to merge 1 commit into
google:masterfrom
renovate-bot:renovate/go-libraries

renovate-bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

forking-renovate Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate-bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v6.0.0-alpha.5

What's Changed

New Contributors

v1.19.1

What's Changed

New Contributors

v1.8.5

v0.291.0

Features

Bug Fixes

v0.290.0

Features

v0.289.0

Features

v0.288.0

Features

v1.83.0: Release 1.83.0

Security

New Features

Bug Fixes

Configuration

Uh oh!

forking-renovate Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: bindings/go/go.mod

File name: go/go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate-bot commented Aug 4, 2026 •

edited

Loading

`v6.0.0-alpha.5`

`v1.19.1`

`v1.8.5`

`v0.291.0`

`v0.290.0`

`v0.289.0`

`v0.288.0`

`v1.83.0`: Release 1.83.0

forking-renovate Bot commented Aug 4, 2026 •

edited

Loading