chore(deps): update go indirect dependencies by deckhouse-BOaTswain · Pull Request #112 · deckhouse/module-sdk

deckhouse-BOaTswain · 2026-06-01T00:11:53Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/cloudflare/cfssl	`v1.6.5` -> `v1.7.0`
github.com/deckhouse/deckhouse/pkg/log	`v0.2.0` -> `v0.2.1`
github.com/docker/cli	`v29.4.0+incompatible` -> `v29.8.2+incompatible`
github.com/docker/docker-credential-helpers	`v0.9.3` -> `v0.9.9`
github.com/evanphx/json-patch	`v5.9.0+incompatible` -> `v5.9.11+incompatible`
github.com/fsnotify/fsnotify	`v1.9.0` -> `v1.10.1`
github.com/fxamacker/cbor/v2	`v2.9.2` -> `v2.9.4`
github.com/go-logr/logr	`v1.4.3` -> `v1.4.4`
github.com/go-openapi/jsonpointer	`v0.23.1` -> `v0.24.0`
github.com/go-openapi/swag	`v0.25.5` -> `v0.29.2`
github.com/go-openapi/swag/cmdutils	`v0.25.5` -> `v0.29.2`
github.com/go-openapi/swag/conv	`v0.25.5` -> `v0.29.2`
github.com/go-openapi/swag/fileutils	`v0.25.5` -> `v0.29.2`
github.com/go-openapi/swag/jsonname	`v0.26.0` -> `v0.29.2`
github.com/go-openapi/swag/jsonutils	`v0.25.5` -> `v0.29.2`
github.com/go-openapi/swag/loading	`v0.25.5` -> `v0.29.2`
github.com/go-openapi/swag/mangling	`v0.25.5` -> `v0.29.2`
github.com/go-openapi/swag/netutils	`v0.25.5` -> `v0.29.2`
github.com/go-openapi/swag/stringutils	`v0.25.5` -> `v0.29.2`
github.com/go-openapi/swag/typeutils	`v0.25.5` -> `v0.29.2`
github.com/go-openapi/swag/yamlutils	`v0.25.5` -> `v0.29.2`
github.com/google/certificate-transparency-go	`v1.3.2` -> `v1.3.3`
github.com/google/go-containerregistry	`v0.21.3` -> `v0.22.1`
github.com/hashicorp/errwrap	`v1.0.0` -> `v1.1.0`
github.com/itchyny/gojq	`v0.12.17` -> `v0.12.19`
github.com/itchyny/timefmt-go	`v0.1.6` -> `v0.1.9`
github.com/jmoiron/sqlx	`v1.3.5` -> `v1.4.0`
github.com/mailru/easyjson	`v0.7.7` -> `v0.9.2`
github.com/pelletier/go-toml	`v1.9.3` -> `v1.9.5`
github.com/prometheus/client_golang	`v1.23.2` -> `v1.24.1`
github.com/prometheus/client_model	`v0.6.2` -> `v0.6.3`
github.com/prometheus/common	`v0.66.1` -> `v0.72.0`
github.com/prometheus/procfs	`v0.16.1` -> `v0.22.0`
github.com/sirupsen/logrus	`v1.9.4` -> `v1.10.2`
github.com/sylabs/oci-tools	`v0.19.0` -> `v0.20.2`
github.com/tidwall/match	`v1.1.1` -> `v1.2.0`
github.com/tidwall/pretty	`v1.2.0` -> `v1.2.2`
github.com/vbatts/tar-split	`v0.12.2` -> `v0.12.3`
github.com/weppos/publicsuffix-go	`v0.30.0` -> `v0.50.3`
github.com/zmap/zlint/v3	`v3.5.0` -> `v3.7.2`
go.yaml.in/yaml/v3	`v3.0.4` -> `v3.0.5`
golang.org/x/net	`v0.58.0` -> `v0.59.0`
golang.org/x/oauth2	`v0.36.0` -> `v0.37.0`
golang.org/x/sync	`v0.22.0` -> `v0.23.0`
golang.org/x/sys	`v0.47.0` -> `v0.48.0`
golang.org/x/term	`v0.45.0` -> `v0.46.0`
golang.org/x/text	`v0.41.0` -> `v0.42.0`
golang.org/x/time	`v0.11.0` -> `v0.16.0`
gomodules.xyz/jsonpatch/v2	`v2.4.0` -> `v2.5.0`
gotest.tools/v3	`v3.4.0` -> `v3.5.2`
gotest.tools/v3	`v3.5.1` -> `v3.5.2`
k8s.io/api	`v0.35.8` -> `v0.37.1`
k8s.io/apiextensions-apiserver	`v0.35.8` -> `v0.37.1`
k8s.io/apimachinery	`v0.35.8` -> `v0.37.1`
k8s.io/client-go	`v0.35.8` -> `v0.37.1`
sigs.k8s.io/controller-runtime	`v0.23.3` -> `v0.25.2`
sigs.k8s.io/structured-merge-diff/v6	`v6.3.2` -> `v6.4.2`

Release Notes

cloudflare/cfssl (github.com/cloudflare/cfssl)

`v1.7.0`

Compare Source

Changelog

5c9bfdf Add scripts to regenerate {api,bundler,ubiquity}'s testdata
2adc622 Create semgrep.yml
faaff55 Fixes #1237 partially by updating test data certificates to be valid
dd8f9ef Github actions linter uses golangci-lint@v1.57
adad8d8 Merge pull request #1 from ang-cloudflare/fix-pr-1434-review-findings
12a0add Merge pull request #1055 from akoserwal/master
361a3a5 Merge pull request #1364 from cloudflare/dependabot/go_modules/golang.org/x/crypto-0.21.0
03f2681 Merge pull request #1365 from cloudflare/dependabot/go_modules/github.com/go-sql-driver/mysql-1.8.0
d6d030a Merge pull request #1368 from cloudflare/dependabot/go_modules/github.com/google/certificate-transparency-go-1.1.8
91b63b5 Merge pull request #1395 from cloudflare/hrushikeshdeshpande-creating-semgrep-yml
cb0a0a3 Merge pull request #1408 from mitch292/mitch292/certificate-transparency-go-bump
730ee58 Merge pull request #1409 from mitch292/mitch292/revert-ct-go-upgrade
1c1bc0b Merge pull request #1410 from mitch292/mitch292/1237-fix-test-cases
6d2d0b2 Merge pull request #1412 from mitch292/mitch292/fix-linting
b898d2f Merge pull request #1415 from mitch292/mitch292/go-version
ed8df49 Merge pull request #1416 from cloudflare/mschwarzl/dockerignore
82408a1 Merge pull request #1434 from elukey/master
e429e72 Merge pull request #1436 from mitch292/fix-copy-extensions-security-bypass
7d5fdbb Merge pull request #1445 from ang-cloudflare/ang/SECENG-13957
e71a023 Merge pull request #1447 from cloudflare/dianatran/goreleaser-v2
800f0c5 Migrate goreleaser config to v2 and limit build parallelism
62db351 Regenerate api's testdata
214a154 Regenerate bundler's testdata
f8821d5 Regenerate ubiquity's testdata
14f61be Revert "Upgrade certificate-transparency-go from v1.1.8 to v1.3.1"
05f2d4f SECENG-13957: feat: add ML-DSA-44/65/87 post-quantum key support
038e4d2 Update README
2bc4eb0 Update READMe
2312d45 Update certstore_development and sqlit_test dbs after testdata update
a40f86c Update repository to reflect required min go version of 1.20
d3645c1 Update semgrep.yml
1a73d78 Upgrade certificate-transparency-go from v1.1.8 to v1.3.1
b4650b5 build(deps): bump github.com/go-sql-driver/mysql from 1.7.1 to 1.8.0
a421aee build(deps): bump github.com/google/certificate-transparency-go
d13ac5d build(deps): bump golang.org/x/crypto from 0.19.0 to 0.21.0
ea2095d fix: preserve regenerated fixture coverage
8994bdd fix: prevent CSR extensions from overriding CA-managed key usage in copy_extensions
cd8a4de ignore .git to .dockerignore

docker/cli (github.com/docker/cli)

docker/docker-credential-helpers (github.com/docker/docker-credential-helpers)

`v0.9.9`

Compare Source

What's Changed

update to go1.26.7
Dockerfile: update to debian trixie, libgcc-12-dev, ubuntu 24.04 (noble)
README: remove Go Report Card badge
build(deps): bump docker/* actions
build(deps): bump actions/checkout from 6.0.3 to 7.0.1
build(deps): bump actions/setup-go from 6.4.0 to 7.0.0
build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0
build(deps): bump crazy-max/.github/.github/workflows/zizmor.yml from 1.10.0 to 1.11.0
build(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.2

Full Changelog: docker/docker-credential-helpers@v0.9.8...v0.9.9

`v0.9.8`

Compare Source

What's Changed

update to go1.26.4
wincred: inline label, and append to existing
build(deps): bump actions/checkout from 6.0.2 to 6.0.3
build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1
build(deps): bump crazy-max/.github/.github/workflows/zizmor.yml from 1.7.1 to 1.10.0
build(deps): bump docker/bake-action from 7.1.0 to 7.2.0
build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0
build(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0

Full Changelog: docker/docker-credential-helpers@v0.9.7...v0.9.8

`v0.9.7`

Compare Source

What's Changed

update to go1.26.3
ci: update zizmore action to v1.7.1

Full Changelog: docker/docker-credential-helpers@v0.9.6...v0.9.7

`v0.9.6`

Compare Source

What's Changed

update to go1.25.9
secretservice: allow building on openbsd
wincred: minor cleanups
Dockerfile: document build-args
Dockerfile: update golangci-lint to v2.11
Dockerfile: update xx to v1.9.0
ci: set default permissions and timeouts
ci: update actions
ci: pin actions by sha
ci: add zizmor workflow

Full Changelog: docker/docker-credential-helpers@v0.9.5...v0.9.6

`v0.9.5`

Compare Source

What's Changed

build(deps): bump actions/checkout from 5 to 6 #395
build(deps): bump actions/upload-artifact from 4 to 6 #398
build(deps): bump softprops/action-gh-release from 2.3.3 to 2.4.1 #391
build(deps): bump softprops/action-gh-release from 2.4.1 to 2.5.0 #397
Dockerfile: remove redundant DEBIAN_FRONTEND=noninteractive #404
Dockerfile: update golangci-lint to v2.8 #402
gha: update some actions to ubuntu 24.04 #401
update to go1.25.2 #392
update to go1.25.5 #399

Full Changelog: docker/docker-credential-helpers@v0.9.4...v0.9.5

`v0.9.4`

Compare Source

What's Changed

update to go1.25.1 #387
wincred: fix unsafe uintptr usage to be GC-safe on go1.25 #386
gha: add macos-15-intel, remove macos-13 (deprecated) #384
deb: Dockerfile: update to debian bookworm, ubuntu jammy (22.04) #385
Dockerfile: update xx to v1.7.0 #383
Dockerfile: update golangci-lint to v2.5 #386
Dockerfile: merge build stages #249
build(deps): bump github.com/danieljoos/wincred v1.2.3 #388
build(deps): bump softprops/action-gh-release from 2.2.1 to 2.3.2 #373
build(deps): bump actions/checkout from 4 to 5 #376
build(deps): bump actions/setup-go from 5 to 6 #377
build(deps): bump actions/github-script from 7 to 8 #378
build(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 #379

Full Changelog: docker/docker-credential-helpers@v0.9.3...v0.9.4

evanphx/json-patch (github.com/evanphx/json-patch)

`v5.9.11+incompatible`

Compare Source

`v5.9.10+incompatible`

Compare Source

fsnotify/fsnotify (github.com/fsnotify/fsnotify)

`v1.10.1`

Compare Source

Changes and fixes

inotify: don't remove sibling watches sharing a path prefix (#754)
inotify, windows: don't rename sibling watches sharing a path prefix
(#755)

`v1.10.0`

Compare Source

This version of fsnotify needs Go 1.23.

Changes and fixes

inotify: improve initialization error message (#731)
inotify: send Rename event if recursive watch is renamed (#696)
inotify: avoid copying event buffers when reading names (#741)
kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (#748)
kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (#740)
windows: fix nil pointer dereference in remWatch (#736)
windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (#709, #749)

fxamacker/cbor (github.com/fxamacker/cbor/v2)

`v2.9.4`

Compare Source

This release fixes potential panics when decoding a CBOR map whose key decodes to an uncomparable Go value under certain conditions.

Not affected: user apps that don't register tag types and don't use map key types that are either named empty interfaces (e.g. type MyAny any) or contain interfaces.

These potential panics can be encountered when one of these two conditions is met:

user application registers a tag type (via TagSet interface) that is an array or struct with uncomparable or interface{} element or field type, or
user application specifies a destination Go map whose key type is a named empty interface type or a type containing an interface.

This was identified while improving tests and reviewing code for an upcoming release.

Tests and fuzz tests were extended to cover this bug.

Upgrading to v2.9.4 is recommended.

What's Changed

Fix panic decoding uncomparable map keys under certain conditions by @fxamacker in #817

Full Changelog: fxamacker/cbor@v2.9.3...v2.9.4

`v2.9.3`

Compare Source

This release fixes a potential panic when decoding into a time.Time from a CBOR byte string, map, or array under certain conditions.

Not affected: standard CBOR time data (RFC 8949 tag 0 or tag 1), and decoders configured with timeTag = DecTagRequired.

Upgrading to v2.9.3 is recommended.

The panic stack trace was publicly reported on 2026-08-17, and the fix was released the same day. Fuzz testing was extended to cover this class of bug, and fuzzing of v2.9.3 is ongoing.

What's Changed

Skip data item when decoding to time.Time fails under certain conditions by @fxamacker in #803

Full Changelog: fxamacker/cbor@v2.9.2...v2.9.3

go-logr/logr (github.com/go-logr/logr)

`v1.4.4`

Compare Source

What's Changed

drop +build tags by @pohly in #401
CI: avoid floating dependencies, fix issues by @pohly in #432
Bump to Go 1.26 by @thockin in #445
funcr: bound slog.Group nesting depth to prevent stack overflow by @martinholovsky in #447
funcr: Handle and test recursive values by @thockin in #446

New Contributors

@martinholovsky made their first contribution in #447

Full Changelog: go-logr/logr@v1.4.3...v1.4.4

go-openapi/jsonpointer (github.com/go-openapi/jsonpointer)

`v0.24.0`

Compare Source

0.24.0 - 2026-06-29

Full Changelog: go-openapi/jsonpointer@v0.23.2...v0.24.0

17 commits in this release.

Implemented enhancements

feat(jsonname): added new json name provider more respectful of go conventions for JSON (#195) by @fredbi ...

Refactor

refact: refactored the package into multiple specialized sub-packages by @fredbi ...
refact loading, jsonutils, yamlutils utililities by @fredbi ...

Documentation

doc: announced dependencies reshuffle for v0.24.0 by @fredbi in #142 ...
licensing: modernized the licensing of source code. by @fredbi ...

Code quality

chore: wired the local jsonname package & relinted by @fredbi ...
lint: fix modernize issues by @alexandear ...
chore: improved mono-repo management by @fredbi ...
chore(ci): setup monorepo linting and fixed automerge by @fredbi ...

Testing

test: upgraded tests to use generics (#176) by @fredbi ...
test: upgraded to go-openapi/testify@v2.3.0 (#175) by @fredbi ...

Miscellaneous tasks

chore: removed most remaining external dependencies by @fredbi ...

Updates

build(deps): bump the go-openapi-dependencies group across 15 directories with 2 updates by @dependabot[bot] ...
build(deps): bump the go-openapi-dependencies group across 15 directories with 2 updates by @dependabot[bot] ...

Other (technical)

Import/jsonname by @fredbi in #141 ...
Remove dependency to mailru/easyjson by default by @fredbi ...
split packages as modules by @fredbi ...

People who contributed to this release

jsonpointer license terms

`v0.23.2`

Compare Source

0.23.2 - 2026-06-26

Full Changelog: go-openapi/jsonpointer@v0.23.1...v0.23.2

13 commits in this release.

Implemented enhancements

feat(ci): added shared workflow for bot-pr monitoring by @fredbi ...

Documentation

ci: post README announcements to discord + bump ci-workflows to v0.4.0 by @fredbi in #139 ...
doc: updated contributors file by @bot-go-openapi[bot] in #134 ...
doc: updated contributors file by @bot-go-openapi[bot] in #129 ...

Miscellaneous tasks

chore(ci): run contributors workflow monthly instead of weekly by @fredbi in #138 ...

Updates

chore(deps): bump github.com/go-openapi/testify/v2 from 2.5.1 to 2.6.0 in the go-openapi-dependencies group by @dependabot[bot] in #140 ...
chore(deps): bump go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml from 93b1676 to 2e57e83 in the development-dependencies group by @dependabot[bot] in #137 ...
chore(deps): bump github.com/go-openapi/swag/jsonname from 0.26.0 to 0.26.1 in the go-openapi-dependencies group across 1 directory by [@dependabot[bot]](https://redirect.github.com/depen

Configuration

📅 Schedule: Branch creation - "before 06:00 on monday" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

deckhouse-BOaTswain · 2026-06-01T00:11:56Z