Bump the go-modules-updates group across 1 directory with 4 updates

[dependabot]

Bumps the go-modules-updates group with 4 updates in the / directory: github.com/go-pkgz/lgr, github.com/stretchr/testify, go.mongodb.org/mongo-driver/v2 and golang.org/x/net.

Updates github.com/go-pkgz/lgr from 0.12.4 to 0.13.0

Release notes

Sourced from github.com/go-pkgz/lgr's releases.

Version 0.13.0

New Features

• change the list of hidden secrets at runtime: AddSecrets and RemoveSecrets on Logger, and package-level lgr.AddSecrets and lgr.RemoveSecrets for the global logger and the std logger set by SetupStdLogger. Safe to call while other goroutines log. Secrets are now replaced longest first, with equal-length values in byte order. This can change output for overlapping secrets and for secrets matching part of the ****** replacement marker: Secret("abc", "abcdef") logs ****** for abcdef where it used to log ******def, and Secret("abc", "bcde") on abcde logs a****** where it used to log ******de #32 @​umputun

Bug Fixes

• StackTraceOnError trimmed lgr's own frames only when the sources were in a directory named lgr, so a module cache install printed the whole stack 417d6cc
• lgr.Map with a Mapper that has no TimeFunc panicked on the first logged line 5e2756c

Commits

• dac59bf Merge pull request #32 from go-pkgz/runtime-secrets
• f63e5b1 fix README wording on partially overlapping secrets
• 26691ae read test directory from the compiled file path
• 417d6cc fix stack trace trimming outside of a directory named lgr
• 5e2756c fix panic on mapper with nil TimeFunc
• 176d1c3 add runtime changes to the list of hidden secrets
• db4fd0b make caller info tests independent of checkout directory name
• See full diff in compare view

Updates github.com/stretchr/testify from 1.12.0 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

Commits

• 959dbda Merge pull request #1935 from harryzcy/yaml-update
• 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
• 0358d0e change yaml library to go.yaml.in/yaml/v3
• See full diff in compare view

Updates go.mongodb.org/mongo-driver/v2 from 2.8.2 to 2.9.2

Release notes

Sourced from go.mongodb.org/mongo-driver/v2's releases.

MongoDB Go Driver 2.9.2

The MongoDB Go Driver Team is pleased to release version 2.9.2 of the official MongoDB Go Driver.

Release Highlights

[!WARNING] Go Driver versions v2.1.0 through v2.8.1 and v2.9.0 through v2.9.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite. The fix shipped in v2.8.2 but was not included in v2.9.0 or v2.9.1. This release restores the fix for the 2.9 line. Users on v2.9.0 or v2.9.1 are encouraged to upgrade to Go Driver v2.9.2 as soon as possible. Go Driver v1 is not affected.

[!WARNING]
Go Driver versions v1.1.0 and later and v2.0.0 through v2.9.1 are affected by a security issue CVE-2026-107325 in the bson.RawArray.Validate method. This release resolves that security issue in Go Driver v2. Users are encouraged to upgrade to Go Driver v2.9.2 as soon as possible.

This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.

This release addresses CVE-2026-107325, a security issue in calling bson.RawArray.Validate. Calling bson.RawArray.Validate on an array whose declared length is 0 causes a runtime panic.

It also restores a fix from v2.8.1 that was likewise missing from v2.9.0 and v2.9.1: when a command's first attempt failed with a server error and the retry reported NoWritesPerformed, operations such as Database.RunCommand could return a nil error instead of the server error. They now return the original server error.

Sessions now inherit timeoutMS from the client, so operations run in a session honor the client-level timeout.

What's Changed

🐛 Fixed

• GODRIVER-4142: Inherit timeoutMS at the session level (#2586) by @​prestonvasquez in mongodb/mongo-go-driver#2598
• GODRIVER-4135 Reject negative uncompressed size in DecompressPayload. by @​qingyang-hu in mongodb/mongo-go-driver#2607
• GODRIVER-4083 fix duplicate error logging for network error by @​ayesha-ilm in mongodb/mongo-go-driver#2595
• GODRIVER-4136: reject BSON lengths below the 5-byte minimum before slicing by @​rajath201 in mongodb/mongo-go-driver#2591
• GODRIVER-4118 fix: correct Truncate boundary handling for multi-byte UTF-8 characters by @​zigzagdev in mongodb/mongo-go-driver#2564
• GODRIVER-4177 guard empty documents slice in decodeOpReply QueryFailure branch by @​rajath201 in mongodb/mongo-go-driver#2638
• GODRIVER-4075 Return an error if there are invalid characters in the … by @​prestonvasquez in mongodb/mongo-go-driver#2665
• GODRIVER-4088 Return the server error when the first attempt fails wi… by @​prestonvasquez in mongodb/mongo-go-driver#2666

Full Changelog: mongodb/mongo-go-driver@v2.9.1...v2.9.2

MongoDB Go Driver 2.9.1

The MongoDB Go Driver Team is pleased to release version 2.9.1 of the official MongoDB Go Driver.

Release Highlights

[!WARNING]
Go Driver versions v1.0.0 through v1.17.9 and v2.0.0 through v2.9.0 are affected by a security issue CVE-2026-88031 in the GridFS delete methods. This release resolves that security issue in Go Driver v2. Users are encouraged to upgrade to Go Driver v2.9.1 as soon as possible. For the fix in Go Driver v1, see the v1.17.10 release.

This release addresses CVE-2026-88031, a security issue in GridFS delete methods where the file ID lookup could match more loosely than intended, potentially causing unintended file (and chunk) deletions instead of an exact match on the given file ID.

Users can manually restrict the file ID with a $eq operator before passing it to GridFSBucket methods using code like the following.

func exactMatch(id any) bson.D {
	return bson.D{{"$eq", id}}
}
</tr></table>

... (truncated)

Commits

• df261dc BUMP v2.9.2
• 16b6195 GODRIVER-4088 Return the server error when the first attempt fails wi… (#2666)
• de647b7 GODRIVER-4075 Return an error if there are invalid characters in the … (#2665)
• 59c2e6b GODRIVER-4177 guard empty documents slice in decodeOpReply QueryFailure branc...
• 15edca6 GODRIVER-4138 Latest server binary downloads require private S3. (#2660)
• 74278b9 GODRIVER-4118 fix: correct Truncate boundary handling for multi-byte UTF-8 ch...
• 13954c2 GODRIVER-4168: Authenticate the Claude review with the drivers PR bot app (#2...
• 8f9da57 GODRIVER-4168: Run Claude review only when the claude-review label is applied...
• 44ee9af GODRIVER-4168: Add Claude GitHub workflow (#2632)
• a097394 GODRIVER-4136: reject BSON lengths below the 5-byte minimum before slicing (#...
• Additional commits viewable in compare view

Updates golang.org/x/net from 0.58.0 to 0.61.0

Commits

• c1d31df go.mod: update golang.org/x dependencies
• 8456a20 quic: properly check for allowed frame types in a packet
• 18ece0c http2: prevent crash due to HPACK encoder race
• 2d03f9d http2: avoid 2x refund on stream close with buffered data
• cc7d34f http2: avoid excessive work on initial window changes
• 57f4235 http2: apply header limits to Trailer headers too
• 01e3d03 http2: coalesce dials via wrapped Transport.RoundTrip
• 2824783 http2: delete malformed framing-related headers
• b13c0c1 internal/http3: delete HTTP/3 package
• 520c891 quic: off-path support in loss/congestion/rtt
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions