chore(deps): bump the minor-and-patch group with 11 updates

[dependabot]

Bumps the minor-and-patch group with 11 updates:

Package	From	To
github.com/go-webauthn/webauthn	0.17.4	0.18.0
github.com/xraph/chronicle	1.6.2	1.6.4
github.com/xraph/herald	1.6.1	1.6.2
github.com/xraph/keysmith	1.6.2	1.6.3
github.com/xraph/relay	1.6.2	1.6.3
github.com/xraph/warden	1.6.2	1.6.4
go.mongodb.org/mongo-driver/v2	2.8.0	2.9.0
golang.org/x/crypto	0.55.0	0.56.0
github.com/xraph/dispatch	1.6.2	1.6.5
github.com/xraph/ledger	1.6.1	1.6.4
github.com/xraph/vault	1.6.1	1.6.4

Updates github.com/go-webauthn/webauthn from 0.17.4 to 0.18.0

Release notes

Sourced from github.com/go-webauthn/webauthn's releases.

v0.18.0

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int https://github.com/go-webauthn/webauthn/blob/HEAD/MIGRATION.md as they are substantial between ths version and prior versions.

Bug Fixes

• metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
• metadata: consistent revocation policy and client timeouts (#740) (34d324b)
• metadata: handle certificate chains of any depth (#737) (309ea69)
• metadata: honour status report order and effective dates (#736) (8be5355)
• metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
• metadata: prevent panic corrupt blob (#698) (c5fd013)
• metadata: report malformed status report urls (#738) (ed82f7c)
• protocol: allow any attestation eku (#728) (f4e33fc)
• protocol: androidkey missing authorization list member (#727) (9b02b19)
• protocol: androidkey union generated (#729) (3ed3e75)
• protocol: bind credential public key curve to its algorithm (#752) (314c2be)
• protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
• protocol: compound returns incorrect type (#731) (025d897)
• protocol: credential public key match limited to ECDSA (#732) (b4df26e)
• protocol: harden credential response and options handling (#763) (de0ae6c)
• protocol: missing tpm steps (#725) (f9a63f9)
• protocol: opaque origin matching and validation (#758) (37f065a)
• protocol: possible panic conditions (#719) (0ea14e7)
• protocol: safetynet validation steps (#726) (e12f6e8)
• protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
• webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
• webauthncose: validate okp key algorithm (#759) (98c528b)
• webauthn: deprecations and handle check (#745) (8619bb9)
• webauthn: include backup flag check in registration (#748) (26a4868)
• webauthn: only update uv flag (#746) (b39c822)
• webauthn: use session relying party id (#747) (ebb45e2)

Features

• metadata: update to r46 anchor (#780) (20f33e6)
• ml-dsa preference list and gated availability (#768) (db1e068)
• protocol: client capability enumeration (#765) (62f4489)
• protocol: compound sub-statement scope (#742) (34271da)
• protocol: current user details signal constructor (#766) (b6db923)
• protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
• protocol: related origins well-known document (#753) (05d54dc)
• protocol: relying party attestation policy (#741) (3239ed0)

... (truncated)

Changelog

Sourced from github.com/go-webauthn/webauthn's changelog.

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int [MIGRATION.md] as they are substantial between ths version and prior versions.

Bug Fixes

• metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
• metadata: consistent revocation policy and client timeouts (#740) (34d324b)
• metadata: handle certificate chains of any depth (#737) (309ea69)
• metadata: honour status report order and effective dates (#736) (8be5355)
• metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
• metadata: prevent panic corrupt blob (#698) (c5fd013)
• metadata: report malformed status report urls (#738) (ed82f7c)
• protocol: allow any attestation eku (#728) (f4e33fc)
• protocol: androidkey missing authorization list member (#727) (9b02b19)
• protocol: androidkey union generated (#729) (3ed3e75)
• protocol: bind credential public key curve to its algorithm (#752) (314c2be)
• protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
• protocol: compound returns incorrect type (#731) (025d897)
• protocol: credential public key match limited to ECDSA (#732) (b4df26e)
• protocol: harden credential response and options handling (#763) (de0ae6c)
• protocol: missing tpm steps (#725) (f9a63f9)
• protocol: opaque origin matching and validation (#758) (37f065a)
• protocol: possible panic conditions (#719) (0ea14e7)
• protocol: safetynet validation steps (#726) (e12f6e8)
• protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
• webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
• webauthncose: validate okp key algorithm (#759) (98c528b)
• webauthn: deprecations and handle check (#745) (8619bb9)
• webauthn: include backup flag check in registration (#748) (26a4868)
• webauthn: only update uv flag (#746) (b39c822)
• webauthn: use session relying party id (#747) (ebb45e2)

Features

• metadata: update to r46 anchor (#780) (20f33e6)
• ml-dsa preference list and gated availability (#768) (db1e068)
• protocol: client capability enumeration (#765) (62f4489)
• protocol: compound sub-statement scope (#742) (34271da)
• protocol: current user details signal constructor (#766) (b6db923)
• protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
• protocol: related origins well-known document (#753) (05d54dc)
• protocol: relying party attestation policy (#741) (3239ed0)
• typed extension inputs and outputs (#734) (0661c81)

... (truncated)

Commits

• 109da34 release: v0.18.0 (#782)
• 4977ba1 docs: breaking (#781)
• f8eb85e build(deps): update github/codeql-action action to v4.37.9 (#779)
• 20f33e6 feat(metadata): update to r46 anchor (#780)
• bca8ebd test: add fuzz tests (#777)
• 9b6dffd build(deps): update github/codeql-action action to v4.37.8 (#776)
• 2190797 build: update to go 1.27 (#775)
• 97b0d9f build(deps): update dependency go to v1.27.0 (#774)
• f815453 build(deps): update module github.com/stretchr/testify to v1.12.1 (#772)
• a456bad build(deps): update go toolchain directive to v1.27.0 (#773)
• Additional commits viewable in compare view

Updates github.com/xraph/chronicle from 1.6.2 to 1.6.4

Release notes

Sourced from github.com/xraph/chronicle's releases.

v1.6.4

Changes

• ci: ran go mod tidy (c5ffddc)

---

Installation

go get github.com/xraph/chronicle@v1.6.4

Full Changelog: xraph/chronicle@v1.6.3...v1.6.4

v1.6.3

Changes

• chore: bumped version of forge deps (7c50015)

---

Installation

go get github.com/xraph/chronicle@v1.6.3

Full Changelog: xraph/chronicle@v1.6.2...v1.6.3

Commits

• c5ffddc ci: ran go mod tidy
• 7c50015 chore: bumped version of forge deps
• See full diff in compare view

Updates github.com/xraph/herald from 1.6.1 to 1.6.2

Release notes

Sourced from github.com/xraph/herald's releases.

v1.6.2

Changes

• chore: updated forge deps (992da03)
• build: require sibling modules at versions that exist (65fba95)

---

Installation

go get github.com/xraph/herald@v1.6.2

Full Changelog: xraph/herald@v1.6.1...v1.6.2

Commits

• 992da03 chore: updated forge deps
• 65fba95 build: require sibling modules at versions that exist
• See full diff in compare view

Updates github.com/xraph/keysmith from 1.6.2 to 1.6.3

Release notes

Sourced from github.com/xraph/keysmith's releases.

v1.6.3

Changes

• chore: updated forge deps (55b057f)

---

Installation

go get github.com/xraph/keysmith@v1.6.3

Full Changelog: xraph/keysmith@v1.6.2...v1.6.3

Commits

• 55b057f chore: updated forge deps
• See full diff in compare view

Updates github.com/xraph/relay from 1.6.2 to 1.6.3

Release notes

Sourced from github.com/xraph/relay's releases.

v1.6.3

Changes

• chore: updated forge deps (617d25b)
• chore: bumped version of forge deps (8163f7c)
• chore: updated gitignore (c6ee6b4)

---

Installation

go get github.com/xraph/relay@v1.6.3

Full Changelog: xraph/relay@v1.6.2...v1.6.3

Commits

• 617d25b chore: updated forge deps
• 8163f7c chore: bumped version of forge deps
• c6ee6b4 chore: updated gitignore
• See full diff in compare view

Updates github.com/xraph/warden from 1.6.2 to 1.6.4

Release notes

Sourced from github.com/xraph/warden's releases.

v1.6.4

Warden v1.6.4 (2026-09-03T04:08:45Z)

Composable RBAC + ABAC + ReBAC + PBAC for Go, with a declarative .warden config language and language server in the box.

Changelog

Installation

Using go install

go install github.com/xraph/warden/cmd/warden@v1.6.4
go install github.com/xraph/warden/cmd/warden-lsp@v1.6.4

Pre-built binaries

Download the appropriate archive for your platform from the assets below. Each archive contains both warden and warden-lsp.

Verify checksums:

shasum -a 256 -c checksums.txt

VS Code extension

The companion VS Code extension is published as xraph.vscode-warden and released on its own vscode-warden/v*.*.* tag schedule. See the extension README.

What's Changed

Full changelog: xraph/warden@v1.6.3...v1.6.4

v1.6.3

Warden v1.6.3 (2026-08-26T14:01:05Z)

Composable RBAC + ABAC + ReBAC + PBAC for Go, with a declarative .warden config language and language server in the box.

Changelog

Installation

Using go install

... (truncated)

Commits

• f49d907 chore: update forge deps
• ea36bae chore: bumped forge version
• See full diff in compare view

Updates go.mongodb.org/mongo-driver/v2 from 2.8.0 to 2.9.0

Release notes

Sourced from go.mongodb.org/mongo-driver/v2's releases.

MongoDB Go Driver 2.9.0

The MongoDB Go Driver Team is pleased to release version 2.9.0 of the official MongoDB Go Driver.

Release Highlights

[!WARNING] The minimum supported MongoDB server version is now 4.4.

[!WARNING] The minimum supported Go version is now 1.25. The Go Driver supports the last 2 Go minor versions.

New ext/awsauth module

The new ext/awsauth module adds support for all AWS authentication methods via the official AWS SDK for Go. Applications running on AWS can now use an awsauth.CredentialsProvider in ClientOptions, ClientEncryptionOptions, and AutoEncryptionOptions.

For example, to configure a mongo.Client with the new ext/awsauth module:

import (
    "context"
    "log"
"github.com/aws/aws-sdk-go-v2/config"
"go.mongodb.org/mongo-driver/ext/awsauth"
"go.mongodb.org/mongo-driver/v2/mongo"
"go.mongodb.org/mongo-driver/v2/mongo/options"

)
func main() {
cfg, err := config.LoadDefaultConfig(context.Background())
if err != nil {
log.Fatal(err)
}
provider := awsauth.NewCredentialsProvider(cfg.Credentials)
credential := options.Credential{
	AuthMechanism:          "MONGODB-AWS",
	AWSCredentialsProvider: provider,
}
client, err := mongo.Connect(options.Client().SetAuth(credential))
if err != nil {
log.Fatal(err)
}
defer client.Disconnect(context.Background())
// ...

}

[!NOTE]

... (truncated)

Commits

• 099a81f BUMP v2.9.0
• 3c87f21 GODRIVER-4101 Add tlsDisableCertificateRevocationCheck option. (#2571)
• 5e5fba9 Bump testdata/specifications from d9d69f5 to 70a628b (#2576)
• ac30cac GODRIVER-4109: Exclude OCSP errors from backpressure label (#2584)
• 15ca7a0 GODRIVER-4096 Fix panic in Collection.insert on out-of-order write errors (#2...
• 325f1ac Bump github/codeql-action from 4.37.8 to 4.37.9 in the actions group (#2583)
• 4fe3377 GODRIVER-4062 Remove the ServerOverloadedError retry example. (#2568)
• ed6483f Bump github.com/bombsimon/logrusr/v4 from 4.1.0 to 4.2.0 (#2580)
• b575bc1 Bump github.com/bitfield/script from 0.24.3 to 0.25.0 (#2552)
• 5ba69b9 Bump .evergreen/drivers-evergreen-tools from 890a93b to c70d29e (#2575)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.55.0 to 0.56.0

Commits

• 86efde5 ssh: reject unexpected message types on established channels
• a6cdac6 ssh: drop traffic on undecided channels
• 39dc44e ssh: don't skip the source-address critical option in CheckCert
• afebf4c x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+
• 89f4e9b x509roots/fallback: update bundle
• 71488c4 ssh/knownhosts: compare only public key portions for revocation
• 82adefa ssh: synchronize unexpected response test
• c757c98 all: upgrade go directive to at least 1.26.0 [generated]
• 593c81a ssh: correctly ignore pre-banner lines
• 46efc8b acme: add crypto.SignMessage test coverage
• Additional commits viewable in compare view

Updates github.com/xraph/dispatch from 1.6.2 to 1.6.5

Release notes

Sourced from github.com/xraph/dispatch's releases.

v1.6.5

Changes

• Merge pull request #31 from xraph/fix/client-expired-context (a188970)
• chore: bumped forge version (3defc4c)

---

Installation

go get github.com/xraph/dispatch@v1.6.5

What's Changed

• chore: bumped forge version by @​juicycleff in xraph/dispatch#31

Full Changelog: xraph/dispatch@v1.6.4...v1.6.5

v1.6.4

Changes

• Merge pull request #30 from xraph/fix/client-expired-context (79ea9be)
• fix(client): honour an already-cancelled context before sending (fdfc5ab)

---

Installation

go get github.com/xraph/dispatch@v1.6.4

What's Changed

• fix(client): honour an already-cancelled context before sending by @​juicycleff in xraph/dispatch#30

Full Changelog: xraph/dispatch@v1.6.3...v1.6.4

Commits

• a188970 Merge pull request #31 from xraph/fix/client-expired-context
• 3defc4c chore: bumped forge version
• 79ea9be Merge pull request #30 from xraph/fix/client-expired-context
• fdfc5ab fix(client): honour an already-cancelled context before sending
• b529178 Merge pull request #29 from xraph/fix/shim-sigterm-exit-window
• c1f25c5 fix(exec/subprocess): wait out the reap before probing the grandchild
• 634bf87 chore(exec/shim): annotate the gosec findings that are false positives
• 1ec1ed6 fix(exec/shim): stop a late SIGTERM killing a clean shutdown
• ba94efa Merge pull request #28 from xraph/track-c-execution-isolation
• 1f8d57c chore: bumped forge deps
• See full diff in compare view

Updates github.com/xraph/ledger from 1.6.1 to 1.6.4

Release notes

Sourced from github.com/xraph/ledger's releases.

v1.6.4

Changes

• chore: updated forge deps (7fe72a3)

---

Installation

go get github.com/xraph/ledger@v1.6.4

Full Changelog: xraph/ledger@v1.6.3...v1.6.4

v1.6.3

Changes

• chore: go update the forge deps (867a57a)

---

Installation

go get github.com/xraph/ledger@v1.6.3

Full Changelog: xraph/ledger@v1.6.2...v1.6.3

v1.6.2

Changes

• chore: bumoed version of forge deps (38f2381)

---

Installation

go get github.com/xraph/ledger@v1.6.2

Full Changelog: xraph/ledger@v1.6.1...v1.6.2

Commits

• 7fe72a3 chore: updated forge deps
• 867a57a chore: go update the forge deps
• 38f2381 chore: bumoed version of forge deps
• See full diff in compare view

Updates github.com/xraph/vault from 1.6.1 to 1.6.4

Release notes

Sourced from github.com/xraph/vault's releases.

v1.6.4

Changes

• Merge pull request #20 from xraph/wisdom/kin-169-fix-vault-postgres-setsecret-scalar-scan-breaks-all (b5f5d25)
• fix(store): scan whole rows for version lookups so SetSecret works at all (c6a398b)

---

Installation

go get github.com/xraph/vault@v1.6.4

What's Changed

• fix(store): scan whole rows for version lookups so SetSecret works at all by @​Whizzie99 in xraph/vault#20

New Contributors

• @​Whizzie99 made their first contribution in xraph/vault#20

Full Changelog: xraph/vault@v1.6.3...v1.6.4

v1.6.3

Changes

• ci: ran go mod tidy (2fa28e9)
• ci: ran go mod tidy (61d85d6)

---

Installation

go get github.com/xraph/vault@v1.6.3

Full Changelog: xraph/vault@v1.6.2...v1.6.3

v1.6.2

Changes

• chore: go update the forge deps (2c13355)

---

Installation

</tr></table> 

... (truncated)

Commits

• b5f5d25 Merge pull request #20 from xraph/wisdom/kin-169-fix-vault-postgres-setsecret...
• 2fa28e9 ci: ran go mod tidy
• 61d85d6 ci: ran go mod tidy
• c6a398b fix(store): scan whole rows for version lookups so SetSecret works at all
• 2c13355 chore: go update the forge deps
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions