Skip to content

fix(deps): update go dependencies#1783

Open
renovate[bot] wants to merge 5 commits intodevfrom
renovate/go-non-major
Open

fix(deps): update go dependencies#1783
renovate[bot] wants to merge 5 commits intodevfrom
renovate/go-non-major

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Apr 6, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/antchfx/xmlquery v1.4.4v1.5.1 age confidence
github.com/asticode/go-astisub v0.34.0v0.39.0 age confidence
github.com/crewjam/saml v0.4.14v0.5.1 age confidence
github.com/dgraph-io/ristretto/v2 v2.1.0v2.4.0 age confidence
github.com/gin-contrib/gzip v1.2.2v1.2.6 age confidence
github.com/gin-gonic/gin v1.10.0v1.12.0 age confidence
github.com/go-gormigrate/gormigrate/v2 v2.1.3v2.1.5 age confidence
github.com/go-ldap/ldap/v3 v3.4.10v3.4.13 age confidence
github.com/go-sql-driver/mysql v1.9.1v1.9.3 age confidence
github.com/golang-jwt/jwt/v5 v5.2.2v5.3.1 age confidence
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3v2.28.0 age confidence
github.com/icza/gox v0.2.0v0.2.6 age confidence
github.com/meilisearch/meilisearch-go v0.31.0v0.36.2 age confidence
github.com/prometheus/client_golang v1.21.1v1.23.2 age confidence
github.com/shirou/gopsutil/v4 v4.25.9v4.26.3 age confidence
github.com/sirupsen/logrus v1.9.3v1.9.4 age confidence
github.com/spf13/viper v1.20.0v1.21.0 age confidence
golang.org/x/crypto v0.48.0v0.50.0 age confidence
golang.org/x/sync v0.19.0v0.20.0 age confidence
google.golang.org/grpc v1.79.3v1.80.0 age confidence
google.golang.org/protobuf v1.36.10v1.36.11 age confidence
gorm.io/driver/mysql v1.5.7v1.6.0 age confidence
gorm.io/gorm v1.25.12v1.31.1 age confidence

Release Notes

antchfx/xmlquery (github.com/antchfx/xmlquery)

v1.5.1

Compare Source

Update packages:
  • update github.com/antchfx/xpath from v1.3.5 to v1.3.6

v1.5.0

Compare Source

New Features
  • Add xml.ProcInst supports. Include the new ProcessingInstruction Node Type (#​133, #​106)
  • Add a LineNumbers feature that allows retrieving the line number of each node in the XML file via the WithLineNumbers option. (#​132 by @​aufi)
  • New methods: ChildNodes() (#​127 by @​rmkane)
Other

update github.com/antchfx/xpath from 1.3.3 to 1.3.5. See https://github.com/antchfx/xpath/releases

asticode/go-astisub (github.com/asticode/go-astisub)

v0.39.0

Compare Source

v0.38.0

Compare Source

v0.37.0

Compare Source

v0.36.0

Compare Source

v0.35.0

Compare Source

crewjam/saml (github.com/crewjam/saml)

v0.5.1

Compare Source

v0.5.0

Compare Source

dgraph-io/ristretto (github.com/dgraph-io/ristretto/v2)

v2.4.0

Compare Source

Added
  • Implement public Cache.IterValues() method (#​475)
  • Allow custom key types with underlying types in Key constraint (#​478)
Fixed
  • Fix compilation on 32-bit archs (#​465)

Full Changelog: dgraph-io/ristretto@v2.3.0...v2.4.0

v2.3.0: Ristretto v2.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: dgraph-io/ristretto@v2.2.0...v2.3.0

v2.2.0: Ristretto v2.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: dgraph-io/ristretto@v2.1.0...v2.2.0

gin-contrib/gzip (github.com/gin-contrib/gzip)

v1.2.6

Compare Source

Changelog

Enhancements
Build process updates
Others

v1.2.5

Compare Source

Changelog

Bug fixes
Enhancements

v1.2.4

Compare Source

Changelog

Bug fixes
Enhancements
Build process updates

v1.2.3

Compare Source

Changelog

Enhancements
  • 3b246bb: chore: update dependencies to latest versions focused on security patches (@​appleboy)
Build process updates
gin-gonic/gin (github.com/gin-gonic/gin)

v1.12.0

Compare Source

Features
  • feat(render): add bson protocol (#​4145)
  • feat(context): add GetError and GetErrorSlice methods for error retrieval (#​4502)
  • feat(binding): add support for encoding.UnmarshalText in uri/query binding (#​4203)
  • feat(gin): add option to use escaped path (#​4420)
  • feat(context): add Protocol Buffers support to content negotiation (#​4423)
  • feat(context): implemented Delete method (#​38e7651)
  • feat(logger): color latency (#​4146)
Enhancements
  • perf(tree): reduce allocations in findCaseInsensitivePath (#​4417)
  • perf(recovery): optimize line reading in stack function (#​4466)
  • perf(path): replace regex with custom functions in redirectTrailingSlash (#​4414)
  • perf(tree): optimize path parsing using strings.Count (#​4246)
  • chore(logger): allow skipping query string output (#​4547)
  • chore(context): always trust xff headers from unix socket (#​3359)
  • chore(response): prevent Flush() panic when the underlying ResponseWriter does not implement http.Flusher (#​4479)
  • refactor(recovery): smart error comparison (#​4142)
  • refactor(context): replace hardcoded localhost IPs with constants (#​4481)
  • refactor(utils): move util functions to utils.go (#​4467)
  • refactor(binding): use maps.Copy for cleaner map handling (#​4352)
  • refactor(context): using maps.Clone (#​4333)
  • refactor(ginS): use sync.OnceValue to simplify engine function (#​4314)
  • refactor: replace magic numbers with named constants in bodyAllowedForStatus (#​4529)
  • refactor: for loop can be modernized using range over int (#​4392)
Bug Fixes
  • fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#​4535)
  • fix(render): write content length in Data.Render (#​4206)
  • fix(context): ClientIP handling for multiple X-Forwarded-For header values (#​4472)
  • fix(binding): empty value error (#​2169)
  • fix(recover): suppress http.ErrAbortHandler in recover (#​4336)
  • fix(gin): literal colon routes not working with engine.Handler() (#​4415)
  • fix(gin): close os.File in RunFd to prevent resource leak (#​4422)
  • fix(response): refine hijack behavior for response lifecycle (#​4373)
  • fix(binding): improve empty slice/array handling in form binding (#​4380)
  • fix(debug): version mismatch (#​4403)
  • fix: correct typos, improve documentation clarity, and remove dead code (#​4511)
Build process updates / CI
  • ci: update Go version support to 1.25+ across CI and docs (#​4550)
  • chore(binding): upgrade bson dependency to mongo-driver v2 (#​4549)

v1.11.0

Compare Source

Features
  • feat(gin): Experimental support for HTTP/3 using quic-go/quic-go (#​3210)
  • feat(form): add array collection format in form binding (#​3986), add custom string slice for form tag unmarshal (#​3970)
  • feat(binding): add BindPlain (#​3904)
  • feat(fs): Export, test and document OnlyFilesFS (#​3939)
  • feat(binding): add support for unixMilli and unixMicro (#​4190)
  • feat(form): Support default values for collections in form binding (#​4048)
  • feat(context): GetXxx added support for more go native types (#​3633)
Enhancements
  • perf(context): optimize getMapFromFormData performance (#​4339)
  • refactor(tree): replace string(/) with "/" in node.insertChild (#​4354)
  • refactor(render): remove headers parameter from writeHeader (#​4353)
  • refactor(context): simplify "GetType()" functions (#​4080)
  • refactor(slice): simplify SliceValidationError Error method (#​3910)
  • refactor(context):Avoid using filepath.Dir twice in SaveUploadedFile (#​4181)
  • refactor(context): refactor context handling and improve test robustness (#​4066)
  • refactor(binding): use strings.Cut to replace strings.Index (#​3522)
  • refactor(context): add an optional permission parameter to SaveUploadedFile (#​4068)
  • refactor(context): verify URL is Non-nil in initQueryCache() (#​3969)
  • refactor(context): YAML judgment logic in Negotiate (#​3966)
  • tree: replace the self-defined 'min' to official one (#​3975)
  • context: Remove redundant filepath.Dir usage (#​4181)
Bug Fixes
  • fix: prevent middleware re-entry issue in HandleContext (#​3987)
  • fix(binding): prevent duplicate decoding and add validation in decodeToml (#​4193)
  • fix(gin): Do not panic when handling method not allowed on empty tree (#​4003)
  • fix(gin): data race warning for gin mode (#​1580)
  • fix(context): verify URL is Non-nil in initQueryCache() (#​3969)
  • fix(context): YAML judgment logic in Negotiate (#​3966)
  • fix(context): check handler is nil (#​3413)
  • fix(readme): fix broken link to English documentation (#​4222)
  • fix(tree): Keep panic infos consistent when wildcard type build faild (#​4077)
Build process updates / CI
  • ci: integrate Trivy vulnerability scanning into CI workflow (#​4359)
  • ci: support Go 1.25 in CI/CD (#​4341)
  • build(deps): upgrade github.com/bytedance/sonic from v1.13.2 to v1.14.0 (#​4342)
  • ci: add Go version 1.24 to GitHub Actions (#​4154)
  • build: update Gin minimum Go version to 1.21 (#​3960)
  • ci(lint): enable new linters (testifylint, usestdlibvars, perfsprint, etc.) (#​4010, #​4091, #​4090)
  • ci(lint): update workflows and improve test request consistency (#​4126)
Dependency updates
  • chore(deps): bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#​4346, #​4356)
  • chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1 (#​4347)
  • chore(deps): bump actions/setup-go from 5 to 6 (#​4351)
  • chore(deps): bump github.com/quic-go/quic-go from 0.53.0 to 0.54.0 (#​4328)
  • chore(deps): bump golang.org/x/net from 0.33.0 to 0.38.0 (#​4178, #​4221)
  • chore(deps): bump github.com/go-playground/validator/v10 from 10.20.0 to 10.22.1 (#​4052)
Documentation updates
  • docs(changelog): update release notes for Gin v1.10.1 (#​4360)
  • docs: Fixing English grammar mistakes and awkward sentence structure in doc/doc.md (#​4207)
  • docs: update documentation and release notes for Gin v1.10.0 (#​3953)
  • docs: fix typo in Gin Quick Start (#​3997)
  • docs: fix comment and link issues (#​4205, #​3938)
  • docs: fix route group example code (#​4020)
  • docs(readme): add Portuguese documentation (#​4078)
  • docs(context): fix some function names in comment (#​4079)

v1.10.1

Compare Source

Features
  • refactor: strengthen HTTPS security and improve code organization
  • feat(binding): Support custom BindUnmarshaler for binding. (#​3933)
Enhancements
  • chore(deps): bump github.com/bytedance/sonic from 1.11.3 to 1.11.6 (#​3940)
  • chore(deps): bump golangci/golangci-lint-action from 4 to 5 (#​3941)
  • chore: update external dependencies to latest versions (#​3950)
  • chore: update various Go dependencies to latest versions (#​3901)
  • chore: refactor configuration files for better readability (#​3951)
  • chore: update changelog categories and improve documentation (#​3917)
  • feat: update version constant to v1.10.0 (#​3952)
Build process updates
  • ci(release): refactor changelog regex patterns and exclusions (#​3914)
  • ci(Makefile): vet command add .PHONY (#​3915)
go-gormigrate/gormigrate (github.com/go-gormigrate/gormigrate/v2)

v2.1.5

Compare Source

  • feat: log in case of error when closing rows
  • chore(ci): add 1.25 to integration-test go matrix
  • chore(integration-test): bump go to 1.25
  • chore: bump go deps

v2.1.4

Compare Source

go-ldap/ldap (github.com/go-ldap/ldap/v3)

v3.4.13

Compare Source

What's Changed

New Contributors

Full Changelog: go-ldap/ldap@v3.4.12...v3.4.13

v3.4.12

Compare Source

What's New

What's Changed

New Contributors

Full Changelog: go-ldap/ldap@v3.4.11...v3.4.12

v3.4.11

Compare Source

What's Changed

New Contributors

Full Changelog: go-ldap/ldap@v3.4.10...v3.4.11

go-sql-driver/mysql (github.com/go-sql-driver/mysql)

v1.9.3

Compare Source

What's Changed

Full Changelog: go-sql-driver/mysql@v1.9.2...v1.9.3

v1.9.2

Compare Source

v1.9.2 is a re-release of v1.9.1 due to a release process issue; no changes were made to the content.

golang-jwt/jwt (github.com/golang-jwt/jwt/v5)

v5.3.1

Compare Source

What's Changed

🔐 Features
👒 Dependencies

New Contributors

Full Changelog: golang-jwt/jwt@v5.3.0...v5.3.1

v5.3.0

Compare Source

This release is almost identical to to v5.2.3 but now correctly indicates Go 1.21 as minimum requirement.

What's Changed

Full Changelog: golang-jwt/jwt@v5.2.3...v5.3.0

v5.2.3

Compare Source

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v5.2.2...v5.2.3

grpc-ecosystem/grpc-gateway (github.com/grpc-ecosystem/grpc-gateway/v2)

v2.28.0

Compare Source

What's Changed

New Contributors

  • [@​irenarindos]

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 6am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Copy Markdown
Contributor Author

renovate bot commented Apr 6, 2026

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 24 additional dependencies were updated

Details:

Package Change
github.com/go-asn1-ber/asn1-ber v1.5.7 -> v1.5.8-0.20250403174932-29230038a667
github.com/bytedance/sonic v1.12.7 -> v1.15.0
github.com/bytedance/sonic/loader v0.2.2 -> v0.5.0
github.com/cloudwego/base64x v0.1.4 -> v0.1.6
github.com/gabriel-vasile/mimetype v1.4.8 -> v1.4.12
github.com/golang-jwt/jwt/v4 v4.5.1 -> v4.5.2
github.com/klauspost/cpuid/v2 v2.2.9 -> v2.3.0
golang.org/x/arch v0.13.0 -> v0.22.0
golang.org/x/mod v0.33.0 -> v0.34.0
golang.org/x/tools v0.42.0 -> v0.43.0
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 -> v0.1.0
github.com/beevik/etree v1.4.1 -> v1.5.0
github.com/fsnotify/fsnotify v1.8.0 -> v1.9.0
github.com/gin-contrib/sse v1.0.0 -> v1.1.0
github.com/go-playground/validator/v10 v10.24.0 -> v10.30.1
github.com/goccy/go-json v0.10.4 -> v0.10.5
github.com/pelletier/go-toml/v2 v2.2.3 -> v2.2.4
github.com/spf13/afero v1.12.0 -> v1.15.0
github.com/spf13/cast v1.7.1 -> v1.10.0
github.com/spf13/pflag v1.0.6 -> v1.0.10
github.com/ugorji/go/codec v1.2.12 -> v1.3.1
golang.org/x/net v0.50.0 -> v0.52.0
golang.org/x/sys v0.41.0 -> v0.43.0
golang.org/x/text v0.35.0 -> v0.36.0
File name: runner/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 7 additional dependencies were updated

Details:

Package Change
github.com/ebitengine/purego v0.9.0 -> v0.10.0
github.com/klauspost/compress v1.17.11 -> v1.18.0
github.com/prometheus/client_model v0.6.1 -> v0.6.2
github.com/prometheus/common v0.62.0 -> v0.66.1
github.com/prometheus/procfs v0.15.1 -> v0.16.1
github.com/tklauser/go-sysconf v0.3.15 -> v0.3.16
github.com/tklauser/numcpus v0.10.0 -> v0.11.0
File name: worker/edge/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated

Details:

Package Change
github.com/klauspost/compress v1.17.11 -> v1.18.0
github.com/prometheus/client_model v0.6.1 -> v0.6.2
github.com/prometheus/common v0.62.0 -> v0.66.1
github.com/prometheus/procfs v0.15.1 -> v0.16.1
File name: worker/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 7 additional dependencies were updated

Details:

Package Change
github.com/tklauser/go-sysconf v0.3.15 -> v0.3.16
github.com/tklauser/numcpus v0.10.0 -> v0.11.0
golang.org/x/net v0.48.0 -> v0.49.0
golang.org/x/sys v0.39.0 -> v0.41.0
golang.org/x/text v0.32.0 -> v0.33.0
github.com/ebitengine/purego v0.9.0 -> v0.10.0
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 -> v0.0.0-20260120221211-b8f7ae30c516

@renovate renovate bot force-pushed the renovate/go-non-major branch 6 times, most recently from 214a3fe to f7c50fc Compare April 9, 2026 01:00
@Mazi02 Mazi02 added the dependencies Pull requests that update a dependency file label Apr 9, 2026
@renovate renovate bot force-pushed the renovate/go-non-major branch 5 times, most recently from 904707f to 593f5b0 Compare April 9, 2026 21:19
@Mazi02 Mazi02 added the go Pull requests that update Go code label Apr 9, 2026
@renovate renovate bot force-pushed the renovate/go-non-major branch 8 times, most recently from 41b809a to ce2d779 Compare April 11, 2026 12:46
@renovate renovate bot force-pushed the renovate/go-non-major branch 3 times, most recently from 97fad36 to 4658807 Compare April 13, 2026 09:02
@renovate renovate bot force-pushed the renovate/go-non-major branch 3 times, most recently from 61bc33d to 029a7ed Compare April 13, 2026 21:58
@Mazi02
Copy link
Copy Markdown
Contributor

Mazi02 commented Apr 14, 2026

In this PR, the gorm-update could cause changes in go.work.sum. I have to run go tidy. @joschahenningsen is it ok to commit the go.work.sum here?

@joschahenningsen
Copy link
Copy Markdown
Member

Absolutely @Mazi02

@joschahenningsen
Copy link
Copy Markdown
Member

I think the blocking issue here though is the changes in the meilisearch dependency, we need to check how our usage of it breaks due to the update.

@Mazi02
Copy link
Copy Markdown
Contributor

Mazi02 commented Apr 14, 2026

Yes I looked into it and tried to adjust the methods used in there. It's only an extra argument used in deleteAllDocs and AddDocs, and hits type is stricter now so interface{} doesnt work.

I am going to run the solutions I found by you.

@Mazi02
Copy link
Copy Markdown
Contributor

Mazi02 commented Apr 14, 2026

I’m getting several staticcheck findings after the dependency upgrade.

I can address them, but before doing that I’d like to clarify whether you prefer fixing them in this PR or in a separate follow-up PR.

If we keep this PR focused on the dependency upgrade, I would temporarily disable staticcheck in pre-commit for this branch and re-enable it in a dedicated refactoring/toolchain cleanup PR.

@kordianbruck , @joschahenningsen any ideas?

@renovate renovate bot force-pushed the renovate/go-non-major branch from 029a7ed to cd41c2e Compare April 14, 2026 17:54
@renovate
Copy link
Copy Markdown
Contributor Author

renovate bot commented Apr 14, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants