Skip to content

build(deps): bump the go-dependency group across 1 directory with 4 updates#236

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependency-b0c41aaa07
Open

build(deps): bump the go-dependency group across 1 directory with 4 updates#236
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependency-b0c41aaa07

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 16, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependency group with 3 updates in the / directory: github.com/absmach/magistrala, github.com/dgraph-io/badger/v4 and oras.land/oras-go/v2.

Updates github.com/absmach/magistrala from 0.20.0 to 0.30.0

Release notes

Sourced from github.com/absmach/magistrala's releases.

v0.30.0

What's Changed

Full Changelog: absmach/magistrala@v0.20.0...v0.30.0

Commits
  • cb364d0 NOISSUE - Update FluxMQ dependency
  • b68c9fe NOISSUE - Bump the go-dependency group with 4 updates (#3528)
  • 0d50489 NOISSUE - Update FMQ version
  • 24edbe6 NOISSUE - Bump golang from 1.26.3-alpine3.22 to 1.26.4-alpine3.22 in /docker ...
  • 610da72 NOISSUE - Bump codecov/codecov-action from 6 to 7 in /.github/workflows in th...
  • 90672e5 NOISSUE - Bump the go-dependency group across 1 directory with 12 updates (#3...
  • 5821d2a NOISSUE - Sign server certificate with SANs for container hostnames (#3524)
  • 4948873 NOISSUE - Fix queue subscriptions (#3522)
  • 493073a NOISSUE - Update dependencies
  • 5a528dd NOISSUE - Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 in /.github/...
  • Additional commits viewable in compare view

Updates github.com/dgraph-io/badger/v4 from 4.9.1 to 4.9.2

Release notes

Sourced from github.com/dgraph-io/badger/v4's releases.

v4.9.2

What's Changed

New Contributors

Full Changelog: dgraph-io/badger@v4.9.1...v4.9.2

Changelog

Sourced from github.com/dgraph-io/badger/v4's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

Commits
  • 284cea0 fix(compaction): clamp baseLevel to >=1 to prevent L0->L0 panic on la… (#2296)
  • 897f12f fix : read only user should be able to open db on ReadOnly mode (#2268)
  • ca9e10b enh: compile with jemalloc 5.3.1 (#2275)
  • 7427d56 perf: skip lsm lookup for expired entries during value log rewrite (#2269)
  • 773a835 fix: Prevent NPE on sync with inmemory DB (#2264)
  • abbb9a5 fix(cd): upload build artifacts to GitHub Release (#2273)
  • 796cb85 chore(core): remove unused event log (#2257)
  • See full diff in compare view

Updates golang.org/x/sync from 0.20.0 to 0.21.0

Commits

Updates oras.land/oras-go/v2 from 2.6.0 to 2.6.1

Release notes

Sourced from oras.land/oras-go/v2's releases.

v2.6.1

This is a security patch release addressing five advisories in the authentication, remote, and content layers, plus accumulated bug fixes and maintenance since v2.6.0.

Security Fixes

  • Drop the Authorization header on cross-origin redirects to prevent origin credentials leaking to a redirect target on a different scheme/port of the same host (GHSA-vh4v-2xq2-g5cg)
  • Validate the bearer realm host before sending credentials to prevent credential exfiltration to an attacker-controlled token service, including TLS downgrades and IP-literal metadata endpoints; adds TrustedRealmHosts (GHSA-28r5-37g7-p6mp, GHSA-xf85-363p-868w)
  • Validate the Location host before blob upload to prevent credentials being forwarded to a cross-host upload endpoint (SSRF / CWE-918) (#1152, GHSA-jxpm-75mh-9fp7)
  • Reject descriptor sizes exceeding 32 MiB in content.ReadAll to prevent a crafted OCI layout from triggering a makeslice panic and crashing the process (#1153, GHSA-f36w-mj3v-6jqv)
  • Resolve symlinks when enforcing the workingDir write boundary in content/file, blocking writes that escape the boundary via a symlinked path component when AllowPathTraversalOnWrite=false

Bug Fixes

  • graph.Memory should use digest as map key (#1095)
  • Fix credentials key for the Docker registry-1 host (#966)
  • Support an empty credentials file (#959)

Other Changes

  • Add GitOps release workflow with goreleaser (#1161)
  • Shift the Go support window to [1.24, 1.25] (#991)
  • Run go modernize (#1005)
  • Sync CODEOWNERS and OWNERS.md from main to v2 (#1122)
  • Remove scripts reference from the Makefile (#960)
  • Bump golang.org/x/sync 0.14.0 → 0.20.0 (#971, #978, #1001, #1037, #1078, #1121)
  • Bump GitHub Actions: actions/checkout 4→5 (#989), actions/setup-go 5→6 (#998), actions/stale 9→10 (#997), github/codeql-action 3→4 (#1016)
Commits
  • 47b7c80 release: v2.6.1 (#1195)
  • 3c2e884 Merge commit from fork
  • cc323e5 Merge commit from fork
  • 7a9f4b0 Merge commit from fork
  • d593d50 feat: add gitops release workflow with goreleaser (#1161)
  • 5fd67f9 fix(content): reject descriptor sizes exceeding 32 MiB in ReadAll (#1153)
  • 4683c46 fix: validate Location host before blob upload to prevent credential leak (#1...
  • 4a3e611 build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 (#1121)
  • 00de1f0 chore: sync CODEOWNERS and OWNERS.md from main to v2 (#1122)
  • d7b6f8e fix: graph.Memory should use digest as map key (#1095)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the go-dependency group across 1 directory with 4 u…
0a41b55 
…pdates

Bumps the go-dependency group with 3 updates in the / directory: [github.com/absmach/magistrala](https://github.com/absmach/magistrala), [github.com/dgraph-io/badger/v4](https://github.com/dgraph-io/badger) and [oras.land/oras-go/v2](https://github.com/oras-project/oras-go).


Updates `github.com/absmach/magistrala` from 0.20.0 to 0.30.0
- [Release notes](https://github.com/absmach/magistrala/releases)
- [Commits](absmach/magistrala@v0.20.0...v0.30.0)

Updates `github.com/dgraph-io/badger/v4` from 4.9.1 to 4.9.2
- [Release notes](https://github.com/dgraph-io/badger/releases)
- [Changelog](https://github.com/dgraph-io/badger/blob/main/CHANGELOG.md)
- [Commits](dgraph-io/badger@v4.9.1...v4.9.2)

Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
- [Commits](golang/sync@v0.20.0...v0.21.0)

Updates `oras.land/oras-go/v2` from 2.6.0 to 2.6.1
- [Release notes](https://github.com/oras-project/oras-go/releases)
- [Commits](oras-project/oras-go@v2.6.0...v2.6.1)

---
updated-dependencies:
- dependency-name: github.com/absmach/magistrala
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependency
- dependency-name: github.com/dgraph-io/badger/v4
  dependency-version: 4.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependency
- dependency-name: golang.org/x/sync
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependency
- dependency-name: oras.land/oras-go/v2
  dependency-version: 2.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependency
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants