Skip to content

Conversation

@renovate
Copy link

@renovate renovate bot commented Oct 6, 2025

Update Request | Renovate Bot

This PR contains the following updates:

Package Change Age Adoption Passing Confidence Type Update
github.com/ProtonMail/go-crypto v1.1.0-alpha.5.0.20240827111422-b5837fa4476e -> v1.3.0 age adoption passing confidence require minor
github.com/ProtonMail/gopenpgp/v2 v2.7.5 -> v3.3.0 age adoption passing confidence require major
github.com/adrg/xdg v0.5.0 -> v0.5.3 age adoption passing confidence require patch
github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 -> v2.27.3 age adoption passing confidence require minor
github.com/planetscale/vtprotobuf 0393e58 -> ba97887 require digest
github.com/stretchr/testify v1.9.0 -> v1.11.1 age adoption passing confidence require minor
golang.org/x/sys v0.24.0 -> v0.38.0 age adoption passing confidence require minor
google.golang.org/grpc v1.66.0 -> v1.77.0 age adoption passing confidence require minor
google.golang.org/protobuf v1.34.2 -> v1.36.10 age adoption passing confidence require minor

Release Notes

ProtonMail/go-crypto (github.com/ProtonMail/go-crypto)

v1.3.0

Compare Source

What's Changed

  • API v2: Tolerate invalid key signatures if one verifies in #​284
  • Enforce acceptable hash functions in clearsign in #​281
  • Allow to set a decompressed message size limit in #​285
  • API v1: Only allow acceptable hashes when writing signatures in #​286

Full Changelog: ProtonMail/go-crypto@v1.2.0...v1.3.0

v1.2.0

Compare Source

What's Changed

Full Changelog: ProtonMail/go-crypto@v1.1.6...v1.2.0

v1.1.6

Compare Source

What's Changed

Full Changelog: ProtonMail/go-crypto@v1.1.5...v1.1.6

v1.1.5

Compare Source

What's Changed

Full Changelog: ProtonMail/go-crypto@v1.1.4...v1.1.5

v1.1.4

Compare Source

What's Changed

Full Changelog: ProtonMail/go-crypto@v1.1.3...v1.1.4

v1.1.3

Compare Source

What's Changed

Full Changelog: ProtonMail/go-crypto@v1.1.2...v1.1.3

v1.1.2

Compare Source

What's Changed

  • Cleartext Framework: Exclude the line-ending separator when decoding plaintext by @​lubux in #​242

Full Changelog: ProtonMail/go-crypto@v1.1.1...v1.1.2

v1.1.1

Compare Source

What's Changed

Full Changelog: ProtonMail/go-crypto@v1.1.0...v1.1.1

v1.1.0

Compare Source

What's Changed

This release adds full support for the new version of the OpenPGP standard, RFC 9580. In addition, the release introduces an improved non-backwards compatible v2 API. The API in the openpgp package remains fully backwards compatible while the new v2 API is located in a separate v2 package in openpgp.

For the full changes since v1.0.0, see the previous release notes. For the full changelog, see ProtonMail/go-crypto@v1.0.0...v1.1.0.

Changes since v1.1.0-beta.0:

  • Replace expiring curve448 integration test vector by @​lubux
  • Validate input key size in SEIPDv2 decryption by @​lubux

Changelog since v1.1.0-beta.0: ProtonMail/go-crypto@v1.1.0-beta.0...v1.1.0.

v1.1.0-proton

Compare Source

What's Changed

This release is v1.1.0 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.

v1.1.0-beta.0-proton

Compare Source

This pre-release is v1.1.0-beta.0 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.

v1.1.0-beta.0

Compare Source

What's Changed

Full Changelog: ProtonMail/go-crypto@v1.1.0-alpha.5...v1.1.0-beta.0

v1.1.0-alpha.5-proton

Compare Source

This pre-release is v1.1.0-alpha.5 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.

v1.1.0-alpha.4-proton

Compare Source

This pre-release is v1.1.0-alpha.4 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.

v1.1.0-alpha.3-proton

Compare Source

This pre-release is v1.1.0-alpha.3 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.

v1.1.0-alpha.2-proton

Compare Source

v1.1.0-alpha.1-proton

Compare Source

This pre-release is v1.1.0-alpha.1 with support for symmetric keys and automatic forwarding, both of which are not standardized yet.

ProtonMail/gopenpgp (github.com/ProtonMail/gopenpgp/v2)

v3.3.0

Compare Source

What's Changed
Added
  • MaxDecompressedSize option to control the maximum size of decompressed messages.
Changed
  • Update go-crypto to v1.3.0.

Full Changelog: ProtonMail/gopenpgp@v3.2.1...v3.3.0

v3.2.1

Compare Source

What's Changed

Fixed
  • Avoid double compression in signcryption with a session key by @​lubux in #​337

Full Changelog: ProtonMail/gopenpgp@v3.2.0...v3.2.1

v3.2.0

Compare Source

What's Changed
Added
Changed
  • Bumped minimum supported Go version to 1.22.0.
  • Update go-crypto fork to v1.2.0.
  • Remove pkgs/errors dependency.

Full Changelog: ProtonMail/gopenpgp@v3.1.3...v3.2.0

v3.1.3

Compare Source

What's Changed
Changed
  • Update go-crypto fork to v1.1.6

Full Changelog: ProtonMail/gopenpgp@v3.1.2...v3.1.3

v3.1.2

Compare Source

What's Changed
Changed
  • Update go-crypto fork to v1.1.5

Full Changelog: ProtonMail/gopenpgp@v3.1.1...v3.1.2

v3.1.1

Compare Source

What's Changed
Changed
  • Update go-crypto fork to v1.1.4

Full Changelog: ProtonMail/gopenpgp@v3.1.0...v3.1.1

v3.1.0

Compare Source

What's Changed
Added
Changed
  • Adapt to go-crypto cleartext API changes by @​lubux in #​310
  • Rename profile.Custom.AllowWeakRSA to profile.Custom.InsecureAllowWeakRSA
  • Update go-crypto fork to v1.1.3

Full Changelog: ProtonMail/gopenpgp@v3.0.0...v3.1.0

v3.0.0

Compare Source

What's Changed
New simplified and unified API

GopenPGP v3 introduces a new unified API for high level OpenPGP operations. In comparison to GopenPGP v2, where similar functions were dispersed across different types and required varying implementations for the same operations, GopenPGP v3 consolidates these functions into a consistent interface. Now, operations such as Sign, Verify, Encrypt, Decrypt, and Key generation are each accessible through a unified, builder like API, simplifying integration and enhancing code readability across cryptographic workflows.

However, applications migrating from v2 to v3 will need to update their API calls, as the changes are not backward-compatible. This means that all previous API calls must be rewritten to align with the new, unified API structure. GopenPGP v3 supports the migration process by offering extensive documentation and practical examples. We recommend upgrading to v3 for the latest features and improvements, but we'll continue to support GopenPGP v2 for the time being. Our support includes ongoing bug fixes and minor feature updates to ensure stability and functionality for existing users.

For usage examples of the new API, see the README. For the full documentation, see https://pkg.go.dev/github.com/ProtonMail/gopenpgp/v3.

Profiles

GopenPGP v3 introduces the concept of profiles, enabling applications to configure OpenPGP algorithm selection based on their specific needs. For most applications, the provided preset profiles offer robust and secure defaults, eliminating the need for additional configuration.

RFC 9580 and Interoperability

GopenPGP v3 adds full support for the latest OpenPGP specification, RFC 9580. Compliance with the specification has also been significantly enhanced, as confirmed by the results in the OpenPGP interoperability test suite. These enhancements in GopenPGP v3 are possible by leveraging a new API in the go-crypto fork, which enables a range of improvements in functionality, compliance, and performance.

Go Mobile Support

GopenPGP v3 aims to be fully compatible with Gomobile to provide an API for mobile platforms. For this reason, the library defaults to a builder-like pattern, which is less commonly used in Go. All code that is only relevant for mobile platforms has been moved to the mobile module.

Extending Functionality

GopenPGP v3 introduces a streaming interface across all APIs, enabling memory efficient processing of large data.
Additionally, it extends the library's functionality with various improvements, such as:

  • Consider all signatures in a message during verification and allow inspection of each.
  • Support signing with multiple keys.
  • Support encrypting to an "anonymous recipient", where the recipient KeyID is represented as all zeros in the message.
  • Add support for the intended recipient feature as specified in RFC 9580.
  • Ensure consistent behaviour across all APIs.
  • Support generating v6 keys as specified in RFC 9580.

Full Changelog: ProtonMail/gopenpgp@v2.7.5...v3.0.0.

Changelog since v3.0.0-beta.0: ProtonMail/gopenpgp@v3.0.0-beta.0...v3.0.0.

v2.9.0

Compare Source

What's Changed

Changed
  • Update go-crypto fork to v1.3.0.
  • Change min go version to 1.22.0.

Full Changelog: ProtonMail/gopenpgp@v2.8.3...v2.9.0

v2.8.3

Compare Source

What's Changed

Changed
  • Update go-crypto fork to v1.1.6

Full Changelog: ProtonMail/gopenpgp@v2.8.2...v2.8.3

v2.8.2

Compare Source

What's Changed

Changed
  • Update go-crypto fork to v1.1.4

Full Changelog: ProtonMail/gopenpgp@v2.8.1...v2.8.2

v2.8.1

Compare Source

What's Changed

Changed
  • Update go-crypto fork to v1.1.3

Full Changelog: ProtonMail/gopenpgp@v2.8.0...v2.8.1

v2.8.0

Compare Source

What's Changed

Support for RFC 9580

Adds support for reading and writing messages with RFC 9580 by updating the underlying go-crypto fork library to the latest version. Note that GopenPGP v2 currently does not support:

  • RFC 9580 intended recipients
  • RFC 9580 key generation

For full RFC 9580 support, we recommend upgrading to GopenPGP v3.

Full Changelog: ProtonMail/gopenpgp@v2.7.5...v2.8.0

adrg/xdg (github.com/adrg/xdg)

v0.5.3

Compare Source

Changelog
  • Updated xdg.SearchRuntimeFile to also look in the operating system's temporary directory for runtime files.
    This covers unlikely cases in which runtime files cannot be written relative to the base runtime directory either because it does not exist or it is not accessible, so xdg.RuntimeFile suggests the operating system's temporary directory as a suitable fallback location.
Internal
  • Improved package testing.

v0.5.2

Compare Source

Changelog
  • Updated logic of xdg.RuntimeFile: due to the special nature of the runtime directory, the function no longer attempts to create it if it does not exist. If that's the case, the function uses the operating system's temporary directory as a fallback. The function still creates subdirectories relative to the base runtime directory or its fallback.

    Justification: the creation of the runtime directory is not in the scope of this package as it has special requirements defined by the XDG Base Directory Specification. Relevant excerpt:

    The lifetime of the directory MUST be bound to the user being logged in. It MUST be created when the user first logs in and if the user fully logs out the directory MUST be removed. If the user logs in more than once they should get pointed to the same directory, and it is mandatory that the directory continues to exist from their first login to their last logout on the system, and not removed in between. Files in the directory MUST not survive reboot or a full logout/login cycle.

    Also, on Linux, the parent directories of the default user runtime directory are owned by the root user so they cannot be created by a regular user. pam_systemd is usually responsible for creating the runtime directory (/run/user/$UID).

v0.5.1

Compare Source

Changelog
  • Added support for the non-standard XDG_BIN_HOME base directory.
    See XDG base directories README section for more details.
  • Added more config and data search locations on macOS.
    • Added ~/.config at the end of the list of default locations for XDG_CONFIG_DIRS.
    • Added ~/.local/share at the end of the list of default locations for XDG_DATA_DIRS.
  • Added more application search locations on Windows:
    • %ProgramFiles%
    • %ProgramFiles%\Common Files
    • %LOCALAPPDATA%\Programs
    • %LOCALAPPDATA%\Programs\Common
Internal
  • Updated golang.org/x/sys dependency to the latest version.
  • Improved package testing.
grpc-ecosystem/grpc-gateway (github.com/grpc-ecosystem/grpc-gateway/v2)

v2.27.3

Compare Source

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.27.2...v2.27.3

v2.27.2

Compare Source

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.27.1...v2.27.2

v2.27.1

Compare Source

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.27.0...v2.27.1

v2.27.0

Compare Source

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.26.3...v2.26.4

v2.26.3

Compare Source

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.26.2...v2.26.3

v2.26.2

Compare Source

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.26.1...v2.26.2

v2.26.1

Compare Source

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.26.0...v2.26.1

v2.26.0

Compare Source

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.25.1...v2.26.0

v2.25.1

Compare Source

Support the new Opaque API in openapiv2 generated files

This release contains breaking changes from v2.25.0, in that the previously deprecated EnumDescriptor and Descriptor methods on the struct types in the openapiv2 options package have been removed. This seems to be a requirement to generate the new Hybrid API. Please open an issue if you were depending on these functions and we'll see what we can do about it.

What's Changed

Full Changelog: grpc-ecosystem/grpc-gateway@v2.25.0...v2.25.1

v2.25.0

Compare Source

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.24.0...v2.25.0

v2.24.0

Compare Source

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.23.0...v2.24.0

v2.23.0

Compare Source

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.22.0...v2.23.0

stretchr/testify (github.com/stretchr/testify)

v1.11.1

Compare Source

This release fixes #​1785 introduced in v1.11.0 where expected argument values implementing the stringer interface (String() string) with a method which mutates their value, when passed to mock.Mock.On (m.On("Method", <expected>).Return()) or actual argument values passed to mock.Mock.Called may no longer match one another where they previously did match. The behaviour prior to v1.11.0 where the stringer is always called is restored. Future testify releases may not call the stringer method at all in this case.

What's Changed

Full Changelog: stretchr/testify@v1.11.0...v1.11.1

v1.11.0

Compare Source

What's Changed

Functional Changes

v1.11.0 Includes a number of performance improvements.


Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@talos-bot talos-bot moved this to In Review in Planning Oct 6, 2025
@smira smira removed this from Planning Oct 6, 2025
@renovate renovate bot force-pushed the renovate/dependencies branch 2 times, most recently from 6dc95f1 to e93f1c6 Compare October 8, 2025 09:23
@renovate
Copy link
Author

renovate bot commented Oct 8, 2025

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 5 additional dependencies were updated

Details:

Package Change
golang.org/x/crypto v0.26.0 -> v0.43.0
golang.org/x/net v0.28.0 -> v0.46.1-0.20251013234738-63d1a5100f82
golang.org/x/text v0.17.0 -> v0.30.0
google.golang.org/genproto/googleapis/api v0.0.0-20240827150818-7e3bb234dfed -> v0.0.0-20251022142026-3a174f9686a8
google.golang.org/genproto/googleapis/rpc v0.0.0-20240827150818-7e3bb234dfed -> v0.0.0-20251022142026-3a174f9686a8

@renovate renovate bot force-pushed the renovate/dependencies branch from e93f1c6 to 6966695 Compare October 10, 2025 07:58
@renovate renovate bot force-pushed the renovate/dependencies branch from 6966695 to 67a6fde Compare October 23, 2025 09:02
@renovate renovate bot force-pushed the renovate/dependencies branch 3 times, most recently from 9721e4e to 8b46ddb Compare November 9, 2025 11:48
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate bot force-pushed the renovate/dependencies branch from 8b46ddb to 8c02476 Compare November 19, 2025 03:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant