chore: update dependencies

[renovate]

Update Request | Renovate Bot

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
github.com/ProtonMail/gopenpgp/v2	v2.10.0 → v3.4.1					require	major
github.com/cenkalti/backoff/v4	v4.3.0 → v5.0.3					require	major
github.com/grpc-ecosystem/grpc-gateway/v2	v2.28.0 → v2.29.0					require	minor
github.com/klauspost/compress	v1.18.5 → v1.18.6					require	patch
github.com/planetscale/vtprotobuf	0393e58 → ba97887					require	digest
go.uber.org/zap	v1.27.1 → v1.28.0					require	minor
google.golang.org/grpc	v1.79.3 → v1.81.0					require	minor

---

Release Notes

ProtonMail/gopenpgp (github.com/ProtonMail/gopenpgp/v2)

v3.4.1

Compare Source

What's Changed

• Fix EOF behavior of the verification Reader in #​358

Full Changelog: ProtonMail/gopenpgp@v3.4.0...v3.4.1

v3.4.0

Compare Source

What's Changed

Added

• InsecureAllowAllKeyFlagsWhenMissing profile option. Allows usage of keys without key flags.

Changed

• Update go-crypto fork to v1.4.1.

Full Changelog: ProtonMail/gopenpgp@v3.3.0...v3.4.0

v3.3.0

Compare Source

What's Changed

Added

• MaxDecompressedSize option to control the maximum size of decompressed messages.

Changed

• Update go-crypto to v1.3.0.

Full Changelog: ProtonMail/gopenpgp@v3.2.1...v3.3.0

v3.2.1

Compare Source

What's Changed

Fixed

• Avoid double compression in signcryption with a session key by @​lubux in #​337

Full Changelog: ProtonMail/gopenpgp@v3.2.0...v3.2.1

v3.2.0

Compare Source

What's Changed

Added

• Improved API for encryption with a session key by @​lubux in #​331

Changed

• Bumped minimum supported Go version to 1.22.0.
• Update go-crypto fork to v1.2.0.
• Remove pkgs/errors dependency.

Full Changelog: ProtonMail/gopenpgp@v3.1.3...v3.2.0

v3.1.3

Compare Source

What's Changed

Changed

• Update go-crypto fork to v1.1.6

Full Changelog: ProtonMail/gopenpgp@v3.1.2...v3.1.3

v3.1.2

Compare Source

What's Changed

Changed

• Update go-crypto fork to v1.1.5

Full Changelog: ProtonMail/gopenpgp@v3.1.1...v3.1.2

v3.1.1

Compare Source

What's Changed

Changed

• Update go-crypto fork to v1.1.4

Full Changelog: ProtonMail/gopenpgp@v3.1.0...v3.1.1

v3.1.0

Compare Source

What's Changed

Added

• Add decryption option to allow disabling the integrity tag requirement by @​JasonQuinn in #​314
• Add option to decrypt with signature keys by @​lubux in #​316

Changed

• Adapt to go-crypto cleartext API changes by @​lubux in #​310
• Rename profile.Custom.AllowWeakRSA to profile.Custom.InsecureAllowWeakRSA
• Update go-crypto fork to v1.1.3

Full Changelog: ProtonMail/gopenpgp@v3.0.0...v3.1.0

v3.0.0

Compare Source

What's Changed

New simplified and unified API

GopenPGP v3 introduces a new unified API for high level OpenPGP operations. In comparison to GopenPGP v2, where similar functions were dispersed across different types and required varying implementations for the same operations, GopenPGP v3 consolidates these functions into a consistent interface. Now, operations such as Sign, Verify, Encrypt, Decrypt, and Key generation are each accessible through a unified, builder like API, simplifying integration and enhancing code readability across cryptographic workflows.

However, applications migrating from v2 to v3 will need to update their API calls, as the changes are not backward-compatible. This means that all previous API calls must be rewritten to align with the new, unified API structure. GopenPGP v3 supports the migration process by offering extensive documentation and practical examples. We recommend upgrading to v3 for the latest features and improvements, but we'll continue to support GopenPGP v2 for the time being. Our support includes ongoing bug fixes and minor feature updates to ensure stability and functionality for existing users.

For usage examples of the new API, see the README. For the full documentation, see https://pkg.go.dev/github.com/ProtonMail/gopenpgp/v3.

Profiles

GopenPGP v3 introduces the concept of profiles, enabling applications to configure OpenPGP algorithm selection based on their specific needs. For most applications, the provided preset profiles offer robust and secure defaults, eliminating the need for additional configuration.

RFC 9580 and Interoperability

GopenPGP v3 adds full support for the latest OpenPGP specification, RFC 9580. Compliance with the specification has also been significantly enhanced, as confirmed by the results in the OpenPGP interoperability test suite. These enhancements in GopenPGP v3 are possible by leveraging a new API in the go-crypto fork, which enables a range of improvements in functionality, compliance, and performance.

Go Mobile Support

GopenPGP v3 aims to be fully compatible with Gomobile to provide an API for mobile platforms. For this reason, the library defaults to a builder-like pattern, which is less commonly used in Go. All code that is only relevant for mobile platforms has been moved to the mobile module.

Extending Functionality

GopenPGP v3 introduces a streaming interface across all APIs, enabling memory efficient processing of large data.
Additionally, it extends the library's functionality with various improvements, such as:

• Consider all signatures in a message during verification and allow inspection of each.
• Support signing with multiple keys.
• Support encrypting to an "anonymous recipient", where the recipient KeyID is represented as all zeros in the message.
• Add support for the intended recipient feature as specified in RFC 9580.
• Ensure consistent behaviour across all APIs.
• Support generating v6 keys as specified in RFC 9580.

Full Changelog: ProtonMail/gopenpgp@v2.7.5...v3.0.0.

Changelog since v3.0.0-beta.0: ProtonMail/gopenpgp@v3.0.0-beta.0...v3.0.0.

cenkalti/backoff (github.com/cenkalti/backoff/v4)

v5.0.3

Compare Source

v5.0.2

Compare Source

v5.0.1

Compare Source

v5.0.0

Compare Source

grpc-ecosystem/grpc-gateway (github.com/grpc-ecosystem/grpc-gateway/v2)

v2.29.0

Compare Source

What's Changed

• fix: use proto.Merge to avoid copylocks with use_opaque_api=true by @​emahiro in #​6383
• fix: allow proto3 optional fields in path parameters by @​susanachl in #​6416
• Add option to disable HTTP method override by @​achew22 in #​6447
• Add Go documentation badge to README by @​achew22 in #​6448
• fix: add missing return statements in error handler paths by @​jet-go in #​6561
• Deprecate fields and methods if file is deprecated by @​aidandj in #​6613
• Add edition 2024 support by @​printfn in #​6622

New Contributors

• @​emahiro made their first contribution in #​6383
• @​susanachl made their first contribution in #​6416
• @​jet-go made their first contribution in #​6561
• @​aidandj made their first contribution in #​6613
• @​printfn made their first contribution in #​6622

Full Changelog: grpc-ecosystem/grpc-gateway@v2.28.0...v2.29.0

klauspost/compress (github.com/klauspost/compress)

v1.18.6

Compare Source

What's Changed

• s2: Fix amd64 stack frame corruption by @​klauspost in #​1145
• gzhttp: Canonicalize ETag header by @​justinmayhew in #​1139
• perf: pool hash tables in Go encode paths to reduce allocations by @​huynhanx03 in #​1143

New Contributors

• @​justinmayhew made their first contribution in #​1139
• @​huynhanx03 made their first contribution in #​1143
• @​thaJeztah made their first contribution in #​1144

Full Changelog: klauspost/compress@v1.18.5...v1.18.6

uber-go/zap (go.uber.org/zap)

v1.28.0

Compare Source

Enhancements:

• #​1534: Add zapcore.CheckPreWriteHook and CheckedEntry.Before method for transforming entries before they are written to any Cores.

grpc/grpc-go (google.golang.org/grpc)

v1.81.0: Release 1.81.0

Compare Source

Behavior Changes

• balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. (#​8808)

Dependencies

• Minimum supported Go version is now 1.25. (#​8969)

Bug Fixes

• xds: Use the leaf cluster's security config for the TLS handshake instead of the aggregate cluster's config. (#​8956)
• transport: Send a RST_STREAM when receiving an END_STREAM when the stream is not already half-closed. (#​8832)
• xds: Fix ADS resource name validation to prevent a panic. (#​8970)

New Features

• grpc/stats: Add support for custom labels in per-call metrics (gRFC A108). (#​9008)
• xds: Add support for Server Name Indication (SNI) and SAN validation (gRFC A101). Disabled by default. To enable, set GRPC_EXPERIMENTAL_XDS_SNI=true environment variable. (#​9016)
• xds: Add support to control which fields get propagated from ORCA backend metric reports to LRS load reports (gRFC A85). Disabled by default. To enable, set GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION=true. (#​9005)
• xds: Add metrics to track xDS client connectivity and cached resource state (gRFC A78). (#​8807)
• stats/otel: Enhance grpc.subchannel.disconnections metric by adding disconnection reason to the grpc.disconnect_error label (gRFC A94). This provides granular insights into why subchannels are closing. (#​8973)
• mem: Add mem.Buffer.Slice() API to slice the buffer like a slice. (#​8977)
  • Special Thanks: @​ash2k

Performance Improvements

• alts: Pool read buffers to lower memory utilization when sockets are unreadable. (#​8964)
• transport: Pool HTTP/2 framer read buffers to reduce idle memory consumption. Currently limited to Linux for ALTS and non-encrypted transports (TCP, Unix). To disable, set GRPC_GO_EXPERIMENTAL_HTTP_FRAMER_READ_BUFFER_POOLING=false and report any issues. (#​9032)

v1.80.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 6 additional dependencies were updated

Details:

Package	Change
golang.org/x/crypto	v0.40.0 -> v0.43.0
golang.org/x/net	v0.42.0 -> v0.46.1-0.20251013234738-63d1a5100f82
golang.org/x/sys	v0.34.0 -> v0.37.0
golang.org/x/text	v0.29.0 -> v0.30.0
google.golang.org/genproto/googleapis/api	v0.0.0-20250929231259-57b25ae835d4 -> v0.0.0-20251022142026-3a174f9686a8
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250929231259-57b25ae835d4 -> v0.0.0-20251022142026-3a174f9686a8

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
golang.org/x/text	v0.35.0 -> v0.36.0
google.golang.org/genproto/googleapis/api	v0.0.0-20260209200024-4cfbd4190f57 -> v0.0.0-20260414002931-afd174a4e478
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260209200024-4cfbd4190f57 -> v0.0.0-20260414002931-afd174a4e478