Skip to content

deps(deps): bump the gomod-minor-and-patch group across 1 directory with 17 updates#317

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-minor-and-patch-d6cfc6ce1f
Closed

deps(deps): bump the gomod-minor-and-patch group across 1 directory with 17 updates#317
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-minor-and-patch-d6cfc6ce1f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the gomod-minor-and-patch group with 11 updates in the / directory:

Package From To
cloud.google.com/go/storage 1.62.2 1.62.3
github.com/aws/aws-sdk-go-v2 1.41.7 1.42.0
github.com/aws/aws-sdk-go-v2/config 1.32.18 1.32.25
github.com/aws/aws-sdk-go-v2/service/cloudtrail 1.55.11 1.56.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.74.0 1.75.2
github.com/disgoorg/disgo 0.19.3 0.19.6
github.com/pulumi/pulumi-aws/sdk/v6 6.83.3 6.83.4
github.com/pulumi/pulumi-kubernetes/sdk/v4 4.31.1 4.32.0
github.com/pulumi/pulumi/pkg/v3 3.243.0 3.245.0
golang.org/x/crypto 0.52.0 0.53.0
google.golang.org/api 0.280.0 0.284.0

Updates cloud.google.com/go/storage from 1.62.2 to 1.62.3

Release notes

Sourced from cloud.google.com/go/storage's releases.

storage: v1.62.3

v1.62.3 (2026-06-03)

Bug Fixes

  • fix race condition during retries in gRPC writer (#14649) (04b6c635)

  • add server closed idle connection to retriable errors (#14594) (20b37d65)

Commits
  • 8afd6a0 chore: librarian release pull request: 20260603T093646Z (#14699)
  • 04b6c63 fix(storage): fix race condition during retries in gRPC writer (#14649)
  • 20b37d6 fix(storage): add server closed idle connection to retriable errors (#14594)
  • See full diff in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.41.7 to 1.42.0

Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.18 to 1.32.25

Commits

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.19.17 to 1.19.24

Commits

Updates github.com/aws/aws-sdk-go-v2/service/cloudtrail from 1.55.11 to 1.56.4

Commits

Updates github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.74.0 to 1.75.2

Commits

Updates github.com/disgoorg/disgo from 0.19.3 to 0.19.6

Release notes

Sourced from github.com/disgoorg/disgo's releases.

v0.19.6

What's Changed

New Contributors

Full Changelog: disgoorg/disgo@v0.19.5...v0.19.6

v0.19.5

What's Changed

New Contributors

Full Changelog: disgoorg/disgo@v0.19.4...v0.19.5

v0.19.4

What's Changed

New Contributors

Full Changelog: disgoorg/disgo@v0.19.3...v0.19.4

Commits
  • de15e6a fix(voice): nil-guard udpConnImpl.Close to prevent SIGSEGV on un-opened conn ...
  • 6964fdb feat(discord): add missing placeholder on Attachment (#549)
  • 18dc4c2 fix(voice): Conn.Close blocking forever (#547)
  • 23c6006 feat: add new fields and flags (#548)
  • 0fea91e feat: add missing fields to EmbedResource (#546)
  • 8fafd96 feat: add DELETE role connection endpoint (#545)
  • 4123e81 feat(OAuth2Scope): add OAuth2ScopeIdentifyPremium scope (#544)
  • e1f1523 fix: apply DefaultAllowedMentions to interaction responses sent via Respond (...
  • 1df3e87 fix(discord): remove unsupported negated MessageSearchEmbedType (#541)
  • e254950 feat(rest): add JSON error code 160014 (#540)
  • Additional commits viewable in compare view

Updates github.com/pulumi/pulumi-aws/sdk/v6 from 6.83.3 to 6.83.4

Release notes

Sourced from github.com/pulumi/pulumi-aws/sdk/v6's releases.

v6.83.4

Address reported CVEs via Go toolchain and dependency bumps

Go toolchain -> 1.25.7 (provider/go.mod, sdk/go.mod) resolves the stdlib CVEs:
- CVE-2025-68121  crypto/tls session-resumption certificate validation bypass
- CVE-2025-61726  net/http Request.ParseForm unbounded query params (DoS)
- CVE-2025-61728  archive/zip super-linear filename indexing (DoS)
- CVE-2025-61730  crypto/tls 1.3 handshake cross-level info disclosure
- CVE-2025-61731  cmd/go cgo pkg-config --log-file arbitrary file write
- CVE-2025-61732  cmd/cgo doc-comment code smuggling

cloudflare/circl -> v1.6.3 resolves CVE-2026-1229 (CIRCL p384 CombinedMult).

go-git/go-git/v5 -> v5.16.5 resolves CVE-2026-25934 (go-git packfile integrity).


go-git v5.16.5 requires Go 1.24, so the sdk go directive rises 1.23.0 -> 1.24.0.

Commits
  • 32b77a0 Address reported CVEs via Go toolchain and dependency bumps
  • e3c8398 Disable flaky integration tests on v6 backport branch
  • See full diff in compare view

Updates github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.31.1 to 4.32.0

Release notes

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

v4.32.0

No release notes provided.

Changelog

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog.

4.32.0 (June 5, 2026)

Fixed

  • #3176 ensure Helm-installed CRDs can be resolved during preview
  • #4396 Fix panic when creating a kubernetes.io/service-account-token Secret with a non-existent ServiceAccount.
  • #4394 Don't fail YAML render when a custom resource's namespace scope can't be determined offline. The resource is rendered without a namespace and a warning is logged, rather than erroring.

Changed

  • Align the documented minimum supported Kubernetes version and local SDK install instructions with current provider behavior.
Commits

Updates github.com/pulumi/pulumi/pkg/v3 from 3.243.0 to 3.245.0

Release notes

Sourced from github.com/pulumi/pulumi/pkg/v3's releases.

v3.245.0

3.245.0 (2026-06-04)

Improvements

  • [backend/diy] Update gocloud.dev to 0.46 and aws sdk to v2 #23421
  • [cli] Show download and unpack progress when installing provider plugins pulumi/pulumi#23408
  • [cli/do] Expose the selected stack's organization and short name to PCL input files when running pulumi do inside a project
  • [cli/do] Suggest similar tokens when an unknown token is passed to pulumi do #23341
  • [cli/neo] Support up/down arrows to scroll through prompt history in pulumi neo #23425
  • [cli/stack] Remame pulumi stack init to new #23422

Bug Fixes

  • [engine] Download the HCL language runtime on demand instead of bundling it #23356
  • [sdk/nodejs] Fix mergeOptions dropping onError hooks from ResourceOptions in the Node.js SDK
  • [cli/auth] Delete shared temporary agent credentials when logging out

Miscellaneous

  • [sdk/go] Remove "name" from plugin loading functions and require "Type" on Configure & DiffConfig calls #23363

v3.244.0

3.244.0 (2026-05-28)

Bug Fixes

  • [cli/do] Fix top level flags like --logtostderr being recognized when using pulumi do #23355
  • [cli/install] Distinguish multiple packages with the same plugin
  • [engine] Fix snapshot integrity issue with up --refresh
  • [engine] Forward all provider errors to error hooks for retry #23347
  • [engine] Trace cancel RPCs sent to plugins during shutdown as children of the active operation instead of emitting separate root spans #23362
  • [sdk/python] Merge requirements.txt into pyproject.toml when using uv without a project section #23340
Changelog

Sourced from github.com/pulumi/pulumi/pkg/v3's changelog.

3.245.0 (2026-06-04)

Improvements

  • [backend/diy] Update gocloud.dev to 0.46 and aws sdk to v2 #23421
  • [cli] Show download and unpack progress when installing provider plugins pulumi/pulumi#23408
  • [cli/do] Expose the selected stack's organization and short name to PCL input files when running pulumi do inside a project
  • [cli/do] Suggest similar tokens when an unknown token is passed to pulumi do #23341
  • [cli/neo] Support up/down arrows to scroll through prompt history in pulumi neo #23425

Bug Fixes

  • [engine] Download the HCL language runtime on demand instead of bundling it #23356

Miscellaneous

  • [sdk/go] Remove "name" from plugin loading functions and require "Type" on Configure & DiffConfig calls #23363

Bug Fixes

  • [sdk/nodejs] Fix mergeOptions dropping onError hooks from ResourceOptions in the Node.js SDK
  • [cli/auth] Delete shared temporary agent credentials when logging out

Improvements

  • [cli/stack] Remame pulumi stack init to new #23422

3.244.0 (2026-05-28)

Bug Fixes

  • [cli/do] Fix top level flags like --logtostderr being recognized when using pulumi do #23355
  • [cli/install] Distinguish multiple packages with the same plugin
  • [engine] Fix snapshot integrity issue with up --refresh
  • [engine] Forward all provider errors to error hooks for retry #23347
  • [engine] Trace cancel RPCs sent to plugins during shutdown as children of the active operation instead of emitting separate root spans #23362
  • [sdk/python] Merge requirements.txt into pyproject.toml when using uv without a project section #23340
Commits
  • d602109 Support up/down arrows for prompt history in pulumi neo (#23425)
  • 4b6578e block merge queue while release is in progress (#23429)
  • 4795a4c fix(import): surface converter argument errors cleanly for --from imports (#2...
  • 931a9e8 Add tests for serialization failure messages (#23424)
  • fae1a56 Unbundle the HCL language runtime and download it on demand (#23356)
  • 158f072 Allow a language to request a PackageSpec, not just a PackageDescriptor (#23330)
  • 9a4184b Add pulumi stack new as an alias of pulumi stack init (#23422)
  • f6eec78 Update gocloud.dev to 0.46 (#23421)
  • 6fea015 Simplify l2-invoke-options-depends-on (#23380)
  • 91ea2b1 fix race in TestTaintMultipleResources (#23406)
  • Additional commits viewable in compare view

Updates github.com/pulumi/pulumi/sdk/v3 from 3.243.0 to 3.245.0

Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.245.0

3.245.0 (2026-06-04)

Improvements

  • [backend/diy] Update gocloud.dev to 0.46 and aws sdk to v2 #23421
  • [cli] Show download and unpack progress when installing provider plugins pulumi/pulumi#23408
  • [cli/do] Expose the selected stack's organization and short name to PCL input files when running pulumi do inside a project
  • [cli/do] Suggest similar tokens when an unknown token is passed to pulumi do #23341
  • [cli/neo] Support up/down arrows to scroll through prompt history in pulumi neo #23425
  • [cli/stack] Remame pulumi stack init to new #23422

Bug Fixes

  • [engine] Download the HCL language runtime on demand instead of bundling it #23356
  • [sdk/nodejs] Fix mergeOptions dropping onError hooks from ResourceOptions in the Node.js SDK
  • [cli/auth] Delete shared temporary agent credentials when logging out

Miscellaneous

  • [sdk/go] Remove "name" from plugin loading functions and require "Type" on Configure & DiffConfig calls #23363

v3.244.0

3.244.0 (2026-05-28)

Bug Fixes

  • [cli/do] Fix top level flags like --logtostderr being recognized when using pulumi do #23355
  • [cli/install] Distinguish multiple packages with the same plugin
  • [engine] Fix snapshot integrity issue with up --refresh
  • [engine] Forward all provider errors to error hooks for retry #23347
  • [engine] Trace cancel RPCs sent to plugins during shutdown as children of the active operation instead of emitting separate root spans #23362
  • [sdk/python] Merge requirements.txt into pyproject.toml when using uv without a project section #23340
Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.245.0 (2026-06-04)

Improvements

  • [backend/diy] Update gocloud.dev to 0.46 and aws sdk to v2 #23421
  • [cli] Show download and unpack progress when installing provider plugins pulumi/pulumi#23408
  • [cli/do] Expose the selected stack's organization and short name to PCL input files when running pulumi do inside a project
  • [cli/do] Suggest similar tokens when an unknown token is passed to pulumi do #23341
  • [cli/neo] Support up/down arrows to scroll through prompt history in pulumi neo #23425

Bug Fixes

  • [engine] Download the HCL language runtime on demand instead of bundling it #23356

Miscellaneous

  • [sdk/go] Remove "name" from plugin loading functions and require "Type" on Configure & DiffConfig calls #23363

Bug Fixes

  • [sdk/nodejs] Fix mergeOptions dropping onError hooks from ResourceOptions in the Node.js SDK
  • [cli/auth] Delete shared temporary agent credentials when logging out

Improvements

  • [cli/stack] Remame pulumi stack init to new #23422

3.244.0 (2026-05-28)

Bug Fixes

  • [cli/do] Fix top level flags like --logtostderr being recognized when using pulumi do #23355
  • [cli/install] Distinguish multiple packages with the same plugin
  • [engine] Fix snapshot integrity issue with up --refresh
  • [engine] Forward all provider errors to error hooks for retry #23347
  • [engine] Trace cancel RPCs sent to plugins during shutdown as children of the active operation instead of emitting separate root spans #23362
  • [sdk/python] Merge requirements.txt into pyproject.toml when using uv without a project section #23340
Commits
  • d602109 Support up/down arrows for prompt history in pulumi neo (#23425)
  • 4b6578e block merge queue while release is in progress (#23429)
  • 4795a4c fix(import): surface converter argument errors cleanly for --from imports (#2...
  • 931a9e8 Add tests for serialization failure messages (#23424)
  • fae1a56 Unbundle the HCL language runtime and download it on demand (#23356)
  • 158f072 Allow a language to request a PackageSpec, not just a PackageDescriptor (#23330)
  • 9a4184b Add pulumi stack new as an alias of pulumi stack init (#23422)
  • f6eec78 Update gocloud.dev to 0.46 (#23421)
  • 6fea015 Simplify l2-invoke-options-depends-on (#23380)
  • 91ea2b1 fix race in TestTaintMultipleResources (#23406)
  • Additional commits viewable in compare view

Updates gocloud.dev from 0.45.0 to 0.46.0

Release notes

Sourced from gocloud.dev's releases.

v0.46.0

BREAKING_CHANGE:

  • blob/s3blob: migrate from deprecated s3/manager to s3/transfermanager by @​vangent in google/go-cloud#3717
    • Only breaking if you're using As to access specific AWS types from the old manager.

What's Changed

all

blob:

runtimevar:

pubsub

docstore

secrets

postgres

New Contributors

Full Changelog: google/go-cloud@v0.45.0...v0.46.0

Commits
  • 60f0d74 all: prerelease
  • a1725f0 blob/s3blob: migrate from deprecated s3/manager to s3/transfermanager (#3717)
  • 7eadd65 aws: add AWS IAM Role assumption support (#3716)
  • 054c82e postgres/awspostgres: add IAM authentication support (#3713)
  • 2b85c85 docs: fix Pub/Sub subscribe wording (#3714)
  • b9dee8d build: add top-level permissions restriction to tests workflow (#3711)
  • 45a8cfc docstore: support unwrapping ActionListError for use with errors.Is (#3705)
  • 78b5976 all: support typed errors and errors.Is for error codes (#3708)
  • 595f8b6 all: update another otel dep (#3701)
  • c903aef all: update otel deps (#3699)
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.52.0 to 0.53.0

Commits
  • 45460e0 go.mod: update golang.org/x dependencies
  • d37c95e pkcs12: limit PBKDF iteration count to prevent CPU exhaustion
  • e2ffffe ssh: reject incomplete gssapi-with-mic configurations
  • 60e158a ssh/test: isolate CLI tests from user SSH config and agent
  • 1b77d23 ssh/knownhosts: reject lines with multiple or unknown markers
  • 3872a2b ssh/knownhosts: verify declared key type matches decoded key
  • 9f72ecc ssh/knownhosts: treat only ASCII space and tab as whitespace
  • 8f405a4 ssh: validate ECDSA curve matches expected algorithm
  • bb41b3d ssh: improve DH GEX group selection using PreferredBits
  • e04e721 ssh/agent: validate ed25519 private key length in Add
  • Additional commits viewable in compare view

Updates golang.org/x/sync from 0.20.0 to 0.21.0

Commits

Updates golang.org/x/term from 0.43.0 to 0.44.0

Commits

Updates golang.org/x/text from 0.37.0 to 0.38.0

Commits

Updates google.golang.org/api from 0.280.0 to 0.284.0

Release notes

Sourced from google.golang.org/api's releases.

v0.284.0

0.284.0 (2026-06-09)

Features

v0.283.0

0.283.0 (2026-06-01)

Features

v0.282.0

0.282.0 (2026-05-27)

Features

v0.281.0

0.281.0 (2026-05-26)

Features

Changelog

Sourced from google.golang.org/api's changelog.

0.284.0 (2026-06-09)

Features

0.283.0 (2026-06-01)

Features

0.282.0 (2026-05-27)

Features

0.281.0 (2026-05-26)

Features

Commits

@dependabot
deps(deps): bump the gomod-minor-and-patch group across 1 directory w…
88e4640 
…ith 17 updates

Bumps the gomod-minor-and-patch group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go) | `1.62.2` | `1.62.3` |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.41.7` | `1.42.0` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.18` | `1.32.25` |
| [github.com/aws/aws-sdk-go-v2/service/cloudtrail](https://github.com/aws/aws-sdk-go-v2) | `1.55.11` | `1.56.4` |
| [github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs](https://github.com/aws/aws-sdk-go-v2) | `1.74.0` | `1.75.2` |
| [github.com/disgoorg/disgo](https://github.com/disgoorg/disgo) | `0.19.3` | `0.19.6` |
| [github.com/pulumi/pulumi-aws/sdk/v6](https://github.com/pulumi/pulumi-aws) | `6.83.3` | `6.83.4` |
| [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) | `4.31.1` | `4.32.0` |
| [github.com/pulumi/pulumi/pkg/v3](https://github.com/pulumi/pulumi) | `3.243.0` | `3.245.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.52.0` | `0.53.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.280.0` | `0.284.0` |



Updates `cloud.google.com/go/storage` from 1.62.2 to 1.62.3
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](googleapis/google-cloud-go@storage/v1.62.2...storage/v1.62.3)

Updates `github.com/aws/aws-sdk-go-v2` from 1.41.7 to 1.42.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.7...v1.42.0)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.18 to 1.32.25
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.32.18...config/v1.32.25)

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.19.17 to 1.19.24
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@credentials/v1.19.17...credentials/v1.19.24)

Updates `github.com/aws/aws-sdk-go-v2/service/cloudtrail` from 1.55.11 to 1.56.4
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/wafv2/v1.55.11...service/eks/v1.56.4)

Updates `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs` from 1.74.0 to 1.75.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.74.0...service/s3/v1.75.2)

Updates `github.com/disgoorg/disgo` from 0.19.3 to 0.19.6
- [Release notes](https://github.com/disgoorg/disgo/releases)
- [Commits](disgoorg/disgo@v0.19.3...v0.19.6)

Updates `github.com/pulumi/pulumi-aws/sdk/v6` from 6.83.3 to 6.83.4
- [Release notes](https://github.com/pulumi/pulumi-aws/releases)
- [Changelog](https://github.com/pulumi/pulumi-aws/blob/master/CHANGELOG_OLD.md)
- [Commits](pulumi/pulumi-aws@v6.83.3...v6.83.4)

Updates `github.com/pulumi/pulumi-kubernetes/sdk/v4` from 4.31.1 to 4.32.0
- [Release notes](https://github.com/pulumi/pulumi-kubernetes/releases)
- [Changelog](https://github.com/pulumi/pulumi-kubernetes/blob/master/CHANGELOG.md)
- [Commits](pulumi/pulumi-kubernetes@v4.31.1...v4.32.0)

Updates `github.com/pulumi/pulumi/pkg/v3` from 3.243.0 to 3.245.0
- [Release notes](https://github.com/pulumi/pulumi/releases)
- [Changelog](https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md)
- [Commits](pulumi/pulumi@v3.243.0...v3.245.0)

Updates `github.com/pulumi/pulumi/sdk/v3` from 3.243.0 to 3.245.0
- [Release notes](https://github.com/pulumi/pulumi/releases)
- [Changelog](https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md)
- [Commits](pulumi/pulumi@v3.243.0...v3.245.0)

Updates `gocloud.dev` from 0.45.0 to 0.46.0
- [Release notes](https://github.com/google/go-cloud/releases)
- [Commits](google/go-cloud@v0.45.0...v0.46.0)

Updates `golang.org/x/crypto` from 0.52.0 to 0.53.0
- [Commits](golang/crypto@v0.52.0...v0.53.0)

Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
- [Commits](golang/sync@v0.20.0...v0.21.0)

Updates `golang.org/x/term` from 0.43.0 to 0.44.0
- [Commits](golang/term@v0.43.0...v0.44.0)

Updates `golang.org/x/text` from 0.37.0 to 0.38.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.37.0...v0.38.0)

Updates `google.golang.org/api` from 0.280.0 to 0.284.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.280.0...v0.284.0)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/storage
  dependency-version: 1.62.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.32.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-version: 1.19.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/aws/aws-sdk-go-v2/service/cloudtrail
  dependency-version: 1.56.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
  dependency-version: 1.75.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/disgoorg/disgo
  dependency-version: 0.19.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/pulumi/pulumi-aws/sdk/v6
  dependency-version: 6.83.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/pulumi/pulumi-kubernetes/sdk/v4
  dependency-version: 4.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/pulumi/pulumi/pkg/v3
  dependency-version: 3.245.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/pulumi/pulumi/sdk/v3
  dependency-version: 3.245.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: gocloud.dev
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: golang.org/x/sync
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: golang.org/x/term
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: golang.org/x/text
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: google.golang.org/api
  dependency-version: 0.284.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 11, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 11, 2026
@github-actions

github-actions Bot commented Jun 11, 2026

Copy link
Copy Markdown

Semgrep Scan Results

Repository: api | Commit: 1226fe7

Check Status Details
✅ Semgrep Pass 0 total findings (no error/warning)

Scanned at 2026-06-11 10:02 UTC

@github-actions

github-actions Bot commented Jun 11, 2026

Copy link
Copy Markdown

Security Scan Results

Repository: api | Commit: 1226fe7

Check Status Details
✅ Secret Scan Pass No secrets detected
✅ Dependencies (Trivy) Pass 0 total (no critical/high)
✅ Dependencies (Grype) Pass 0 total (no critical/high)
📦 SBOM Generated 522 components (CycloneDX)

Scanned at 2026-06-11 10:03 UTC

@Cre-eD Cre-eD mentioned this pull request Jun 13, 2026
Merged
Cre-eD added a commit that referenced this pull request Jun 13, 2026
@Cre-eD
deps: consolidated bumps (#310 #311 #314 #317) + govulncheck non-Go-P…
2deddae 
…R gate (#323)

## Consolidated dependency bumps + govulncheck gate fix

Bundles the four open Dependabot PRs into one branch so they can be
reviewed and merged together, plus the CI change that stops this class
of false block from recurring. Each is a separate, signed commit off
current `main`:

| Commit | Replaces | Change |
|---|---|---|
| Go modules | #317 | 17 modules in the `gomod-minor-and-patch` group —
`golang.org/x/crypto` 0.52→0.53, `golang.org/x/text` 0.37→0.38,
`aws-sdk-go-v2` 1.41.7→1.42.0, `pulumi` 3.243→3.245, `gocloud.dev`
0.45→0.46, `google.golang.org/api` 0.280→0.284, Azure SDK keyvault
module restructure, + transitives |
| CI actions | #311 | `actions/checkout` v6.0.2→v6.0.3,
`github/codeql-action` v4 digest |
| caddy | #314 | `caddy` 2.11.3→2.11.4 (builder + runtime stages) |
| lambda base | #310 | `public.ecr.aws/lambda/provided:al2023` digest
refresh |
| **govulncheck gate** | — | skip the reachability scan on PRs that
touch no Go input (see below) |

`go.mod`/`go.sum` are byte-identical to #317's head (which already
passed govulncheck + CodeQL). Locally verified: `go mod tidy` is a no-op
and `go build ./...` is clean on `go 1.26.4`. CI on the first four
commits was fully green (govulncheck, Build Setup, all Build matrix
targets, Run tests, CodeQL, Fuzz).

### Why the Dependabot PRs were stuck on govulncheck

`govulncheck.yml` uses `go-version-file: go.mod`, so it scans the
**standard library of whatever `go` directive the PR carries**. `main`
is now `go 1.26.4` (stdlib `crypto/x509` + `net/textproto` advisories
fixed). The two June-3 PRs (#310, #311) were branched while `main` was
still `go 1.26.3`, so their stale base still trips those stdlib vulns —
even though one only bumps a Docker digest and the other only bumps
GitHub Actions, neither of which touches Go. The June-8/11 PRs (#314,
#317) were branched after the bump and pass cleanly.

### The gate fix (prevents recurrence)

The 5th commit adds a "Decide whether to scan" step: on a PR it lists
the changed files and runs govulncheck only when a Go input (`*.go` /
`go.mod` / `go.sum`) changed. A PR that changes no Go input cannot alter
reachability, and cannot change the stdlib version govulncheck reads
from the `go` directive — so a Docker/Actions-only PR is skipped (and
reports success) instead of re-flagging whatever sits on its stale base.
The job always runs and reports, so a required status check is never
left pending; `main`-push and the weekly cron still scan
unconditionally, so nothing escapes the gate before release. This PR
itself touches `go.mod`/`go.sum`, so it runs the full scan.

Once merged, the four Dependabot PRs (#310, #311, #314, #317) can be
closed.

---------

Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
@dependabot @github

dependabot Bot commented on behalf of github Jun 13, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 13, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/gomod-minor-and-patch-d6cfc6ce1f branch June 13, 2026 13:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Cre-eD Cre-eD Cre-eD approved these changes
@smecsia smecsia Awaiting requested review from smecsia smecsia is a code owner
@universe-ops universe-ops Awaiting requested review from universe-ops universe-ops is a code owner
@Laboratory Laboratory Awaiting requested review from Laboratory Laboratory is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Cre-eD