build(deps): bump the minor-and-patch group with 27 updates #49

dependabot · 2026-01-14T16:53:16Z

Bumps the minor-and-patch group with 27 updates:

Package	From	To
connectrpc.com/connect	`1.16.2`	`1.19.1`
connectrpc.com/vanguard	`0.2.0`	`0.3.0`
github.com/alecthomas/participle/v2	`2.1.1`	`2.1.4`
github.com/aws/aws-sdk-go-v2	`1.30.4`	`1.41.1`
github.com/aws/aws-sdk-go-v2/config	`1.27.12`	`1.32.7`
github.com/aws/aws-sdk-go-v2/service/s3	`1.60.1`	`1.95.1`
github.com/aws/aws-sdk-go-v2/service/secretsmanager	`1.28.7`	`1.41.1`
github.com/aws/smithy-go	`1.20.4`	`1.24.0`
github.com/cloudflare/cloudflare-go	`0.109.0`	`0.116.0`
github.com/cyrusaf/ctxlog	`1.3.2`	`1.3.3`
github.com/getsentry/sentry-go	`0.28.0`	`0.40.0`
github.com/go-jose/go-jose/v3	`3.0.3`	`3.0.4`
github.com/go-jose/go-jose/v4	`4.0.4`	`4.1.3`
github.com/golang-jwt/jwt/v5	`5.2.1`	`5.3.0`
github.com/golang-migrate/migrate/v4	`4.17.1`	`4.19.1`
github.com/google/go-cmp	`0.6.0`	`0.7.0`
github.com/grpc-ecosystem/grpc-gateway/v2	`2.19.1`	`2.27.4`
github.com/hasura/go-graphql-client	`0.13.0`	`0.15.1`
github.com/jackc/pgx/v5	`5.5.5`	`5.8.0`
github.com/resend/resend-go/v2	`2.6.0`	`2.28.0`
github.com/rs/cors	`1.11.0`	`1.11.1`
github.com/stretchr/testify	`1.9.0`	`1.11.1`
golang.org/x/crypto	`0.28.0`	`0.45.0`
google.golang.org/genproto/googleapis/api	`0.0.0-20240814211410-ddb44dafa142`	`0.0.0-20251222181119-0a764e51fe1b`
google.golang.org/genproto/googleapis/rpc	`0.0.0-20240814211410-ddb44dafa142`	`0.0.0-20251222181119-0a764e51fe1b`
google.golang.org/grpc	`1.64.1`	`1.78.0`
google.golang.org/protobuf	`1.34.2`	`1.36.11`

Updates connectrpc.com/connect from 1.16.2 to 1.19.1

Release notes

Sourced from connectrpc.com/connect's releases.

v1.19.1

What's Changed

Bugfixes

Fix bounds check on envelope for 32-bit archs by @emcfarlane in #887

Fix CallInfo header/trailer propagation on error responses by @emcfarlane in #892

Full Changelog: connectrpc/connect-go@v1.19.0...v1.19.1

v1.19.0

This release introduces the highly requested "simple" flag for code generation, making Connect significantly more ergonomic for everyday RPC development.

The new simple flag in protoc-gen-connect-go generates cleaner, more intuitive client and handler interfaces that eliminate request/response wrappers for most use cases. This addresses community feedback about verbosity and provides a more straightforward API. When enabled, metadata (headers/trailers) can be passed through context instead of explicit wrapper objects, optimizing for the common case where developers don't need direct access to HTTP headers.

What's Changed

Enhancements

Add simple flag for more ergonomic generated code by @bufdev and @smaye81 in connectrpc/connect-go#851

Update Go to v1.24 and document http.Protocol use removing the dependency on golang.org/x/net/http2 by @maxbrunet in connectrpc/connect-go#873, connectrpc/connect-go#877

Add support for Edition 2024 by @emcfarlane in connectrpc/connect-go#878

Bugfixes

Include valid spec and headers when calling recover handler for streaming RPCs by @jhump in connectrpc/connect-go#817

Other changes

Go version support updated to latest two instead of three by @jhump in connectrpc/connect-go#837

CI testing improvements by @pkwarren and @jhump in connectrpc/connect-go#838, connectrpc/connect-go#839

Code quality improvements by @mattrobenolt and @bufdev in connectrpc/connect-go#841, connectrpc/connect-go#867

Documentation improvements by @adlion and @stefanvanburen in connectrpc/connect-go#821, connectrpc/connect-go#880

New Contributors

@adlion made their first contribution in connectrpc/connect-go#821

@maxbrunet made their first contribution in connectrpc/connect-go#873

@stefanvanburen made their first contribution in connectrpc/connect-go#880

Full Changelog: connectrpc/connect-go@v1.18.1...v1.19.0

v1.18.1

What's Changed

Bugfixes

Fix protoc-gen-connect-go schema variable case handling by @emcfarlane in connectrpc/connect-go#808

Full Changelog: connectrpc/connect-go@v1.18.0...v1.18.1

... (truncated)

Commits

ad95987 Prepare for v1.19.1 (#895)
a19db8a Fix CallInfo header/trailer propagation on error responses (#892)
af35892 Fix bounds check on envelope for 32-bit archs (#887)
ab1cd05 Fix README.md (#890)
79c4205 Update README.md to use validate-go and codify example in internal/example (#...
5efe980 Back to development (#884)
0f2c5b2 Prepare for v1.19.0 (#883)
a9ad76e Update README to show simple flag usage (#864)
cf078a1 Remove golang.org/x/net/http2 dependency from tests (#877)
5cb2412 Fix several GoDoc comments (#880)
Additional commits viewable in compare view

Updates connectrpc.com/vanguard from 0.2.0 to 0.3.0

Release notes

Sourced from connectrpc.com/vanguard's releases.

v0.3.0

What's Changed

Enhancements

Support JSON name query parameters by @emcfarlane in connectrpc/vanguard-go#133

Bugfixes

Fix panic on invalid field path error by @emcfarlane in connectrpc/vanguard-go#134

Full Changelog: connectrpc/vanguard-go@v0.2.0...v0.3.0

Commits

14a6410 Upgrade min go version to v1.21 (#132)
4b3622a Fix panic on invalid field path error (#134)
b93721f Support JSON name query parameters (#133)
2577d26 Update DCO language (#130)
813195b Update CONTRIBUTING.md: CLA -> DCO (#129)
78f5d30 Migrate buf configuration files to v2 (#127)
See full diff in compare view

Updates github.com/alecthomas/participle/v2 from 2.1.1 to 2.1.4

Release notes

Sourced from github.com/alecthomas/participle/v2's releases.

v2.1.4

Changelog

bcbb391 fix: setField() reports position + removes Go field

v2.1.3

Changelog

11c856f fix: add "lexer: " prefix to all errors from the lexer

ea76346 chore(deps): update all non-major dependencies (#429)

v2.1.2

Changelog

cd919e6 fix(scripts): add GOBIN fallback and support any cwd (#430)

6b79c5d chore: bump go+golangci-lint

05fdeeb chore(deps): update module github.com/alecthomas/kong to v1 (#416)

5f96b07 docs: fix GraphQL example (#405)

088bb72 docs: simple lexer rules are tried in order (#404)

a8adfde Fix broken link in the README (#402)

b1ee217 feat: json example (#395)

499a330 chore: disable upgrades of golangci-lint

cf12772 fix: bump assert+repr

e31fb00 avoid returning errors when one-or-more groups have no matches (#390)

79c6085 Update README.md (#386)

7147047 Update renovate

Commits

bcbb391 fix: setField() reports position + removes Go field
11c856f fix: add "lexer: " prefix to all errors from the lexer
ea76346 chore(deps): update all non-major dependencies (#429)
cd919e6 fix(scripts): add GOBIN fallback and support any cwd (#430)
6b79c5d chore: bump go+golangci-lint
05fdeeb chore(deps): update module github.com/alecthomas/kong to v1 (#416)
5f96b07 docs: fix GraphQL example (#405)
088bb72 docs: simple lexer rules are tried in order (#404)
a8adfde Fix broken link in the README (#402)
b1ee217 feat: json example (#395)
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.30.4 to 1.41.1

Commits

dcbed91 Release 2026-01-09
08120e8 Regenerated Clients
1d7a925 Update endpoints model
482067d Update API model
4662404 remove example (#3282)
c28a6f4 Release 2026-01-07
2fa7a72 Regenerated Clients
077cbaa Update endpoints model
3282dbc Update API model
3daa74a Release 2026-01-06
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.27.12 to 1.32.7

Commits

5a96470 Release 2024-12-19
653aa80 Regenerated Clients
d02b239 Update endpoints model
698d709 Update API model
885de40 Fix improper use of Printf-style functions (#2934)
858298a Release 2024-12-18
f58264a Regenerated Clients
df31082 Update endpoints model
346690e Update API model
4515454 Release 2024-12-17
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.60.1 to 1.95.1

Commits

dcbed91 Release 2026-01-09
08120e8 Regenerated Clients
1d7a925 Update endpoints model
482067d Update API model
4662404 remove example (#3282)
c28a6f4 Release 2026-01-07
2fa7a72 Regenerated Clients
077cbaa Update endpoints model
3282dbc Update API model
3daa74a Release 2026-01-06
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.28.7 to 1.41.1

Commits

dcbed91 Release 2026-01-09
08120e8 Regenerated Clients
1d7a925 Update endpoints model
482067d Update API model
4662404 remove example (#3282)
c28a6f4 Release 2026-01-07
2fa7a72 Regenerated Clients
077cbaa Update endpoints model
3282dbc Update API model
3daa74a Release 2026-01-06
Additional commits viewable in compare view

Updates github.com/aws/smithy-go from 1.20.4 to 1.24.0

Release notes

Sourced from github.com/aws/smithy-go's releases.

v1.22.4

Release (2025-06-16)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.22.4

Bug Fix: Fix CBOR serd empty check for string and enum fields

v1.22.3

Release (2025-02-17)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.22.3

Dependency Update: Bump minimum Go version to 1.22 per our language support policy.

Changelog

Sourced from github.com/aws/smithy-go's changelog.

Release (2025-12-01)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.24.0

Feature: Improve allocation footprint of the middleware stack. This should convey a ~10% reduction in allocations per SDK request.

Release (2025-11-03)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.23.2

Bug Fix: Adjust the initial sizes of each middleware phase to avoid some unnecessary reallocation.

Bug Fix: Avoid unnecessary allocation overhead from the metrics system when not in use.

Release (2025-10-15)

General Highlights

Dependency Update: Bump minimum go version to 1.23.

Dependency Update: Updated to the latest SDK module versions

Release (2025-09-18)

Module Highlights

github.com/aws/smithy-go/aws-http-auth: v1.1.0

Feature: Added support for SIG4/SIGV4A querystring authentication.

Release (2025-08-27)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.23.0

Feature: Sort map keys in JSON Document types.

Release (2025-07-24)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.22.5

Feature: Add HTTP interceptors.

Release (2025-06-16)

... (truncated)

Commits

71f5bff Release 2025-12-01
c94c177 changelog
0cc0b1c convert middleware steps to linked lists (#617)
ed49224 Add param binding error check in auth scheme resolution to avoid panic (#619)
0e0b20c add discrete tests for initialize step (#618)
ddbac1c only add interceptors if configured (#616)
798bf4f remove pointless trace spans (#615)
dc545a7 don't create op metrics context if not in use (#613)
6f12c09 add host label validation for region before ep resolution (#612)
299f404 Release 2025-11-03
Additional commits viewable in compare view

Updates github.com/cloudflare/cloudflare-go from 0.109.0 to 0.116.0

Release notes

Sourced from github.com/cloudflare/cloudflare-go's releases.

v0.116.0

ENHANCEMENTS:

access_service_tokens: Added graceful rotation support for client secrets (#4189)

v0.115.0

ENHANCEMENTS:

access_service_token: add last_seen_at field (#3838)

dns: Add settings to DNSRecord (#3670)

teams_rules: add support for biso admin controls v2 (#3848)

DEPENDENCIES:

deps: bumps dependabot/fetch-metadata from 2.2.0 to 2.3.0 (#3865)

deps: bumps github.com/go-git/go-git/v5 from 5.11.0 to 5.13.0 (#3869)

deps: bumps github.com/goccy/go-json from 0.10.4 to 0.10.5 (#3870)

deps: bumps golang.org/x/net from 0.25.0 to 0.33.0 (#3868)

v0.114.0

NOTES:

rulesets: remove http_request_sbfm phase (#3824)

workers: The placement_mode attribute in script upload responses has been deprecated. The new attribute placement.mode should be used instead. (#3825)

ENHANCEMENTS:

access_application: added more fields to private destinations (#3829)

teams_rules: add support for resolve_dns_internally settings on dns_resolver rules (#3779)

waiting_room: add waiting room turnstile integration fields (#3764)

workers: Add new placement attribute object in script upload responses. It contains the mode and status attributes. (#3825)

DEPENDENCIES:

deps: bumps golang.org/x/net from 0.33.0 to 0.34.0 (#3796)

deps: bumps golang.org/x/time from 0.8.0 to 0.9.0 (#3783)

v0.113.0

ENHANCEMENTS:

teams_location: make location parameters optional (#3758)

DEPENDENCIES:

deps: bumps golang.org/x/net from 0.32.0 to 0.33.0 (#3756)

v0.112.0

ENHANCEMENTS:

access_application: support Access service token + multi-valued authentication for SCIM provisioning (#3708)

... (truncated)

Changelog

Sourced from github.com/cloudflare/cloudflare-go's changelog.

0.116.0 (September 5th, 2025)

ENHANCEMENTS:

access_service_tokens: Added graceful rotation support for client secrets (#4189)

0.115.0 (January 29th, 2025)

ENHANCEMENTS:

access_service_token: add last_seen_at field (#3838)

dns: Add settings to DNSRecord (#3670)

teams_rules: add support for biso admin controls v2 (#3848)

DEPENDENCIES:

deps: bumps dependabot/fetch-metadata from 2.2.0 to 2.3.0 (#3865)

deps: bumps github.com/go-git/go-git/v5 from 5.11.0 to 5.13.0 (#3869)

deps: bumps github.com/goccy/go-json from 0.10.4 to 0.10.5 (#3870)

deps: bumps golang.org/x/net from 0.25.0 to 0.33.0 (#3868)

0.114.0 (January 15th, 2025)

NOTES:

rulesets: remove http_request_sbfm phase (#3824)

workers: The placement_mode attribute in script upload responses has been deprecated. The new attribute placement.mode should be used instead. (#3825)

ENHANCEMENTS:

access_application: added more fields to private destinations (#3829)

teams_rules: add support for resolve_dns_internally settings on dns_resolver rules (#3779)

waiting_room: add waiting room turnstile integration fields (#3764)

workers: Add new placement attribute object in script upload responses. It contains the mode and status attributes. (#3825)

DEPENDENCIES:

deps: bumps golang.org/x/net from 0.33.0 to 0.34.0 (#3796)

deps: bumps golang.org/x/time from 0.8.0 to 0.9.0 (#3783)

0.113.0 (January 1st, 2025)

ENHANCEMENTS:

teams_location: make location parameters optional (#3758)

DEPENDENCIES:

deps: bumps golang.org/x/net from 0.32.0 to 0.33.0 (#3756)

... (truncated)

Commits

1eda786 Update CHANGELOG.md
1317436 Update CHANGELOG.md for #4189
fd41d6b Merge pull request #4189 from GreenStage/aholland/client_secret_version
8f93e33 Bump golangci/golangci-lint-action to fix CI errors
d5bd4b9 Add graceful rotation support for client secrets
57714bf Update CHANGELOG.md
b063df7 generate changelog
46140a1 Merge pull request #3870 from cloudflare/dependabot/go_modules/github.com/goc...
3abb34b add CHANGELOG for #3870
c726fce Bump github.com/goccy/go-json from 0.10.4 to 0.10.5
Additional commits viewable in compare view

Updates github.com/cyrusaf/ctxlog from 1.3.2 to 1.3.3

Release notes

Sourced from github.com/cyrusaf/ctxlog's releases.

Subsequent anchor points on a ctx with an existing anchor point should noop

See #10.

Previously, if you called AnchorGlobalAttrs on a ctx with an existing anchor point, it would reset and clear all existing global attrs. This change chooses not to overwrite the existing anchor point, but rather re-use it. I considered creating a new anchor point and copying over fields, but thought the approach of maintaining the previous anchor point would be more common. We can always add a method to reset the anchor point if that is a needed use case.

Commits

5e8b294 Merge pull request #10 from cyrusaf/noop-second-anchor
9edd55a subsequent anchor points on a ctx with an existing anchor point should count ...
6735c3f Merge pull request #9 from cyrusaf/race-fix
See full diff in compare view

Updates github.com/getsentry/sentry-go from 0.28.0 to 0.40.0

Release notes

Sourced from github.com/getsentry/sentry-go's releases.

0.40.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.40.0.

Bug Fixes

Disable DisableTelemetryBuffer flag and noop Telemetry Buffer, to prevent a panic at runtime (#1149).

0.39.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.39.0.

Features

Drop events from the telemetry buffer when rate-limited or transport is full, allowing the buffer queue to empty itself under load (#1138).

Bug Fixes

Fix scheduler's hasWork() method to check if buffers are ready to flush. The previous implementation was causing CPU spikes (#1143).

0.38.0

Breaking Changes

Features
Introduce a new async envelope transport and telemetry buffer to prioritize and batch events (#1094, #1093, #1107).

Advantages:

Prioritized, per-category buffers (errors, transactions, logs, check-ins) reduce starvation and improve resilience under load

Batching for high-volume logs (up to 100 items or 5s) cuts network overhead

Bounded memory with eviction policies

Improved flush behavior with context-aware flushing
Add ClientOptions.DisableTelemetryBuffer to opt out and fall back to the legacy transport layer (HTTPTransport / HTTPSyncTransport).
err := sentry.Init(sentry.ClientOptions{
  Dsn: "__DSN__",
  DisableTelemetryBuffer: true, // fallback to legacy transport
})
Notes

If a custom Transport is provided, the SDK automatically disables the telemetry buffer and uses the legacy transport for compatibility.

0.37.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.37.0.

Breaking Changes

Behavioral change for the TraceIgnoreStatusCodes option. The option now defaults to ignoring 404 status codes (#1122).

Features

... (truncated)

Changelog

Sourced from github.com/getsentry/sentry-go's changelog.

0.40.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.40.0.

Bug Fixes

Disable DisableTelemetryBuffer flag and noop Telemetry Buffer, to prevent a panic at runtime (#1149).

0.39.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.39.0.

Features

Drop events from the telemetry buffer when rate-limited or transport is full, allowing the buffer queue to empty itself under load (#1138).

Bug Fixes

Fix scheduler's hasWork() method to check if buffers are ready to flush. The previous implementation was causing CPU spikes (#1143).

0.38.0

Breaking Changes

Features
Introduce a new async envelope transport and telemetry buffer to prioritize and batch events (#1094, #1093, #1107).

Advantages:

Prioritized, per-category buffers (errors, transactions, logs, check-ins) reduce starvation and improve resilience under load

Batching for high-volume logs (up to 100 items or 5s) cuts network overhead

Bounded memory with eviction policies

Improved flush behavior with context-aware flushing
Add ClientOptions.DisableTelemetryBuffer to opt out and fall back to the legacy transport layer (HTTPTransport / HTTPSyncTransport).
err := sentry.Init(sentry.ClientOptions{
  Dsn: "__DSN__",
  DisableTelemetryBuffer: true, // fallback to legacy transport
})
Notes

If a custom Transport is provided, the SDK automatically disables the telemetry buffer and uses the legacy transport for compatibility.

0.37.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.37.0.

Breaking Changes

... (truncated)

Commits

f3fc564 release: 0.40.0
9232f5d chore: prepare 0.40.0 (#1150)
55ee13e feat: disable Telemetry Buffer (#1149)
34261f3 Merge branch 'release/0.39.0'
a362682 release: 0.39.0
2153b50 chore: prepare 0.39.0 (#1144)
112f257 fix: scheduler should check for ready to flush buffers (#1143)
03de096 feat: drop rate-limited events (#1138)
a2066ef Merge branch 'release/0.38.0'
eb9fd9f release: 0.38.0
Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4

Release notes

Sourced from github.com/go-jose/go-jose/v3's releases.

v3.0.4

What's Changed

Backport fix for GHSA-c6gw-w398-hv78 CVE-2025-27144 go-jose/go-jose#174

Full Changelog: go-jose/go-jose@v3.0.3...v3.0.4

Commits

5253038 Backport fix 167 to v3 (#174)
047dc99 CI: Update github actions and go version (#173)
0f017e9 Revert #26 (ignore unsupported JWKs in Sets) (#131)
3e2bbef Unmarshal jwk keys with unsupported key type or algorithm into empty … (#26)
See full diff in compare view

Updates github.com/go-jose/go-jose/v4 from 4.0.4 to 4.1.3

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.3

This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop x/crypto and no longer have any external dependencies in go-jose outside of the standard library!

This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.

What's Changed

Remove Go 1.23 support by @mcpherrinm in go-jose/go-jose#205

Reject JWS with an unprotected critical b64 header by @mcpherrinm in go-jose/go-jose#210

Full Changelog: go-jose/go-jose@v4.1.2...v4.1.3

v4.1.2

What's Changed

go-jose v4.1.2 improves some documentation, errors, and removes the only 3rd-party dependency.

Update go-jose documentation by @mcpherrinm in go-jose/go-jose#198

Remove dependency on testify by @wardviaene in go-jose/go-jose#197

Improve error message for invalid private keys by @ProjectMutilation in go-jose/go-jose#195

JWK unsupported error when unmarshalling by @fprojetto in go-jose/go-jose#191

Add JSONWebKey type to makeJWERecipient by @alvarolivie in go-jose/go-jose#200

testutils/assert: remove True, Nil, NotNil by @jsha in go-jose/go-jose#202

New Contributors

@wardviaene made their first contribution in go-jose/go-jose#197

@fprojetto made their first contribution in go-jose/go-jose#191

@alvarolivie made their first contribution in go-jose/go-jose#200

Full Changelog: go-jose/go-jose@v4.1.1...v4.1.2

v4.1.1

What's Changed

Drop go-cmp dependency by @mcpherrinm in go-jose/go-jose#186

jws: improve performance and allocations for ParseSignedCompact by @drakkan in go-jose/go-jose#188

Add missing quote to unknown curve message #170 by @sudhanvaghebbale in go-jose/go-jose#189

Fix incorrect validation by @ProjectMutilation in go-jose/go-jose#192

Restore Go 1.23 compatibility by @anuraaga in go-jose/go-jose#193

New Contributors

@drakkan made their first contribution in go-jose/go-jose#188

@sudhanvaghebbale made their first contribution in go-jose/go-jose#189

@ProjectMutilation made their first contribution in go-jose/go-jose#192

@anuraaga made their first contribution in go-jose/go-jose#193

Full Changelog: go-jose/go-jose@v4.1.0...v4.1.1

v4.1.0

What's Changed

Document signatureAlgorithms argument by @tgeoghegan in go-jose/go-jose#163

Add custom error for unsupported JWS signature algorithms by @beautifulentropy in go-jose/go-jose#181

use stdlib pbkdf2 package on go 1.24 by @kruskall in go-jose/go-jose#180

... (truncated)

Commits

5348b9a Reject JWS with an unprotected critical b64 header (#210)
9153a5e Bump actions/setup-python from 5 to 6 (#208)
2126e17 Bump actions/setup-go from 5 to 6 (#209)
9860c65 Bump actions/checkout from 4 to 5 (#206)
14239fd Remove Go 1.23 support (#205)
a16e158 Update CI to run on Go 1.24 and 1.25 (#204)
a1565a4 testutils/assert: remove True, Nil, NotNil (#202)
3a80e13 jwe: accept non-pointer JSONWebKey in Recipient (#200)
e2cde04 jwk: JSONWebKey.UnmarshalJSON can return ErrUnsupportedKeyType (#191)
6a17172 jwk: list all missing fields on error (#195)
Additional commits viewable in compare view

Updates github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.3.0

Release notes

Sourced from github.com/golang-jwt/jwt/v5's releases.

v5.3.0

This release is almost identical to to v5.2.3 but now correctly indicates Go 1.21 as minimum requirement.

What's Changed

Create CODEOWNERS by @oxisto in golang-jwt/jwt#449

Bump Go version to indicate correct minimum requirement by @oxisto in golang-jwt/jwt#452

Full Changelog: golang-jwt/jwt@v5.2.3...v5.3.0

v5.2.3

What's Changed

Bump GitHub workflows and Go versions by @mfridman in golang-jwt/jwt#438

Implementing validation of multiple audiences by @oxisto in golang-jwt/jwt#433

Bump golangci/golangci-lint-action from 7 to 8 by @dependabot[bot] in golang-jwt/jwt#440

replaced interface{} to any by @aachex in golang-jwt/jwt#445

Fix bug in validation of multiple audiences by @sfinnman-cotn in golang-jwt/jwt#441

New Contributors

@aachex made their first contribution in golang-jwt/jwt#445

@sfinnman-cotn made their first contribution in golang-jwt/jwt#441

Full Changelog: golang-jwt/jwt@v5.2.2...v5.2.3

v5.2.2

What's Changed

Fixed GHSA-mh63-6h87-95cp by @mfridman

Fixed some typos by @Ashikpaul in golang-jwt/jwt#382

build: add go1.22 to ci workflows by @mfridman in golang-jwt/jwt#383

Bump golangci/golangci-lint-action from 4 to 5 by

Bumps the minor-and-patch group with 27 updates: | Package | From | To | | --- | --- | --- | | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `1.16.2` | `1.19.1` | | [connectrpc.com/vanguard](https://github.com/connectrpc/vanguard-go) | `0.2.0` | `0.3.0` | | [github.com/alecthomas/participle/v2](https://github.com/alecthomas/participle) | `2.1.1` | `2.1.4` | | [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.30.4` | `1.41.1` | | [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.27.12` | `1.32.7` | | [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.60.1` | `1.95.1` | | [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.28.7` | `1.41.1` | | [github.com/aws/smithy-go](https://github.com/aws/smithy-go) | `1.20.4` | `1.24.0` | | [github.com/cloudflare/cloudflare-go](https://github.com/cloudflare/cloudflare-go) | `0.109.0` | `0.116.0` | | [github.com/cyrusaf/ctxlog](https://github.com/cyrusaf/ctxlog) | `1.3.2` | `1.3.3` | | [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go) | `0.28.0` | `0.40.0` | | [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) | `3.0.3` | `3.0.4` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.0.4` | `4.1.3` | | [github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt) | `5.2.1` | `5.3.0` | | [github.com/golang-migrate/migrate/v4](https://github.com/golang-migrate/migrate) | `4.17.1` | `4.19.1` | | [github.com/google/go-cmp](https://github.com/google/go-cmp) | `0.6.0` | `0.7.0` | | [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) | `2.19.1` | `2.27.4` | | [github.com/hasura/go-graphql-client](https://github.com/hasura/go-graphql-client) | `0.13.0` | `0.15.1` | | [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.5.5` | `5.8.0` | | [github.com/resend/resend-go/v2](https://github.com/resend/resend-go) | `2.6.0` | `2.28.0` | | [github.com/rs/cors](https://github.com/rs/cors) | `1.11.0` | `1.11.1` | | [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.9.0` | `1.11.1` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.28.0` | `0.45.0` | | [google.golang.org/genproto/googleapis/api](https://github.com/googleapis/go-genproto) | `0.0.0-20240814211410-ddb44dafa142` | `0.0.0-20251222181119-0a764e51fe1b` | | [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20240814211410-ddb44dafa142` | `0.0.0-20251222181119-0a764e51fe1b` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.64.1` | `1.78.0` | | google.golang.org/protobuf | `1.34.2` | `1.36.11` | Updates `connectrpc.com/connect` from 1.16.2 to 1.19.1 - [Release notes](https://github.com/connectrpc/connect-go/releases) - [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md) - [Commits](connectrpc/connect-go@v1.16.2...v1.19.1) Updates `connectrpc.com/vanguard` from 0.2.0 to 0.3.0 - [Release notes](https://github.com/connectrpc/vanguard-go/releases) - [Commits](connectrpc/vanguard-go@v0.2.0...v0.3.0) Updates `github.com/alecthomas/participle/v2` from 2.1.1 to 2.1.4 - [Release notes](https://github.com/alecthomas/participle/releases) - [Changelog](https://github.com/alecthomas/participle/blob/master/CHANGES.md) - [Commits](alecthomas/participle@v2.1.1...v2.1.4) Updates `github.com/aws/aws-sdk-go-v2` from 1.30.4 to 1.41.1 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@v1.30.4...v1.41.1) Updates `github.com/aws/aws-sdk-go-v2/config` from 1.27.12 to 1.32.7 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@config/v1.27.12...v1.32.7) Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.60.1 to 1.95.1 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.60.1...service/s3/v1.95.1) Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.28.7 to 1.41.1 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@config/v1.28.7...v1.41.1) Updates `github.com/aws/smithy-go` from 1.20.4 to 1.24.0 - [Release notes](https://github.com/aws/smithy-go/releases) - [Changelog](https://github.com/aws/smithy-go/blob/main/CHANGELOG.md) - [Commits](aws/smithy-go@v1.20.4...v1.24.0) Updates `github.com/cloudflare/cloudflare-go` from 0.109.0 to 0.116.0 - [Release notes](https://github.com/cloudflare/cloudflare-go/releases) - [Changelog](https://github.com/cloudflare/cloudflare-go/blob/v0.116.0/CHANGELOG.md) - [Commits](cloudflare/cloudflare-go@v0.109.0...v0.116.0) Updates `github.com/cyrusaf/ctxlog` from 1.3.2 to 1.3.3 - [Release notes](https://github.com/cyrusaf/ctxlog/releases) - [Commits](cyrusaf/ctxlog@v1.3.2...v1.3.3) Updates `github.com/getsentry/sentry-go` from 0.28.0 to 0.40.0 - [Release notes](https://github.com/getsentry/sentry-go/releases) - [Changelog](https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md) - [Commits](getsentry/sentry-go@v0.28.0...v0.40.0) Updates `github.com/go-jose/go-jose/v3` from 3.0.3 to 3.0.4 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v3.0.3...v3.0.4) Updates `github.com/go-jose/go-jose/v4` from 4.0.4 to 4.1.3 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.0.4...v4.1.3) Updates `github.com/golang-jwt/jwt/v5` from 5.2.1 to 5.3.0 - [Release notes](https://github.com/golang-jwt/jwt/releases) - [Commits](golang-jwt/jwt@v5.2.1...v5.3.0) Updates `github.com/golang-migrate/migrate/v4` from 4.17.1 to 4.19.1 - [Release notes](https://github.com/golang-migrate/migrate/releases) - [Commits](golang-migrate/migrate@v4.17.1...v4.19.1) Updates `github.com/google/go-cmp` from 0.6.0 to 0.7.0 - [Release notes](https://github.com/google/go-cmp/releases) - [Commits](google/go-cmp@v0.6.0...v0.7.0) Updates `github.com/grpc-ecosystem/grpc-gateway/v2` from 2.19.1 to 2.27.4 - [Release notes](https://github.com/grpc-ecosystem/grpc-gateway/releases) - [Commits](grpc-ecosystem/grpc-gateway@v2.19.1...v2.27.4) Updates `github.com/hasura/go-graphql-client` from 0.13.0 to 0.15.1 - [Release notes](https://github.com/hasura/go-graphql-client/releases) - [Commits](hasura/go-graphql-client@v0.13.0...v0.15.1) Updates `github.com/jackc/pgx/v5` from 5.5.5 to 5.8.0 - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.5.5...v5.8.0) Updates `github.com/resend/resend-go/v2` from 2.6.0 to 2.28.0 - [Release notes](https://github.com/resend/resend-go/releases) - [Changelog](https://github.com/resend/resend-go/blob/main/CHANGELOG.md) - [Commits](resend/resend-go@v2.6.0...v2.28.0) Updates `github.com/rs/cors` from 1.11.0 to 1.11.1 - [Commits](rs/cors@v1.11.0...v1.11.1) Updates `github.com/stretchr/testify` from 1.9.0 to 1.11.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.9.0...v1.11.1) Updates `golang.org/x/crypto` from 0.28.0 to 0.45.0 - [Commits](golang/crypto@v0.28.0...v0.45.0) Updates `google.golang.org/genproto/googleapis/api` from 0.0.0-20240814211410-ddb44dafa142 to 0.0.0-20251222181119-0a764e51fe1b - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20240814211410-ddb44dafa142 to 0.0.0-20251222181119-0a764e51fe1b - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/grpc` from 1.64.1 to 1.78.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.64.1...v1.78.0) Updates `google.golang.org/protobuf` from 1.34.2 to 1.36.11 --- updated-dependencies: - dependency-name: connectrpc.com/connect dependency-version: 1.19.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: connectrpc.com/vanguard dependency-version: 0.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/alecthomas/participle/v2 dependency-version: 2.1.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2 dependency-version: 1.41.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-version: 1.32.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.95.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager dependency-version: 1.41.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/aws/smithy-go dependency-version: 1.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/cloudflare/cloudflare-go dependency-version: 0.116.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/cyrusaf/ctxlog dependency-version: 1.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/getsentry/sentry-go dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/go-jose/go-jose/v3 dependency-version: 3.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/golang-jwt/jwt/v5 dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/golang-migrate/migrate/v4 dependency-version: 4.19.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/google/go-cmp dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/grpc-ecosystem/grpc-gateway/v2 dependency-version: 2.27.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/hasura/go-graphql-client dependency-version: 0.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/resend/resend-go/v2 dependency-version: 2.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: github.com/rs/cors dependency-version: 1.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: github.com/stretchr/testify dependency-version: 1.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: google.golang.org/genproto/googleapis/api dependency-version: 0.0.0-20251222181119-0a764e51fe1b dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20251222181119-0a764e51fe1b dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: google.golang.org/grpc dependency-version: 1.78.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: google.golang.org/protobuf dependency-version: 1.36.11 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…6f9b

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jan 14, 2026

dependabot bot force-pushed the dependabot/go_modules/minor-and-patch-4b276b6f9b branch from 9f6fca3 to fe47f67 Compare January 15, 2026 16:36

dependabot bot force-pushed the dependabot/go_modules/minor-and-patch-4b276b6f9b branch from fe47f67 to 805bce7 Compare January 26, 2026 21:13

dependabot bot force-pushed the dependabot/go_modules/minor-and-patch-4b276b6f9b branch from 805bce7 to 9937b04 Compare February 2, 2026 15:03

gareth-civia added 4 commits February 2, 2026 16:05

Merge branch 'main' into dependabot/go_modules/minor-and-patch-4b276b…

7758d29

…6f9b

get tests running

0a8dc6a

fmt

56cf5d3

update readme

16dcd15

gareth-civia approved these changes Feb 11, 2026

View reviewed changes

gareth-civia merged commit 458b4bc into main Feb 11, 2026
8 checks passed

gareth-civia deleted the dependabot/go_modules/minor-and-patch-4b276b6f9b branch February 11, 2026 14:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the minor-and-patch group with 27 updates #49

build(deps): bump the minor-and-patch group with 27 updates #49

Uh oh!

dependabot bot commented on behalf of github Jan 14, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

build(deps): bump the minor-and-patch group with 27 updates #49

build(deps): bump the minor-and-patch group with 27 updates #49

Uh oh!

Conversation

dependabot bot commented on behalf of github Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.19.1

What's Changed

Bugfixes

v1.19.0

What's Changed

Enhancements

Bugfixes

Other changes

New Contributors

v1.18.1

What's Changed

Bugfixes

v0.3.0

What's Changed

Enhancements

Bugfixes

v2.1.4

Changelog

v2.1.3

Changelog

v2.1.2

Changelog

v1.22.4

Release (2025-06-16)

General Highlights

Module Highlights

v1.22.3

Release (2025-02-17)

General Highlights

Module Highlights

Release (2025-12-01)

General Highlights

Module Highlights

Release (2025-11-03)

General Highlights

Module Highlights

Release (2025-10-15)

General Highlights

Release (2025-09-18)

Module Highlights

Release (2025-08-27)

General Highlights

Module Highlights

Release (2025-07-24)

General Highlights

Module Highlights

Release (2025-06-16)

v0.116.0

v0.115.0

v0.114.0

v0.113.0

v0.112.0

0.116.0 (September 5th, 2025)

0.115.0 (January 29th, 2025)

0.114.0 (January 15th, 2025)

0.113.0 (January 1st, 2025)

Subsequent anchor points on a ctx with an existing anchor point should noop

0.40.0

Bug Fixes

0.39.0

Features

Bug Fixes

0.38.0

Breaking Changes

Features

Notes

0.37.0

Breaking Changes

Features

0.40.0

Bug Fixes

0.39.0

Features

Bug Fixes

dependabot bot commented on behalf of github Jan 14, 2026 •

edited

Loading