build(deps): bump github.com/nats-io/nats-server/v2 from 2.11.1 to 2.11.12#3
Conversation
Bumps [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) from 2.11.1 to 2.11.12. - [Release notes](https://github.com/nats-io/nats-server/releases) - [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md) - [Commits](nats-io/nats-server@v2.11.1...v2.11.12) --- updated-dependencies: - dependency-name: github.com/nats-io/nats-server/v2 dependency-version: 2.11.12 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
WalkthroughUpdated Go module dependencies across the project, including patches for compression, cryptography, and networking libraries; added Antithesis SDK as an indirect dependency; adjusted various indirect module versions to maintain compatibility alignment. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
go.mod (1)
44-105:⚠️ Potential issue | 🟠 MajorAddress nats.go v1.48.0 subject validation behavior change.
nats.go v1.48.0 now validates subject names and rejects subjects with whitespace or control characters by default. Existing NATS notification targets configured with subjects containing spaces, tabs, or newlines will fail after the upgrade. Either validate subject inputs to prevent invalid characters or use
nats.SkipSubjectValidation()in the NATS connection options to retain legacy behavior. Document the breaking change for users with existing NATS configs.golang.org/x/crypto v0.47.0 includes security fixes (CVE-2025-47914, CVE-2025-58181 in ssh/agent) and is safe to merge.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@go.mod` around lines 44 - 105, The upgrade to nats.go v1.48.0 introduces strict subject validation causing existing NATS notifications with whitespace/control characters to fail; locate the NATS connection initialization (e.g., functions/methods like NewNATSClient, connectToNATS, or where nats.Connect is called) and either sanitize/validate configured subject strings before use (reject or trim spaces/newlines) or add nats.SkipSubjectValidation() to the nats.Connect options to preserve legacy behavior; update any configuration validation code that builds subjects and add a brief comment documenting this breaking change for operators.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@go.mod`:
- Around line 44-105: The upgrade to nats.go v1.48.0 introduces strict subject
validation causing existing NATS notifications with whitespace/control
characters to fail; locate the NATS connection initialization (e.g.,
functions/methods like NewNATSClient, connectToNATS, or where nats.Connect is
called) and either sanitize/validate configured subject strings before use
(reject or trim spaces/newlines) or add nats.SkipSubjectValidation() to the
nats.Connect options to preserve legacy behavior; update any configuration
validation code that builds subjects and add a brief comment documenting this
breaking change for operators.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
Bumps github.com/nats-io/nats-server/v2 from 2.11.1 to 2.11.12.
Release notes
Sourced from github.com/nats-io/nats-server/v2's releases.
... (truncated)
Commits
2d97cb7Release v2.11.12ea9680aCherry-picks for 2.11.12 (#7776)eb53e0d[IMPROVED] Remove no interest messages from head of streamdc0d365[FIXED] Many concurrent checkInterestState goroutines360db02[FIXED] Interest stream desync after consumer filter update74802ff[IMPROVED] Simplify recalculate pending with updated filter subject(s)6f77800Release v2.11.12-RC.7134ebc2Revert "Perform_writeFullStateunder read lock only"ddd1442Release v2.11.12-RC.659b2eb8Cherry-picks for 2.11.12-RC.6 (#7768)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by CodeRabbit