Skip to content

build(deps): bump the go-dev-dependencies group with 10 updates#261

Merged
mgoetzegb merged 1 commit intomainfrom
dependabot/go_modules/go-dev-dependencies-913005c8fe
Nov 10, 2025
Merged

build(deps): bump the go-dev-dependencies group with 10 updates#261
mgoetzegb merged 1 commit intomainfrom
dependabot/go_modules/go-dev-dependencies-913005c8fe

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Nov 10, 2025

Bumps the go-dev-dependencies group with 10 updates:

Package From To
github.com/testcontainers/testcontainers-go 0.39.0 0.40.0
github.com/docker/docker 28.5.1+incompatible 28.5.2+incompatible
github.com/ebitengine/purego 0.9.0 0.9.1
github.com/go-openapi/jsonreference 0.21.2 0.21.3
github.com/go-openapi/spec 0.22.0 0.22.1
github.com/golang-migrate/migrate/v4 4.18.3 4.19.0
github.com/quic-go/quic-go 0.55.0 0.56.0
golang.org/x/arch 0.22.0 0.23.0
golang.org/x/sync 0.17.0 0.18.0
golang.org/x/sys 0.37.0 0.38.0

Updates github.com/testcontainers/testcontainers-go from 0.39.0 to 0.40.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go's releases.

v0.40.0

What's Changed

⚠️ Breaking Changes

The below modules receive a breaking change in the signature of their functional options, as now all of them return an error when needed (returning nil for success). Therefore, you're only affected when assigning the options to variables.

  • Old: type Option func(*options)
  • New: type Option func(*options) error

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

... (truncated)

Commits
  • 71b5775 chore: use new version (v0.40.0) in modules and examples
  • 7e7e8cc chore(deps): bump amannn/action-semantic-pull-request from 5.5.3 to 6.1.1 (#3...
  • f95900f feat(azure): add cosmosdb module (#3452)
  • 1ed2735 fix(udp): expose UDP ports properly (#3485)
  • 7527203 chore(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 and golang.org/x/cry...
  • aa75771 chore(deps): bump github.com/docker/docker from 28.3.3+incompatible to 28.5.1...
  • bddd936 feat(wait): add human-readable String() methods to all wait strategies (#3461)
  • 666b20d chore(deps): bump mkdocs-include-markdown-plugin from 7.1.6 to 7.2.0 (#3463)
  • 56b85e5 chore(deps): bump actions/setup-go from 5.4.0 to 6.0.0 (#3462)
  • 9895e2e chore: enable prealloc linter and address issues (#3458)
  • Additional commits viewable in compare view

Updates github.com/docker/docker from 28.5.1+incompatible to 28.5.2+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

v28.5.2

28.5.2

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

[!CAUTION] This release contains fixes for three high-severity security vulnerabilities in runc:

All three vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files.

Packaging updates

Bug fixes and enhancements

Deprecations

  • Go-SDK: cli/command/image/build: deprecate DefaultDockerfileName, DetectArchiveReader, WriteTempDockerfile, ResolveAndValidateContextPath. These utilities were only used internally and will be removed in the next release. docker/cli#6610
  • Go-SDK: cli/command/image/build: deprecate IsArchive utility. docker/cli#6560
  • Go-SDK: opts: deprecate ValidateMACAddress. docker/cli#6560
  • Go-SDK: opts: deprecate ListOpts.Delete(). docker/cli#6560
Commits
  • 89c5e8f Merge pull request #51396 from thaJeztah/28.x_backport_api_docs
  • 9b93878 Merge pull request #51395 from thaJeztah/28.x_backport_rootless_reject
  • 6178456 Merge pull request #51398 from vvoland/51397-28.x
  • 0cae4e5 vendor: github.com/moby/buildkit v0.25.2
  • 33cc06f Merge pull request #51394 from vvoland/51393-28.x
  • d525277 api/docs: remove BuildCache.Parent field for API v1.42 and up
  • 2fbc51b dockerd-rootless.sh: reject DOCKERD_ROOTLESS_ROOTLESSKIT_NET=host
  • bd98008 integration-cli: Adjust nofile limits
  • 1967515 Dockerfile: update runc binary to v1.3.3
  • 4489660 Merge pull request #51387 from thaJeztah/28.x_bump_go
  • Additional commits viewable in compare view

Updates github.com/ebitengine/purego from 0.9.0 to 0.9.1

Commits

Updates github.com/go-openapi/jsonreference from 0.21.2 to 0.21.3

Commits
  • d5ff0ea tests: replaced stretchr/testify by go-openapi/testify
  • 5cee2c3 chore: updated license marks in source files
  • See full diff in compare view

Updates github.com/go-openapi/spec from 0.22.0 to 0.22.1

Commits
  • f06cfff tests: replaced stretchr/testify by go-openapi/testify
  • 9da6d8d chore: updated license marks in source files
  • 3c1111c chore(linting): removed nolint directives when the linter has fixed false pos...
  • See full diff in compare view

Updates github.com/golang-migrate/migrate/v4 from 4.18.3 to 4.19.0

Release notes

Sourced from github.com/golang-migrate/migrate/v4's releases.

v4.19.0

What's Changed

New Contributors

Full Changelog: golang-migrate/migrate@v4.18.3...v4.19.0

Commits
  • 8b9c5f7 Merge pull request #1310 from dhui/update_go
  • b4ec9bc Add support for Go 1.25 and drop support for 1.23
  • ed4bdd4 Ensure bufferWriter is always closed in Migration.Buffer and propagate close ...
  • 8945e85 Merge pull request #1303 from romshark/master
  • 7108d80 Merge pull request #1309 from dhui/dktest_v0.4.6
  • 682016f Merge pull request #1277 from sandhilt/doc/change-apt-key-to-gpg
  • f3e6b5a Replace usage of deprecated docker types
  • 0a17402 Update dktest to v0.4.6 for docker vuln fix
  • 5eee0c8 Merge pull request #1299 from golang-migrate/dependabot/go_modules/golang.org...
  • 642a24d Bump golang.org/x/oauth2 from 0.18.0 to 0.27.0
  • Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.55.0 to 0.56.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.56.0

This release introduces qlog support for HTTP/3 (#5367, #5372, #5374, #5375, #5376, #5381, #5383).

For this, we completely changed how connection tracing works. Instead of a general-purpose logging.ConnectionTracer (which we removed entirely), we now have a qlog-specific tracer (#5356, #5417). quic-go users can now implement their own qlog events.

It also removes the Prometheus-based metrics collection. Please comment on the tracking issue (#5294) if you rely on metrics and are interested in seeing metrics brought back in a future release.

Notable Changes

  • replaced the unmaintained gojay with a custom, performance-optimized JSON encoder (#5353, #5371)
  • quicvarint: improved panic message for numbers larger than 2^62 (#5410)

Behind the Scenes

Go 1.25 introduced support for testing concurrent code using testing/synctest. We've been working on transitioning tests to use synctest (#5357, #5391, #5393, #5397, #5398, #5403, #5414, #5415), using @​MarcoPolo's simnet package to simulate a network in memory.

Using synctest makes test execution more reliable (reducing flakiness). The use of a synthetic clock leads to a massive speedup; the execution time of some integration tests was reduced from 20s to less than 1ms. The work will continue for the next release (see tracking issue: #5386).

Changelog

... (truncated)

Commits

Updates golang.org/x/arch from 0.22.0 to 0.23.0

Commits

Updates golang.org/x/sync from 0.17.0 to 0.18.0

Commits

Updates golang.org/x/sys from 0.37.0 to 0.38.0

Commits
  • 15129aa cpu: also use MRS instruction in getmmfr1
  • ed38ca2 unix: add SizeofNhmsg and SizeofNexthopGrp
  • 3675c4c cpu: use MRS instruction to read arm64 system registers
  • 2a15272 unix: add consts for ELF handling
  • 6239615 cpu: add HPDS, LOR, PAN detection for arm64
  • ea436ef windows: add iphlpapi routing functions
  • 28c5bda unix: add SetMemPolicy and its mode/flag values
  • b731f78 unix/linux: switch to ubuntu 25.04, Go 1.25.1
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Nov 10, 2025
@dependabot dependabot bot requested review from a team as code owners November 10, 2025 04:09
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Nov 10, 2025
@greenbonebot
Copy link
Copy Markdown
Member

greenbonebot commented Nov 10, 2025

Scanning the following files:

go.mod
go.sum

Scan: 'go.mod'

Nothing detected in go.mod
Scan took 0.00 seconds

Scan: 'go.sum'

Nothing detected in go.sum
Scan took 0.00 seconds

@github-actions
Copy link
Copy Markdown

github-actions bot commented Nov 10, 2025

Conventional Commits Report

😢 No conventional commits found.

👉 Learn more about the conventional commits usage at Greenbone.

@codecov
Copy link
Copy Markdown

codecov bot commented Nov 10, 2025 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.86%. Comparing base (5ff2345) to head (4acb3e2).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #261   +/-   ##
=======================================
  Coverage   55.86%   55.86%           
=======================================
  Files          61       61           
  Lines        3222     3222           
=======================================
  Hits         1800     1800           
  Misses       1293     1293           
  Partials      129      129
Flag Coverage Δ
opensearch-tests 95.62% <ø> (ø)
postgres-tests 91.96% <ø> (ø)
unit-tests 48.89% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@dependabot @mgoetzegb
build(deps): bump the go-dev-dependencies group with 10 updates
4acb3e2 
Bumps the go-dev-dependencies group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go) | `0.39.0` | `0.40.0` |
| [github.com/docker/docker](https://github.com/docker/docker) | `28.5.1+incompatible` | `28.5.2+incompatible` |
| [github.com/ebitengine/purego](https://github.com/ebitengine/purego) | `0.9.0` | `0.9.1` |
| [github.com/go-openapi/jsonreference](https://github.com/go-openapi/jsonreference) | `0.21.2` | `0.21.3` |
| [github.com/go-openapi/spec](https://github.com/go-openapi/spec) | `0.22.0` | `0.22.1` |
| [github.com/golang-migrate/migrate/v4](https://github.com/golang-migrate/migrate) | `4.18.3` | `4.19.0` |
| [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) | `0.55.0` | `0.56.0` |
| [golang.org/x/arch](https://github.com/golang/arch) | `0.22.0` | `0.23.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.17.0` | `0.18.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.37.0` | `0.38.0` |


Updates `github.com/testcontainers/testcontainers-go` from 0.39.0 to 0.40.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.39.0...v0.40.0)

Updates `github.com/docker/docker` from 28.5.1+incompatible to 28.5.2+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](moby/moby@v28.5.1...v28.5.2)

Updates `github.com/ebitengine/purego` from 0.9.0 to 0.9.1
- [Release notes](https://github.com/ebitengine/purego/releases)
- [Commits](ebitengine/purego@v0.9.0...v0.9.1)

Updates `github.com/go-openapi/jsonreference` from 0.21.2 to 0.21.3
- [Commits](go-openapi/jsonreference@v0.21.2...v0.21.3)

Updates `github.com/go-openapi/spec` from 0.22.0 to 0.22.1
- [Commits](go-openapi/spec@v0.22.0...v0.22.1)

Updates `github.com/golang-migrate/migrate/v4` from 4.18.3 to 4.19.0
- [Release notes](https://github.com/golang-migrate/migrate/releases)
- [Changelog](https://github.com/golang-migrate/migrate/blob/master/.goreleaser.yml)
- [Commits](golang-migrate/migrate@v4.18.3...v4.19.0)

Updates `github.com/quic-go/quic-go` from 0.55.0 to 0.56.0
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.55.0...v0.56.0)

Updates `golang.org/x/arch` from 0.22.0 to 0.23.0
- [Commits](golang/arch@v0.22.0...v0.23.0)

Updates `golang.org/x/sync` from 0.17.0 to 0.18.0
- [Commits](golang/sync@v0.17.0...v0.18.0)

Updates `golang.org/x/sys` from 0.37.0 to 0.38.0
- [Commits](golang/sys@v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: github.com/testcontainers/testcontainers-go
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dev-dependencies
- dependency-name: github.com/docker/docker
  dependency-version: 28.5.2+incompatible
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dev-dependencies
- dependency-name: github.com/ebitengine/purego
  dependency-version: 0.9.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dev-dependencies
- dependency-name: github.com/go-openapi/jsonreference
  dependency-version: 0.21.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dev-dependencies
- dependency-name: github.com/go-openapi/spec
  dependency-version: 0.22.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dev-dependencies
- dependency-name: github.com/golang-migrate/migrate/v4
  dependency-version: 4.19.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dev-dependencies
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.56.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dev-dependencies
- dependency-name: golang.org/x/arch
  dependency-version: 0.23.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dev-dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.18.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dev-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.38.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@mgoetzegb mgoetzegb force-pushed the dependabot/go_modules/go-dev-dependencies-913005c8fe branch from 1b78afa to 4acb3e2 Compare November 10, 2025 10:16
@mgoetzegb mgoetzegb enabled auto-merge (rebase) November 10, 2025 10:16
@mgoetzegb mgoetzegb merged commit de26e92 into main Nov 10, 2025
12 checks passed
@mgoetzegb mgoetzegb deleted the dependabot/go_modules/go-dev-dependencies-913005c8fe branch November 10, 2025 10:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mgoetzegb mgoetzegb mgoetzegb approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@greenbonebot @mgoetzegb