Skip to content

chore(deps): bump the minor-patch group across 1 directory with 10 updates - #1228

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-patch-eed0d71046
Open

chore(deps): bump the minor-patch group across 1 directory with 10 updates#1228
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-patch-eed0d71046

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-patch group with 10 updates in the / directory:

Package From To
github.com/go-jose/go-jose/v4 4.1.5 4.1.7
github.com/go-ldap/ldap/v3 3.4.14 3.4.15
github.com/jackc/pgx/v5 5.11.0 5.12.0
golang.org/x/crypto 0.57.0 0.58.0
golang.org/x/net 0.59.0 0.60.0
golang.org/x/tools 0.50.0 0.51.0
k8s.io/api 0.37.1 0.37.2
k8s.io/apimachinery 0.37.1 0.37.2
k8s.io/client-go 0.37.1 0.37.2
modernc.org/sqlite 1.59.0 1.61.0

Updates github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.7

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.7

Fixed Security Issues

Fixed

  • jwk: fix bug in x5c parsing (#311)
  • reject base64-encoded "null" in protected headers (#309)

Deprecated

  • deprecate ParseEncrypted / ParseSigned (#222)

v4.1.6

Fixed Security Issues

This release contains a fix for GHSA-mgcc-cww5-fp2q

Breaking Changes

The fix for GHSA-mgcc-cww5-fp2q involves capping the size of the RSA modulus of keys accepted by JWK parsing. This limit is 4096 bits. If you need this to be higher, set MaxRSAModulusBits before performing any JWK parsing.

Changed

Full Changelog: go-jose/go-jose@v4.1.5...v4.1.6

Commits
  • 59611a1 encoding: remove byteBuffer.toInt() (#321)
  • 6a800bb Limit recipients and signatures in JWE/JWS (#316)
  • aa88aaa limit RSA size in certificate verify (#315)
  • 32e526c encoding: use byteBuffer.bytes() consistently (#320)
  • b419a16 Detect if headers are set by presence in the map (#319)
  • fe7494f json: backport stdlib fix for embedded unexported field (#318)
  • 1f8f4bb Thumbprint: reject invalid RSA key (#317)
  • d47ac06 deprecate ParseEncrypted / ParseSigned (#222)
  • 1f9a4fe test: use subtests for RoundtripJWE (#220)
  • e56db5b reject base64-encoded "null" in protected headers (#309)
  • Additional commits viewable in compare view

Updates github.com/go-ldap/ldap/v3 from 3.4.14 to 3.4.15

Release notes

Sourced from github.com/go-ldap/ldap/v3's releases.

v3.4.15

What's Changed

New Contributors

Full Changelog: go-ldap/ldap@v3.4.14...v3.4.15

Commits
  • e614cf9 fix: return error for unexpected response in ModifyWithResult (#639)
  • f3f0153 fix: reject out-of-range resultCode before narrowing to uint16 (#640)
  • f8db69e Modify README for testing and server commands
  • 05f305f fix: navigate LDAPMessage envelope in parseLDAPResult (#636)
  • ca8bcfa feat: expose ResultCode and DiagnosticMessage on SearchResult (#626)
  • f3d2070 fix: export ErrMalformedPacket sentinel
  • 0c9a799 fix: address review feedback on malformed-packet hardening
  • b73a2ec fix: reject malformed packets via shared child-count and bounds checks
  • e4851f6 fix: validate closing parenthesis in compound and grouped filters (#633) (#635)
  • 90c6466 extended: wrap requestValue as RFC 4511 [1] OCTET STRING (#628)
  • Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.11.0 to 5.12.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

  • SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@​igor-kupczynski).
  • Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @​president-xd.

Features

  • Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)
  • Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)
  • pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)
  • pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

  • pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.
  • pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

Commits
  • b2ef08b Update changelog for v5.12.0
  • 8199015 Merge commit from fork
  • 5b1a6a0 Merge commit from fork
  • 65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
  • f2701a0 pgconn: only fall back when Windows service file is missing
  • db95468 Merge pull request #2696 from k-zshiba/support-oid8
  • fa2327d Start each query on a new line when joining a simple protocol batch
  • 2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
  • efc0b74 Merge upstream master into support-oid8
  • 5a17450 pgconn: require AuthenticationOk before ReadyForQuery
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.57.0 to 0.58.0

Commits
  • 8fdf07b go.mod: update golang.org/x dependencies
  • 2437861 salsa20: fix keystream reuse in LoongArch LSX tail
  • c3db4df acme: prefer test log helpers in test contexts
  • 4e01a84 acme: adds support for profiles draft
  • 8f0f111 ssh: check that no Unicode-aware string function is used
  • b39ff6d ssh: add certificate algorithms for ML-DSA keys
  • 4465db3 ssh: add the ML-DSA public key algorithms
  • 83e695b ssh: implement ETM mode for CBC ciphers
  • 946083a ssh: only drop a trailing carriage return
  • 543dde9 ssh: accept known_hosts entries with a multi-word comment
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.59.0 to 0.60.0

Commits
  • 18ece0c http2: prevent crash due to HPACK encoder race
  • 2d03f9d http2: avoid 2x refund on stream close with buffered data
  • cc7d34f http2: avoid excessive work on initial window changes
  • 57f4235 http2: apply header limits to Trailer headers too
  • 01e3d03 http2: coalesce dials via wrapped Transport.RoundTrip
  • 2824783 http2: delete malformed framing-related headers
  • b13c0c1 internal/http3: delete HTTP/3 package
  • 520c891 quic: off-path support in loss/congestion/rtt
  • 656874f quic: determine local address for connections
  • a818e16 quic: add a pathAddrs type, holding a local/peer address pair
  • Additional commits viewable in compare view

Updates golang.org/x/tools from 0.50.0 to 0.51.0

Commits
  • ea2f152 go.mod: update golang.org/x dependencies
  • 00443da go/analysis/passes/printf: pin testdata Go versions
  • 9ba0a15 internal/refactor/inline: check import accessibility before Go version
  • 25196fc cmd/toolstash: check -linkobj files to support early export
  • ead0503 gopls/internal/golang: unexport dragon*Question variables
  • 5693030 gopls/internal/golang: call arguments mistreated in inlineAllCalls
  • 134264d gopls/internal/golang/stubmethods: do not panic when FindByPos fails
  • 01d93d7 gopls/internal/golang: slay the dragon: update questions
  • 405de39 go/callgraph: fix benchmarks to analyze whole program
  • 231a7fa go/ssa, cmd/deadcode: release type information once functions are built
  • Additional commits viewable in compare view

Updates k8s.io/api from 0.37.1 to 0.37.2

Commits

Updates k8s.io/apimachinery from 0.37.1 to 0.37.2

Commits

Updates k8s.io/client-go from 0.37.1 to 0.37.2

Commits

Updates modernc.org/sqlite from 1.59.0 to 1.61.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

  • 2026-11-02 v1.61.2:

    • Limit now works on a connection handed out by a driver.Connector that wraps the ones NewConnector opens, provided the wrapper has an Unwrap() driver.Conn method; it used to fail with unexpected driverConn type. NewConnector now also says which optional interfaces such a wrapper must forward. Resolves [GitHub issue #11](modernc-org/sqlite#11), thanks Andres Morey (@​amorey)!

  • 2026-10-31 v1.61.1:

    • Prepared statements are no longer parsed and planned again on every execution. Since v1.61.0, SQLite 3.54 expired a cached statement that has a col = ? term in a join or an ORDER BY query whenever the driver cleared its bindings after a run, so a statement prepared with db.Prepare or tx.Prepare cost about twice what it did in v1.60.1. Integer bindings now stay in place between executions, so a parameter bound to 0 or 1 does not re-prepare it either. Resolves [GitLab issue #264](https://gitlab.com/cznic/sqlite/-/issues/264). See [GitLab merge request #147](https://gitlab.com/cznic/sqlite/-/merge_requests/147), thanks Roman Khafizianov (@​requilence)!
    • Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!
    • Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.
    • Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!
    • The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.
    • Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

  • 2026-10-21 v1.61.0:

  • 2026-09-29 v1.60.1:

    • Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

  • 2026-09-28 v1.60.0:

    • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
    • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.
    • make vendor now writes vendor.json, the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries; the test suite fails when they no longer match. Tooling only. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).
    • vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.
    • Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.
    • The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.
    • Document three limits of the pluggable page cache on RegisterPageCache and Cache: it cannot be combined with modernc.org/sqlite/vec, PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines. Documentation only.
    • Document in the package documentation that state set on a pooled connection is inherited by the next caller to borrow it, and that a connection reached through sql.Conn.Raw is not safe for concurrent use. Documentation only.
    • Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so anything after a ; runs too. Recommended for any application whose DSN is not a compile-time constant.
    • Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof, which have always worked in a DSN starting with file:, and the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257). Documentation only.
    • Add SECURITY.md, the vulnerability reporting policy: three private channels, what is in scope, that only the latest release is supported, and how a confirmed report is disclosed, including an entry in the Go vulnerability database so govulncheck reports it. IRP.md, linked from it, is the maintainers' incident response plan. Documentation only.
    • Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Documentation only.
    • Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries with all seventeen license texts in full, and a Software Bill of Materials, sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), explained in SBOM.md. Both cover what a module-graph tool cannot see: the transpiled SQLite and sqlite-vec C, and the upstreams modernc.org/libc carries, musl among them. Documentation only.

  • 2026-09-15 v1.59.0:

    • Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, memmove, memset, memcmp and strlen with native Go, cutting CPU time on query-heavy workloads by up to a third; see the new Performance section below. As always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does; see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call, removing the last driver-side allocation per invocation. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return. Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).
    • Add regression tests pinning the identity and the pooling of that context. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!
    • Add a Performance section to the package documentation: measured CPU-time ratios of this driver against the same SQLite compiled from C, where the gap comes from, and the two consequences for applications — index the columns that ORDER BY, GROUP BY and WHERE use, and bound the database/sql pool with SetMaxOpenConns.

... (truncated)

Commits
  • 4df1ebe sqlite, conn, stmt, tx: end a busy_timeout wait when the call's context is done
  • 44ae8d4 update dependencies, make vendor: SQLite 3.54.1, libc v1.79.0
  • 570dc56 CHANGELOG.md: context cancellation before a statement starts (GitHub PR #9)
  • 4eacffe sqlite, conn: keep one cancellation flag per connection
  • 4926b7a Merge GitHub pull request #9 'fix/context-cancellation'
  • 3587a68 fix: preserve cancellation before SQLite execution
  • fd37819 Merge branch 'tx-shared-cache-wait' into 'master'
  • 75b4e62 conn: watch the context only while waiting for a shared-cache lock
  • 5856ee8 tx, conn: wait for a shared-cache lock in BeginTx, Commit and Rollback, and e...
  • 0fc3f90 conn: forget the pre-update, commit and rollback hooks on Close
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-patch group across 1 directory with 10 up…
987a29a 
…dates

Bumps the minor-patch group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.1.5` | `4.1.7` |
| [github.com/go-ldap/ldap/v3](https://github.com/go-ldap/ldap) | `3.4.14` | `3.4.15` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.11.0` | `5.12.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.59.0` | `0.60.0` |
| [golang.org/x/tools](https://github.com/golang/tools) | `0.50.0` | `0.51.0` |
| [k8s.io/api](https://github.com/kubernetes/api) | `0.37.1` | `0.37.2` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.37.1` | `0.37.2` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.37.1` | `0.37.2` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.59.0` | `1.61.0` |



Updates `github.com/go-jose/go-jose/v4` from 4.1.5 to 4.1.7
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](go-jose/go-jose@v4.1.5...v4.1.7)

Updates `github.com/go-ldap/ldap/v3` from 3.4.14 to 3.4.15
- [Release notes](https://github.com/go-ldap/ldap/releases)
- [Commits](go-ldap/ldap@v3.4.14...v3.4.15)

Updates `github.com/jackc/pgx/v5` from 5.11.0 to 5.12.0
- [Release notes](https://github.com/jackc/pgx/releases)
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.11.0...v5.12.0)

Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0
- [Commits](golang/crypto@v0.57.0...v0.58.0)

Updates `golang.org/x/net` from 0.59.0 to 0.60.0
- [Commits](golang/net@v0.59.0...v0.60.0)

Updates `golang.org/x/tools` from 0.50.0 to 0.51.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.50.0...v0.51.0)

Updates `k8s.io/api` from 0.37.1 to 0.37.2
- [Commits](kubernetes/api@v0.37.1...v0.37.2)

Updates `k8s.io/apimachinery` from 0.37.1 to 0.37.2
- [Commits](kubernetes/apimachinery@v0.37.1...v0.37.2)

Updates `k8s.io/client-go` from 0.37.1 to 0.37.2
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.37.1...v0.37.2)

Updates `modernc.org/sqlite` from 1.59.0 to 1.61.0
- [Release notes](https://gitlab.com/cznic/sqlite/tags)
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.59.0...v1.61.0)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: github.com/go-ldap/ldap/v3
  dependency-version: 3.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: golang.org/x/net
  dependency-version: 0.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: golang.org/x/tools
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: k8s.io/api
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: k8s.io/client-go
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: modernc.org/sqlite
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 3, 2026
@coderabbitai

coderabbitai Bot commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

CodeRabbit Verify

  • Run CodeRabbit Verify to test the changes in this pull request.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants