Skip to content

chore(deps): bump the go-minor-patch group across 1 directory with 5 updates - #26

Merged
jonmartinstorm merged 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-eafbd02fce
Aug 3, 2026
Merged

chore(deps): bump the go-minor-patch group across 1 directory with 5 updates#26
jonmartinstorm merged 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-eafbd02fce

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-minor-patch group with 3 updates in the / directory: github.com/coreos/go-oidc/v3, github.com/open-policy-agent/opa and github.com/pressly/goose/v3.

Updates github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0

Release notes

Sourced from github.com/coreos/go-oidc/v3's releases.

v3.20.0

What's Changed

Full Changelog: coreos/go-oidc@v3.19.0...v3.20.0

Commits
  • 75dfa5c oidc: add constants for "email" and "profile" scopes
  • a89f046 oidc: add API for determining when issuer URLs mismatch
  • 6a69b6d readme: update README and docs
  • f9049c9 oidc: ignore JWKs with unknown signing algorithms rather than failing
  • 2f178e0 SECURITY.md: add a security policy and point to project-level reporting
  • b3bc7da oidc: improve documentation for APIs
  • 0db9053 oidc: modernize with new Go APIs
  • See full diff in compare view

Updates github.com/open-policy-agent/opa from 1.18.0 to 1.19.0

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.19.0

This release contains a mix of new features and bug fixes. Notably:

  • A fixed SQL injection vector in the Compile API
  • Stricter safety checking for Rego assignments (:=)
  • A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go)
  • Startup warnings for unknown configuration options
  • A new strings.split_n built-in function
  • A REPL line reader that handles pasted input correctly, migrating existing history files

Fix SQL injection vector in Compile API: Quote SQL filter field identifiers (#8945)

The field names in the SQL emitted by the Compile API come from partially evaluated refs, so a policy that selects a dynamic key — such as input.fruits[input.column] — puts caller-controlled text in an identifier position. That text was emitted verbatim, which turns

WHERE fruit.name = 'allowed'

into

WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'

and an application appending the filter to its query returns rows the policy denies.

Field segments that are not bare identifiers are now quoted at the UCAST-to-SQL boundary, with any embedded quote character escaped. Ordinary column names stay unquoted, so existing filters keep their current shape and remain case-insensitive on Postgres.

Authored by @​thevilledev

Behavior change: stricter safety for assignment (:=) (#3546)

The assignment operator (:=) is documented as "syntactic sugar for =, local variable creation, and additional compiler checks," and the safety checker reflects that: after rewriting, := is treated identically to = (unification), so an assignment's right-hand side can be made safe by unifying "backwards" through the left-hand side. This means policies like x := y; x = 7 compile (binding y to 7) even though y is never assigned, and x := y; obj[x] can silently degrade an expected constant-time lookup into full iteration.

This change makes the right-hand-side of := be treated as a read that must be made safe by other expressions, and can no longer be satisfied through the left-hand-side. Affected policies that previously compiled now fail with a rego_unsafe_var_error. Reference iteration on the right-hand-side (e.g. some k; v := obj[k]) is unaffected.

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.19.0

This release contains a mix of new features and bug fixes. Notably:

  • A fixed SQL injection vector in the Compile API
  • Stricter safety checking for Rego assignments (:=)
  • A cgo-free, faster WebAssembly runtime (wazero replaces wasmtime-go)
  • Startup warnings for unknown configuration options
  • A new strings.split_n built-in function
  • A REPL line reader that handles pasted input correctly, migrating existing history files

Fix SQL injection vector in Compile API: Quote SQL filter field identifiers (#8945)

The field names in the SQL emitted by the Compile API come from partially evaluated refs, so a policy that selects a dynamic key — such as input.fruits[input.column] — puts caller-controlled text in an identifier position. That text was emitted verbatim, which turns

WHERE fruit.name = 'allowed'

into

WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'

and an application appending the filter to its query returns rows the policy denies.

Field segments that are not bare identifiers are now quoted at the UCAST-to-SQL boundary, with any embedded quote character escaped. Ordinary column names stay unquoted, so existing filters keep their current shape and remain case-insensitive on Postgres.

Authored by @​thevilledev

Behavior change: stricter safety for assignment (:=) (#3546)

The assignment operator (:=) is documented as "syntactic sugar for =, local variable creation, and additional compiler checks," and the safety checker reflects that: after rewriting, := is treated identically to = (unification), so an assignment's right-hand side can be made safe by unifying "backwards" through the left-hand side. This means policies like x := y; x = 7 compile (binding y to 7) even though y is never assigned, and x := y; obj[x] can silently degrade an expected constant-time lookup into full iteration.

This change makes the right-hand-side of := be treated as a read that must be made safe by other expressions, and can no longer be satisfied through the left-hand-side. Affected policies that previously compiled now fail with a rego_unsafe_var_error. Reference iteration on the right-hand-side (e.g. some k; v := obj[k]) is unaffected.

... (truncated)

Commits
  • 1e32c79 Prepare v1.19.0 release (#8955)
  • db035b0 Add support for Go 1.27 & jsonv2 (#8947)
  • 27fe5ce ast: Fix leaky future.keywords.not import in Rego v0 (#8953)
  • ab21870 format: Keep rule body inline when the head spans multiple lines (#8904)
  • 95090fa Add strings.split_n built-in function (#8915)
  • 12a86ed build(deps): bump find-my-way and prisma in /e2e/api/compile/prisma
  • 18815e2 build(deps): bump the dependencies group across 2 directories with 5 updates
  • f1e2ac0 build(deps): bump postcss from 8.5.15 to 8.5.23 in /docs
  • d9c7856 build(deps): bump js-yaml from 5.2.1 to 5.2.2 in /docs
  • 69d2cc0 tester: make Result JSON round-trippable (#8946)
  • Additional commits viewable in compare view

Updates github.com/pressly/goose/v3 from 3.27.1 to 3.27.3

Release notes

Sourced from github.com/pressly/goose/v3's releases.

v3.27.3

Changed

  • Various dependency upgrades

v3.27.2

Changed

  • Upgrade golang.org/x/crypto and golang.org/x/net to address security advisories (CVE fixes)
  • Various dependency upgrades
Changelog

Sourced from github.com/pressly/goose/v3's changelog.

[v3.27.3] - 2026-07-22

Changed

  • Various dependency upgrades

[v3.27.2] - 2026-06-30

Changed

  • Upgrade golang.org/x/crypto and golang.org/x/net to address security advisories (CVE fixes)
  • Various dependency upgrades
Commits
  • 520411a release: v3.27.3
  • 26403f9 build(deps): update internal/testing dependencies
  • abcfbd1 ci: pin GitHub Actions to commit SHAs
  • a54dd54 build(deps): bump actions/setup-go from 6 to 7 (#1094)
  • 27c2f4f build(deps): update dependencies
  • a443d13 fix: capture markdown subsections in release-notes.sh
  • b0f7076 release: v3.27.2
  • 6669df2 build(deps): bump github.com/opencontainers/runc from 1.3.3 to 1.3.6 in /inte...
  • f61f5b9 build(deps): bump the gomod group across 1 directory with 4 updates (#1086)
  • 90d5b3a build(deps): bump actions/checkout from 6 to 7 (#1081)
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.0 - 2026-07-20

Changes

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.0 / 2026-07-20

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927
Commits
  • 48dd383 Cut v1.24.0 (#2061)
  • a725305 Cut v1.24.0-rc.0 (#2058)
  • 77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
  • 78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
  • 34e9a7f Merge pull request #2055 from prombot/repo_sync
  • 43749bc Update common Prometheus files
  • de19217 examples: improve simple main.go example (#1999)
  • 20355eb fix: correct typos in comments and test error messages (#2049)
  • 4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
  • b0d896b Replace deprecated model.NameValidationScheme with explicit UTF8Validation (#...
  • Additional commits viewable in compare view

Updates golang.org/x/text from 0.38.0 to 0.40.0

Commits
  • 724af9c go.mod: update golang.org/x dependencies
  • bf5b9d6 internal/export/idna: always treat Punycode encoding pure ASCII as an error
  • b326f3d go.mod: update golang.org/x dependencies
  • 5ae8e57 unicode/norm: avoid infinite loop on invalid input
  • 0dc94a2 all: fix some comments
  • See full diff in compare view

@dependabot
dependabot Bot requested a review from a team as a code owner July 27, 2026 06:20
jonmartinstorm
jonmartinstorm reviewed Aug 3, 2026
View reviewed changes

@jonmartinstorm jonmartinstorm left a comment •
edited
Loading

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should work OOTB

@jonmartinstorm

jonmartinstorm commented Aug 3, 2026

Copy link
Copy Markdown
Collaborator

@copilot resolve the merge conflicts in this pull request

@dependabot
chore(deps): bump the go-minor-patch group across 1 directory with 5 …
8e49860 
…updates

Bumps the go-minor-patch group with 3 updates in the / directory: [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc), [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) and [github.com/pressly/goose/v3](https://github.com/pressly/goose).


Updates `github.com/coreos/go-oidc/v3` from 3.19.0 to 3.20.0
- [Release notes](https://github.com/coreos/go-oidc/releases)
- [Commits](coreos/go-oidc@v3.19.0...v3.20.0)

Updates `github.com/open-policy-agent/opa` from 1.18.0 to 1.19.0
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa@v1.18.0...v1.19.0)

Updates `github.com/pressly/goose/v3` from 3.27.1 to 3.27.3
- [Release notes](https://github.com/pressly/goose/releases)
- [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md)
- [Commits](pressly/goose@v3.27.1...v3.27.3)

Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.23.2...v1.24.0)

Updates `golang.org/x/text` from 0.38.0 to 0.40.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.38.0...v0.40.0)

---
updated-dependencies:
- dependency-name: github.com/coreos/go-oidc/v3
  dependency-version: 3.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.18.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/pressly/goose/v3
  dependency-version: 3.27.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: golang.org/x/text
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-minor-patch-eafbd02fce branch from 555d882 to 8e49860 Compare August 3, 2026 09:51
@jonmartinstorm
jonmartinstorm merged commit 09628d6 into main Aug 3, 2026
3 of 4 checks passed
@dependabot
dependabot Bot deleted the dependabot/go_modules/go-minor-patch-eafbd02fce branch August 3, 2026 09:51
Copilot stopped work on behalf of jonmartinstorm due to an error August 3, 2026 09:52
The session was cancelled by the user.
Copilot AI requested a review from jonmartinstorm August 3, 2026 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jonmartinstorm jonmartinstorm Awaiting requested review from jonmartinstorm

Assignees

No one assigned

Labels

dependencies go

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jonmartinstorm