build(deps): bump the low-risk group across 1 directory with 7 updates #48

dependabot · 2025-09-14T23:11:49Z

Bumps the low-risk group with 7 updates in the / directory:

Package	From	To
github.com/Azure/azure-sdk-for-go/sdk/azcore	`1.18.2`	`1.19.1`
github.com/aws/aws-sdk-go-v2	`1.38.0`	`1.39.0`
github.com/aws/aws-sdk-go-v2/config	`1.31.0`	`1.31.8`
github.com/aws/aws-sdk-go-v2/service/secretsmanager	`1.38.0`	`1.39.4`
github.com/aws/aws-sdk-go-v2/service/ssm	`1.63.0`	`1.64.4`
github.com/hashicorp/vault/api	`1.20.0`	`1.21.0`
github.com/spf13/cobra	`1.9.1`	`1.10.1`

Updates github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.18.2 to 1.19.1

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azcore's releases.

sdk/azcore/v1.19.1

1.19.1 (2025-09-11)

Bugs Fixed

Fixed resource identifier parsing for provider-specific resource hierarchies containing "resourceGroups" segments.

Other Changes

Improved error fall-back for improperly authored long-running operations.

Upgraded dependencies.

sdk/azcore/v1.19.0

1.19.0 (2025-08-21)

Features Added

Added runtime.APIVersionLocationPath to be set by clients that set the API version in the path.

Commits

b75b3dc Prep azcore v1.19.1 for release (#25228)
f1cef39 [keyvault] update build.go files (#25200)
02dfb45 [Release] sdk/resourcemanager/sql/armsql/2.0.0-beta.7 (#25220)
5dd8b77 Upgrade emitter and TypeSpec packages to latest versions (#25221)
9efb424 [Release] sdk/resourcemanager/iotfirmwaredefense/armiotfirmwaredefense/2.0.0 ...
fa86806 Upgrade azidentity dependencies (#25192)
feb6e13 Return ResponseError for LROs with an unsuccessful initial response (#25206)
6167922 Users/gupta kashish/deprecation date update (#25201)
61af7e1 upgrade autorest.go (#25195)
f3e42c2 CLI credentials return errors when given claims (#25186)
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.38.0 to 1.39.0

Commits

648027e Release 2025-09-08
a3b9b7b Regenerated Clients
67dad83 Update endpoints model
2bfe86a Update API model
59e7410 add businessmetrics feature ID for env-based bearer token (#3182)
1cdc158 Patching override s3expire shape (#3180)
1745ede Release 2025-09-05
f84de53 Regenerated Clients
7cdaa31 Update API model
498b5c4 remove service/sms (#3177)
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.31.0 to 1.31.8

Commits

70e9f3d Release 2025-09-10
e620ecb Regenerated Clients
b412203 Update endpoints model
89f42ef Update API model
d71b109 Bump smithy go version to allow unused required parameter in endpoint rule se...
f68827f Release 2025-09-09
d1748bf Regenerated Clients
00307c0 Update endpoints model
424be93 Update API model
648027e Release 2025-09-08
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.38.0 to 1.39.4

Commits

70e9f3d Release 2025-09-10
e620ecb Regenerated Clients
b412203 Update endpoints model
89f42ef Update API model
d71b109 Bump smithy go version to allow unused required parameter in endpoint rule se...
f68827f Release 2025-09-09
d1748bf Regenerated Clients
00307c0 Update endpoints model
424be93 Update API model
648027e Release 2025-09-08
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/ssm from 1.63.0 to 1.64.4

Commits

fe7486f Release 2025-06-17
1b6cafd Regenerated Clients
8db1137 Update API model
3c5cc0e Bump smithy go version (#3115)
6746486 Release 2025-06-16
f536b0d Regenerated Clients
b014b35 Update API model
5c12a3b correct smithy go bumping to correct commit in its main branch (#3112)
b65321f Bump codegen for CBOR empty check (#3111)
e6c02cd Release 2025-06-12
Additional commits viewable in compare view

Updates github.com/hashicorp/vault/api from 1.20.0 to 1.21.0

Release notes

Sourced from github.com/hashicorp/vault/api's releases.

v1.20.3

No release notes provided.

v1.20.2

August 06, 2025

SECURITY:

auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled [GH-31427,HCSEC-2025-20].

BUG FIXES:

agent/template: Fixed issue where templates would not render correctly if namespaces was provided by config, and the namespace and mount path of the secret were the same. [GH-31392]

identity/mfa: revert cache entry change from #31217 and document cache entry values [GH-31421]

v1.20.1

No release notes provided.

Changelog

Sourced from github.com/hashicorp/vault/api's changelog.

Previous versions

v1.10.0 - v1.15.16

v1.0.0 - v1.9.10

v0.11.6 and earlier

1.20.3

August 28, 2025

FEATURES:

IBM RACF Static Role Password Phrase Management (Enterprise): Add support for static role password phrase management to the LDAP secrets engine. (hashicorp/vault-plugin-secrets-openldap#184)

SECURITY:

core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-wjrx-6529-hcj3. (8b3a9ce1)

CHANGES:

core: Bump Go version to 1.24.6. (ce56e14e)

http: Add JSON configurable limits to HTTP handling for JSON payloads: max_json_depth, max_json_string_value_length, max_json_object_entry_count, max_json_array_element_count. [GH-31069]

sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.2, which also bumps github.com/docker/docker to v28.3.3+incompatible (8f172169)

secrets/openldap (enterprise): update plugin to v0.16.1

IMPROVEMENTS:

auth/ldap: add explicit logging to rotations in ldap [GH-31401]

core (enterprise): improve rotation manager logging to include specific lines for rotation success and failure

secrets/database: log password rotation success (info) and failure (error). Some relevant log lines have been updated to include "path" fields. [GH-31402]

secrets/transit: add logging on both success and failure of key rotation [GH-31420]

ui: Use the Helios Design System Code Block component for all readonly code editors and use its Code Editor component for all other code editors [GH-30188]

BUG FIXES:

core (enterprise): fix a bug where issuing a token in a namespace used root auth configuration instead of namespace auth configuration

core/metrics: Add service name prefix for core HA metrics to avoid duplicate, zero-value metrics. (91e5f443)

core/seal: When Seal-HA is enabled, make it an error to persist the barrier keyring when not all seals are healthy. This prevents the possibility of failing to unseal when a different subset of seals are healthy than were healthy at last write. (bbe64227)

raft (enterprise): auto-join will now work in regions that do not support dual-stack (c66baf5e)

raft/autopilot: Fixes an issue with enterprise redundancy zones where, if the leader was in a redundancy zone and that leader becomes unavailable, the node would become an unzoned voter. This can artificially inflate the required number of nodes for quorum, leading to a situation where the cluster cannot recover if another leader subsequently becomes unavailable. Vault will now keep an unavailable node in its last known redundancy zone as a non-voter. [GH-31443]

replication (enterprise): Fix bug where group updates fail when processed on a standby node in a PR secondary cluster.

secrets-sync (enterprise): GCP locational KMS keys are no longer incorrectly removed when the location name is all lowercase.

secrets/database/postgresql: Support for multiline statements in the rotation_statements field. [GH-31442]

ui: Fix DR secondary view from not loading/transitioning. [GH-31478]

1.20.2

August 06, 2025

... (truncated)

Commits

e40eca1 VAULT-39294: Deprecate recover_snapshot_id query param and use a header inste...
c9605c7 VAULT-36947: Support force unloading a snapshot (#8740) (#9036)
5d632ef [VAULT-38600] Create TOTP Login MFA credential self-enrollment API endpoint (...
eaf949c VAULT-37633: Database static role recover operations (#8922) (#8982)
3c459f7 [VAULT-39267] actions(slack): migrate to v2 action (#8964) (#8990)
50af559 VAULT-38796, VAULT-38889 reformat observation schema to version 2 (#9006) (#9...
a820af0 Backport [VAULT-38600] Fix the name of the CE stub for mfaLoginEnterprisePath...
37bd994 VAULT-38463: Fix ldap failure (#8996) (#9001)
3edbb13 changelog: fix commit URL in CE generated template (#9010) (#9013)
bfd2e54 UI: Moving settings/mount-backend-form to secrets/mounts (#8975) (#8998)
Additional commits viewable in compare view

Updates github.com/spf13/cobra from 1.9.1 to 1.10.1

Release notes

Sourced from github.com/spf13/cobra's releases.

v1.10.1

🐛 Fix

chore: upgrade pflags v1.0.9 by @jpmcb in spf13/cobra#2305

v1.0.9 of pflags brought back ParseErrorsWhitelist and marked it as deprecated

Full Changelog: spf13/cobra@v1.10.0...v1.10.1

v1.10.0

What's Changed

🚨 Attention!

Bump pflag to 1.0.8 by @tomasaschan in spf13/cobra#2303

This version of pflag carried a breaking change: it renamed ParseErrorsWhitelist to ParseErrorsAllowlist which can break builds if both pflag and cobra are dependencies in your project.

If you use both pflag and cobra, upgrade pflagto 1.0.8 andcobrato1.10.0`

or use the newer, fixed version of pflag v1.0.9 which keeps the deprecated ParseErrorsWhitelist

More details can be found here: spf13/cobra#2303

✨ Features

Flow context to command in SetHelpFunc by @Frassle in spf13/cobra#2241

The default ShellCompDirective can be customized for a command and its subcommands by @albers in spf13/cobra#2238

🐛 Fix

Upgrade golangci-lint to v2, address findings by @scop in spf13/cobra#2279

🪠 Testing

Test with Go 1.24 by @harryzcy in spf13/cobra#2236

chore: Rm GitHub Action PR size labeler by @jpmcb in spf13/cobra#2256

📝 Docs

Remove traling curlybrace by @yedayak in spf13/cobra#2237

Update command.go by @styee in spf13/cobra#2248

feat: Add security policy by @jpmcb in spf13/cobra#2253

Update Readme (Warp) by @ericdachen in spf13/cobra#2267

Add Periscope to the list of projects using Cobra by @anishathalye in spf13/cobra#2299

New Contributors

@harryzcy made their first contribution in spf13/cobra#2236

@yedayak made their first contribution in spf13/cobra#2237

@Frassle made their first contribution in spf13/cobra#2241

... (truncated)

Commits

7da941c chore: Bump pflag to v1.0.9 (#2305)
51d6751 Bump pflag to 1.0.8 (#2303)
3f3b818 Update README.md with new logo
dcaf42e Add Periscope to the list of projects using Cobra (#2299)
6dec1ae The default ShellCompDirective can be customized for a command and its subcom...
c8289c1 chore(golangci-lint): add some exclusion presets
4af7b64 refactor: apply golangci-lint autofixes, work around false positives
75790e4 chore(golangci-lint): upgrade to v2
db3ddb5 Adding sponsorship to README.md
67171d6 putting sponsorship below header
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the low-risk group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/Azure/azure-sdk-for-go/sdk/azcore](https://github.com/Azure/azure-sdk-for-go) | `1.18.2` | `1.19.1` | | [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.38.0` | `1.39.0` | | [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.31.0` | `1.31.8` | | [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.38.0` | `1.39.4` | | [github.com/aws/aws-sdk-go-v2/service/ssm](https://github.com/aws/aws-sdk-go-v2) | `1.63.0` | `1.64.4` | | [github.com/hashicorp/vault/api](https://github.com/hashicorp/vault) | `1.20.0` | `1.21.0` | | [github.com/spf13/cobra](https://github.com/spf13/cobra) | `1.9.1` | `1.10.1` | Updates `github.com/Azure/azure-sdk-for-go/sdk/azcore` from 1.18.2 to 1.19.1 - [Release notes](https://github.com/Azure/azure-sdk-for-go/releases) - [Changelog](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/sdk-breaking-changes-guide-migration.md) - [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.18.2...sdk/azcore/v1.19.1) Updates `github.com/aws/aws-sdk-go-v2` from 1.38.0 to 1.39.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@v1.38.0...v1.39.0) Updates `github.com/aws/aws-sdk-go-v2/config` from 1.31.0 to 1.31.8 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@v1.31.0...config/v1.31.8) Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.38.0 to 1.39.4 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@v1.38.0...service/amp/v1.39.4) Updates `github.com/aws/aws-sdk-go-v2/service/ssm` from 1.63.0 to 1.64.4 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.63.0...service/iot/v1.64.4) Updates `github.com/hashicorp/vault/api` from 1.20.0 to 1.21.0 - [Release notes](https://github.com/hashicorp/vault/releases) - [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md) - [Commits](hashicorp/vault@v1.20.0...api/v1.21.0) Updates `github.com/spf13/cobra` from 1.9.1 to 1.10.1 - [Release notes](https://github.com/spf13/cobra/releases) - [Commits](spf13/cobra@v1.9.1...v1.10.1) --- updated-dependencies: - dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azcore dependency-version: 1.19.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: low-risk - dependency-name: github.com/aws/aws-sdk-go-v2 dependency-version: 1.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: low-risk - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-version: 1.31.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: low-risk - dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager dependency-version: 1.39.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: low-risk - dependency-name: github.com/aws/aws-sdk-go-v2/service/ssm dependency-version: 1.64.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: low-risk - dependency-name: github.com/hashicorp/vault/api dependency-version: 1.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: low-risk - dependency-name: github.com/spf13/cobra dependency-version: 1.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: low-risk ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2025-09-14T23:11:51Z

Assignees

The following users could not be added as assignees: elvenspellmaker. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

sonarqubecloud · 2025-09-14T23:16:31Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot bot assigned dnitsch and ElvenSpellmaker Sep 14, 2025

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 14, 2025

ElvenSpellmaker approved these changes Sep 18, 2025

View reviewed changes

ElvenSpellmaker merged commit b9f339f into master Sep 18, 2025
5 checks passed

ElvenSpellmaker deleted the dependabot/go_modules/low-risk-5242dc1d5b branch September 18, 2025 14:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the low-risk group across 1 directory with 7 updates #48

build(deps): bump the low-risk group across 1 directory with 7 updates #48

Uh oh!

dependabot bot commented on behalf of github Sep 14, 2025

Uh oh!

dependabot bot commented on behalf of github Sep 14, 2025

Uh oh!

sonarqubecloud bot commented Sep 14, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

build(deps): bump the low-risk group across 1 directory with 7 updates #48

build(deps): bump the low-risk group across 1 directory with 7 updates #48

Uh oh!

Conversation

dependabot bot commented on behalf of github Sep 14, 2025

sdk/azcore/v1.19.1

1.19.1 (2025-09-11)

Bugs Fixed

Other Changes

sdk/azcore/v1.19.0

1.19.0 (2025-08-21)

Features Added

v1.20.3

v1.20.2

August 06, 2025

v1.20.1

Previous versions

1.20.3

August 28, 2025

1.20.2

August 06, 2025

v1.10.1

🐛 Fix

v1.10.0

What's Changed

🚨 Attention!

✨ Features

🐛 Fix

🪠 Testing

📝 Docs

New Contributors

Uh oh!

dependabot bot commented on behalf of github Sep 14, 2025

Assignees

Uh oh!

sonarqubecloud bot commented Sep 14, 2025

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants