chore(deps): update module github.com/letsencrypt/boulder to v0.20260406.0 (main)

[elastic-renovate-prod]

This PR contains the following updates:

Package	Type	Update	Change
github.com/letsencrypt/boulder	indirect	minor	v0.20251110.0 -> v0.20260406.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

letsencrypt/boulder (github.com/letsencrypt/boulder)

v0.20260406.0

Compare Source

What's Changed

• test: Upgrade consul to 1.22.6 by @​inahga in https://github.com/letsencrypt/boulder/pull/8696
• Remove registrations.LockCol by @​aarongable in https://github.com/letsencrypt/boulder/pull/8698
• bad-key-revoker: Require maxExpectedReplicationLag by @​jprenken in https://github.com/letsencrypt/boulder/pull/8693
• deps: update pkcs11 and pkcs11key by @​jsha in https://github.com/letsencrypt/boulder/pull/8692
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @​dependabot[bot] inhttps://github.com/letsencrypt/boulder/pull/86999

Full Changelog: letsencrypt/boulder@v0.20260331.0...v0.20260406.0

v0.20260331.0

Compare Source

What's Changed

• grpc: implement OnHealthy by @​jsha in https://github.com/letsencrypt/boulder/pull/8686
• deps: update grpc to 1.79.3 by @​jsha in https://github.com/letsencrypt/boulder/pull/8685
• Remove deprecated flags by @​jsha in https://github.com/letsencrypt/boulder/pull/8684
• test: make nonce-srv-v2 / noncev2 the default by @​jsha in https://github.com/letsencrypt/boulder/pull/8689
• va: Add experimental VA for testing Hickory by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8688
• ra: remove MaxNames config field by @​jsha in https://github.com/letsencrypt/boulder/pull/8691
• grpc: Advertise h2 support in ALPN by @​inahga in https://github.com/letsencrypt/boulder/pull/8697

New Contributors

• @​inahga made their first contribution in https://github.com/letsencrypt/boulder/pull/8697

Full Changelog: letsencrypt/boulder@v0.20260324.0...v0.20260331.0

v0.20260324.0

Compare Source

What's Changed

• test: add health check for bvitess by @​jsha in https://github.com/letsencrypt/boulder/pull/8658
• crl/va/test: Let the bodies hit the Close() by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8682
• noncebalancer: use endpointsharding, ignore ready status by @​jsha in https://github.com/letsencrypt/boulder/pull/8679
• wfe/ra/va/pa: Add support for draft-ietf-acme-dns-persist-00 by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8660
• CTPolicy: always try to get SCTs from a tiled log first by @​aarongable in https://github.com/letsencrypt/boulder/pull/8676

Full Changelog: letsencrypt/boulder@v0.20260317.0...v0.20260324.0

v0.20260317.0

Compare Source

What's Changed

• test: Remove badNonce retries and increase nonce maxConnectionAge by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8661
• Remove ra.validateContacts because it is unused by @​aarongable in https://github.com/letsencrypt/boulder/pull/8666
• Remove TODOs from challenge.RecordsSane by @​aarongable in https://github.com/letsencrypt/boulder/pull/8670
• Remove sa.Count[Pending|Invalid]Authorizations2 by @​aarongable in https://github.com/letsencrypt/boulder/pull/8669
• observer: add CCADB CRL prober by @​jsha in https://github.com/letsencrypt/boulder/pull/8644
• test: make health-checker quieter by @​jsha in https://github.com/letsencrypt/boulder/pull/8671
• CI: Drop go1.25.x by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8675
• vitess: add vschemas with vindexes by @​jsha in https://github.com/letsencrypt/boulder/pull/8634
• Update publicsuffix-go (PSL) from v0.50.2 to v0.50.3 by @​jprenken in https://github.com/letsencrypt/boulder/pull/8678
• ratelimits: stricter() should always prefer denied decisions by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8674

Full Changelog: letsencrypt/boulder@v0.20260309.0...v0.20260317.0

v0.20260309.0

Compare Source

What's Changed

• sa: improve errors from SetOrderError by @​jsha in https://github.com/letsencrypt/boulder/pull/8656
• test: Update from go1.25.5 and go1.25.7 to go1.25.8 and go1.26.1 by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8664
• features: Small comment fix for DNSAccount01Enabled by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8663
• CI: Update release jobs to use go1.25.8 and go1.26.1 by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8665

Full Changelog: letsencrypt/boulder@v0.20260303.0...v0.20260309.0

v0.20260303.0

Compare Source

What's Changed

• Reduce maximum allowed valid authorization lifetime by @​aarongable in https://github.com/letsencrypt/boulder/pull/8648
• observer: Reduce memory usage by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8649
• Remove extraneous top-level struct args to IsAnyNilOrZero by @​aarongable in https://github.com/letsencrypt/boulder/pull/8651
• Fix miscellaneous value/pointer receiver mismatches by @​aarongable in https://github.com/letsencrypt/boulder/pull/8652
• test: Update challtestsrv for dns-persist-01 by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8653
• Exempt ARI renewals from on-demand blocklisting by @​aarongable in https://github.com/letsencrypt/boulder/pull/8655

Full Changelog: letsencrypt/boulder@v0.20260225.0...v0.20260303.0

v0.20260225.0

Compare Source

What's Changed

• build: support native architecture builds on ARM hosts by @​sheurich in https://github.com/letsencrypt/boulder/pull/8547
• Run go fix by @​mcpherrinm in https://github.com/letsencrypt/boulder/pull/8636
• release: tag based on refs/remotes/origin/main. by @​jsha in https://github.com/letsencrypt/boulder/pull/8640
• observer: remove TCP prober by @​jsha in https://github.com/letsencrypt/boulder/pull/8637
• Use context.WithoutCancel instead of context.Background by @​aarongable in https://github.com/letsencrypt/boulder/pull/8635
• Don't modify http.DefaultTransport by @​aarongable in https://github.com/letsencrypt/boulder/pull/8641
• VA: properly initialize slowRemoteTimeout by @​aarongable in https://github.com/letsencrypt/boulder/pull/8642
• VA: ensure wildcard hostname is lowercased by @​aarongable in https://github.com/letsencrypt/boulder/pull/8643
• Add blocklisting for recursive on-demand domains by @​aarongable in https://github.com/letsencrypt/boulder/pull/8646
• Improve error handling in admin block-key and revoke-cert by @​aarongable in https://github.com/letsencrypt/boulder/pull/8647

Full Changelog: letsencrypt/boulder@v0.20260223.0...v0.20260225.0

v0.20260223.0

Compare Source

What's Changed

• sa: use UPDATE for overrides by @​jsha in https://github.com/letsencrypt/boulder/pull/8632
• ratelimits: Fix potential data race in the limit registry by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8628
• Replace gopkg.in/yaml.v3 v3.0.1 with go.yaml.in/yaml/v3 v3.0.4 by @​aarongable in https://github.com/letsencrypt/boulder/pull/8627
• build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 by @​dependabot[bot] inhttps://github.com/letsencrypt/boulder/pull/86333
• sa: remove Update from UpdateRevokedCertificate by @​jsha in https://github.com/letsencrypt/boulder/pull/8631
• Update otel to v1.40.0. by @​jsha in https://github.com/letsencrypt/boulder/pull/8639

Full Changelog: letsencrypt/boulder@v0.20260217.0...v0.20260223.0

v0.20260217.0

Compare Source

What's Changed

• build(deps): bump the aws group with 3 updates by @​dependabot[bot] inhttps://github.com/letsencrypt/boulder/pull/85655
• ra: improve error message about IP address support by @​jsha in https://github.com/letsencrypt/boulder/pull/8592
• sa: Add GetOrderAuthorizations by @​jsha in https://github.com/letsencrypt/boulder/pull/8605
• test: reduce the numbers of databases by @​jsha in https://github.com/letsencrypt/boulder/pull/8609
• Bump Go version to 1.25.7 by @​jsha in https://github.com/letsencrypt/boulder/pull/8622
• sfe/ra/sa/admin: Prevent lower override requests from reducing limits by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8613
• Update PSL from v0.50.1 to v0.50.2 by @​aarongable in https://github.com/letsencrypt/boulder/pull/8623
• Clean up and deprecate no wait for ready by @​maen-bn in https://github.com/letsencrypt/boulder/pull/8608
• Use stdlib path.Join to construct URL paths in WFE by @​maen-bn in https://github.com/letsencrypt/boulder/pull/8601
• build: improve build reproducibility by @​sheurich in https://github.com/letsencrypt/boulder/pull/8549
• Observer: simplify Probe interface by @​aarongable in https://github.com/letsencrypt/boulder/pull/8619
• Add AIA certificate prober to boulder-observer by @​jsha in https://github.com/letsencrypt/boulder/pull/8624

Full Changelog: letsencrypt/boulder@v0.20260202.0...v0.20260217.0

v0.20260202.0

Compare Source

What's Changed

• sa: collapse migrations into CombinedSchema by @​jsha in https://github.com/letsencrypt/boulder/pull/8599
• Deprecate IssuerConfig active by @​maen-bn in https://github.com/letsencrypt/boulder/pull/8597
• Upgrade all audit log lines to structured json by @​aarongable in https://github.com/letsencrypt/boulder/pull/8595
• Deprecate ServeRenewalInfo feature flag by @​maen-bn in https://github.com/letsencrypt/boulder/pull/8585
• Jitter the ARI Retry-After header amount 20% either side of 6 hours by @​maen-bn in https://github.com/letsencrypt/boulder/pull/8576
• Remove error returned from grpc.ProblemDetailsToPB as it's not used by @​maen-bn in https://github.com/letsencrypt/boulder/pull/8607
• docker: simplify bmariadb container by @​jsha in https://github.com/letsencrypt/boulder/pull/8611
• Reduce cardinality of structured log keys by @​aarongable in https://github.com/letsencrypt/boulder/pull/8600
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] inhttps://github.com/letsencrypt/boulder/pull/86155
• ra: add CAARechecksFailOrder feature flag by @​jsha in https://github.com/letsencrypt/boulder/pull/8610
• test: use SIGKILL instead of SIGTERM by @​jsha in https://github.com/letsencrypt/boulder/pull/8612

New Contributors

• @​maen-bn made their first contribution in https://github.com/letsencrypt/boulder/pull/8597

Full Changelog: letsencrypt/boulder@v0.20260126.0...v0.20260202.0

v0.20260126.0

Compare Source

What's Changed

• features: enable StoreAuthzsInOrders in config by @​jsha in https://github.com/letsencrypt/boulder/pull/8570
• salesforce: Rename email package and pardot-test-srv by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8523
• Update overrideForm data values to match sfe/overrides.go by @​ezekiel in https://github.com/letsencrypt/boulder/pull/8586
• health-checker: reduce log noise by @​jsha in https://github.com/letsencrypt/boulder/pull/8583
• sfe: Render optional checkboxes as valid by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8587
• RA: Simplify sending validation records to the SA by @​aarongable in https://github.com/letsencrypt/boulder/pull/8569
• Admin: Support multiple private keys in a file by @​mcpherrinm in https://github.com/letsencrypt/boulder/pull/8550
• Cleanup: remove deprecated admin db config field by @​aarongable in https://github.com/letsencrypt/boulder/pull/8553
• ratelimits: Fix loading of override limits from the database by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8591
• test: on migration error, don't try to auto-recover by @​jsha in https://github.com/letsencrypt/boulder/pull/8545
• Admin: stub out override and pausing methods for dry-run by @​aarongable in https://github.com/letsencrypt/boulder/pull/8579
• sa: deprecate two feature flags by @​jsha in https://github.com/letsencrypt/boulder/pull/8580
• ratelimits: Fix docs urls for two rate limits by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8596

New Contributors

• @​ezekiel made their first contribution in https://github.com/letsencrypt/boulder/pull/8586

Full Changelog: letsencrypt/boulder@v0.20260120.0...v0.20260126.0

v0.20260120.0

Compare Source

What's Changed

• test: bump consul to 1.19.2 by @​jsha in https://github.com/letsencrypt/boulder/pull/8563
• publisher: Errf -> InfoObject by @​jsha in https://github.com/letsencrypt/boulder/pull/8561
• log: use Requester in revocation logs by @​jsha in https://github.com/letsencrypt/boulder/pull/8560
• log: audit-level messages on startup and shutdown by @​jsha in https://github.com/letsencrypt/boulder/pull/8562
• Remove direct db connection from admin tool by @​aarongable in https://github.com/letsencrypt/boulder/pull/8552
• test: allow empty $DB_ADDR for most tests by @​jsha in https://github.com/letsencrypt/boulder/pull/8568
• grpc: log health check failures by @​jsha in https://github.com/letsencrypt/boulder/pull/8546
• Make log.Errf not automatically [AUDIT] level by @​aarongable in https://github.com/letsencrypt/boulder/pull/8564
• Clean up usage of non-formatter log methods by @​aarongable in https://github.com/letsencrypt/boulder/pull/8566
• build(deps): bump actions/checkout from 4 to 6 by @​dependabot[bot] inhttps://github.com/letsencrypt/boulder/pull/85377
• Move USE_VITESS variable into entrypoint.sh by @​jsha in https://github.com/letsencrypt/boulder/pull/8567

Full Changelog: letsencrypt/boulder@v0.20260112.0...v0.20260120.0

v0.20260112.0

Compare Source

What's Changed

• build(deps): bump the aws group across 1 directory with 4 updates by @​dependabot[bot] inhttps://github.com/letsencrypt/boulder/pull/85444
• observer: remove redundant manual config validators by @​sheurich in https://github.com/letsencrypt/boulder/pull/8538
• va: Avoid creating multiple slow remote timers in doRemoteOperation by @​aaomidi in https://github.com/letsencrypt/boulder/pull/8516
• ct-test-srv: remove logging at startup by @​jsha in https://github.com/letsencrypt/boulder/pull/8551

Full Changelog: letsencrypt/boulder@v0.20260105.0...v0.20260112.0

v0.20260105.0

Compare Source

What's Changed

• lint: fix staticcheck QF issues by @​alexandear in https://github.com/letsencrypt/boulder/pull/8524
• fix: correct typos in test and documentation comments by @​alexandear in https://github.com/letsencrypt/boulder/pull/8526
• test: Refactor initSA to simplify cleanup in tests by @​alexandear in https://github.com/letsencrypt/boulder/pull/8525
• add bsetup notes to README by @​acaird in https://github.com/letsencrypt/boulder/pull/8521
• CA: Log error instead of cert upon storage failure by @​aarongable in https://github.com/letsencrypt/boulder/pull/8528
• web: No longer escape HTML characters in SendError by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8533

New Contributors

• @​alexandear made their first contribution in https://github.com/letsencrypt/boulder/pull/8524
• @​acaird made their first contribution in https://github.com/letsencrypt/boulder/pull/8521

Full Changelog: letsencrypt/boulder@v0.20251216.0...v0.20260105.0

v0.20251216.0

Compare Source

What's Changed

• build(deps): bump the aws group across 1 directory with 4 updates by @​dependabot[bot] inhttps://github.com/letsencrypt/boulder/pull/84966
• Remove usage of subtle.ConstantTimeCompare in validation by @​aarongable in https://github.com/letsencrypt/boulder/pull/8519
• docker: Add build context for vtcomboserver service by @​sheurich in https://github.com/letsencrypt/boulder/pull/8520
• Fix wildcard authorization reuse with DNS-Account-01 by @​sheurich in https://github.com/letsencrypt/boulder/pull/8504
• Refactor DNS to pass full messages up to the VA by @​aarongable in https://github.com/letsencrypt/boulder/pull/8513
• ca/cert-checker: Support test log submissions by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8522

Full Changelog: letsencrypt/boulder@v0.20251208.0...v0.20251216.0

v0.20251208.0

Compare Source

What's Changed

• ratelimits: Refactor Reset() to accept a batch of Transactions by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8503
• Update CI to go1.25.5 by @​aarongable in https://github.com/letsencrypt/boulder/pull/8511
• Store authzIDs directly in order table by @​jsha in https://github.com/letsencrypt/boulder/pull/8460
• Add current datetime column to orderFqdnSets and authz2 tables by @​aarongable in https://github.com/letsencrypt/boulder/pull/8512
• sa: Fix modelToOrder to populate V2Authorizations from Authzs column by @​aaomidi in https://github.com/letsencrypt/boulder/pull/8514
• Remove ECDSA P-224 curve support from the ceremony tool by @​pgporada in https://github.com/letsencrypt/boulder/pull/8515
• Allow monitoring_only logs as well as test logs for submitToTestLogs by @​mcpherrinm in https://github.com/letsencrypt/boulder/pull/8510
• database: Add vitess + mysql 8.4 to our development environment by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8468

Full Changelog: letsencrypt/boulder@v0.20251202.0...v0.20251208.0

v0.20251202.0

Compare Source

What's Changed

• sa: use dummy date instead of zero date by @​jsha in https://github.com/letsencrypt/boulder/pull/8481
• borp/sa: Update borp to pass Transaction args through BoulderTypeConverter by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8494
• sfe: Keep loading intervals in sync with promise, fix wording by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8500
• sfe/redis: Add limiter config to SFE and cleanup creds by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8501
• Make CAA checking more like DCV checking by @​aarongable in https://github.com/letsencrypt/boulder/pull/8491
• Update Public Suffix List to v0.50.1 by @​aarongable in https://github.com/letsencrypt/boulder/pull/8495
• sa: Stop injecting max_statement_time and long_query_time into DSNs by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8490
• Remove dead code by @​mcpherrinm in https://github.com/letsencrypt/boulder/pull/8506
• build(deps): bump github/codeql-action from 3 to 4 by @​dependabot[bot] inhttps://github.com/letsencrypt/boulder/pull/85077

Full Changelog: letsencrypt/boulder@v0.20251118.0...v0.20251202.0

v0.20251118.0

Compare Source

What's Changed

• build(deps): bump actions/github-script from 7 to 8 by @​dependabot[bot] inhttps://github.com/letsencrypt/boulder/pull/84722
• wfe: Add healthz endpoint by @​jprenken in https://github.com/letsencrypt/boulder/pull/8484
• Use promauto.With(stats) instead of stats.MustRegister() by @​aarongable in https://github.com/letsencrypt/boulder/pull/8483
• database: Remove Partitions from our tables by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8489
• sfe/overrides: Update agreements with revised wording from legal by @​beautifulentropy in https://github.com/letsencrypt/boulder/pull/8488

Full Changelog: letsencrypt/boulder@v0.20251110.0...v0.20251118.0

---

Configuration

📅 Schedule: Branch creation - "* 1 * * 1-5" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[elastic-renovate-prod]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/go-jose/go-jose/v4	v4.1.3 -> v4.1.4