Bump the gomod-minor-updates group across 1 directory with 9 updates#1143
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
force-pushed
the
dependabot/go_modules/gomod-minor-updates-767ca06d86
branch
from
fd28436 to
ae914fa
Compare
Kusari Analysis Results:
Both dependency and code security analyses independently recommend proceeding. The net security posture of this PR is positive: the removal of github.com/aws/aws-sdk-go eliminates two known CVEs (CVE-2020-8912 and CVE-2020-8911) related to S3 Crypto SDK weaknesses, and no new CVEs are introduced by any added or updated packages. No secrets, malicious code patterns, or workflow security issues were detected in the code changes. Two non-blocking items require follow-up but are not security blockers: (1) the transitive dependency github.com/rcrowley/go-metrics carries a BSD-2-Clause-Views license that should be reviewed and confirmed acceptable by your legal team before merging; (2) cloud.google.com/go/pubsub v1 should be fully removed from go.mod once the in-progress migration to cloud.google.com/go/pubsub/v2 v2.4.0 is complete. Neither item presents a security risk that would justify blocking this PR. Note View full detailed analysis result for more information on the output and the checks that were run.
Found this helpful? Give it a 👍 or 👎 reaction! |
|
Kusari PR Analysis rerun based on - ae914fa performed at: 2026-05-15T00:46:59Z - link to updated analysis |
|
@dependabot rebase |
Bumps the gomod-minor-updates group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [cloud.google.com/go/pubsub](https://github.com/googleapis/google-cloud-go) | `1.45.3` | `1.50.2` | | [github.com/gopacket/gopacket](https://github.com/gopacket/gopacket) | `1.3.1` | `1.5.0` | | [github.com/package-url/packageurl-go](https://github.com/package-url/packageurl-go) | `0.1.3` | `0.1.6` | | [go.uber.org/zap](https://github.com/uber-go/zap) | `1.27.0` | `1.28.0` | | [gocloud.dev](https://github.com/google/go-cloud) | `0.40.0` | `0.45.0` | | [gocloud.dev/pubsub/kafkapubsub](https://github.com/google/go-cloud) | `0.40.0` | `0.45.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.79.3` | `1.81.1` | Updates `cloud.google.com/go/pubsub` from 1.45.3 to 1.50.2 - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md) - [Commits](googleapis/google-cloud-go@pubsub/v1.45.3...pubsub/v1.50.2) Updates `github.com/gopacket/gopacket` from 1.3.1 to 1.5.0 - [Release notes](https://github.com/gopacket/gopacket/releases) - [Commits](gopacket/gopacket@v1.3.1...v1.5.0) Updates `github.com/package-url/packageurl-go` from 0.1.3 to 0.1.6 - [Release notes](https://github.com/package-url/packageurl-go/releases) - [Commits](package-url/packageurl-go@v0.1.3...v0.1.6) Updates `go.uber.org/zap` from 1.27.0 to 1.28.0 - [Release notes](https://github.com/uber-go/zap/releases) - [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md) - [Commits](uber-go/zap@v1.27.0...v1.28.0) Updates `gocloud.dev` from 0.40.0 to 0.45.0 - [Release notes](https://github.com/google/go-cloud/releases) - [Commits](google/go-cloud@v0.40.0...v0.45.0) Updates `gocloud.dev/pubsub/kafkapubsub` from 0.40.0 to 0.45.0 - [Release notes](https://github.com/google/go-cloud/releases) - [Commits](google/go-cloud@v0.40.0...v0.45.0) Updates `google.golang.org/api` from 0.216.0 to 0.272.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.216.0...v0.272.0) Updates `google.golang.org/grpc` from 1.79.3 to 1.81.1 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.79.3...v1.81.1) Updates `google.golang.org/protobuf` from 1.36.10 to 1.36.11 --- updated-dependencies: - dependency-name: cloud.google.com/go/pubsub dependency-version: 1.50.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-updates - dependency-name: github.com/gopacket/gopacket dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-updates - dependency-name: github.com/package-url/packageurl-go dependency-version: 0.1.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-minor-updates - dependency-name: go.uber.org/zap dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-updates - dependency-name: gocloud.dev dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-updates - dependency-name: gocloud.dev/pubsub/kafkapubsub dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-updates - dependency-name: google.golang.org/api dependency-version: 0.272.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-updates - dependency-name: google.golang.org/grpc dependency-version: 1.81.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-updates - dependency-name: google.golang.org/protobuf dependency-version: 1.36.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/go_modules/gomod-minor-updates-767ca06d86
branch
from
ae914fa to
c6100a4
Compare
|
Kusari PR Analysis rerun based on - c6100a4 performed at: 2026-05-15T01:03:25Z - link to updated analysis |
calebbrown
deleted the
dependabot/go_modules/gomod-minor-updates-767ca06d86
branch
|
Kusari PR Analysis rerun based on - c6100a4 performed at: 2026-05-15T01:18:58Z - link to updated analysis |
|
Kusari PR Analysis rerun based on - c6100a4 performed at: 2026-05-15T02:02:22Z - link to updated analysis |
1 participant
Bumps the gomod-minor-updates group with 7 updates in the / directory:
1.45.31.50.21.3.11.5.00.1.30.1.61.27.01.28.00.40.00.45.00.40.00.45.01.79.31.81.1Updates
cloud.google.com/go/pubsubfrom 1.45.3 to 1.50.2Commits
e2bbf19chore: librarian release pull request: 20260331T202405Z (#14314)4e6350fchore: librarian release pull request: 20260331T201226Z (#14312)7c26e42chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 in /interna...e5b2057chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 in /internal/g...97d824dfeat(firestore): add WithAlwaysUseImplicitOrderBy option (#14260)eb1fe4cchore: librarian release pull request: 20260331T193117Z (#14310)8a34364feat(bigtable): check alts if we return permission denied for pingandwarm (#...98a546dchore: update version.go template (#14307)efb8c17chore: add biglake and hive (#14306)4c0232afix(pubsub): check for nil concurrency control span (#14303)Updates
github.com/gopacket/gopacketfrom 1.3.1 to 1.5.0Release notes
Sourced from github.com/gopacket/gopacket's releases.
... (truncated)
Commits
ac0316afeat: support to parse enip and cip protocols for industrial automation (#137)c656f7afix: prevent panic when creating flows from malformed linux sll packets (#139)34a6022afpacket: add vnet_hdr_size option that can be passed to NewTPacket (#136)f251eb3fix: Update MAC prefixes and generation logic (#138)e229ad0afpacket: add protocol option that can be passed to NewTPacket (#135)f972276gtp: assign value to data[0] after PrependBytes (#130)1365ed5Bump actions/setup-go from 5 to 6 (#131)3df4fdcadded apsp (from Google's repo) (#129)cabc5c7added ague (from google's repo) (#128)fa445caFix Dot11InformationElement parsing panic (#124)Updates
github.com/package-url/packageurl-gofrom 0.1.3 to 0.1.6Release notes
Sourced from github.com/package-url/packageurl-go's releases.
Commits
a74324eOptimize parsing and serialization performance (#86)b41f387Address review feedback and add chrome-extension validationa546cc5Optimize parsing and serialization performance53d197fTestRoundtrip: complements parsing/toString tests in purl-specb33c146parsing should support slashes in version names2c7e350Merge pull request #90 from Talgarr/masterccaaf70Remove version requirement for TypeSwift384a9f2update purl-spec tests8382d52update submodule41187c2add vscode-extension purlUpdates
go.uber.org/zapfrom 1.27.0 to 1.28.0Release notes
Sourced from go.uber.org/zap's releases.
Changelog
Sourced from go.uber.org/zap's changelog.
Commits
5b81b37release v1.28.0 (#1547)0ab0d5azapcore: Add PreWriteHook for transforming entries before write (#1534)d278c59[chore] CI: test on Go 1.26 (#1535)16fb16bchore(dep): replace archived gopkg.in/yaml.v3 with officially maintained go.y...7b755a3release 1.27.1 (#1521)d6b395bUpdate lazy logger not to materialize unless it's being written to (#1519)4b9cea0ci: Test with Go 1.24, Go 1.25 (#1508)7c80d7bFix race condition in WithLazy implementation (#1426) (#1511)07077a6Prevent zap.Object from panicing on nils (#1501)a6afd05Fix lint check name (#1502)Updates
gocloud.devfrom 0.40.0 to 0.45.0Release notes
Sourced from gocloud.dev's releases.
... (truncated)
Commits
7cc909ball: prerelease (#3664)31e3651blob/s3blob: map S3 403 errors to PermissionDenied code (#3663)c8f1226all: update NATS dependency (#3662)ac4bb89all: Upgrade GitHub Actions for Node 24 compatibility (#3660)1497536secrets/gcpkms: Add support for Additional Authenticated Data (AAD) (#3659)113974aall: Upgrade go.opentelemetry.io/otel/sdk to v1.40.0 (#3657)0b41d48build(deps): bump the go_modules group across 2 directories with 1 update (#3...4c421d0all: Update to go 1.26 (#3653)b84d07fall: run go 1.26's go fix (#3654)ae3c665blob/gcsblob: derive universe domain from credentials (#3652)Updates
gocloud.dev/pubsub/kafkapubsubfrom 0.40.0 to 0.45.0Release notes
Sourced from gocloud.dev/pubsub/kafkapubsub's releases.
... (truncated)
Commits
7cc909ball: prerelease (#3664)31e3651blob/s3blob: map S3 403 errors to PermissionDenied code (#3663)c8f1226all: update NATS dependency (#3662)ac4bb89all: Upgrade GitHub Actions for Node 24 compatibility (#3660)1497536secrets/gcpkms: Add support for Additional Authenticated Data (AAD) (#3659)113974aall: Upgrade go.opentelemetry.io/otel/sdk to v1.40.0 (#3657)0b41d48build(deps): bump the go_modules group across 2 directories with 1 update (#3...4c421d0all: Update to go 1.26 (#3653)b84d07fall: run go 1.26's go fix (#3654)ae3c665blob/gcsblob: derive universe domain from credentials (#3652)Updates
google.golang.org/apifrom 0.216.0 to 0.272.0Release notes
Sourced from google.golang.org/api's releases.
... (truncated)
Changelog
Sourced from google.golang.org/api's changelog.
... (truncated)
Commits
e7df9fechore(main): release 0.272.0 (#3535)5d8b266chore(all): update all (#3540)6374c49feat(all): auto-regenerate discovery clients (#3541)73bcfcffeat(all): auto-regenerate discovery clients (#3539)319b5abfeat(all): auto-regenerate discovery clients (#3538)6def284feat(all): auto-regenerate discovery clients (#3537)549ef3efeat(all): auto-regenerate discovery clients (#3536)b4d37a1feat(all): auto-regenerate discovery clients (#3534)e79327bchore(main): release 0.271.0 (#3533)a3dde28chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 in /interna...Updates
google.golang.org/grpcfrom 1.79.3 to 1.81.1Release notes
Sourced from google.golang.org/grpc's releases.