Skip to content

chore(deps): bump the all group across 1 directory with 3 updates#1680

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-11429c6cb9
Closed

chore(deps): bump the all group across 1 directory with 3 updates#1680
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-11429c6cb9

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 22, 2026 •
edited
Loading

Bumps the all group with 3 updates in the / directory: cloud.google.com/go/storage, github.com/google/go-containerregistry and golang.org/x/crypto.

Updates cloud.google.com/go/storage from 1.62.1 to 1.62.2

Release notes

Sourced from cloud.google.com/go/storage's releases.

storage: v1.62.2

v1.62.2 (2026-05-18)

Features

Bug Fixes

  • restore metadata operations timeout in gRPC (#14575) (275ff562)

  • Set default chunkRetryDeadline to 32s in NewWriterFromAppendableObject (#14458) (ec7c7d66)

  • refactor userProject metadata propagation in ListObjects (#14533) (fbb543e3)

Commits
  • 50a5755 chore: librarian release pull request: 20260518T161338Z (#14610)
  • 585840f spanner: skip flaky TestIntegration_DbRemovalRecovery (#14607)
  • f8bf88f test(spanner): retry query after database recreation in integration test (#14...
  • 9168ab8 chore(librariangen): tweak release preview test (#14599)
  • f8b9a93 fix(spanner/spannertest): Support UUID as a base data type (#14117)
  • a42fd83 fix(internal/librariange): release preview support (#14588)
  • d944830 fix(datastore): add retries to emulator (#14591)
  • c5aaedc chore: migrate Go configuration in librarian.yaml (#14587)
  • 8a0e849 doc(agentplatform): Add notes and quick examples to the README
  • 033f4fe chore: librarian release pull request: 20260514T191310Z (#14589)
  • Additional commits viewable in compare view

Updates github.com/google/go-containerregistry from 0.21.5 to 0.21.6

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.6

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.5...v0.21.6

Commits
  • 53f7e39 Update go version to 1.26.3 (#2300)
  • bf87c3b transport: allow bearer realm at same host:port as registry (#2302)
  • c55facd transport: retry HTTP 429 (Too Many Requests) (#2301)
  • 68a569e fix: preserve per-occurrence layer identity in Layers() (#2299)
  • 35b354b fix(mutate): preserve config blob and layers for non-Docker OCI artifacts (#2...
  • e5983f2 remote: block SSRF via private-IP Location headers in blob uploads (#2295)
  • 6dad820 remote: validate foreign layer URLs to prevent SSRF (fixes #2259) (#2293)
  • 78bdf1b validate: skip non-layer layers (#2298)
  • c29d91c pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract ...
  • a70d75a transport: block redirects from token server to private/link-local addresses ...
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.51.0 to 0.52.0

Commits
  • a1c0d99 go.mod: update golang.org/x dependencies
  • 3c7c869 ssh: fix deadlock on unexpected channel responses
  • 533fb3f ssh: fix source-address critical option bypass
  • abbc44d ssh: fix incorrect operator order
  • e052873 ssh: fix infinite loop on large channel writes due to integer overflow
  • b61cf85 ssh: enforce user presence verification for security keys
  • 9c2cd33 ssh: enforce strict limits on DSA key parameters
  • 8907318 ssh: reject RSA keys with excessively large moduli
  • ffd87b4 ssh: fix panic when authority callbacks are nil
  • 4e7a738 ssh: fix deadlock on unexpected global responses
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Used by dependabot - identifies all PRs created by dependabot kind/misc Categorizes issue or PR as a miscellaneuous one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesnt merit a release note. labels May 22, 2026
@tekton-robot
Copy link
Copy Markdown

tekton-robot commented May 22, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign ab-ghosh after the PR has been reviewed.
You can assign the PR to them by writing /assign @ab-ghosh in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot requested review from lcarva and wlynch May 22, 2026 14:20
@tekton-robot tekton-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label May 22, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 25, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@ab-ghosh ab-ghosh mentioned this pull request May 26, 2026
Open
6 tasks
@ab-ghosh
Copy link
Copy Markdown
Member

ab-ghosh commented May 26, 2026

Note: The go-containerregistry v0.21.6 upgrade includes a breaking change (google/go-containerregistry#2281) that affects Chains users with insecure in-cluster registries (e.g. kind, OpenShift internal registry, air-gapped setups). Domains ending in .cluster.local are no longer treated as HTTP by default — only .localhost is.
This is fixed by #1684 , which should be merged before this PR.

@dependabot
chore(deps): bump the all group across 1 directory with 3 updates
5f55163 
Bumps the all group with 3 updates in the / directory: [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go), [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) and [golang.org/x/crypto](https://github.com/golang/crypto).


Updates `cloud.google.com/go/storage` from 1.62.1 to 1.62.2
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](googleapis/google-cloud-go@storage/v1.62.1...storage/v1.62.2)

Updates `github.com/google/go-containerregistry` from 0.21.5 to 0.21.6
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.21.5...v0.21.6)

Updates `golang.org/x/crypto` from 0.51.0 to 0.52.0
- [Commits](golang/crypto@v0.51.0...v0.52.0)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/storage
  dependency-version: 1.62.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.21.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/go_modules/all-11429c6cb9 branch from 86a8da8 to 5f55163 Compare May 26, 2026 21:21
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 27, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 27, 2026
@dependabot dependabot Bot deleted the dependabot/go_modules/all-11429c6cb9 branch May 27, 2026 16:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lcarva lcarva Awaiting requested review from lcarva

@wlynch wlynch Awaiting requested review from wlynch

Assignees

No one assigned

Labels

dependencies Used by dependabot - identifies all PRs created by dependabot kind/misc Categorizes issue or PR as a miscellaneuous one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesnt merit a release note. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@tekton-robot @ab-ghosh @anithapriyanatarajan