Skip to content

deps(go): bump the go-minor-patch group across 1 directory with 5 updates - #97

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-97795deff2
Closed

deps(go): bump the go-minor-patch group across 1 directory with 5 updates#97
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-97795deff2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-minor-patch group with 4 updates in the / directory: github.com/go-chi/chi/v5, github.com/nats-io/nats-server/v2, github.com/stretchr/testify and google.golang.org/api.

Updates github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.2

What's Changed

  • feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @​VojtechVitek in go-chi/chi#1151
  • docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @​VojtechVitek in go-chi/chi#1111
  • fix: don't drop handlers that collide with a Mount()/Route() pattern by @​VojtechVitek in go-chi/chi#1148
  • Don't duplicate methods in Allow: header for 405 responses by @​flimzy in go-chi/chi#1029
  • fix(middleware): reject catch-all compress wildcards by @​VojtechVitek in go-chi/chi#1156
    • middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in go-chi/chi#868 and go-chi/chi#1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

Commits
  • 3893906 fix(middleware): reject catch-all compress wildcards "/" and "/*" (#1156)
  • 9b6ddcd Don't duplicate methods in Allow: header for 405 responses (#1029)
  • 29164f0 fix: don't drop handlers that collide with a Mount()/Route() pattern (#1148)
  • bc02284 docs: deployment recipe + verify checklist for ClientIPFromXFFTrustedProxies ...
  • 60ecea5 feat(middleware): add text/markdown, text/csv, text/vtt to default compressib...
  • See full diff in compare view

Updates github.com/nats-io/nats-server/v2 from 2.14.5 to 2.14.6

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.14.6

Changelog

Refer to the 2.14 Upgrade Guide for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

Go Version

  • 1.26.7

Improved

General

  • Removal from service import response maps is now constant-time (#8463)
  • The client code no longer resets the deadline more times than necessary when flushing client buffers (#8513)
  • The client write buffers are now freed correctly when the working buffer exceeds a rational size (#8515)

JetStream

  • Stream reads are now isolated with a separate lock, which improves the performance of direct gets (#8486)
  • Improved the performance of looking up matching sequence numbers for multi-subject gets (#8486)
  • Reduced the number of heap escapes in subject tree matching (#8526)

Fixed

General

  • WebSocket client buffers are recycled more aggressively when reallocating into larger buffers (#8518)
  • Fixed missing routes after a reconnect when gossiped URLs were rejected (#8527)

JetStream

  • The filestore block sync no longer incorrectly skips blocks that were compacted during the same pass (#8456)
  • The filestore block sync now performs a single directory sync upon completion rather than once per compacted block (#8461)
  • The filestore I/O semaphore now covers block sync operations (#8462)
  • Stream config updates with replicas greater than 1 are now rejected on non-clustered systems (#8464)
  • Fixed some issues that could prevent stream snapshots from taking place on a clean shutdown (#8465)
  • The filestore inline compaction no longer ignores sync_interval: always (#8475)
  • The stream created time is now preserved after recovery on a standalone server (#8471, contributed by @​Green7)
  • Fixed a data race that could apply when accessing the batch ID (#8369)
  • Fixed a data race when reading the consumer direct or sourcing status (#8478, contributed by @​nberlee)
  • Prevent the consumer direct or sourcing status from being changed with a consumer update (#8478, contributed by @​nberlee)
  • Fixed an issue where the server could fail to distinguish consumer tiers when enforcing limits (#8484)
  • Fixed a flow control problem where replicated consumers could get stuck after a leader change (#8488)
  • Fixed various consumer create issues that could destroy the state of an existing consumer with the same name (#8491)
  • Internal message delete proposals are no longer counted in the JS API statistics (#8502)
  • Dynamic filestore reservations no longer incorrectly shrink based on used storage after restarts (#8503)
  • Fixed a signalling issue that could stall Raft catchups (#8501)
  • The pending append entry cache in-memory is now bounded by size as well as entry count (#8501)
  • Fixed an issue where a stale snapshot from a previous Raft group could be replayed if the group name was unchanged (#8501)

... (truncated)

Commits
  • 1aa10f9 Release v2.14.6
  • e863317 Cherry-picks for 2.14.6 (#8529)
  • 1196e5a [FIXED] Route missing after reconnect when duplicate resolution kept gossip URL
  • 89befb5 [IMPROVED] Only allocate AckAll sequences when acking in place
  • 0079dd9 [FIXED] AckAll on WQ removed messages outside consumer filter
  • c83ca82 Release v2.14.6-RC.2
  • 9dca6dc Reduce heap escapes in subject tree matching
  • 1c93130 Cherry-picks for 2.14.6-RC.2 (#8525)
  • b6971ae Fix handling of atomic writes tmp files in test helper
  • 591bb3b Fix TestJetStreamClusterHardKillAfterStreamAdd
  • Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.12.0 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

Commits

Updates google.golang.org/api from 0.293.0 to 0.294.0

Release notes

Sourced from google.golang.org/api's releases.

v0.294.0

0.294.0 (2026-08-26)

Features

Changelog

Sourced from google.golang.org/api's changelog.

0.294.0 (2026-08-26)

Features

Commits

Updates google.golang.org/grpc from 1.83.0 to 1.83.2

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.2

Security

  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)

Release 1.83.1

Security

  • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
  • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
  • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
  • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
  • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)

Performance

  • transport: Restrict memory overhead of buffering small data frames. (#9331)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(go): bump the go-minor-patch group across 1 directory with 5 upd…
38b800e 
…ates

Bumps the go-minor-patch group with 4 updates in the / directory: [github.com/go-chi/chi/v5](https://github.com/go-chi/chi), [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server), [github.com/stretchr/testify](https://github.com/stretchr/testify) and [google.golang.org/api](https://github.com/googleapis/google-api-go-client).


Updates `github.com/go-chi/chi/v5` from 5.3.1 to 5.3.2
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.3.1...v5.3.2)

Updates `github.com/nats-io/nats-server/v2` from 2.14.5 to 2.14.6
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md)
- [Commits](nats-io/nats-server@v2.14.5...v2.14.6)

Updates `github.com/stretchr/testify` from 1.12.0 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.12.0...v1.12.1)

Updates `google.golang.org/api` from 0.293.0 to 0.294.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.293.0...v0.294.0)

Updates `google.golang.org/grpc` from 1.83.0 to 1.83.2
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.83.0...v1.83.2)

---
updated-dependencies:
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-version: 2.14.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: google.golang.org/api
  dependency-version: 0.294.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 31, 2026
@dependabot
dependabot Bot requested a review from rennerdo30 as a code owner August 31, 2026 12:25
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 31, 2026
@rennerdo30

rennerdo30 commented Sep 5, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Sep 5, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 5, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/go-minor-patch-97795deff2 branch September 5, 2026 06:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rennerdo30 rennerdo30 Awaiting requested review from rennerdo30 rennerdo30 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rennerdo30