Skip to content

build(deps): bump the security group across 2 directories with 10 updates - #3869

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/security-cf918cf27e
Open

build(deps): bump the security group across 2 directories with 10 updates#3869
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/security-cf918cf27e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the security group with 8 updates in the / directory:

Package From To
github.com/aws/aws-sdk-go-v2 1.43.0 1.43.6
github.com/aws/aws-sdk-go-v2/config 1.32.31 1.32.37
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager 0.3.5 0.3.13
github.com/ohler55/ojg 1.28.2 1.28.4
github.com/onsi/ginkgo/v2 2.32.0 2.32.1
go.yaml.in/yaml/v3 3.0.4 3.0.5
helm.sh/helm/v3 3.21.3 3.21.4
helm.sh/helm/v4 4.2.3 4.2.4

Bumps the security group with 1 update in the /kinds directory: go.yaml.in/yaml/v3.

Updates github.com/aws/aws-sdk-go-v2 from 1.43.0 to 1.43.6

Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.31 to 1.32.37

Commits

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.19.30 to 1.19.36

Commits

Updates github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.3.5 to 0.3.13

Commits

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.106.0 to 1.107.2

Commits

Updates github.com/ohler55/ojg from 1.28.2 to 1.28.4

Release notes

Sourced from github.com/ohler55/ojg's releases.

v1.28.4

Full Changelog: ohler55/ojg@v1.28.3...v1.28.4

v1.28.3

What's Changed

Full Changelog: ohler55/ojg@v1.28.2...v1.28.3

Changelog

Sourced from github.com/ohler55/ojg's changelog.

[1.28.4] - 2026-07-07

Fixed

  • JSONPath slice for [::2] against an empty slice works correctly now.

[1.28.3] - 2026-08-01

Fixed

  • JSONPath slices support negative ranges correctly now and the slice end values are exclusive to match the JSONPath specification.
Commits

Updates github.com/onsi/ginkgo/v2 from 2.32.0 to 2.32.1

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.32.1

2.32.1

Fixes

  • Defer AfterAll until repeated spec completes [e647b3b]
Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.32.1

Fixes

  • Defer AfterAll until repeated spec completes [e647b3b]
Commits

Updates go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5

Commits
  • e16c7af Remove empty go.sum file
  • 6abcd01 Fix unhandled nil-errors in tests
  • 9481db7 Remove suite_test.go and gopkg.in/check.v1
  • 485f5fc Use standard testing library for limit_test.go
  • 3e00046 Use standard testing library for node_test.go
  • f612058 Use standard testing library for decode_test.go
  • 078f958 Use standard testing library encode_test.go
  • 3847ac0 [v3] backport CodeQL workflow
  • 1666663 Revert incorrect gofmt changes
  • 73290cb Retract v3 tags that cannot be installed
  • See full diff in compare view

Updates helm.sh/helm/v3 from 3.21.3 to 3.21.4

Release notes

Sourced from helm.sh/helm/v3's releases.

Helm v3.21.4 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • fix(engine): prevent Files.Lines panic on empty file (backport to v3)- #32303 by @​mahesh-sadupalli
  • fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932- #32463 by @​karan-vk
  • [dev-v3 backport] fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158- #32535 by @​scottrigby
  • [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061- #32536 by @​scottrigby
  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0- (includes golang.org/x/text v0.40.0 to fix GO-2026-5970) #32308

Installation and Upgrading

Download Helm v3.21.4. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#32308) 813176c51bb5c181dbbd7901298ddcc104cd3417 (dependabot[bot])
  • [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061 b6aa8b1d71140347f75ef0b77fac91f28ffe10b3 (Scott Rigby)
  • fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158 57ce7aeec1eb82422c5c349dfadda20ea3f743fe (Scott Rigby)
  • fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932 ab71449c76f66e55064ae4503a6e7adae21dcfa9 (Karan V)
  • fix(engine): prevent Files.Lines panic on empty file 955dfab1e6bdd70b5ccd7b932b2d500e9e26566c (Mahesh Sadupalli)

... (truncated)

Commits
  • 813176c chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 (#32308)
  • b6aa8b1 [dev-v3 backport] deps: bump google.golang.org/grpc@v1.82.1 for GO-2026-6061
  • 57ce7ae fix: bump go.opentelemetry.io/otel@v1.44.0 for GO-2026-5158
  • ab71449 fix(provenance): migrate to ProtonMail/go-crypto to resolve GO-2026-5932
  • 955dfab fix(engine): prevent Files.Lines panic on empty file
  • See full diff in compare view

Updates helm.sh/helm/v4 from 4.2.3 to 4.2.4

Release notes

Sourced from helm.sh/helm/v4's releases.

Helm v4.2.4 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

Installation and Upgrading

Download Helm v4.2.4. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

... (truncated)

Commits
  • 3900f43 Minimal fix to build failure from #31211.
  • f7c6e8f fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158 (#32521)
  • 035a2c3 chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1
  • f76a5f4 fix: pass registry client to downloader.Manager in upgrade
  • 5a7c6c7 Apply suggestions
  • 2281848 Properly format the extra field in gzipped packages
  • 2c979a1 Fix missing conflict retry with server-side apply (#32088)
  • 2bd2c66 Potential fix for pull request finding
  • 183a540 fix(registry): resolve golangci-lint issues in token-auth tests
  • 08d8da1 chore: go mod tidy after rebase on main
  • Additional commits viewable in compare view

Updates go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5

Commits
  • e16c7af Remove empty go.sum file
  • 6abcd01 Fix unhandled nil-errors in tests
  • 9481db7 Remove suite_test.go and gopkg.in/check.v1
  • 485f5fc Use standard testing library for limit_test.go
  • 3e00046 Use standard testing library for node_test.go
  • f612058 Use standard testing library for decode_test.go
  • 078f958 Use standard testing library encode_test.go
  • 3847ac0 [v3] backport CodeQL workflow
  • 1666663 Revert incorrect gofmt changes
  • 73290cb Retract v3 tags that cannot be installed
  • See full diff in compare view

Updates go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5

Commits
  • e16c7af Remove empty go.sum file
  • 6abcd01 Fix unhandled nil-errors in tests
  • 9481db7 Remove suite_test.go and gopkg.in/check.v1
  • 485f5fc Use standard testing library for limit_test.go
  • 3e00046 Use standard testing library for node_test.go
  • f612058 Use standard testing library for decode_test.go
  • 078f958 Use standard testing library encode_test.go
  • 3847ac0 [v3] backport CodeQL workflow
  • 1666663 Revert incorrect gofmt changes
  • 73290cb Retract v3 tags that cannot be installed
  • See full diff in compare view

Updates go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5

Commits
  • e16c7af Remove empty go.sum file
  • 6abcd01 Fix unhandled nil-errors in tests
  • 9481db7 Remove suite_test.go and gopkg.in/check.v1
  • 485f5fc Use standard testing library for limit_test.go
  • 3e00046 Use standard testing library for node_test.go
  • f612058 Use standard testing library for decode_test.go
  • 078f958 Use standard testing library encode_test.go
  • 3847ac0 [v3] backport CodeQL workflow
  • 1666663 Revert incorrect gofmt changes
  • 73290cb Retract v3 tags that cannot be installed
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the security group across 2 directories with 10 upd…
f9f2511 
…ates

Bumps the security group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.43.0` | `1.43.6` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.31` | `1.32.37` |
| [github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager](https://github.com/aws/aws-sdk-go-v2) | `0.3.5` | `0.3.13` |
| [github.com/ohler55/ojg](https://github.com/ohler55/ojg) | `1.28.2` | `1.28.4` |
| [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) | `2.32.0` | `2.32.1` |
| [go.yaml.in/yaml/v3](https://github.com/yaml/go-yaml) | `3.0.4` | `3.0.5` |
| [helm.sh/helm/v3](https://github.com/helm/helm) | `3.21.3` | `3.21.4` |
| [helm.sh/helm/v4](https://github.com/helm/helm) | `4.2.3` | `4.2.4` |

Bumps the security group with 1 update in the /kinds directory: [go.yaml.in/yaml/v3](https://github.com/yaml/go-yaml).


Updates `github.com/aws/aws-sdk-go-v2` from 1.43.0 to 1.43.6
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.43.0...v1.43.6)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.31 to 1.32.37
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.32.31...config/v1.32.37)

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.19.30 to 1.19.36
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@credentials/v1.19.30...credentials/v1.19.36)

Updates `github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager` from 0.3.5 to 0.3.13
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@feature/s3/transfermanager/v0.3.5...feature/s3/transfermanager/v0.3.13)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.106.0 to 1.107.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.106.0...service/s3/v1.107.2)

Updates `github.com/ohler55/ojg` from 1.28.2 to 1.28.4
- [Release notes](https://github.com/ohler55/ojg/releases)
- [Changelog](https://github.com/ohler55/ojg/blob/develop/CHANGELOG.md)
- [Commits](ohler55/ojg@v1.28.2...v1.28.4)

Updates `github.com/onsi/ginkgo/v2` from 2.32.0 to 2.32.1
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](onsi/ginkgo@v2.32.0...v2.32.1)

Updates `go.yaml.in/yaml/v3` from 3.0.4 to 3.0.5
- [Commits](yaml/go-yaml@v3.0.4...v3.0.5)

Updates `helm.sh/helm/v3` from 3.21.3 to 3.21.4
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](helm/helm@v3.21.3...v3.21.4)

Updates `helm.sh/helm/v4` from 4.2.3 to 4.2.4
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](helm/helm@v4.2.3...v4.2.4)

Updates `go.yaml.in/yaml/v3` from 3.0.4 to 3.0.5
- [Commits](yaml/go-yaml@v3.0.4...v3.0.5)

Updates `go.yaml.in/yaml/v3` from 3.0.4 to 3.0.5
- [Commits](yaml/go-yaml@v3.0.4...v3.0.5)

Updates `go.yaml.in/yaml/v3` from 3.0.4 to 3.0.5
- [Commits](yaml/go-yaml@v3.0.4...v3.0.5)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.43.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.32.37
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-version: 1.19.36
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager
  dependency-version: 0.3.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-version: 1.107.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security
- dependency-name: github.com/ohler55/ojg
  dependency-version: 1.28.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.32.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
- dependency-name: go.yaml.in/yaml/v3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.21.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
- dependency-name: helm.sh/helm/v4
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
- dependency-name: go.yaml.in/yaml/v3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
- dependency-name: go.yaml.in/yaml/v3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
- dependency-name: go.yaml.in/yaml/v3
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions

github-actions Bot commented Aug 20, 2026

Copy link
Copy Markdown

This PR has been released (on staging) and is available for download with a embedded-cluster-smoke-test-staging-app license ID.

Online Installer:

curl "https://staging.replicated.app/embedded/embedded-cluster-smoke-test-staging-app/ci/appver-dev-f9f2511" -H "Authorization: $EC_SMOKE_TEST_LICENSE_ID" -o embedded-cluster-smoke-test-staging-app-ci.tgz

Airgap Installer (may take a few minutes before the airgap bundle is built):

curl "https://staging.replicated.app/embedded/embedded-cluster-smoke-test-staging-app/ci-airgap/appver-dev-f9f2511?airgap=true" -H "Authorization: $EC_SMOKE_TEST_LICENSE_ID" -o embedded-cluster-smoke-test-staging-app-ci.tgz

Happy debugging!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies go type::chore

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants