runtime icon indicating copy to clipboard operation
runtime copied to clipboard

Published 20 hours ago • verified publisher icon cosi-project

chore: update dependencies

Open renovate[bot] opened this issue 1 month ago • 1 comments

Update Request | Renovate Bot

This PR contains the following updates:

Package Change Age Adoption Passing Confidence Type Update
github.com/ProtonMail/gopenpgp/v2 v2.9.0 -> v3.3.0 age adoption passing confidence require major
github.com/cenkalti/backoff/v4 v4.3.0 -> v5.0.3 age adoption passing confidence require major
github.com/planetscale/vtprotobuf 0393e58 -> ba97887 require digest
github.com/siderolabs/gen v0.8.5 -> v0.8.6 age adoption passing confidence require patch
go.yaml.in/yaml/v4 v4.0.0-rc.2 -> v4.0.0-rc.3 age adoption passing confidence require patch
golang.org/x/sync v0.17.0 -> v0.18.0 age adoption passing confidence require minor
google.golang.org/grpc v1.76.0 -> v1.77.0 age adoption passing confidence require minor

Release Notes

ProtonMail/gopenpgp (github.com/ProtonMail/gopenpgp/v2)

v3.3.0

Compare Source

What's Changed
Added
  • MaxDecompressedSize option to control the maximum size of decompressed messages.
Changed
  • Update go-crypto to v1.3.0.

Full Changelog: https://github.com/ProtonMail/gopenpgp/compare/v3.2.1...v3.3.0

v3.2.1

Compare Source

What's Changed

Fixed
  • Avoid double compression in signcryption with a session key by @​lubux in #​337

Full Changelog: https://github.com/ProtonMail/gopenpgp/compare/v3.2.0...v3.2.1

v3.2.0

Compare Source

What's Changed
Added
Changed
  • Bumped minimum supported Go version to 1.22.0.
  • Update go-crypto fork to v1.2.0.
  • Remove pkgs/errors dependency.

Full Changelog: https://github.com/ProtonMail/gopenpgp/compare/v3.1.3...v3.2.0

v3.1.3

Compare Source

What's Changed
Changed
  • Update go-crypto fork to v1.1.6

Full Changelog: https://github.com/ProtonMail/gopenpgp/compare/v3.1.2...v3.1.3

v3.1.2

Compare Source

What's Changed
Changed
  • Update go-crypto fork to v1.1.5

Full Changelog: https://github.com/ProtonMail/gopenpgp/compare/v3.1.1...v3.1.2

v3.1.1

Compare Source

What's Changed
Changed
  • Update go-crypto fork to v1.1.4

Full Changelog: https://github.com/ProtonMail/gopenpgp/compare/v3.1.0...v3.1.1

v3.1.0

Compare Source

What's Changed
Added
Changed
  • Adapt to go-crypto cleartext API changes by @​lubux in #​310
  • Rename profile.Custom.AllowWeakRSA to profile.Custom.InsecureAllowWeakRSA
  • Update go-crypto fork to v1.1.3

Full Changelog: https://github.com/ProtonMail/gopenpgp/compare/v3.0.0...v3.1.0

v3.0.0

Compare Source

What's Changed
New simplified and unified API

GopenPGP v3 introduces a new unified API for high level OpenPGP operations. In comparison to GopenPGP v2, where similar functions were dispersed across different types and required varying implementations for the same operations, GopenPGP v3 consolidates these functions into a consistent interface. Now, operations such as Sign, Verify, Encrypt, Decrypt, and Key generation are each accessible through a unified, builder like API, simplifying integration and enhancing code readability across cryptographic workflows.

However, applications migrating from v2 to v3 will need to update their API calls, as the changes are not backward-compatible. This means that all previous API calls must be rewritten to align with the new, unified API structure. GopenPGP v3 supports the migration process by offering extensive documentation and practical examples. We recommend upgrading to v3 for the latest features and improvements, but we'll continue to support GopenPGP v2 for the time being. Our support includes ongoing bug fixes and minor feature updates to ensure stability and functionality for existing users.

For usage examples of the new API, see the README. For the full documentation, see https://pkg.go.dev/github.com/ProtonMail/gopenpgp/v3.

Profiles

GopenPGP v3 introduces the concept of profiles, enabling applications to configure OpenPGP algorithm selection based on their specific needs. For most applications, the provided preset profiles offer robust and secure defaults, eliminating the need for additional configuration.

RFC 9580 and Interoperability

GopenPGP v3 adds full support for the latest OpenPGP specification, RFC 9580. Compliance with the specification has also been significantly enhanced, as confirmed by the results in the OpenPGP interoperability test suite. These enhancements in GopenPGP v3 are possible by leveraging a new API in the go-crypto fork, which enables a range of improvements in functionality, compliance, and performance.

Go Mobile Support

GopenPGP v3 aims to be fully compatible with Gomobile to provide an API for mobile platforms. For this reason, the library defaults to a builder-like pattern, which is less commonly used in Go. All code that is only relevant for mobile platforms has been moved to the mobile module.

Extending Functionality

GopenPGP v3 introduces a streaming interface across all APIs, enabling memory efficient processing of large data. Additionally, it extends the library's functionality with various improvements, such as:

  • Consider all signatures in a message during verification and allow inspection of each.
  • Support signing with multiple keys.
  • Support encrypting to an "anonymous recipient", where the recipient KeyID is represented as all zeros in the message.
  • Add support for the intended recipient feature as specified in RFC 9580.
  • Ensure consistent behaviour across all APIs.
  • Support generating v6 keys as specified in RFC 9580.

Full Changelog: https://github.com/ProtonMail/gopenpgp/compare/v2.7.5...v3.0.0.

Changelog since v3.0.0-beta.0: https://github.com/ProtonMail/gopenpgp/compare/v3.0.0-beta.0...v3.0.0.

cenkalti/backoff (github.com/cenkalti/backoff/v4)

v5.0.3

Compare Source

v5.0.2

Compare Source

v5.0.1

Compare Source

v5.0.0

Compare Source

siderolabs/gen (github.com/siderolabs/gen)

v0.8.6

Compare Source

gen 0.8.6 (2025-11-03)

Welcome to the v0.8.6 release of gen!

Please try out the release binaries and report any issues at https://github.com/siderolabs/gen/issues.

Contributors
  • Dmitriy Matrenichev
  • Artem Chernyshev
  • Utku Ozdemir
  • Andrey Smirnov
  • Andrey Smirnov
  • Dmitriy Matrenichev
  • Mateusz Urbanek
Changes
27 commits

  • 4c7388b chore: update Go modules, replace YAML library
  • 044d921 feat: add xslices.Deduplicate
  • dcb2b74 feat: add panicsafe package
  • b36ee43 feat: make xyaml.CheckUnknownKeys public
  • 3e319e7 feat: implement xyaml.UnmarshalStrict
  • 7c0324f chore: future-proof HashTrieMap
  • 5ae3afe chore: update hashtriemap implementation from the latest upstream
  • e847d2a chore: add more utilities to xiter
  • f3c5a2b chore: add Empty and Empty2 iterators
  • c53b90b chore: add packages xiter/xstrings/xbytes
  • 7654108 chore: add hashtriemap implementation
  • 8485864 chore: optimize maps.Values and maps.Keys
  • 238baf9 chore: add typesafe SyncMap and bump stuff
  • efca710 chore: add FilterInPlace method to maps and update module
  • 36a3ae3 feat: update module
  • f9f5805 chore: bump rekres and add functions from exp
  • b968d21 feat: add TryRecv and RecvWithContext functions
  • 476dfea feat: add foreach and clear to lazymap
  • 214c1ef chore: set slice.Filter result slice cap to len
  • 8e89b1e feat: add GetOrCreate and GetOrCall methods
  • 7c7ccc3 feat: introduce channel SendWithContext
  • b3b6db8 fix: fix Copy documentation and implementation
  • 521f737 feat: add xerrors package which contains additions to the std errors
  • 726e066 fix: rename tuples.go to pair.go and set proper package name
  • d8d7d25 chore: minor additions
  • 338a650 chore: add initial implementation and documentation
  • 4fd8667 Initial commit
Changes since v0.8.5
1 commit

  • 4c7388b chore: update Go modules, replace YAML library
Dependency Changes

This release has no dependency changes

yaml/go-yaml (go.yaml.in/yaml/v4)

v4.0.0-rc.3

Compare Source

grpc/grpc-go (google.golang.org/grpc)

v1.77.0: Release 1.77.0

Compare Source

API Changes

  • mem: Replace the Reader interface with a struct for better performance and maintainability. (#​8669)

Behavior Changes

  • balancer/pickfirst: Remove support for the old pick_first LB policy via the environment variable GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=false. The new pick_first has been the default since v1.71.0. (#​8672)

Bug Fixes

  • xdsclient: Fix a race condition in the ADS stream implementation that could result in resource-not-found errors, causing the gRPC client channel to move to TransientFailure. (#​8605)
  • client: Ignore HTTP status header for gRPC streams. (#​8548)
  • client: Set a read deadline when closing a transport to prevent it from blocking indefinitely on a broken connection. (#​8534)
  • client: Fix a bug where default port 443 was not automatically added to addresses without a specified port when sent to a proxy.
    • Setting environment variable GRPC_EXPERIMENTAL_ENABLE_DEFAULT_PORT_FOR_PROXY_TARGET=false disables this change; please file a bug if any problems are encountered as we will remove this option soon. (#​8613)
  • balancer/pickfirst: Fix a bug where duplicate addresses were not being ignored as intended. (#​8611)
  • server: Fix a bug that caused overcounting of channelz metrics for successful and failed streams. (#​8573)
  • balancer/pickfirst: When configured, shuffle addresses in resolver updates that lack endpoints. Since gRPC automatically adds endpoints to resolver updates, this bug only affects custom LB policies that delegate to pick_first but don't set endpoints. (#​8610)
  • mem: Clear large buffers before re-using. (#​8670)

Performance Improvements

New Features

  • outlierdetection: Add metrics specified in gRFC A91. (#​8644)
  • stats/opentelemetry: Add support for optional label grpc.lb.backend_service in per-call metrics (#​8637)
  • xds: Add support for JWT Call Credentials as specified in gRFC A97. Set environment variable GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS=true to enable this feature. (#​8536)
  • experimental/stats: Add support for up/down counters. (#​8581)

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • [ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate[bot] avatar Nov 03 '25 10:11 renovate[bot]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 6 additional dependencies were updated

Details:

Package Change
golang.org/x/crypto v0.40.0 -> v0.43.0
golang.org/x/net v0.42.0 -> v0.46.1-0.20251013234738-63d1a5100f82
golang.org/x/sys v0.34.0 -> v0.37.0
golang.org/x/text v0.29.0 -> v0.30.0
google.golang.org/genproto/googleapis/api v0.0.0-20250929231259-57b25ae835d4 -> v0.0.0-20251022142026-3a174f9686a8
google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 -> v0.0.0-20251022142026-3a174f9686a8

renovate[bot] avatar Nov 19 '25 19:11 renovate[bot]