chore(deps): bump the go-deps group with 4 updates by dependabot[bot] · Pull Request #215 · sirosfoundation/go-trust

dependabot · 2026-10-15T12:14:06Z

Bumps the go-deps group with 4 updates: github.com/SUNET/vc, github.com/fxamacker/cbor/v2, github.com/go-oidfed/lib and github.com/prometheus/client_golang.

Updates github.com/SUNET/vc from 0.7.22 to 0.7.23

Commits

479f62c test(apigw): cover importer idempotency/race; fix microcredential card
e2cf5dd fix(apigw): make bootstrap import race-safe; scope fly sync to dev
5718be8 Merge branch 'main' into masv/microcredential/deploy
dc4c08e Merge pull request #751 from SUNET/fix/identity-mapping-requires-namespace-merge
fb1be2c fix: serialize wrapped *Error sentinels with their named title
8cba83a test: cover wrapped identity-mapping namespace error in StatusCode
b448b1a Merge branch 'main' into fix/identity-mapping-requires-namespace-merge
82c6449 refactor: map identity-mapping namespace error to a deterministic 400
42670b2 Merge pull request #750 from SUNET/fix/oidcrp-reregister-on-expiry-merge
6cd7401 ci: re-trigger PR checks (prior push hit a GitHub 500, desynced the head)
Additional commits viewable in compare view

Updates github.com/fxamacker/cbor/v2 from 2.9.4 to 2.9.6

Release notes

Sourced from github.com/fxamacker/cbor/v2's releases.

v2.9.6 fixes 12 bugs, including an important fix for apps that decode CBOR maps into Go maps, and has one behavior change. API is unchanged but more errors are detected.

Most of these bugs were identified while improving tests and reviewing code for an upcoming release.

Tests and fuzz tests were extended.

Upgrading to v2.9.6 from all prior versions is recommended.

🐞 Important Fix

Not affected:

Decoding data this codec encoded from the same Go map type, because this codec does not encode to CBOR null from Go values of bool, integer, float, or string kind.

Apps that don't decode a CBOR null or undefined map key or value into a Go map whose key or value type is of bool, integer, float, or string kind.

Decoding CBOR maps into structs (struct fields of map type follow the bullet above).

Decoding CBOR maps into map[any]any, and into any (with unchanged DefaultMapType).

For use cases outside the "not affected" list, decoding a CBOR null or undefined map key or value (including 55799(null)) into a Go map whose key or value type is of bool, integer, float, or string kind kept the previous map entry's key or value (instead of the zero value). See PR #855 for details.

⚠️ Behavior change

Decoding CBOR null or undefined into an interface that holds a value now sets it to nil, matching encoding/json (v1 and v2). Previously, the interface kept its value (PR #827), which was not the intended behavior.

What's Changed

Some of these bugs could only be triggered by incorrect usage in user apps, such as invalid struct tags or an unsupported DefaultByteStringType setting, etc. None of these bugs were reported by a project affected by them.

Decoding

Skip CBOR data item when destination struct has incorrect tags by @fxamacker in fxamacker/cbor#821

Fix decoding CBOR null/undefined to interface value by @fxamacker in fxamacker/cbor#827

Fix decoding to unaddressable value in interface by @fxamacker in fxamacker/cbor#828

Improve the DefaultByteStringType check by @fxamacker in fxamacker/cbor#829

Fix decoding to self-referencing types by @fxamacker in fxamacker/cbor#831

Fix decoding 55799(null) to pointer or interface by @fxamacker in fxamacker/cbor#851

Fix stale Go map entry from CBOR null key/value by @fxamacker in fxamacker/cbor#855

Encoding

Fix encoding self-referencing types by @fxamacker in fxamacker/cbor#833

Fix panic encoding marshaler of unsupported underlying types by @fxamacker in fxamacker/cbor#834

Fix omitzero panic encoding struct field of unsupported underlying types implementing marshaler by @fxamacker in fxamacker/cbor#835

Fix encoding TimeUnixMicro outside 1677 to 2262 by @fxamacker in fxamacker/cbor#837

Encoded output also changes for some times within one second of either end of that range.

Reject encoding time.Time when Go formats wrong year by @fxamacker in fxamacker/cbor#838

CI / GitHub Actions and Docs

Improve docs related to encoding time.Time by @fxamacker in fxamacker/cbor#854

Full Changelog: fxamacker/cbor@v2.9.4...v2.9.6

... (truncated)

Commits

8604f5f Merge pull request #857 from fxamacker/fxamacker/retract-v2.9.5
1e80139 Retract v2.9.5
a1b077c Merge pull request #855 from fxamacker/fxamacker/release-2.9-fix-nil-map-value
0d86c22 Fix stale Go map entry from CBOR null key/value
dd5dab6 Merge pull request #854 from fxamacker/fxamacker/release-2.9-update-docs
599c7c8 Improve docs related to encoding time.Time
850c568 Merge pull request #851 from fxamacker/fxamacker/release-2.9-fix-decoding-557...
c046eed Fix decoding 55799(null) to pointer or interface
ac3c8da Merge pull request #838 from fxamacker/fxamacker/release-2.9-fix-encoding-rfc...
258d49e Merge pull request #837 from fxamacker/fxamacker/release-2.9-fix-encoding-tim...
Additional commits viewable in compare view

Updates github.com/go-oidfed/lib from 0.11.4 to 0.12.0

Release notes

Sourced from github.com/go-oidfed/lib's releases.

go-oidfed/lib 0.12.0

The required go version is now 1.27.

Features

Automatic private_key_jwt client authentication on federation endpoints. An entity that advertises private_key_jwt in an endpoint's *_auth_methods (fetch, list, resolve, trust-mark) is now called with an authenticated form-encoded POST: the request params plus client_assertion_type + client_assertion (audience = endpoint URL). When the field is absent (or no producer is set), behavior is unchanged (unauthenticated GET).

New setter SetDefaultClientAuth(*RequestObjectProducer) and package var DefaultClientAuth enable auto-auth for the fetch/list/trust-mark endpoints (FetchEntityStatement, entity collection list fetching, and external trust-mark refresh).

SimpleRemoteMetadataResolver gains ClientAuth *RequestObjectProducer (non-nil → always POST + client assertion), optional Headers, and AlgsFromEC func() []string for reading acceptable signing algorithms from the target's Entity Configuration. RemoteResolverClientAuth (ROProducer + Force) applies only to SmartRemoteMetadataResolver.

SmartRemoteMetadataResolver gains ClientAuth *RemoteResolverClientAuth and, when set, authenticates to each trust anchor's resolve endpoint exactly when the anchor's EC advertises private_key_jwt in federation_resolve_endpoint_auth_methods (or always with Force: true).

Breaking Changes

ML-DSA keys now use Go's native crypto/mldsa. The github.com/jwx-go/mldsa/v4 and filippo.io/mldsa extension imports are gone; all ML-DSA key types are crypto/mldsa and algorithms come from jwa (jwa.MLDSA44/65/87()). ML-DSA signing/verification and PKCS#8 PEM handling are unchanged in behavior.

ML-DSA PEM export now writes the interoperable (RFC 9935) seed-only encoding via crypto/x509 instead of the legacy OCTET-STRING-wrapped seed form. This matches what OpenSSL and Go's stdlib emit. Parsing still accepts both the new and the legacy encoding, so previously exported keys keep loading.

Migration

New jwx.ConvertMLDSAPEM([]byte) ([]byte, error) re-encodes a PEM ML-DSA private key from the legacy encoding to the new interoperable one; jwx.ConvertMLDSAPrivateKeyAsPem(*mldsa.PrivateKey) is the object-level variant. Existing legacy keys continue to load without conversion; run the converter when you want PEM files to match OpenSSL/stdlib output. New helpers jwx.ParseMLDSAPrivateKeyFromPEM and jwx.ExportMLDSAPrivateKeyAsPem are also exported.

Changelog

Sourced from github.com/go-oidfed/lib's changelog.

go-oidfed/lib 0.12.0

The required go version is now 1.27.

Features

Automatic private_key_jwt client authentication on federation endpoints. An entity that advertises private_key_jwt in an endpoint's *_auth_methods (fetch, list, resolve, trust-mark) is now called with an authenticated form-encoded POST: the request params plus client_assertion_type + client_assertion (audience = endpoint URL). When the field is absent (or no producer is set), behavior is unchanged (unauthenticated GET).

New setter SetDefaultClientAuth(*RequestObjectProducer) and package var DefaultClientAuth enable auto-auth for the fetch/list/trust-mark endpoints (FetchEntityStatement, entity collection list fetching, and external trust-mark refresh).

SimpleRemoteMetadataResolver gains ClientAuth *RequestObjectProducer (non-nil → always POST + client assertion), optional Headers, and AlgsFromEC func() []string for reading acceptable signing algorithms from the target's Entity Configuration. RemoteResolverClientAuth (ROProducer + Force) applies only to SmartRemoteMetadataResolver.

SmartRemoteMetadataResolver gains ClientAuth *RemoteResolverClientAuth and, when set, authenticates to each trust anchor's resolve endpoint exactly when the anchor's EC advertises private_key_jwt in federation_resolve_endpoint_auth_methods (or always with Force: true).

Breaking Changes

ML-DSA keys now use Go's native crypto/mldsa. The github.com/jwx-go/mldsa/v4 and filippo.io/mldsa extension imports are gone; all ML-DSA key types are crypto/mldsa and algorithms come from jwa (jwa.MLDSA44/65/87()). ML-DSA signing/verification and PKCS#8 PEM handling are unchanged in behavior.

ML-DSA PEM export now writes the interoperable (RFC 9935) seed-only encoding via crypto/x509 instead of the legacy OCTET-STRING-wrapped seed form. This matches what OpenSSL and Go's stdlib emit. Parsing still accepts both the new and the legacy encoding, so previously exported keys keep loading.

Migration

New jwx.ConvertMLDSAPEM([]byte) ([]byte, error) re-encodes a PEM ML-DSA private key from the legacy encoding to the new interoperable one; jwx.ConvertMLDSAPrivateKeyAsPem(*mldsa.PrivateKey) is the object-level variant. Existing legacy keys continue to load without conversion; run the converter when you want PEM files to match OpenSSL/stdlib output. New helpers jwx.ParseMLDSAPrivateKeyFromPEM and jwx.ExportMLDSAPrivateKeyAsPem are also exported.

Commits

7b66d95 update changelog for v0.12.0: document Go 1.27 requirement, breaking changes ...
9ccaa56 add support for interoperable ML-DSA private key PEM encoding, parsing, and l...
40b9572 replace jwxmldsa usage with jwa-based ML-DSA implementation, bump depende...
7edd6f9 add support for private_key_jwt client authentication on federation endpoin...
See full diff in compare view

Updates github.com/prometheus/client_golang from 1.24.1 to 1.25.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.25.0

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

[CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138

[CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963

[CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928

[FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091

[FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146

[ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142

[ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095

[ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125

[BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136

[BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139

[BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

What's Changed

fix: Remove unneeded and broken CI badge by @bwplotka in prometheus/client_golang#2057

Synchronize common files from prometheus/prometheus by @prombot in prometheus/client_golang#2060

build(deps): bump the codeql group with 4 updates by @dependabot[bot] in prometheus/client_golang#2066

build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 by @dependabot[bot] in prometheus/client_golang#2071

build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 in the golang-org-x group across 1 directory by @dependabot[bot] in prometheus/client_golang#2069

build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 in /exp by @dependabot[bot] in prometheus/client_golang#2072

build(deps): bump github.com/prometheus/common from 0.69.0 to 0.70.1 in /exp by @dependabot[bot] in prometheus/client_golang#2073

build(deps): bump github.com/prometheus/common from 0.69.0 to 0.70.1 by @dependabot[bot] in prometheus/client_golang#2070

build(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /tutorials/whatsup by @dependabot[bot] in prometheus/client_golang#2075

Pin GitHub Actions by @SuperQ in prometheus/client_golang#2074

build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in prometheus/client_golang#2067

promhttp: fix panic on requests with nil URL by @SAY-5 in prometheus/client_golang#2065

Return info annotations in addition to warnings in the API by @zenador in prometheus/client_golang#1963

build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in prometheus/client_golang#2082

Synchronize common files from prometheus/prometheus by @prombot in prometheus/client_golang#2084

Synchronize common files from prometheus/prometheus by @prombot in prometheus/client_golang#2086

Synchronize common files from prometheus/prometheus by @prombot in prometheus/client_golang#2088

Regenerate Go collector runtime metrics for Go 1.25 and Go 1.26 by @bwplotka in prometheus/client_golang#2090

go.mod: remove obsolete exclude rule by @thaJeztah in prometheus/client_golang#2077

Synchronize common files from prometheus/prometheus by @prombot in prometheus/client_golang#2093

README: document the OpenTelemetry OTLP push bridge by @mvanhorn in prometheus/client_golang#1987

docs: add AGENTS.md contributor and maintainer guide by @bwplotka in prometheus/client_golang#2056

testutil: add GatherAndFormat helper by @wieghx in prometheus/client_golang#2091

build(deps): bump the codeql group with 4 updates by @dependabot[bot] in prometheus/client_golang#2101

build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @dependabot[bot] in prometheus/client_golang#2097

build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by @dependabot[bot] in prometheus/client_golang#2098

build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 in /exp by @dependabot[bot] in prometheus/client_golang#2099

build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 in /exp by @dependabot[bot] in prometheus/client_golang#2100

build(deps): bump github.com/prometheus/procfs from 0.21.1 to 0.22.0 in the prometheus group across 1 directory by @dependabot[bot] in prometheus/client_golang#2096

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.25.0 / 2026-10-07

[CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138

[CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963

[CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928

[FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091

[FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146

[ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142

[ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095

[ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125

[BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136

[BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139

[BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

Commits

0d88875 Cut v1.25.0 (#2164)
e9946ee Cut v1.25.0-rc.0 (#2154)
de866d6 Merge pull request #2152 from prometheus/dependabot/go_modules/api/prometheus...
a37302f prometheus: fix modernize lint findings (#2151)
a3fa380 build(deps): bump google.golang.org/grpc
9da3fcc fix: updates for tsdb blocks handling (#1928)
0ecb5c2 api: match complete URL placeholders (#2136)
2ad001a exp/api/remote: reset buffer before generic marshal (#2139)
0db8d43 promhttp: vary negotiated metrics responses (#2142)
b1f9c7a Merge pull request #2144 from prometheus/dependabot/go_modules/exp/github.com...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-deps group with 4 updates: [github.com/SUNET/vc](https://github.com/SUNET/vc), [github.com/fxamacker/cbor/v2](https://github.com/fxamacker/cbor), [github.com/go-oidfed/lib](https://github.com/go-oidfed/lib) and [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang). Updates `github.com/SUNET/vc` from 0.7.22 to 0.7.23 - [Release notes](https://github.com/SUNET/vc/releases) - [Changelog](https://github.com/SUNET/vc/blob/main/CHANGELOG.md) - [Commits](SUNET/vc@v0.7.22...v0.7.23) Updates `github.com/fxamacker/cbor/v2` from 2.9.4 to 2.9.6 - [Release notes](https://github.com/fxamacker/cbor/releases) - [Commits](fxamacker/cbor@v2.9.4...v2.9.6) Updates `github.com/go-oidfed/lib` from 0.11.4 to 0.12.0 - [Release notes](https://github.com/go-oidfed/lib/releases) - [Changelog](https://github.com/go-oidfed/lib/blob/main/CHANGELOG.md) - [Commits](go-oidfed/lib@v0.11.4...v0.12.0) Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.24.1...v1.25.0) --- updated-dependencies: - dependency-name: github.com/SUNET/vc dependency-version: 0.7.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/fxamacker/cbor/v2 dependency-version: 2.9.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/go-oidfed/lib dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/prometheus/client_golang dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from leifj as a code owner October 15, 2026 12:14

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 15, 2026

leifj approved these changes Oct 15, 2026

View reviewed changes

leifj merged commit f6633a0 into main Oct 15, 2026
13 of 14 checks passed

leifj deleted the dependabot/go_modules/go-deps-b4f7cfd6df branch October 15, 2026 14:42

Navigation Menu

Repository navigation

chore(deps): bump the go-deps group with 4 updates - #215

chore(deps): bump the go-deps group with 4 updates#215
leifj merged 1 commit into
mainfrom
dependabot/go_modules/go-deps-b4f7cfd6df

dependabot Bot commented on behalf of github Oct 15, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 15, 2026

🐞 Important Fix

⚠️ Behavior change

What's Changed

Decoding

Encoding

CI / GitHub Actions and Docs

go-oidfed/lib 0.12.0

Features

Breaking Changes

Migration

go-oidfed/lib 0.12.0

Features

Breaking Changes

Migration

v1.25.0

1.25.0 / 2026-10-07

What's Changed

1.25.0 / 2026-10-07

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant