chore(deps): bump the security-updates group with 18 updates by dependabot[bot] · Pull Request #153 · kubeservice-stack/common

dependabot · 2026-05-22T10:10:26Z

Bumps the security-updates group with 18 updates:

Package	From	To
github.com/BurntSushi/toml	`1.5.0`	`1.6.0`
github.com/gin-gonic/gin	`1.11.0`	`1.12.0`
github.com/go-sql-driver/mysql	`1.9.2`	`1.10.0`
github.com/mattn/go-isatty	`0.0.20`	`0.0.22`
github.com/prometheus/client_golang	`1.22.0`	`1.23.2`
go.etcd.io/etcd/api/v3	`3.5.21`	`3.6.11`
go.etcd.io/etcd/client/v3	`3.5.21`	`3.6.11`
go.etcd.io/etcd/server/v3	`3.5.21`	`3.6.11`
go.opentelemetry.io/contrib/propagators/autoprop	`0.63.0`	`0.68.0`
go.opentelemetry.io/otel/bridge/opentracing	`1.36.0`	`1.43.0`
go.opentelemetry.io/otel/exporters/jaeger	`1.16.0`	`1.17.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace	`1.38.0`	`1.43.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	`1.38.0`	`1.43.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	`1.36.0`	`1.43.0`
go.uber.org/zap	`1.27.0`	`1.28.0`
golang.org/x/sys	`0.42.0`	`0.45.0`
gorm.io/gorm	`1.30.0`	`1.31.1`
k8s.io/client-go	`0.34.1`	`0.36.1`

Updates github.com/BurntSushi/toml from 1.5.0 to 1.6.0

Release notes

Sourced from github.com/BurntSushi/toml's releases.

v1.6.0

TOML 1.1 is now enabled by default. The TOML changelog has an overview of changes: https://github.com/toml-lang/toml/blob/main/CHANGELOG.md

Also two small fixes:
Encode large floats as exponent syntax so that round-tripping things like 5e+22 is correct.
Using duplicate array keys would not give an error:
arr = [1]
arr = [2]
This will now correctly give a "Key 'arr' has already been defined" error.

Commits

5253492 Enable TOML 1.1 by default (#457)
e954445 Reject duplicate arrays (#455)
6b16cbd Update toml-test test cases from upstream (#456)
011fa2b Ensure constant format strings in wf calls
4b439bf Remove itemNil
a473c12 Add test for out of range float64
b535ff8 Add some boring tests for lex.go
6011ef0 Remove unreachable condition in lexTableNameStart
c8ca9e6 Remove unreachable condition
1121f81 Make tomlv read from stdin
Additional commits viewable in compare view

Updates github.com/gin-gonic/gin from 1.11.0 to 1.12.0

Release notes

Sourced from github.com/gin-gonic/gin's releases.

v1.12.0

Changelog

Features

192ac89eefc1c30f7c97ae48a9ffb1c6f1c8c8bc: feat(binding): add support for encoding.UnmarshalText in uri/query binding (#4203) (@takanuva15)

53410d2e07054369e0960fbe2eed97e1b9966f12: feat(context): add GetError and GetErrorSlice methods for error retrieval (#4502) (@raju-mechatronics)

acc55e049e33b401e810dbd8c0d6dcb6b3ba2b05: feat(context): add Protocol Buffers support to content negotiation (#4423) (@1911860538)

38e765119241d990705169bedb5002a29ae0cbd1: feat(context): implemented Delete method (@Spyder01)

771dcc6476d7bc6abb9ec0235ecefa4d38fe6fb0: feat(gin): add option to use escaped path (#4420) (@ldesauw)

4dec17afdff48e8018c83618fbbe69fceeb2b41d: feat(logger): color latency (#4146) (@wsyqn6)

d7776de7d444935ea4385999711bd6331a98fecb: feat(render): add bson protocol (#4145) (@laurentcau)

Bug fixes

b917b14ff9d189f16a7492be79d123a47806ee19: fix(binding): empty value error (#2169) (@guonaihong)

c3d1092b3b48addf6f9cd00fe274ec3bd14650eb: fix(binding): improve empty slice/array handling in form binding (#4380) (@1911860538)

9914178584e42458ff7d23891463a880f58c9d86: fix(context): ClientIP handling for multiple X-Forwarded-For header values (#4472) (@Nurysso)

2a794cd0b0faa7d829291375b27a3467ea972b0d: fix(debug): version mismatch (#4403) (@zeek0x)

c3d5a28ed6d3849da820195b6774d212bcc038a9: fix(gin): close os.File in RunFd to prevent resource leak (#4422) (@1911860538)

5fad976b372e381312f8de69f0969f1284d229d3: fix(gin): literal colon routes not working with engine.Handler() (#4415) (@pawannn)

63dd3e60cab89c27fb66bce1423bd268d52abad1: fix(recover): suppress http.ErrAbortHandler in recover (#4336) (@MondayCha)

5c00df8afadd06cc5be530dde00fe6d9fa4a2e4a: fix(render): write content length in Data.Render (#4206) (@dengaleev)

234a6d4c00cb77af9852aca0b8289745d5529b4b: fix(response): refine hijack behavior for response lifecycle (#4373) (@appleboy)

472d086af2acd924cb4b9d7be0525f7d790f69bc: fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535) (@veeceey)

8e07d37c63e5536eb25f4af4c91eabeee4011fba: fix: Correct typos, improve documentation clarity, and remove dead code (#4511) (@mahanadh)

Enhancements

ba093d19477b896ac89a7fc3246af23d290b8e26: chore(binding): upgrade bson dependency to mongo-driver v2 (#4549) (@BobDu)

b2b489dbf4826c2c630717a77fd5e42774625410: chore(context): always trust xff headers from unix socket (#3359) (@WeidiDeng)

ecb3f7b5e2f3915bf1db240ed5eee572f8dbea36: chore(deps): upgrade golang.org/x/crypto to v0.45.0 (#4449) (@appleboy)

af6e8b70b8261bb0c99ad094fe552ab92991620a: chore(deps): upgrade quic-go to v0.57.1 (@appleboy)

db309081bc5c137b2aa15701ef53f7f19788da25: chore(logger): allow skipping query string output (#4547) (@USA-RedDragon)

26c3a628655cad2388380cb8102d6ce7d4875f3b: chore(response): prevent Flush() panic when http.Flusher (#4479) (@Twacqwq)

5dd833f1f26de0eb30eae47b17e05ced2482dc41: chore: bump minimum Go version to 1.24 and update workflows (#4388) (@appleboy)

Refactor

39858a0859c914bd26948fa950477e11bd8d3823: refactor(binding): use maps.Copy for cleaner map handling (#4352) (@russcoss)

c0048f645ee945c4db30593afdea10123e2c30a6: refactor(context): omit the return value names (#4395) (@wanghaolong613)

915e4c90d28ec4cffc6eb146e208ab5a65eac772: refactor(context): replace hardcoded localhost IPs with constants (#4481) (@pauloappbr)

414de60574449457f3192a7a1d5528940db2836d: refactor(context): using maps.Clone (#4333) (@cuiweixie)

59e9d4a794f12c4f9a6c7bed441b9644e5f6d99b: refactor(ginS): use sync.OnceValue to simplify engine function (#4314) (@1911860538)

3ab698dc5110af1977d57226e4995c57dd34c233: refactor(recovery): smart error comparison (#4142) (@zeek0x)

d1a15347b1e45a8ee816193d3578a93bfd73b70f: refactor(utils): move util functions to utils.go (#4467) (@zeek0x)

e3118cc378d263454098924ebbde7e8d1dd2e904: refactor: for loop can be modernized using range over int (#4392) (@wanghaolong613)

488f8c3ffa579a8d19beb2bae95ff8ef36b3d53f: refactor: replace magic numbers with named constants in bodyAllowedForStatus (#4529) (@veeceey)

9968c4bf9d5a99edc3eee2c068a4c9160ece8915: refactor: use b.Loop() to simplify the code and improve performance (#4389) (@reddaisyy)

a85ef5ce4d0cda8834c59c855068ed48b51192d1: refactor: use b.Loop() to simplify the code and improve performance (#4432) (@efcking)

Build process updates

61b67de522a189b568aced4c5c16917c558e3387: ci(bot): increase frequency and group updates for dependencies (#4367) (@appleboy)

fb27ef26c2fdfe25344b4c039d8a53551f9e912c: ci(lint): refactor test assertions and linter configuration (#4436) (@appleboy)

93ff771e6dbf10e432864b30f3719ac5c84a4d4a: ci(sec): improve type safety and server organization in HTTP middleware (#4437) (@appleboy)

e88fc8927a52b74f55bec0351604a56ac0aa1c51: ci(sec): schedule Trivy security scans to run daily at midnight UTC (#4439) (@appleboy)

5e5ff3ace496a31b138b0820136a146bfb5de0ef: ci: replace vulnerability scanning workflow with Trivy integration (#4421) (@appleboy)

00900fb3e1ea9dde33985a0e4f6afec793d5e786: ci: update CI workflows and standardize Trivy config quotes (#4531) (@appleboy)

ae3f524974fc4f55d18c9e7fae4614503c015226: ci: update Go version support to 1.25+ across CI and docs (#4550) (@appleboy)

... (truncated)

Changelog

Sourced from github.com/gin-gonic/gin's changelog.

Gin v1.12.0

Features

feat(render): add bson protocol (#4145)

feat(context): add GetError and GetErrorSlice methods for error retrieval (#4502)

feat(binding): add support for encoding.UnmarshalText in uri/query binding (#4203)

feat(gin): add option to use escaped path (#4420)

feat(context): add Protocol Buffers support to content negotiation (#4423)

feat(context): implemented Delete method (#38e7651)

feat(logger): color latency (#4146)

Enhancements

perf(tree): reduce allocations in findCaseInsensitivePath (#4417)

perf(recovery): optimize line reading in stack function (#4466)

perf(path): replace regex with custom functions in redirectTrailingSlash (#4414)

perf(tree): optimize path parsing using strings.Count (#4246)

chore(logger): allow skipping query string output (#4547)

chore(context): always trust xff headers from unix socket (#3359)

chore(response): prevent Flush() panic when the underlying ResponseWriter does not implement http.Flusher (#4479)

refactor(recovery): smart error comparison (#4142)

refactor(context): replace hardcoded localhost IPs with constants (#4481)

refactor(utils): move util functions to utils.go (#4467)

refactor(binding): use maps.Copy for cleaner map handling (#4352)

refactor(context): using maps.Clone (#4333)

refactor(ginS): use sync.OnceValue to simplify engine function (#4314)

refactor: replace magic numbers with named constants in bodyAllowedForStatus (#4529)

refactor: for loop can be modernized using range over int (#4392)

Bug Fixes

fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535)

fix(render): write content length in Data.Render (#4206)

fix(context): ClientIP handling for multiple X-Forwarded-For header values (#4472)

fix(binding): empty value error (#2169)

fix(recover): suppress http.ErrAbortHandler in recover (#4336)

fix(gin): literal colon routes not working with engine.Handler() (#4415)

fix(gin): close os.File in RunFd to prevent resource leak (#4422)

fix(response): refine hijack behavior for response lifecycle (#4373)

fix(binding): improve empty slice/array handling in form binding (#4380)

fix(debug): version mismatch (#4403)

fix: correct typos, improve documentation clarity, and remove dead code (#4511)

Build process updates / CI

ci: update Go version support to 1.25+ across CI and docs (#4550)

chore(binding): upgrade bson dependency to mongo-driver v2 (#4549)

Commits

73726dc docs: update documentation to reflect Go version changes (#4552)
e292e5c docs: document and finalize Gin v1.12.0 release (#4551)
ae3f524 ci: update Go version support to 1.25+ across CI and docs (#4550)
38534e2 chore(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#4548)
472d086 fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535)
fb25834 test(context): use http.StatusContinue constant instead of magic number 100 (...
6f1d5fe test(render): add comprehensive error handling tests (#4541)
5c00df8 fix(render): write content length in Data.Render (#4206)
db30908 chore(logger): allow skipping query string output (#4547)
ba093d1 chore(binding): upgrade bson dependency to mongo-driver v2 (#4549)
Additional commits viewable in compare view

Updates github.com/go-sql-driver/mysql from 1.9.2 to 1.10.0

Release notes

Sourced from github.com/go-sql-driver/mysql's releases.

v1.10.0

What's Changed

add Go 1.24 to the test matrix by @shogo82148 in go-sql-driver/mysql#1681

modernize for Go 1.22 by @methane in go-sql-driver/mysql#1695

test stability improvement. by @methane in go-sql-driver/mysql#1698

simplify collation tests by @methane in go-sql-driver/mysql#1700

fix bigint unsigned null column scan to err type int64 by @elonnzhang in go-sql-driver/mysql#1612

Transaction Commit/Rollback returns conn's cached error, if present by @brad-defined in go-sql-driver/mysql#1691

add BenchmarkReceive10kRowsCompress by @methane in go-sql-driver/mysql#1704

optimize readPacket by @methane in go-sql-driver/mysql#1705

MariaDB Metadata skipping and DEPRECATE_EOF by @rusher in go-sql-driver/mysql#1708

Optimization: statements reuse previous column name by @methane in go-sql-driver/mysql#1711

update outdated MySQL internals documentation links by @demouth in go-sql-driver/mysql#1714

fix PING on compressed connections by @methane in go-sql-driver/mysql#1721

add DeepWiki badge by @methane in go-sql-driver/mysql#1722

Update edwards25519 dependency to v1.1.1 by @williamhaw in go-sql-driver/mysql#1749

Configure Dependabot for Go modules by @methane in go-sql-driver/mysql#1755

Bump dominikh/staticcheck-action from 1.3.1 to 1.4.1 by @dependabot[bot] in go-sql-driver/mysql#1759

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in go-sql-driver/mysql#1760

Bump actions/setup-go from 5 to 6 by @dependabot[bot] in go-sql-driver/mysql#1757

fix staticcheck error by @methane in go-sql-driver/mysql#1761

Bump actions/checkout from 4 to 6 by @dependabot[bot] in go-sql-driver/mysql#1758

Fix getSystemVar buffer reuse by @morgo in go-sql-driver/mysql#1754

Consolidate Dependabot update noise by grouping weekly dependency PRs by @Copilot in go-sql-driver/mysql#1762

Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0 by @dependabot[bot] in go-sql-driver/mysql#1756

CI: Update GitHub Actions Go matrix to 1.24–1.26 by @Copilot in go-sql-driver/mysql#1763

Enhance interpolateParams to correctly handle placeholders by @rusher in go-sql-driver/mysql#1732

modernize by @methane in go-sql-driver/mysql#1764

release v1.10.0 by @methane in go-sql-driver/mysql#1765

New Contributors

@elonnzhang made their first contribution in go-sql-driver/mysql#1612

@brad-defined made their first contribution in go-sql-driver/mysql#1691

@rusher made their first contribution in go-sql-driver/mysql#1708

@demouth made their first contribution in go-sql-driver/mysql#1714

@williamhaw made their first contribution in go-sql-driver/mysql#1749

@dependabot[bot] made their first contribution in go-sql-driver/mysql#1759

@morgo made their first contribution in go-sql-driver/mysql#1754

@Copilot made their first contribution in go-sql-driver/mysql#1762

Full Changelog: go-sql-driver/mysql@v1.9.2...v1.10.0

v1.9.3

What's Changed

[1.9] test stability improvement. by @methane in go-sql-driver/mysql#1699

[1.9] Transaction Commit/Rollback returns conn's cached error by @methane in go-sql-driver/mysql#1702

backport benchmark_test by @methane in go-sql-driver/mysql#1706

[1.9] optimize readPacket (#1705) by @methane in go-sql-driver/mysql#1707

[1.9] fix PING on compressed connections by @methane in go-sql-driver/mysql#1723

release v1.9.3 by @methane in go-sql-driver/mysql#1725

... (truncated)

Changelog

Sourced from github.com/go-sql-driver/mysql's changelog.

v1.10.0 (2026-04-28)

Fix getSystemVar("max_allowed_packet") potentially returned wrong value. (#1754) This affects only when maxAllowedPacket=0 is set.

Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0. (#1756) While older versions have reported CVEs, they do not affect go-mysql.

Update Go versions to 1.24-1.26. (#1763)

Enhance interpolateParams to correctly handle placeholders. (#1732) The question mark (?) within strings and comments will no longer be treated as a placeholder.

v1.9.3 (2025-06-13)

tx.Commit() and tx.Rollback() returned ErrInvalidConn always. Now they return cached real error if present. (#1690)

Optimize reading small result sets to fix a performance regression introduced by compression protocol support. ([#1707](https://github.com/go-sql-driver/mysql/issues/1707))

Fix db.Ping() on compressed connection. (#1723)

Commits

a065b60 release v1.10.0 (#1765)
09e4187 modernize (#1764)
6c44a9a Enhance interpolateParams to correctly handle placeholders (#1732)
688ce56 Update supported Go version to 1.24–1.26 (#1763)
118d07f Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0 (#1756)
d6b2d3e Consolidate Dependabot update noise by grouping weekly dependency PRs (#1762)
037dfd8 Fix getSystemVar buffer reuse (#1754)
900f330 Bump actions/checkout from 4 to 6 (#1758)
ab9e380 fix staticcheck error (#1761)
f298c66 Bump actions/setup-go from 5 to 6 (#1757)
Additional commits viewable in compare view

Updates github.com/mattn/go-isatty from 0.0.20 to 0.0.22

Commits

9a68506 Fix isCygwinPipeName to accept Windows 7 trailing suffix (#90)
4237fb1 Update Go test matrix to current versions (1.24-1.26)
433c12b Update GitHub Actions to latest versions
1cf5589 Add wasip1 and wasip2 to build constraints in isatty_others.go
1237245 Update dependencies: go 1.15 -> 1.21, golang.org/x/sys v0.6.0 -> v0.28.0
ac9c88d Fix typo in comment: undocomented -> undocumented
8b7124e Add availability check for NtQueryObject in init
08d0313 Fix isCygwinPipeName to reject names with extra trailing tokens
See full diff in compare view

Updates github.com/prometheus/client_golang from 1.22.0 to 1.23.2

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.23.2 - 2025-09-05

This release is made to upgrade to prometheus/common v0.66.1, which drops the dependencies github.com/grafana/regexp and go.uber.org/atomic and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in replacement). There are no functional changes.

[release-1.23] Upgrade to prometheus/common@v0.66.1 by @aknuds1 in prometheus/client_golang#1869

[release-1.23] Cut v1.23.2 by @aknuds1 in prometheus/client_golang#1870

Full Changelog: prometheus/client_golang@v1.23.1...v1.23.2

v1.23.1 - 2025-09-04

This release is made to be compatible with a backwards incompatible API change in prometheus/common v0.66.0. There are no functional changes.

[release-1.23] Upgrade to prometheus/common v0.66 by @aknuds1 in prometheus/client_golang#1866

[release-1.23] Cut v1.23.1 by @aknuds1 in prometheus/client_golang#1867

Full Changelog: prometheus/client_golang@v1.23.0...v1.23.1

v1.23.0 - 2025-07-30

[CHANGE] Minimum required Go version is now 1.23, only the two latest Go versions are supported from now on. #1812

[FEATURE] Add WrapCollectorWith and WrapCollectorWithPrefix #1766

[FEATURE] Add exemplars for native histograms #1686

[ENHANCEMENT] exp/api: Bubble up status code from writeResponse #1823

[ENHANCEMENT] collector/go: Update runtime metrics for Go v1.23 and v1.24 #1833

[BUGFIX] exp/api: client prompt return on context cancellation #1729

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.23.2 / 2025-09-05

This release is made to upgrade to prometheus/common v0.66.1, which drops the dependencies github.com/grafana/regexp and go.uber.org/atomic and replaces gopkg.in/yaml.v2 with go.yaml.in/yaml/v2 (a drop-in replacement). There are no functional changes.

1.23.1 / 2025-09-04

This release is made to be compatible with a backwards incompatible API change in prometheus/common v0.66.0. There are no functional changes.

1.23.0 / 2025-07-30

[CHANGE] Minimum required Go version is now 1.23, only the two latest Go versions are supported from now on. #1812

[FEATURE] Add WrapCollectorWith and WrapCollectorWithPrefix #1766

[FEATURE] Add exemplars for native histograms #1686

[ENHANCEMENT] exp/api: Bubble up status code from writeResponse #1823

[ENHANCEMENT] collector/go: Update runtime metrics for Go v1.23 and v1.24 #1833

[BUGFIX] exp/api: client prompt return on context cancellation #1729

Commits

8179a56 Cut v1.23.2 (#1870)
4142b59 Merge pull request #1869 from prometheus/arve/upgrade-common
4ff40f0 Cut v1.23.1 (#1867)
989b029 Upgrade to prometheus/common v0.66 (#1866)
e4b2208 Cut v1.23.0 (#1848)
d9492af cut v1.23.0-rc.1 (#1842)
aeae8a0 Cut v1.23.0-rc.0 (#1837)
b157309 Update common Prometheus files (#1832)
a704e28 build(deps): bump the github-actions group with 3 updates (#1826)
c774311 Fix errNotImplemented reference (#1835)
Additional commits viewable in compare view

Updates go.etcd.io/etcd/api/v3 from 3.5.21 to 3.6.11

Release notes

Sourced from go.etcd.io/etcd/api/v3's releases.

v3.6.11

Please check out CHANGELOG for a full list of changes. And make sure to read upgrade guide before upgrading etcd (there may be breaking changes).

For installation guides, please check out play.etcd.io and operating etcd. Latest support status for common architectures and operating systems can be found at supported platforms.

Linux

ETCD_VER=v3.6.11
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
/tmp/etcd-download-test/etcd --version
/tmp/etcd-download-test/etcdctl version
/tmp/etcd-download-test/etcdutl version
start a local etcd server
/tmp/etcd-download-test/etcd
write,read to etcd
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo

macOS (Darwin)

ETCD_VER=v3.6.11
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64
</tr></table>

... (truncated)

Commits

ec166e2 version: bump up to 3.6.11
d671fd0 Merge pull request #21685 from ahrtr/20260429_auth_3.6
633de82 Fix the 'read via PrevKv' and 'Put with lease' in TXN bypass rbac check issue
fbbd0a1 Add an integration test to reproduce the issue of PutWithLease in a TXN bypas...
3fe5746 Add an integration test case to reproduce the read via PrevKv bypass rbac che...
16a8a36 Merge pull request #21681 from ahrtr/20260428_auth_refactor
c387fa5 Get all Put related auth check into a separate function 'checkPutAuth'
20e6f23 move function CheckTxnAuth from package txn to apply
7d4b175 Merge pull request #21667 from ahrtr/20260426_add_member
bc2482b Merge pull request #21668 from ahrtr/20260426_dep_3.6
Additional commits viewable in compare view

Updates go.etcd.io/etcd/client/v3 from 3.5.21 to 3.6.11

Release notes

Sourced from go.etcd.io/etcd/client/v3's releases.

v3.6.11

Please check out CHANGELOG for a full list of changes. And make sure to read upgrade guide before upgrading etcd (there may be breaking changes).

For installation guides, please check out play.etcd.io and operating etcd. Latest support status for common architectures and operating systems can be found at supported platforms.

Linux

ETCD_VER=v3.6.11
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
/tmp/etcd-download-test/etcd --version
/tmp/etcd-download-test/etcdctl version
/tmp/etcd-download-test/etcdutl version
start a local etcd server
/tmp/etcd-download-test/etcd
write,read to etcd
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo

macOS (Darwin)

ETCD_VER=v3.6.11
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64
</tr></table>

... (truncated)

Commits

ec166e2 version: bump up to 3.6.11
d671fd0 Merge pull request #21685 from ahrtr/20260429_auth_3.6
633de82 Fix the 'read via PrevKv' and 'Put with lease' in TXN bypass rbac check issue
fbbd0a1 Add an integration test to reproduce the issue of PutWithLease in a TXN bypas...
3fe5746 Add an integration test case to reproduce the read via PrevKv bypass rbac che...
16a8a36 Merge pull request #21681 from ahrtr/20260428_auth_refactor
c387fa5 Get all Put related auth check into a separate function 'checkPutAuth'
20e6f23 move function CheckTxnAuth from package txn to apply
7d4b175 Merge pull request #21667 from ahrtr/20260426_add_member
bc2482b Merge pull request #21668 from ahrtr/20260426_dep_3.6
Additional commits viewable in compare view

Updates go.etcd.io/etcd/server/v3 from 3.5.21 to 3.6.11

Release notes

Sourced from go.etcd.io/etcd/server/v3's releases.

v3.6.11

Please check out CHANGELOG for a full list of changes. And make sure to read upgrade guide before upgrading etcd (there may be breaking changes).

For installation guides, please check out play.etcd.io and operating etcd. Latest support status for common architectures and operating systems can be found at supported platforms.

Linux

ETCD_VER=v3.6.11
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/etcd-download-test --strip-components=1 --no-same-owner
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
/tmp/etcd-download-test/etcd --version
/tmp/etcd-download-test/etcdctl version
/tmp/etcd-download-test/etcdutl version
start a local etcd server
/tmp/etcd-download-test/etcd
write,read to etcd
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 put foo bar
/tmp/etcd-download-test/etcdctl --endpoints=localhost:2379 get foo

macOS (Darwin)

ETCD_VER=v3.6.11
choose either URL
GOOGLE_URL=https://storage.googleapis.com/etcd
GITHUB_URL=https://github.com/etcd-io/etcd/releases/download
DOWNLOAD_URL=${GOOGLE_URL}
rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
rm -rf /tmp/etcd-download-test && mkdir -p /tmp/etcd-download-test
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-darwin-amd64.zip -o /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
unzip /tmp/etcd-${ETCD_VER}-darwin-amd64.zip -d /tmp && rm -f /tmp/etcd-${ETCD_VER}-darwin-amd64.zip
mv /tmp/etcd-${ETCD_VER}-darwin-amd64/* /tmp/etcd-download-test && rm -rf mv /tmp/etcd-${ETCD_VER}-darwin-amd64
</tr></table>

... (truncated)

Commits

ec166e2 version: bump up to 3.6.11
d671fd0 Merge pull request #21685 from ahrtr/20260429_auth_3.6
633de82 Fix the 'read via PrevKv' and 'Put with lease' in TXN bypass rbac check issue
fbbd0a1 Add an integration test to reproduce the issue of PutWithLease in a TXN bypas...
3fe5746 Add an integration test case to reproduce the read via PrevKv bypass rbac che...
16a8a36 Merge pull request #21681 from ahrtr/20260428_auth_refactor
c387fa5 Get all Put related auth check into a separate function 'checkPutAuth'
20e6f23 move function CheckTxnAuth from package txn to apply
7d4b175 Merge pull request #21667 from ahrtr/20260426_add_member
bc2482b Merge pull request #21668 from ahrtr/20260426_dep_3.6
Additional commits viewable in compare view

Updates go.opentelemetry.io/contrib/propagators/autoprop from 0.63.0 to 0.68.0

Release notes

Sourced from go.opentelemetry.io/contrib/propagators/autoprop's releases.

Release v1.43.0/v2.5.0/v0.68.0/v0.37.0/v0.23.0/v0.18.0/v0.16.0/v0.15.0

Added

Add Resource method to SDK in go.opentelemetry.io/contrib/otelconf/v0.3.0 to expose the resolved SDK resource from declarative configuration. (#8660)

Add support to set the configuration file via OTEL_CONFIG_FILE in go.opentelemetry.io/contrib/otelconf. (#8639)

Add support for service resource detector in go.opentelemetry.io/contrib/otelconf. (#8674)

Add support for attribute_count_limit and attribute_value_length_limit in tracer provider configuration in go.opentelemetry.io/contrib/otelconf. (#8687)

Add support for attribute_count_limit and attribute_value_length_limit in logger provider configuration in go.opentelemetry.io/contrib/otelconf. (#8686)

Add support for server.address and server.port attributes in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grp... Description has been truncated

Bumps the security-updates group with 18 updates: | Package | From | To | | --- | --- | --- | | [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml) | `1.5.0` | `1.6.0` | | [github.com/gin-gonic/gin](https://github.com/gin-gonic/gin) | `1.11.0` | `1.12.0` | | [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.9.2` | `1.10.0` | | [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) | `0.0.20` | `0.0.22` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.22.0` | `1.23.2` | | [go.etcd.io/etcd/api/v3](https://github.com/etcd-io/etcd) | `3.5.21` | `3.6.11` | | [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.5.21` | `3.6.11` | | [go.etcd.io/etcd/server/v3](https://github.com/etcd-io/etcd) | `3.5.21` | `3.6.11` | | [go.opentelemetry.io/contrib/propagators/autoprop](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.63.0` | `0.68.0` | | [go.opentelemetry.io/otel/bridge/opentracing](https://github.com/open-telemetry/opentelemetry-go) | `1.36.0` | `1.43.0` | | [go.opentelemetry.io/otel/exporters/jaeger](https://github.com/open-telemetry/opentelemetry-go) | `1.16.0` | `1.17.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.38.0` | `1.43.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.38.0` | `1.43.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `1.36.0` | `1.43.0` | | [go.uber.org/zap](https://github.com/uber-go/zap) | `1.27.0` | `1.28.0` | | [golang.org/x/sys](https://github.com/golang/sys) | `0.42.0` | `0.45.0` | | [gorm.io/gorm](https://github.com/go-gorm/gorm) | `1.30.0` | `1.31.1` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.34.1` | `0.36.1` | Updates `github.com/BurntSushi/toml` from 1.5.0 to 1.6.0 - [Release notes](https://github.com/BurntSushi/toml/releases) - [Commits](BurntSushi/toml@v1.5.0...v1.6.0) Updates `github.com/gin-gonic/gin` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/gin-gonic/gin/releases) - [Changelog](https://github.com/gin-gonic/gin/blob/master/CHANGELOG.md) - [Commits](gin-gonic/gin@v1.11.0...v1.12.0) Updates `github.com/go-sql-driver/mysql` from 1.9.2 to 1.10.0 - [Release notes](https://github.com/go-sql-driver/mysql/releases) - [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md) - [Commits](go-sql-driver/mysql@v1.9.2...v1.10.0) Updates `github.com/mattn/go-isatty` from 0.0.20 to 0.0.22 - [Commits](mattn/go-isatty@v0.0.20...v0.0.22) Updates `github.com/prometheus/client_golang` from 1.22.0 to 1.23.2 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.22.0...v1.23.2) Updates `go.etcd.io/etcd/api/v3` from 3.5.21 to 3.6.11 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.5.21...v3.6.11) Updates `go.etcd.io/etcd/client/v3` from 3.5.21 to 3.6.11 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.5.21...v3.6.11) Updates `go.etcd.io/etcd/server/v3` from 3.5.21 to 3.6.11 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.5.21...v3.6.11) Updates `go.opentelemetry.io/contrib/propagators/autoprop` from 0.63.0 to 0.68.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.63.0...zpages/v0.68.0) Updates `go.opentelemetry.io/otel/bridge/opentracing` from 1.36.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.43.0) Updates `go.opentelemetry.io/otel/exporters/jaeger` from 1.16.0 to 1.17.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.16.0...v1.17.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.38.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.43.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.38.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.43.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.36.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.43.0) Updates `go.uber.org/zap` from 1.27.0 to 1.28.0 - [Release notes](https://github.com/uber-go/zap/releases) - [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md) - [Commits](uber-go/zap@v1.27.0...v1.28.0) Updates `golang.org/x/sys` from 0.42.0 to 0.45.0 - [Commits](golang/sys@v0.42.0...v0.45.0) Updates `gorm.io/gorm` from 1.30.0 to 1.31.1 - [Release notes](https://github.com/go-gorm/gorm/releases) - [Commits](go-gorm/gorm@v1.30.0...v1.31.1) Updates `k8s.io/client-go` from 0.34.1 to 0.36.1 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.34.1...v0.36.1) --- updated-dependencies: - dependency-name: github.com/BurntSushi/toml dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: github.com/gin-gonic/gin dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: github.com/go-sql-driver/mysql dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: github.com/mattn/go-isatty dependency-version: 0.0.22 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: security-updates - dependency-name: github.com/prometheus/client_golang dependency-version: 1.23.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.etcd.io/etcd/api/v3 dependency-version: 3.6.11 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.etcd.io/etcd/client/v3 dependency-version: 3.6.11 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.etcd.io/etcd/server/v3 dependency-version: 3.6.11 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/contrib/propagators/autoprop dependency-version: 0.68.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/bridge/opentracing dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/exporters/jaeger dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.uber.org/zap dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: golang.org/x/sys dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: gorm.io/gorm dependency-version: 1.31.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: k8s.io/client-go dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates ... Signed-off-by: dependabot[bot] <support@github.com>

sonarqubecloud · 2026-05-22T10:10:44Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

CLAassistant · 2026-05-22T10:11:13Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

codacy-production · 2026-05-22T10:12:29Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels May 22, 2026

pull-request-size Bot added the size/L size/L label May 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the security-updates group with 18 updates#153

chore(deps): bump the security-updates group with 18 updates#153
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/main/security-updates-d70b63d723

dependabot Bot commented on behalf of github May 22, 2026

Uh oh!

sonarqubecloud Bot commented May 22, 2026

Uh oh!

CLAassistant commented May 22, 2026

Uh oh!

codacy-production Bot commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github May 22, 2026

v1.6.0

v1.12.0

Changelog

Features

Bug fixes

Enhancements

Refactor

Build process updates

Gin v1.12.0

Features

Enhancements

Bug Fixes

Build process updates / CI

v1.10.0

What's Changed

New Contributors

v1.9.3

What's Changed

v1.10.0 (2026-04-28)

v1.9.3 (2025-06-13)

v1.23.2 - 2025-09-05

v1.23.1 - 2025-09-04

v1.23.0 - 2025-07-30

1.23.2 / 2025-09-05

1.23.1 / 2025-09-04

1.23.0 / 2025-07-30

v3.6.11

Linux

macOS (Darwin)

v3.6.11

Linux

macOS (Darwin)

v3.6.11

Linux

macOS (Darwin)

Release v1.43.0/v2.5.0/v0.68.0/v0.37.0/v0.23.0/v0.18.0/v0.16.0/v0.15.0

Added

Uh oh!

sonarqubecloud Bot commented May 22, 2026

Quality Gate passed

Uh oh!

CLAassistant commented May 22, 2026

Uh oh!

codacy-production Bot commented May 22, 2026

Up to standards ✅

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant