Bump the go-modules-updates group with 7 updates

[dependabot]

Bumps the go-modules-updates group with 7 updates:

Package	From	To
github.com/PuerkitoBio/goquery	1.12.0	1.13.0
github.com/go-pkgz/lgr	0.12.3	0.12.4
github.com/go-pkgz/rest	1.23.1	1.24.0
github.com/go-pkgz/routegroup	1.6.0	1.6.1
github.com/stretchr/testify	1.11.1	1.12.0
go.mongodb.org/mongo-driver/v2	2.8.0	2.8.2
golang.org/x/net	0.57.0	0.58.0

Updates github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0

Release notes

Sourced from github.com/PuerkitoBio/goquery's releases.

v1.13.0

Performance improvements and new top-level goquery.Text function to extract text from a selection with more control than the sel.Text jquery-like method.

Commits

• 4a4f132 Linkify github usernames
• e47f384 Add new version to readme to prepare 1.13 release
• 80a9b7f Run CI on go1.27 (+1.26)
• ad18e5a Merge pull request #596 from ChrisJr404/text-toplevel-func
• 4e49d09 add tests for empty and fully-filtered selections
• 91ed06d Add top-level Text function for BeautifulSoup-style text extraction
• 105f399 Merge pull request #595 from PuerkitoBio/dependabot/go_modules/golang.org/x/n...
• d329e29 build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0
• 53a9b37 Merge pull request #586 from jvoisin/cachephwc
• 50e9856 Merge pull request #593 from PuerkitoBio/dependabot/go_modules/golang.org/x/n...
• Additional commits viewable in compare view

Updates github.com/go-pkgz/lgr from 0.12.3 to 0.12.4

Release notes

Sourced from github.com/go-pkgz/lgr's releases.

v0.12.4

Secrets registered with lgr.Secret() were redacted only in the formatted output line. With a SlogHandler set, the raw message reached the handler unredacted, so secrets appeared in JSON slog output. The message is now redacted before the handler sees it.

Commits

• ca2aefa Fix secret redaction bypassed by SlogHandler (#31)
• See full diff in compare view

Updates github.com/go-pkgz/rest from 1.23.1 to 1.24.0

Release notes

Sourced from github.com/go-pkgz/rest's releases.

Version 1.24.0

Breaking change for one configuration. CORS now panics at construction when credentials are enabled and * is among the allowed origins, which is the default origin list. That combination reflects whatever origin the request carries and sends Access-Control-Allow-Credentials: true with it, so any site a signed-in user visits can read authenticated responses. Enumerate the origins, or opt in explicitly with the new CorsUnsafeAnyOriginWithCredentials if the service is meant to be embedded on arbitrary third-party origins.

Gzip now decides on the response content type rather than the request one. The request Content-Type is empty on a GET, so compression previously almost never happened. Responses that were never compressed will start being compressed. Accept-Encoding is parsed rather than substring-matched, a named gzip entry outranks *, and q=0 is honoured as a refusal. Responses with no body, already-encoded bodies and partial content are left alone, and Flush and Hijack are advertised only when the writer underneath has them.

Other fixes:

• CacheControl parsed If-None-Match with a substring match, so an etag could match a longer one. It is now parsed as a tag list, answered only for GET and HEAD, and yields to If-Match and If-Unmodified-Since.
• Recoverer re-panics http.ErrAbortHandler, which net/http needs to abort the response.
• EncodeJSON encodes into a buffer before writing the status, so an encoding failure leaves the response uncommitted.
• BlackWords refuses a request whose body cannot be read instead of passing a partly consumed one through.
• The file server closes handles opened while probing directories.
• Benchmark timings are measured on the injectable clock, which removes a flaky test.

Version 1.23.2

Improvements

• test all packages on a go 1.24 + stable matrix 5420ae9
• make coveralls reporting non-blocking b8de942

Bug Fixes

• Fix exact IP matching in OnlyFrom #48 @​umputun

Commits

• 153b694 fix: order the gzip hijack error path so failures cannot corrupt the body (#56)
• fdfb4d1 fix: send the 101 status line before the connection is handed over
• 24bb874 fix: advertise Flusher and Hijacker only when the writer beneath does
• 5297d5a fix: measure request duration on the injectable clock
• 7e0b665 Negotiate gzip on the response content type (#51)
• 896d9aa Reject wildcard CORS origin when credentials are enabled (#52)
• 664e700 Fix verified findings in middlewares and helpers (#49)
• 5de8db4 Handle If-None-Match correctly in CacheControl (#50)
• 5420ae9 ci: test all packages on a go 1.24 + stable matrix
• b8de942 ci: make coveralls reporting non-blocking
• Additional commits viewable in compare view

Updates github.com/go-pkgz/routegroup from 1.6.0 to 1.6.1

Release notes

Sourced from github.com/go-pkgz/routegroup's releases.

Version 1.6.1

What's Changed

Bug Fixes

• Preserve http.ServeMux routing with a custom not-found handler by @​umputun in #32
• Fix CI workflow ordering so checkout precedes setup-go by @​paskal in #30

Details

v1.5.3 stopped a custom NotFoundHandler from overriding 405 responses. It turns out http.ServeMux reports an empty pattern for three outcomes, not two, and the third one was still being swallowed:

• A path needing cleanup, such as /a/../x or //x, now gets the standard library's redirect instead of the custom 404. Previously the redirect was replaced, so the 405 or handler waiting at the cleaned path was never reached.
• The probe used to detect a true 404 could execute a real route handler. A root middleware that rewrites the request left the entry pattern stale, and the probe then ran the matching handler against a throwaway recorder: the write went through, its response was discarded, and the client received the custom 404. A trailing-slash stripper in front of a POST route was enough to trigger it.
• The probe no longer disturbs the request. A Bundle mounted under an outer mux as outer.Handle("/app/{rest...}", bundle) now sees r.PathValue("rest") intact inside its custom handler, where it was previously cleared.

Implementation

The probe now runs the handler that the route lookup already returned rather than re-entering the mux, so it can only reach one of ServeMux's own synthetic handlers. The route is resolved again inside the wrapped handler, and a request that matches after a middleware rewrite goes straight to the mux.

The extra lookup happens only when no route matched on entry and a NotFoundHandler is configured. Benchmarked against v1.6.0 with 20 routes registered, a matched request with three root middlewares is unchanged at roughly 290 ns and the same allocation count, both serially and at 16-way parallelism.

Improvements

• Update CI actions and the golangci-lint version by @​umputun in #31

Full Changelog: go-pkgz/routegroup@v1.6.0...v1.6.1

Commits

• a2b8c04 fix: preserve ServeMux routing with custom not-found handler (#32)
• 165757a chore: update CI actions and golangci-lint version
• 3ab4ae1 Fix CI workflow: checkout before setup-go for proper caching (#30)
• See full diff in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.0

What's Changed

Functional Changes

• assert: make *AssertionFunc types just aliases by @​dolmen in stretchr/testify#1563

Fixes

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in stretchr/testify#1775
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in stretchr/testify#1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in stretchr/testify#1665
• assert.PanicsWithError: report error message by @​olivergondza in stretchr/testify#1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in stretchr/testify#1787
• add type to error message of assert.Same by @​egawata in stretchr/testify#1792
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in stretchr/testify#1795
• assert: truncate very long objects in test failure messages by @​brackendawson in stretchr/testify#1646
• assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @​nghiack7 in stretchr/testify#1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

• CI: test also with Go 1.23 by @​dolmen in stretchr/testify#1783
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in stretchr/testify#1708
• Promote ccoVeille to maintainer by @​brackendawson in stretchr/testify#1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in stretchr/testify#1790
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in stretchr/testify#1791
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in stretchr/testify#1782
• doc: remove ineffective inline code blocks by @​brackendawson in stretchr/testify#1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in stretchr/testify#1815
• chore: vendor go-spew from https://github.com/davecgh/go-spew by @​ccoVeille in stretchr/testify#1827
• require: fix godoc generation for assertions returning a bool by @​Baxromumarov in stretchr/testify#1850
• docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by @​a2not in stretchr/testify#1821
• docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by @​a2not in stretchr/testify#1842
• EMERITUS.md: add @​tylerb by @​dolmen in stretchr/testify#1812
• CI: test also with Go 1.24 by @​alexandear in stretchr/testify#1856
• deps: bump objx to v0.5.3 and remove dependency cycle issue by @​ccoVeille in stretchr/testify#1823
• CI: upgrade GitHub Actions and pin hashes by @​SuperQ in stretchr/testify#1883
• CI: add _readme-gofmt tool to reformat Go code in README by @​dolmen in stretchr/testify#1889
• CI: add check of GitHub Action pinned hashes against tag by @​dolmen in stretchr/testify#1885
• _codegen: modernize by @​dolmen in stretchr/testify#1890
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in stretchr/testify#1906
• mock: Mock.Return does not exist anymore by @​Kentzo in stretchr/testify#1905

New Contributors

• @​mutaiib made their first contribution in stretchr/testify#1775
• @​vyas-git made their first contribution in stretchr/testify#1665
• @​olivergondza made their first contribution in stretchr/testify#1400
• @​egawata made their first contribution in stretchr/testify#1792
• @​ubunatic made their first contribution in stretchr/testify#1815
• @​Baxromumarov made their first contribution in stretchr/testify#1850
• @​a2not made their first contribution in stretchr/testify#1821

... (truncated)

Commits

• 001eb79 Merge pull request #1905 from Kentzo/patch-1
• ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
• 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
• f8c01f3 mock: Mock.Return does not exist anymore
• 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
• a11649e assert: make *AssertionFunc type just aliases
• dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
• 098f8d7 _codegen: use strings.Builder
• d2699be _codegen: modernize
• a463c8c Merge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashes
• Additional commits viewable in compare view

Updates go.mongodb.org/mongo-driver/v2 from 2.8.0 to 2.8.2

Release notes

Sourced from go.mongodb.org/mongo-driver/v2's releases.

MongoDB Go Driver 2.8.2

The MongoDB Go Driver Team is pleased to release version 2.8.2 of the official MongoDB Go Driver.

Release Highlights

[!WARNING] Driver versions v2.1.0 through v2.8.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite that is fixed in this release (v2.8.2). Users are encouraged to upgrade to this version as soon as possible.

This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.

It also fixes a bug in Collection.BulkWrite where, for unordered bulk writes split across multiple batches, a write-concern error from an earlier batch could be non-deterministically silently dropped or replaced by subsequent batches. Now the operation will return the last non-nil writeConcern error, if one occured.

What's Changed

🐛 Fixed

• GODRIVER-4025 fix: Preserve the last non-nil WriteConcernError across bulk write batches by @​zigzagdev in mongodb/mongo-go-driver#2555
• GODRIVER-4075 Return an error if there are invalid characters in the database name for bulkWrite. by @​matthewdale

Full Changelog: mongodb/mongo-go-driver@v2.8.1...v2.8.2

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 2.8.1

The MongoDB Go Driver Team is pleased to release version 2.8.1 of the official MongoDB Go Driver.

Release Highlights

This release fixes a bug where failed writes could look like they succeeded. If a write operation's first attempt failed with a NoWritesPerformed error label, the driver could return a nil/ErrNoDocuments result instead of the real failure, and the caller would end up decoding the server's error document as if it were a normal result. The bug has been fixed so the driver now surfaces the real server error, letting applications detect and retry the failure correctly.

What's Changed

🐛 Fixed

• GODRIVER-4088 Return the server error when the first attempt fails with NoWritesPerformed. by @​qingyang-hu in mongodb/mongo-go-driver#2549

Full Changelog: mongodb/mongo-go-driver@v2.8.0...v2.8.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

Commits

• 1af6d00 BUMP v2.8.2
• 2ccb9c0 Merge commit from fork
• 0c032cb GODRIVER-4075 Return an error if there are invalid characters in the database...
• faeba4a GODRIVER-4025 cherry-pick: Preserve the last non-nil WriteConcernError across...
• 847433b BUMP v2.8.1
• 1d6850a GODRIVER-4088 Return the server error when the first attempt fails with NoWri...
• 6948126 GODRIVER-4064 Skip tests that fail due to SERVER-128517 (#2525)
• 994762e GODRIVER-4026 [release/2.8] Use cmake<4.4 for libmongocrypt build. (#2487)
• See full diff in compare view

Updates golang.org/x/net from 0.57.0 to 0.58.0

Commits

• acc78e0 go.mod: update golang.org/x dependencies
• 90d10f0 internal/http3: delete invalid Content-Length if declared in server handler
• 08abf4d internal/http3: infer headers when Content-Encoding is set but is empty
• 8d10596 http2: avoid deadlocks in wrapped ClientConn state callback
• 99c3b0a http2/hpack: build the table lookup maps lazily, only for encoders
• 5a920b1 http3: rework registration to allow using a fake network
• 7fd2842 quic: return an error from Accept after PacketConn reader exits
• 825111d quic: avoid busy-loop when keep-alive is blocked by congestion control
• a02ddfa http/httpproxy: prioritize lowercase proxy environment variables
• 574e5eb quic: halt conn goroutines on close when listener exits early
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions