Skip to content

Bump the all group across 1 directory with 4 updates - #337

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/all-8649bd7442
Open

Bump the all group across 1 directory with 4 updates#337
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/all-8649bd7442

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the all group with 4 updates in the / directory: go.step.sm/crypto, golang.org/x/net, google.golang.org/genproto/googleapis/rpc and google.golang.org/grpc.

Updates go.step.sm/crypto from 0.89.0 to 0.91.0

Release notes

Sourced from go.step.sm/crypto's releases.

Release v0.91.0

What's Changed

Dependencies

Full Changelog: smallstep/crypto@v0.90.0...v0.91.0

Release v0.90.0

What's Changed

Dependencies

Full Changelog: smallstep/crypto@v0.89.0...v0.90.0

Release v0.90.0-rc2

No release notes provided.

Release v0.90.0-rc1

No release notes provided.

Commits
  • 622be32 Merge pull request #1134 from smallstep/herman/mackms-label-or-hash
  • 9ec7bfe Add support for creating signers without a label on MacKMS
  • 7263a69 Merge pull request #1126 from smallstep/dependabot/go_modules/google.golang.o...
  • f5b6cf9 chore(deps): Bump google.golang.org/api from 0.293.0 to 0.297.0
  • 5a689a1 Merge pull request #1125 from smallstep/dependabot/go_modules/github.com/goog...
  • eefedcf Merge pull request #1128 from smallstep/dependabot/go_modules/modernc.org/sql...
  • f387e37 Merge pull request #1132 from smallstep/dependabot/go_modules/github.com/aws/...
  • 5e735d5 chore(deps): Bump github.com/aws/aws-sdk-go-v2/config
  • 4f5b695 Merge pull request #1133 from smallstep/dependabot/go_modules/github.com/aws/...
  • 67e9851 chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.58.0 to 0.59.0

Commits
  • 540d04c go.mod: update golang.org/x dependencies
  • 20eef7f quic: clear fast-path receive buffer on stream reset
  • c23af1b internal/http3: fix compilation error due to missed symbol name update
  • eda109f internal/http3: send appropriate error codes in STOP_SENDING frames
  • 12e0501 internal/http3: server header size limits
  • d89285e quic: add Stream.StopSending, and rework stream/application errors
  • d34deae quic: ensure Endpoint.Close waits for connection loops to exit
  • 55577aa http2: use IDNA Lookup profile, not raw Punycode translation
  • b22627e internal/http3: handle a nil TLSConfig in newQUICConfig
  • 6e98b0d internal/http3: report endpoint creation errors from initEndpoint
  • Additional commits viewable in compare view

Updates google.golang.org/genproto/googleapis/rpc from 0.0.0-20260803160001-6ac0973c030d to 0.0.0-20260819154853-08b0e4226688

Commits

Updates google.golang.org/grpc from 1.83.2 to 1.84.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.84.0

Behavior Changes

  • stats/otel: The grpc.lb.pick_first.* metrics have been removed and replaced with grpc.subchannel.* metrics. See gRFC A94 for more details. (#9215)

New Features

  • xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

  • client: Fix a bug where a ClientConn could get permanently stuck in IDLE when an RPC was canceled during stream creation. Previously, such cancellations triggered stream cleanup twice, corrupting the channel's idleness state and causing subsequent RPCs to fail with deadline exceeded errors. (#9191)
  • client: Fix a bug where non-gRPC HTTP responses ending with an empty DATA frame failed the RPC with status code Internal instead of preserving the HTTP-mapped status code and response body. (#9217)
  • credentials: Validate metadata returned by per-RPC credentials, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from credentials was sent to the server in outgoing HTTP/2 requests. (#9202)
  • credentials/sts: Prevent potential token leakage by disallowing HTTP redirects during STS token exchange. Previously, 3xx redirects were followed automatically, replaying the request body containing authentication tokens to the redirect destination. (#9299)
  • randomsubsetting: Ignore endpoints that contain no addresses. Previously, this could cause the policy to panic while computing hashes. (#9259)
  • stats/otel: Ensure method names are populated in trace spans when metrics are disabled. Previously, running with tracing enabled and metrics disabled resulted in server trace spans lacking the RPC method name (recording only "Recv."). (#9262)
  • transport: Return io.ErrUnexpectedEOF when EOF is encountered after partial header or message body reads. Previously, partial reads could return a plain io.EOF, failing to distinguish truncated data from a clean end of stream. (#9204)
  • transport: Validate metadata supplied by balancers (in PickResult.Metadata) and resolver addresses, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from these sources was sent to the server in outgoing HTTP/2 requests. (#9203)
  • xds: Fix a rare corner case that could prevent a cluster from being removed when it is no longer in use. (#9140)
  • xds: Fix panic during route matching for routes containing header matchers with empty exact_match strings. (#9223)
  • xds: Reject routes containing header matchers with empty prefix_match or suffix_match strings. Previously, this caused a panic during route matching. (#9223)
  • xds: Fix EDS drop policies being applied at a much lower rate than configured due to an integer overflow. (#9257)
  • xds: Reject EDS resources containing drop policies with unsupported denominators. Previously, such resources caused the client to panic when calculating drop rates. (#9218)
  • xds/rbac: Reject RBAC configurations containing nested Principal or Permission rules with :scheme or grpc- prefixed header matchers. Previously, such configurations could cause DENY policies to fail open. (#9258)
  • xds/rbac: Rewrite host header matchers to :authority in nested Principal and Permission rules. Previously, this rewrite only applied to top-level rules, causing nested host matchers to never match incoming requests and DENY policies to fail open. (#9258)
  • xds/rbac: Reject CidrRanges with an unset prefix length. Previously, an omitted prefix_len field caused a panic during RBAC configuration parsing. (#9250)

Performance Improvements

  • transport: Avoid a heap allocation when flushing shared write buffers. (#9233)
  • credentials/alts: Support dynamic frame size negotiation and add the GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE environment variable (default 4KiB, max 512KiB) to configure the maximum ALTS record frame size. (#9268)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the all group across 1 directory with 4 updates
e2adb2e 
Bumps the all group with 4 updates in the / directory: [go.step.sm/crypto](https://github.com/smallstep/crypto), [golang.org/x/net](https://github.com/golang/net), [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) and [google.golang.org/grpc](https://github.com/grpc/grpc-go).


Updates `go.step.sm/crypto` from 0.89.0 to 0.91.0
- [Release notes](https://github.com/smallstep/crypto/releases)
- [Commits](smallstep/crypto@v0.89.0...v0.91.0)

Updates `golang.org/x/net` from 0.58.0 to 0.59.0
- [Commits](golang/net@v0.58.0...v0.59.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260803160001-6ac0973c030d to 0.0.0-20260819154853-08b0e4226688
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `google.golang.org/grpc` from 1.83.2 to 1.84.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.83.2...v1.84.0)

---
updated-dependencies:
- dependency-name: go.step.sm/crypto
  dependency-version: 0.91.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: golang.org/x/net
  dependency-version: 0.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-version: 0.0.0-20260819154853-08b0e4226688
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: google.golang.org/grpc
  dependency-version: 1.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 22, 2026
@dependabot
dependabot Bot requested review from a team and maraino as code owners September 22, 2026 15:43
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 22, 2026
@github-actions github-actions Bot added the needs triage Waiting for discussion / prioritization by team label Sep 22, 2026
@github-actions
github-actions Bot enabled auto-merge September 22, 2026 15:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@maraino maraino Awaiting requested review from maraino maraino is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code needs triage Waiting for discussion / prioritization by team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@step-ci