chore(deps): Bump the "all-dependencies" group with 3 updates across multiple ecosystems by dependabot[bot] · Pull Request #2 · Quad4-Software/Quad4-ID

dependabot · 2026-10-30T17:11:31Z

Bumps the all-dependencies group with 3 updates in the / directory: docker/login-action, voidzero-dev/setup-vp and taiki-e/install-action.

Updates docker/login-action from 4.6.0 to 4.7.0

Release notes

Sourced from docker/login-action's releases.

v4.7.0

Preserve explicit ECR settings in registry-auth by @crazy-max in docker/login-action#1089

Use registry hosts for scoped credentials by @crazy-max in docker/login-action#1088

Raise Docker Hub OIDC max expiry to 6 hours by @crazy-max in docker/login-action#1068

Log Docker Hub OIDC token exchange progress by @crazy-max in docker/login-action#1061

Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1154.0 in docker/login-action#1093

Bump @docker/actions-toolkit from 0.94.0 to 0.107.0 in docker/login-action#1100

Bump @humanfs/node from 0.16.7 to 0.16.8 in docker/login-action#1077

Bump csv-parse from 7.0.1 to 7.0.3 in docker/login-action#1078

Bump handlebars from 4.7.9 to 4.7.10 in docker/login-action#1091

Bump js-yaml from 5.2.2 to 5.5.0 in docker/login-action#1066

Bump postcss from 8.5.22 to 8.5.26 in docker/login-action#1071

Bump postcss-selector-parser from 7.1.1 to 7.1.6 in docker/login-action#1092

Bump source-map-js from 1.2.1 to 1.2.2 in docker/login-action#1090

Bump undici from 6.27.0 to 6.29.1 in docker/login-action#1085

Bump uuid from 14.0.1 to 14.0.3 in docker/login-action#1096

Full Changelog: docker/login-action@v4.6.0...v4.7.0

Commits

81c6f93 Merge pull request #1100 from docker/dependabot/npm_and_yarn/docker/actions-t...
1b16c8d Merge pull request #1096 from docker/dependabot/npm_and_yarn/uuid-14.0.3
ac86b5e [dependabot skip] chore: update generated content
1476d84 build(deps): bump @docker/actions-toolkit from 0.94.0 to 0.107.0
503cee6 Merge pull request #1095 from docker/dependabot/github_actions/actions/create...
f093535 Merge pull request #1099 from docker/dependabot/github_actions/codecov/codeco...
d5ae7f1 Merge pull request #1098 from docker/dependabot/github_actions/docker/bake-ac...
6f97507 Merge pull request #1097 from docker/dependabot/github_actions/docker/bake-ac...
006d61f Merge pull request #1094 from docker/dependabot/github_actions/codeql-actions...
93f5f52 Merge pull request #1093 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
Additional commits viewable in compare view

Updates voidzero-dev/setup-vp from 1.21.2 to 1.22.0

Release notes

Sourced from voidzero-dev/setup-vp's releases.

v1.22.0

This release adds optional toolchain caching in GitHub Actions. Set cache-toolchain: true with exact Vite+ and Node.js versions to cache the CLI, managed Node.js runtime, and selected package manager. Valid cache restores can use native setup to avoid a shell installer download. cache-save: false disables uploads for these caches.

All three integrations now report the resolved Node.js version, package manager name, and package manager version. Setup also selects the project Node.js version before installation. Compatible installers can reuse that runtime and avoid a second Node.js download.

This release also updates dependencies and adds GitHub Actions security checks and pull request code audits.

What's Changed

docs: require GitLab E2E before merging release PRs by @fengmk2 in voidzero-dev/setup-vp#196

chore(deps): update github actions by @renovate[bot] in voidzero-dev/setup-vp#197

feat: add Node.js and package manager version outputs by @everton-dgn in voidzero-dev/setup-vp#199

chore(deps): update vite-plus to v1.2.0 by @renovate[bot] in voidzero-dev/setup-vp#200

chore(deps): update vite-plus to v1.3.0 by @renovate[bot] in voidzero-dev/setup-vp#201

ci: add Fallow pull request audits by @fengmk2 in voidzero-dev/setup-vp#203

chore(lint): enable e18e rules by @fengmk2 in voidzero-dev/setup-vp#205

ci: enable zizmor and replace privileged workflow triggers by @fengmk2 in voidzero-dev/setup-vp#204

perf: select project Node before installation by @fengmk2 in voidzero-dev/setup-vp#202

feat: cache the Vite+ toolchain in GitHub Actions by @fengmk2 in voidzero-dev/setup-vp#207

chore(deps): update dependency zod to v4.6.7 by @renovate[bot] in voidzero-dev/setup-vp#206

perf: cache package managers and use native toolchain setup by @fengmk2 in voidzero-dev/setup-vp#209

New Contributors

@everton-dgn made their first contribution in voidzero-dev/setup-vp#199

Full Changelog: voidzero-dev/setup-vp@v1.21.2...v1.22.0

Commits

cab1ab9 chore: release v1.22.0 (#210)
6eb3ef7 perf: cache package managers and use native toolchain setup (#209)
c025a93 chore(deps): update dependency zod to v4.6.7 (#206)
03bf428 feat: cache the Vite+ toolchain in GitHub Actions (#207)
e2e70bd perf: select project Node before installation (#202)
d5055d9 ci: enable zizmor and replace privileged workflow triggers (#204)
09d608a chore(lint): enable e18e rules (#205)
c7445d9 ci: add Fallow pull request audits (#203)
ad00cb8 chore(deps): update vite-plus to v1.3.0 (#201)
6a60d12 chore(deps): update vite-plus to v1.2.0 (#200)
Additional commits viewable in compare view

Updates taiki-e/install-action from 2.87.29 to 2.87.31

Release notes

Sourced from taiki-e/install-action's releases.

2.87.31

Downgrade cargo-sort@latest to 2.1.3.

Update vacuum@latest to 0.35.0.

Update xh@latest to 0.26.3.

Update uv@latest to 0.13.5.

Update ubi@latest to 0.13.0.

Update trivy@latest to 0.76.1.

Update tombi@latest to 1.9.0.

Update release-plz@latest to 0.3.174.

Update prek@latest to 0.5.7.

Update mise@latest to 2026.10.17.

Update jaq@latest to 3.1.2.

Update espup@latest to 0.17.1.

Update cargo-zigbuild@latest to 0.24.0.

Update cargo-nextest@latest to 0.9.149.

Update biome@latest to 2.6.2.

2.87.30

Update zizmor@latest to 1.31.1.

Update wasmtime@latest to 50.0.0.

Update vacuum@latest to 0.33.2.

Update uv@latest to 0.13.4.

Update trunk@latest to 0.22.0.

Update tombi@latest to 1.8.9.

Update syft@latest to 1.55.0.

Update release-plz@latest to 0.3.173.

Update prek@latest to 0.5.6.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.88.0] - 2026-10-28

Support similarity-rs. (#2017, thanks @HardMax71)

[2.87.33] - 2026-10-28

Update vacuum@latest to 0.35.4.

Update uv@latest to 0.13.6.

Update trunk@latest to 0.22.1.

Update tombi@latest to 1.9.6.

Update release-plz@latest to 0.4.2.

Update mise@latest to 2026.10.21.

Update cargo-nextest@latest to 0.9.150.

Update cargo-about@latest to 0.9.3.

[2.87.32] - 2026-10-26

Update wild@latest to 0.11.0.

Update vacuum@latest to 0.35.2.

Update tombi@latest to 1.9.5.

Update sccache@latest to 0.19.0.

Update release-plz@latest to 0.4.1.

Update mise@latest to 2026.10.19.

Update knope@latest to 0.23.2.

... (truncated)

Commits

1e29709 Release 2.87.31
30fbbdf Update cargo-sort@latest to 2.1.3
bce00a3 Update vacuum@latest to 0.35.0
dce055e Update tombi manifest
28b8d62 Update release-plz manifest
44d13e3 Update mise manifest
510b77d Update xh@latest to 0.26.3
601130d Update vacuum manifest
8e70b88 Update uv@latest to 0.13.5
9092880 Update ubi@latest to 0.13.0
Additional commits viewable in compare view

Bumps the all-dependencies group with 12 updates in the /backend directory:

Package	From	To
github.com/aws/aws-sdk-go-v2	`1.47.3`	`1.47.4`
github.com/aws/aws-sdk-go-v2/config	`1.33.9`	`1.33.10`
github.com/aws/aws-sdk-go-v2/credentials	`1.20.9`	`1.20.10`
github.com/aws/aws-sdk-go-v2/service/s3	`1.114.3`	`1.114.5`
github.com/aws/smithy-go	`1.28.5`	`1.28.6`
github.com/italypaleale/francis	`0.1.1`	`0.1.2`
github.com/italypaleale/go-kit	`1.5.1`	`1.6.0`
github.com/italypaleale/go-sql-utils	`0.3.11`	`0.3.12`
github.com/lestrrat-go/jwx/v4	`4.5.0`	`4.6.0`
github.com/pires/go-proxyproto	`0.15.0`	`0.16.0`
github.com/quic-go/quic-go	`0.64.0`	`0.64.1`
modernc.org/sqlite	`1.60.1`	`1.61.0`

Updates github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.4

Commits

4aaad74 Release 2026-10-22
4c1f2f2 Regenerated Clients
edb4ad6 Update endpoints model
414c9e4 Update API model
5bba534 Bump Smithy Go to 1.28.6 (#3600)
0d2e6fa Release 2026-10-21
0d7e55d Regenerated Clients
d5bf455 Update endpoints model
e92707e Update API model
d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.10

Commits

4aaad74 Release 2026-10-22
4c1f2f2 Regenerated Clients
edb4ad6 Update endpoints model
414c9e4 Update API model
5bba534 Bump Smithy Go to 1.28.6 (#3600)
0d2e6fa Release 2026-10-21
0d7e55d Regenerated Clients
d5bf455 Update endpoints model
e92707e Update API model
d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.20.9 to 1.20.10

Commits

4b3b917 Release 2022-09-14
3ad6cfd Regenerated Clients
abfad89 Update SDK's smithy-go dependency to v1.13.3
b5262aa Update SDK with latest version of API models (#1844)
a13b7a4 codegen: Upgrade to smithy 1.25.0 (#1835)
296bfb3 Update PULL_REQUEST_TEMPLATE.md (#1843)
63566f0 Update BuildAuthToken to validate endpoint contains a port (#1837)
b011f04 Update credentials.go (#1841)
018b8c3 Amend typological errors in retryer package comments
5b135f8 Release 2022-09-02.2
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.3 to 1.114.5

Commits

4aaad74 Release 2026-10-22
4c1f2f2 Regenerated Clients
edb4ad6 Update endpoints model
414c9e4 Update API model
5bba534 Bump Smithy Go to 1.28.6 (#3600)
0d2e6fa Release 2026-10-21
0d7e55d Regenerated Clients
d5bf455 Update endpoints model
e92707e Update API model
d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
Additional commits viewable in compare view

Updates github.com/aws/smithy-go from 1.28.5 to 1.28.6

Changelog

Sourced from github.com/aws/smithy-go's changelog.

Release (2026-10-27)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.28.7

Bug Fix: Fix a panic or EOF error when deserializing a JSON union that contains a member not modeled by the client and whose value is not null.

Bug Fix: Log the underlying error when dumping an HTTP request or response for logging fails

Release (2026-10-21)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.28.6

Bug Fix: Enforce event stream header key value length limit instead of truncating

Bug Fix: Retain the value in a list with the zero value when encountering a null entry on a dense list. This matches how legacy code-generated JSON deserializers behaved.

Release (2026-10-09)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.28.5

Bug Fix: Retain the key with the zero value when encountering a null-value key in a dense map. This matches how legacy code-generated JSON deserializers behaved.

Release (2026-10-07)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.28.4

Bug Fix: Revert #698 that fixed JoinPath with trailing slash. This has a side effect on certain S3 API paths in the downstream SDK that need more consideration.

Release (2026-10-06)

General Highlights

Dependency Update: Updated to the latest SDK module versions

Module Highlights

github.com/aws/smithy-go: v1.28.3

Bug Fix: Accept either casing of message/Message on modeled JSON error structures in schema-based deserialization, and emit the smithy.api#error trait in generated schemas

Bug Fix: Include the underlying error when logging failures to discard or close an HTTP response body

Release (2026-09-18)

... (truncated)

Commits

f0c489f Release 2026-10-21
43007bd Enforce event stream header key value length limit instead of truncating (#733)
fc207dc Serialize null values in lists not marked with @sparse with their zero value ...
See full diff in compare view

Updates github.com/italypaleale/francis from 0.1.1 to 0.1.2

Release notes

Sourced from github.com/italypaleale/francis's releases.

v0.1.2

This is a maintenance release that upgrades the Go compiler version and includes a minor fix.

Fixed the labels in the volume claim template so they no longer include the version

Upgraded Go to 1.27.3

Commits

4361906 Upgrade Go to 1.27.3 (#45)
c1da491 chore: update hugo-assets to v0.4.2 (#44)
2e19152 Fix labels in volume claim template so they don't include version
See full diff in compare view

Updates github.com/italypaleale/go-kit from 1.5.1 to 1.6.0

Release notes

Sourced from github.com/italypaleale/go-kit's releases.

v1.6.0

Webhooks: add support for Google Chat, Microsoft Teams, Telegram

Require Go 1.27.3 or higher due to security vulnerability

Commits

2b2d8de feat(webhook): add support for Google Chat, MS Teams and Telegram (#14)
See full diff in compare view

Updates github.com/italypaleale/go-sql-utils from 0.3.11 to 0.3.12

Release notes

Sourced from github.com/italypaleale/go-sql-utils's releases.

v0.3.12

Fix handling of context cancellation in migrations

Commits

9ff55c4 Migrations: fix handling of rollback failures due to context cancellations
f779e32 Upgrade Go to 1.27.3
See full diff in compare view

Updates github.com/lestrrat-go/jwx/v4 from 4.5.0 to 4.6.0

Release notes

Sourced from github.com/lestrrat-go/jwx/v4's releases.

v4.6.0

For more detailed release notes, see Changes.

What's Changed

build(deps): bump github/codeql-action from 4.37.9 to 4.38.0 by @dependabot[bot] in lestrrat-go/jwx#2354

build(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 by @dependabot[bot] in lestrrat-go/jwx#2353

update jwx v4 guide by @lestrrat in lestrrat-go/jwx#2355

require guide skill tests after API changes by @lestrrat in lestrrat-go/jwx#2356

build(deps): bump github/codeql-action from 4.38.0 to 4.38.1 by @dependabot[bot] in lestrrat-go/jwx#2359

build(deps): bump github/codeql-action from 4.38.1 to 4.38.2 by @dependabot[bot] in lestrrat-go/jwx#2362

jwt: reject overflowing NumericDate values by @lestrrat in lestrrat-go/jwx#2368

jwt: require numbers for pedantic NumericDate by @lestrrat in lestrrat-go/jwx#2369

jws: support strict ECDSA curve checking during verification by @skarm in lestrrat-go/jwx#2367

[v4] replace fastjson header probes with jsontext by @lestrrat in lestrrat-go/jwx#2379

[v4] allow jwk set mutation during iteration by @lestrrat in lestrrat-go/jwx#2380

[v4] fix jwt.Parse fast path with multiple keys by @lestrrat in lestrrat-go/jwx#2382

[v4] fix jwt.Equal for map claims and member order by @lestrrat in lestrrat-go/jwx#2383

[v4] keep trying jwe key providers after errors by @lestrrat in lestrrat-go/jwx#2384

[v4] allow empty jwe ciphertext in JSON form by @lestrrat in lestrrat-go/jwx#2386

[v4] write jwe unprotected header as JSON object by @lestrrat in lestrrat-go/jwx#2388

handle shrinking JWK sets in verify and decrypt by @lestrrat in lestrrat-go/jwx#2394

[v4] jwsbb: size SignBuffer per encoded part by @lestrrat in lestrrat-go/jwx#2400

[v4] docs: fix wrong names and links in jwe/jwt by @lestrrat in lestrrat-go/jwx#2403

[v4] guide: add nested JWT section by @lestrrat in lestrrat-go/jwx#2404

[v4] jwt: honor NumericDate format precision by @lestrrat in lestrrat-go/jwx#2409

[v4] jwt: parse negative NumericDate values by @lestrrat in lestrrat-go/jwx#2411

[v4] jwt: parse decimal NumericDate values exactly by @lestrrat in lestrrat-go/jwx#2413

build(deps): bump github/codeql-action from 4.38.2 to 4.38.3 by @dependabot[bot] in lestrrat-go/jwx#2421

build(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 by @dependabot[bot] in lestrrat-go/jwx#2420

[v4] jws: sign only the protected header in JSON by @lestrrat in lestrrat-go/jwx#2415

[v4] jwt: retry missing alg through jws.Verify by @lestrrat in lestrrat-go/jwx#2422

Fix typo in migration documentation link by @frostmar in lestrrat-go/jwx#2425

build(deps): bump github/codeql-action from 4.38.3 to 4.39.0 by @dependabot[bot] in lestrrat-go/jwx#2428

use crypto/pbkdf2 and drop x/crypto by @lestrrat in lestrrat-go/jwx#2430

require latest go patch release by @lestrrat in lestrrat-go/jwx#2432

use shields.io for the deepwiki badge by @lestrrat in lestrrat-go/jwx#2433

[v4] jws: add WithVerifiedSignature verify option by @lestrrat in lestrrat-go/jwx#2434

[v4] jwe: add WithDecryptedRecipient decrypt option by @lestrrat in lestrrat-go/jwx#2438

[v4] jws: fix crit and multi-signature docs by @lestrrat in lestrrat-go/jwx#2435

[v4] jwe: document per-recipient headers by @lestrrat in lestrrat-go/jwx#2439

[v4] ci: run autodoc only for develop/v4 by @lestrrat in lestrrat-go/jwx#2446

[v4] release v4.6.0 by @lestrrat in lestrrat-go/jwx#2448

New Contributors

@skarm made their first contribution in lestrrat-go/jwx#2367

@frostmar made their first contribution in lestrrat-go/jwx#2425

Full Changelog: lestrrat-go/jwx@v4.5.0...v4.6.0

Changelog

Sourced from github.com/lestrrat-go/jwx/v4's changelog.

v4.6.0 23 October 2026

[jws][jwk] github.com/valyala/fastjson is no longer a dependency. The header probes in jws/jwsbb and jwk/jwkbb now use encoding/json/v2 and jsontext.

jwsbb.HeaderParse, jwsbb.HeaderParseCompact, and jwkbb.HeaderParse now reject a header whose strings contain a raw control character, invalid UTF-8, or a lone surrogate escape such as \ud800. The first HeaderGet* call returns the error, and HeaderHas reports false. jws.VerifyCompactFast, and therefore jwt.Parse, now also reject a protected header with a raw control character or invalid UTF-8 in a string, as jws.Verify does. (#2372)

[jwk] jwk.Set.All() and jwk.Set.Fields() now loop over a copy of the keys or fields taken when each loop starts. The set can therefore be changed inside the loop, for example with AddKey, RemoveKey, Set, or Remove, and those changes do not affect the running loop. (#2373)

[jwt] jwt.Parse called with exactly two jwt.WithKey options and no other options now tries both keys, so a token signed with either key verifies. Calls with three or more options already tried every key. (#2374)

[jwt] jwt.Equal now sorts the members of every JSON object, including nested ones, before comparing, so two tokens holding the same map-valued claim always compare equal. This is needed because v4 serializes with encoding/json/v2, which writes map keys in random order (v3's encoding/json sorted them). Raw JSON claims holding the same members in a different order also compare equal. Arrays keep their order and numbers keep their exact digits, so integers above 2^53 that differ still compare unequal. (#2375)

[jwe] jwe.Decrypt now tries each key provider in turn and moves on to the next one when a provider returns an error, as jws.Verify does. For example, jwe.WithKeySet with a set that has no usable key, followed by a working jwe.WithKey, decrypts with the working key. If no key works, the provider errors are included in the returned error. (#2376)

[jwe] JSON serialization of a JWE now always includes the ciphertext member, and jwe.Parse now accepts an empty ciphertext. A JWE that encrypts an empty plaintext with AES-GCM therefore round-trips through jwe.Encrypt(..., jwe.WithJSON()), jwe.Parse, and json.Marshal. A missing, null, or non-string ciphertext is still rejected, and the iv and tag members must still be non-empty. (#2377)

[jwe] JSON serialization of a JWE now writes the shared unprotected header as a JSON object, as RFC 7516 requires. A JWE with a shared unprotected header therefore round-trips through jwe.Parse, json.Marshal, jwe.Parse, and jwe.Decrypt. (#2378)

... (truncated)

Commits

4fd7c22 Merge pull request #2448 from lestrrat-go/chore-v4-release-4.6.0
6594705 release v4.6.0
f458a10 ci: run autodoc only for develop/v4 (#2446)
968ee04 Merge pull request #2439 from lestrrat-go/docs-v4-jwe-per-recipient-headers
786a0db Merge pull request #2435 from lestrrat-go/docs-v4-jws-crit-extension
ea176ca merge develop/v4
b220ffa Merge pull request #2438 from lestrrat-go/feat-v4-jwe-decrypted-recipient
9492da1 merge develop/v4
5f629b8 merge develop/v4
b011454 Merge pull request #2434 from lestrrat-go/feat-v4-jws-verified-signature
Additional commits viewable in compare view

Updates github.com/pires/go-proxyproto from 0.15.0 to 0.16.0

Release notes

Sourced from github.com/pires/go-proxyproto's releases.

v0.16.0

Breaking changes

Not really breaking changes to the lib users but rather folks who adopted our HTTP2 helper/examples code. Upgrading golang.org/x/net to 0.61.0 required adopting the new API for HTTP2.

What's Changed

fix: WriteTo empty buffer handling by @mymmrac in pires/go-proxyproto#182

fix(ci): drop Go 1.25, add 1.27 by @pires in pires/go-proxyproto#185

deps,ci: bump Go and fix CI validations by @pires in pires/go-proxyproto#188

deps,http2: bump golang.org/x/next from 0.58.0 to 0.61.0 by @pires in pires/go-proxyproto#189

New Contributors

@mymmrac made their first contribution in pires/go-proxyproto#182

Full Changelog: pires/go-proxyproto@v0.15.0...v0.16.0

Commits

32ab355 deps,http2: bump golang.org/x/next from 0.58.0 to 0.61.0
c7268fe ci: validate GHA config before anything else
4331312 ci: explicitly set GHA workflow permissions
2d70a5a deps,ci: bump Go and fix CI validations
ec43bde fix(ci): drop Go 1.25, add 1.27
c435999 build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0
a9aa477 fix: WriteTo empty buffer handling (#182)
b987720 build(deps): bump golang.org/x/net from 0.55.0 to 0.57.0
88dff81 fix dependabot for Go
86099fb enable dependabot
Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.64.0 to 0.64.1

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.64.1

This patch release fixes datagram receive cancellation and stream reset handling.

Notable Fixes

Conn.ReceiveDatagram now fails immediately if the context is already canceled: #5947

http3: Stream.ReceiveDatagram and RequestStream.ReceiveDatagram now fail immediately if the context is already canceled: #5948

Stream reset handling now ignores reliable boundary updates after cancellation: #5950

Changelog

ignore reliable boundary updates after stream cancellation by @marten-seemann in quic-go/quic-go#5950

fail Conn.ReceiveDatagram if the context is already canceled by @marten-seemann in quic-go/quic-go#5947

http3: fail Stream.ReceiveDatagram if the context is already canceled by @marten-seemann in quic-go/quic-go#5948

Full Changelog: quic-go/quic-go@v0.64.0...v0.64.1

Commits

ed90516 http3: fail Stream.ReceiveDatagram if the context is already canceled (#5948)
1170056 fail Conn.ReceiveDatagram if the context is already canceled (#5947)
5a5e6b7 ignore reliable boundary updates after stream cancellation (#5950)
See full diff in compare view

Updates modernc.org/sqlite from 1.60.1 to 1.61.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

2026-10-21 v1.61.1:

Prepared statements are no longer parsed and planned again on every execution. Since v1.61.0, SQLite 3.54 expired a cached statement that has a col = ? term in a join or an ORDER BY query whenever the driver cleared its bindings after a run, so a statement prepared with db.Prepare or tx.Prepare cost about twice what it did in v1.60.1. Integer bindings now stay in place between executions, so a parameter bound to 0 or 1 does not re-prepare it either. Resolves [GitLab issue #264](https://gitlab.com/cznic/sqlite/-/issues/264). See [GitLab merge request #147](https://gitlab.com/cznic/sqlite/-/merge_requests/147), thanks Roman Khafizianov (@requilence)!

Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!

Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.

Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!

The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.

Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

2026-10-21 v1.61.0:

Upgrade to SQLite 3.54.1, re-vendoring lib/ from modernc.org/libsqlite3 v1.15.2 and vec/ from modernc.org/libsqlite_vec v0.7.0; sqlite-vec stays v0.1.9. The pinned modernc.org/libc becomes v1.79.0; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

Add _time_format=string_no_monotonic, opt-in: times are written in the default layout but without Go's monotonic clock reading, the m=+... suffix, so a scanned time matches its row again when bound in WHERE col = ?. The default is unchanged. Resolves [GitLab issue #259](https://gitlab.com/cznic/sqlite/-/issues/259). See [GitLab merge request #142](https://gitlab.com/cznic/sqlite/-/merge_requests/142), thanks 不插电 (@r27153733)!

Each release tag now gets a signed provenance document, linked from its GitLab release; VERIFYING.md says what it proves and how to check one. Tooling only. See [GitLab merge request #141](https://gitlab.com/cznic/sqlite/-/merge_requests/141).

Add an opt-in SQLite authorizer per connection: AuthorizerRegisterer, reached through sql.Conn.Raw or installed on every pooled connection from RegisterConnectionHook; existing connections are unchanged. Resolves [GitLab issue #256](https://gitlab.com/cznic/sqlite/-/issues/256). See [GitLab merge request

…3 updates Bumps the all-dependencies group with 3 updates in the / directory: [docker/login-action](https://github.com/docker/login-action), [voidzero-dev/setup-vp](https://github.com/voidzero-dev/setup-vp) and [taiki-e/install-action](https://github.com/taiki-e/install-action). Updates `docker/login-action` from 4.6.0 to 4.7.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@dbcb813...81c6f93) Updates `voidzero-dev/setup-vp` from 1.21.2 to 1.22.0 - [Release notes](https://github.com/voidzero-dev/setup-vp/releases) - [Commits](voidzero-dev/setup-vp@68f39c7...cab1ab9) Updates `taiki-e/install-action` from 2.87.29 to 2.87.31 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@8cca091...1e29709) chore(deps): Bump the all-dependencies group across 1 directory with 12 updates Bumps the all-dependencies group with 12 updates in the /backend directory: | Package | From | To | | --- | --- | --- | | [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.47.3` | `1.47.4` | | [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.33.9` | `1.33.10` | | [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) | `1.20.9` | `1.20.10` | | [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.114.3` | `1.114.5` | | [github.com/aws/smithy-go](https://github.com/aws/smithy-go) | `1.28.5` | `1.28.6` | | [github.com/italypaleale/francis](https://github.com/italypaleale/francis) | `0.1.1` | `0.1.2` | | [github.com/italypaleale/go-kit](https://github.com/italypaleale/go-kit) | `1.5.1` | `1.6.0` | | [github.com/italypaleale/go-sql-utils](https://github.com/italypaleale/go-sql-utils) | `0.3.11` | `0.3.12` | | [github.com/lestrrat-go/jwx/v4](https://github.com/lestrrat-go/jwx) | `4.5.0` | `4.6.0` | | [github.com/pires/go-proxyproto](https://github.com/pires/go-proxyproto) | `0.15.0` | `0.16.0` | | [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) | `0.64.0` | `0.64.1` | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.60.1` | `1.61.0` | Updates `github.com/aws/aws-sdk-go-v2` from 1.47.3 to 1.47.4 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@v1.47.3...v1.47.4) Updates `github.com/aws/aws-sdk-go-v2/config` from 1.33.9 to 1.33.10 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@config/v1.33.9...config/v1.33.10) Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.20.9 to 1.20.10 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/kms/v1.20.9...service/emr/v1.20.10) Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.114.3 to 1.114.5 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.114.3...service/s3/v1.114.5) Updates `github.com/aws/smithy-go` from 1.28.5 to 1.28.6 - [Release notes](https://github.com/aws/smithy-go/releases) - [Changelog](https://github.com/aws/smithy-go/blob/main/CHANGELOG.md) - [Commits](aws/smithy-go@v1.28.5...v1.28.6) Updates `github.com/italypaleale/francis` from 0.1.1 to 0.1.2 - [Release notes](https://github.com/italypaleale/francis/releases) - [Commits](ItalyPaleAle/francis@v0.1.1...v0.1.2) Updates `github.com/italypaleale/go-kit` from 1.5.1 to 1.6.0 - [Release notes](https://github.com/italypaleale/go-kit/releases) - [Commits](ItalyPaleAle/go-kit@v1.5.1...v1.6.0) Updates `github.com/italypaleale/go-sql-utils` from 0.3.11 to 0.3.12 - [Release notes](https://github.com/italypaleale/go-sql-utils/releases) - [Commits](ItalyPaleAle/go-sql-utils@v0.3.11...v0.3.12) Updates `github.com/lestrrat-go/jwx/v4` from 4.5.0 to 4.6.0 - [Release notes](https://github.com/lestrrat-go/jwx/releases) - [Changelog](https://github.com/lestrrat-go/jwx/blob/develop/v4/Changes) - [Commits](lestrrat-go/jwx@v4.5.0...v4.6.0) Updates `github.com/pires/go-proxyproto` from 0.15.0 to 0.16.0 - [Release notes](https://github.com/pires/go-proxyproto/releases) - [Commits](pires/go-proxyproto@v0.15.0...v0.16.0) Updates `github.com/quic-go/quic-go` from 0.64.0 to 0.64.1 - [Release notes](https://github.com/quic-go/quic-go/releases) - [Commits](quic-go/quic-go@v0.64.0...v0.64.1) Updates `modernc.org/sqlite` from 1.60.1 to 1.61.0 - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.60.1...v1.61.0) chore(deps): Bump the all-dependencies group across 1 directory with 11 updates Bumps the all-dependencies group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@opentelemetry/api](https://github.com/open-telemetry/opentelemetry-js) | `1.9.1` | `1.10.0` | | [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.223.0` | `0.300.0` | | [runed](https://github.com/svecosystem/runed/tree/HEAD/packages/runed) | `0.37.1` | `0.38.0` | | [@inlang/paraglide-js](https://github.com/opral/paraglide-js) | `2.29.0` | `2.29.1` | | [@inlang/plugin-message-format](https://github.com/opral/inlang/tree/HEAD/packages/plugins/inlang-message-format) | `4.5.4` | `4.5.5` | | [@lucide/svelte](https://github.com/lucide-icons/lucide/tree/HEAD/packages/svelte) | `1.58.0` | `1.61.0` | | [bits-ui](https://github.com/huntabyte/bits-ui) | `2.19.5` | `2.20.2` | | [rollup](https://github.com/rollup/rollup) | `4.64.7` | `4.65.0` | | [shadcn-svelte](https://github.com/huntabyte/shadcn-svelte/tree/HEAD/packages/cli) | `1.7.0` | `1.7.1` | | [jose](https://github.com/panva/jose) | `6.2.12` | `6.2.13` | | [vite-plus](https://github.com/voidzero-dev/vite-plus/tree/HEAD/packages/cli) | `1.3.0` | `1.4.0` | Updates `@opentelemetry/api` from 1.9.1 to 1.10.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v1.9.1...v1.10.0) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.223.0 to 0.300.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.223.0...experimental/v0.300.0) Updates `runed` from 0.37.1 to 0.38.0 - [Release notes](https://github.com/svecosystem/runed/releases) - [Changelog](https://github.com/svecosystem/runed/blob/main/packages/runed/CHANGELOG.md) - [Commits](https://github.com/svecosystem/runed/commits/runed@0.38.0/packages/runed) Updates `@inlang/paraglide-js` from 2.29.0 to 2.29.1 - [Changelog](https://github.com/opral/paraglide-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/opral/paraglide-js/commits) Updates `@inlang/plugin-message-format` from 4.5.4 to 4.5.5 - [Changelog](https://github.com/opral/inlang/blob/main/packages/plugins/inlang-message-format/CHANGELOG.md) - [Commits](https://github.com/opral/inlang/commits/HEAD/packages/plugins/inlang-message-format) Updates `@lucide/svelte` from 1.58.0 to 1.61.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.61.0/packages/svelte) Updates `bits-ui` from 2.19.5 to 2.20.2 - [Release notes](https://github.com/huntabyte/bits-ui/releases) - [Commits](https://github.com/huntabyte/bits-ui/compare/bits-ui@2.19.5...bits-ui@2.20.2) Updates `rollup` from 4.64.7 to 4.65.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.64.7...v4.65.0) Updates `shadcn-svelte` from 1.7.0 to 1.7.1 - [Release notes](https://github.com/huntabyte/shadcn-svelte/releases) - [Changelog](https://github.com/huntabyte/shadcn-svelte/blob/main/packages/cli/CHANGELOG.md) - [Commits](https://github.com/huntabyte/shadcn-svelte/commits/shadcn-svelte@1.7.1/packages/cli) Updates `jose` from 6.2.12 to 6.2.13 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.12...v6.2.13) Updates `vite-plus` from 1.3.0 to 1.4.0 - [Release notes](https://github.com/voidzero-dev/vite-plus/releases) - [Commits](https://github.com/voidzero-dev/vite-plus/commits/v1.4.0/packages/cli) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: voidzero-dev/setup-vp dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: taiki-e/install-action dependency-version: 2.87.31 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: github.com/aws/aws-sdk-go-v2 dependency-version: 1.47.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-version: 1.33.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: github.com/aws/aws-sdk-go-v2/credentials dependency-version: 1.20.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.114.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: github.com/aws/smithy-go dependency-version: 1.28.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: github.com/italypaleale/francis dependency-version: 0.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: github.com/italypaleale/go-kit dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: github.com/italypaleale/go-sql-utils dependency-version: 0.3.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: github.com/lestrrat-go/jwx/v4 dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: github.com/pires/go-proxyproto dependency-version: 0.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: github.com/quic-go/quic-go dependency-version: 0.64.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: modernc.org/sqlite dependency-version: 1.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@opentelemetry/api" dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.300.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: runed dependency-version: 0.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@inlang/paraglide-js" dependency-version: 2.29.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: "@inlang/plugin-message-format" dependency-version: 4.5.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: "@lucide/svelte" dependency-version: 1.61.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: bits-ui dependency-version: 2.20.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: rollup dependency-version: 4.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: shadcn-svelte dependency-version: 1.7.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: jose dependency-version: 6.2.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: vite-plus dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-10-30T17:12:08Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
golang/modernc.org/sqlite@v1.60.1 ⏵ v1.61.0	^-2
golang/github.com/italypaleale/go-kit@v1.5.1 ⏵ v1.6.0	⁺¹
golang/github.com/aws/aws-sdk-go-v2@v1.47.3 ⏵ v1.47.4	⁺¹
golang/github.com/aws/smithy-go@v1.28.5 ⏵ v1.28.6	⁺¹
golang/github.com/quic-go/quic-go@v0.64.0 ⏵ v0.64.1	⁺¹
npm/@lucide/svelte@1.58.0 ⏵ 1.61.0	⁺¹	⁺¹	⁺¹
golang/github.com/pires/go-proxyproto@v0.15.0 ⏵ v0.16.0	⁺¹
npm/runed@0.37.1 ⏵ 0.38.0	⁺¹	⁺¹	⁺³
npm/shadcn-svelte@1.7.0 ⏵ 1.7.1	⁺²	⁺⁵
golang/github.com/aws/aws-sdk-go-v2/config@v1.33.9 ⏵ v1.33.10
golang/github.com/lestrrat-go/jwx/v4@v4.5.0 ⏵ v4.6.0	⁺¹
golang/github.com/italypaleale/francis@v0.1.1 ⏵ v0.1.2
npm/bits-ui@2.19.5 ⏵ 2.20.2	⁺¹	⁺¹
golang/github.com/aws/aws-sdk-go-v2/service/s3@v1.114.3 ⏵ v1.114.5
npm/@opentelemetry/api@1.9.1 ⏵ 1.10.0
npm/jose@6.2.12 ⏵ 6.2.13	⁺¹	⁺¹	⁺³
npm/@inlang/plugin-message-format@4.5.4 ⏵ 4.5.5			⁺¹
npm/rollup@4.64.7 ⏵ 4.65.0	⁺¹
npm/@inlang/paraglide-js@2.29.0 ⏵ 2.29.1	⁺¹		⁺¹
npm/vite-plus@1.3.0 ⏵ 1.4.0			⁺¹
golang/github.com/aws/aws-sdk-go-v2/credentials@v1.20.9 ⏵ v1.20.10
npm/@opentelemetry/exporter-trace-otlp-http@0.223.0 ⏵ 0.300.0			⁺¹
golang/github.com/italypaleale/go-sql-utils@v0.3.11 ⏵ v0.3.12	⁺¹

View full report

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 30, 2026

dependabot Bot mentioned this pull request Oct 30, 2026

chore(deps): Bump the "all-dependencies" group with 2 updates across multiple ecosystems #1

Closed

Navigation Menu

Repository navigation

chore(deps): Bump the "all-dependencies" group with 3 updates across multiple ecosystems - #2

chore(deps): Bump the "all-dependencies" group with 3 updates across multiple ecosystems#2
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot-all_dependencies-0a97843624

dependabot Bot commented on behalf of github Oct 30, 2026

Uh oh!

socket-security Bot commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 30, 2026

v4.7.0

v1.22.0

What's Changed

New Contributors

2.87.31

2.87.30

Changelog

[Unreleased]

[2.88.0] - 2026-10-28

[2.87.33] - 2026-10-28

[2.87.32] - 2026-10-26

Release (2026-10-27)

General Highlights

Module Highlights

Release (2026-10-21)

General Highlights

Module Highlights

Release (2026-10-09)

General Highlights

Module Highlights

Release (2026-10-07)

General Highlights

Module Highlights

Release (2026-10-06)

General Highlights

Module Highlights

Release (2026-09-18)

v0.1.2

v1.6.0

v0.3.12

v4.6.0

What's Changed

New Contributors

v0.16.0

Breaking changes

What's Changed

New Contributors

v0.64.1

Notable Fixes

Changelog

Changelog

Uh oh!

socket-security Bot commented Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants