[dependabot]

Bumps the gomod-minor-updates group with 7 updates in the / directory:

Package	From	To
cloud.google.com/go/pubsub	1.50.2	1.51.1
github.com/gopacket/gopacket	1.7.0	1.7.4
github.com/package-url/packageurl-go	0.1.6	0.1.7
golang.org/x/crypto	0.55.0	0.58.0
google.golang.org/api	0.287.0	0.287.1
google.golang.org/grpc	1.83.2	1.84.0
google.golang.org/protobuf	1.36.11	1.36.12

Updates cloud.google.com/go/pubsub from 1.50.2 to 1.51.1

Commits

• f059575 chore(main): release pubsub 1.51.1 (#20400)
• 0d7bd01 chore: send developerknowledge docs to the developers bucket (#20405)
• 56250a2 feat(google/developers/knowledge/v1): onboard developerknowledge library (#20...
• f9efbe7 feat(google/maps/mapmanagement/v2): onboard a new library (#20402)
• 8cd7e2a feat(google/cloud/biglake/hive/v1): onboard a new library (#20401)
• a6b5cdb feat: update sources and regenerate (#20399)
• 03d5ded fix(pubsub): update ackID batch size to 1000 (#20398)
• 9f03a46 chore(main): release pubsub 2.6.2 (#20396)
• e069810 chore: update librarian to v0.38.0 (#20394)
• 530b88a fix(pubsub/v2): update ackID batch size to 1000 (#20393)
• Additional commits viewable in compare view

Updates github.com/gopacket/gopacket from 1.7.0 to 1.7.4

Release notes

Sourced from github.com/gopacket/gopacket's releases.

v1.7.4

Security release. v1.7.3 did not fully fix GTPv2 decoding. Upgrade if you decode untrusted GTPv2 traffic.

Security fixes

Advisory	Area
GHSA-xcf2-23pj-86cv	GTPv2. v1.7.3 fixed the IE header but left one bound short

A GTPv2 message that ended right after the 3-byte sequence number still caused an out-of-bounds panic, because the decoder read the following spare byte without checking for it. The decoder now requires the spare byte and returns a decode error instead.

Exposure: gopacket.NewPacket with default options and DecodingLayerParser with IgnorePanic: false both recover, so those callers saw a decode error. A process crash needed SkipDecodeRecovery: true or IgnorePanic: true.

Other fixes

• USBRequestBlockSetup returns a truncated error on input shorter than 8 bytes instead of panicking (#169)
• pcap: Handle.Close no longer hangs while ReadPacketData is blocked on a handle opened with BlockForever. The blocked read returns io.EOF. This applies on Linux with libpcap 1.10 or later and on Npcap. Other platforms behave as before (#27)
• pcap: darwin builds no longer pass -lpcap to the linker twice (#171)

No API changes.

v1.7.3

v1.7.3 was tagged without release notes. It fixed GHSA-xcf2-23pj-86cv (sFlow, OSPFv2/v3, MDP, GTPv2, Geneve and CDP decoders), GHSA-r93c-g7pr-x4hw (DHCPv6 option String() and STP SerializeTo) and GHSA-w3r9-77cj-r246 (Diameter grouped-AVP recursion).

Credits

The remaining GTPv2 case was reported by @​ChrisJr404. USB fix by @​chiliec.

v1.7.2

Security release. All versions up to and including v1.7.1 are affected for SCTP decoding. Upgrade if you decode untrusted packets or capture files.

Security fixes

Advisory	Area
GHSA-358w-w75h-x6rx	SCTP INIT, INIT-ACK, SACK and SHUTDOWN chunks, and INIT/HEARTBEAT/ERROR/ABORT parameters. v1.7.1 did not fix these

A crafted SCTP chunk (IP protocol 132) caused an out-of-bounds panic. The decoders now check each chunk type's minimum length, SACK gap and duplicate TSN counts, and parameter lengths, and return a decode error instead.

Exposure: gopacket.NewPacket with default options and DecodingLayerParser with IgnorePanic: false both recover, so those callers saw a decode error. A process crash needed SkipDecodeRecovery: true or IgnorePanic: true.

Other fixes

• A valid SCTP chunk whose last parameter's padding sat outside the chunk length (RFC 9260 3.2) panicked. It now decodes.
• gopacket.NewPacket returns ErrUnsupportedLayerType for unknown IP protocols (#168)

Credits

GHSA-358w-w75h-x6rx reported by @​Reload3d and validated by @​FoxhoundAI.

... (truncated)

Commits

• 11ee6a1 Revert "packet: set zeroCopy in NewZeroCopyPacketSource (#172)"
• 3541dd1 layers/gtp2: require the spare byte before reading it
• 583e398 pcap: let Close return while a read is blocked
• c39583a pcap: stop linking -lpcap twice on darwin
• f8c0188 packet: set zeroCopy in NewZeroCopyPacketSource (#172)
• 8c0424b fix(layers): guard USBRequestBlockSetup against short input (#169)
• 2029b6a ci: move to ubuntu-26.04 and make the lint gate real
• d4b61d8 layers/diameter: cap grouped AVP nesting depth
• 07e9da8 layers: stop DHCPv6 String and STP SerializeTo panics
• 0701061 layers: bound seven more decoders on crafted input
• Additional commits viewable in compare view

Updates github.com/package-url/packageurl-go from 0.1.6 to 0.1.7

Release notes

Sourced from github.com/package-url/packageurl-go's releases.

v0.1.7

What's Changed

• Merge identical return branches in adjustMlflowName by @​gshk99 in package-url/packageurl-go#92
• Percent-decode subpath when parsing by @​sueun-dev in package-url/packageurl-go#96
• make brew name and namespace lower-case by @​william-elastisys in package-url/packageurl-go#102
• Reject npm purl with bare scope and no name by @​arpitjain099 in package-url/packageurl-go#95
• Percent-encode sub-delimiters in name/version path segments by @​czunker in package-url/packageurl-go#93
• add support for vcpkg purl-type by @​william-elastisys in package-url/packageurl-go#105
• make cpan namespace optional by @​william-elastisys in package-url/packageurl-go#103

New Contributors

• @​gshk99 made their first contribution in package-url/packageurl-go#92
• @​sueun-dev made their first contribution in package-url/packageurl-go#96
• @​william-elastisys made their first contribution in package-url/packageurl-go#102
• @​arpitjain099 made their first contribution in package-url/packageurl-go#95
• @​czunker made their first contribution in package-url/packageurl-go#93

Full Changelog: package-url/packageurl-go@v0.1.6...v0.1.7

Commits

• c88ed7b Merge pull request #103 from william-elastisys/cpan-optional-namespace
• 569ee0d make cpan namespace optional
• 44fc744 Merge pull request #105 from william-elastisys/add-vcpkg-type
• 9da7353 add support for vcpkg purl-type
• f5978e9 Merge pull request #93 from czunker/fix/encode-sub-delims-in-path-segments
• 327d6a6 Percent-encode sub-delimiters in name/version path segments
• bfacec9 Merge pull request #95 from arpitjain099/fix/npm-missing-name
• 871407e Reject npm purl with bare scope and no name
• 85c494e Merge pull request #102 from william-elastisys/homebrew-case-sensitive
• 16e06cb make brew name and namespace lower-case
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.55.0 to 0.58.0

Commits

• 8fdf07b go.mod: update golang.org/x dependencies
• 2437861 salsa20: fix keystream reuse in LoongArch LSX tail
• c3db4df acme: prefer test log helpers in test contexts
• 4e01a84 acme: adds support for profiles draft
• 8f0f111 ssh: check that no Unicode-aware string function is used
• b39ff6d ssh: add certificate algorithms for ML-DSA keys
• 4465db3 ssh: add the ML-DSA public key algorithms
• 83e695b ssh: implement ETM mode for CBC ciphers
• 946083a ssh: only drop a trailing carriage return
• 543dde9 ssh: accept known_hosts entries with a multi-word comment
• Additional commits viewable in compare view

Updates google.golang.org/api from 0.287.0 to 0.287.1

Release notes

Sourced from google.golang.org/api's releases.

v0.287.1

0.287.1 (2026-07-07)

Documentation

• Remove old TODO file (#3645) (9d7a6b8)

Changelog

Sourced from google.golang.org/api's changelog.

0.287.1 (2026-07-07)

Documentation

• Remove old TODO file (#3645) (9d7a6b8)

Commits

• 93d63e8 chore(main): release 0.287.1 (#3646)
• 9d7a6b8 docs: remove old TODO file (#3645)
• 576018f chore(all): update all (#3644)
• cc70265 chore(deps): bump golang.org/x/net in /internal/kokoro/discogen (#3642)
• 9858f66 chore: downgrade go version in go.work (#3641)
• 3cb00c0 chore: downgrade min Go version (#3640)
• See full diff in compare view

Updates google.golang.org/grpc from 1.83.2 to 1.84.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.84.0

Behavior Changes

• stats/otel: The grpc.lb.pick_first.* metrics have been removed and replaced with grpc.subchannel.* metrics. See gRFC A94 for more details. (#9215)

New Features

• xds: Add support for contains_match in route header matchers. (#9223)
  • Special Thanks: @​nvxbug

Bug Fixes

• client: Fix a bug where a ClientConn could get permanently stuck in IDLE when an RPC was canceled during stream creation. Previously, such cancellations triggered stream cleanup twice, corrupting the channel's idleness state and causing subsequent RPCs to fail with deadline exceeded errors. (#9191)
  • Special Thanks: @​utkuozdemir
• client: Fix a bug where non-gRPC HTTP responses ending with an empty DATA frame failed the RPC with status code Internal instead of preserving the HTTP-mapped status code and response body. (#9217)
  • Special Thanks: @​chengxilo
• credentials: Validate metadata returned by per-RPC credentials, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from credentials was sent to the server in outgoing HTTP/2 requests. (#9202)
  • Special Thanks: @​buger
• credentials/sts: Prevent potential token leakage by disallowing HTTP redirects during STS token exchange. Previously, 3xx redirects were followed automatically, replaying the request body containing authentication tokens to the redirect destination. (#9299)
  • Special Thanks: @​nvxbug
• randomsubsetting: Ignore endpoints that contain no addresses. Previously, this could cause the policy to panic while computing hashes. (#9259)
  • Special Thanks: @​fallintoplace
• stats/otel: Ensure method names are populated in trace spans when metrics are disabled. Previously, running with tracing enabled and metrics disabled resulted in server trace spans lacking the RPC method name (recording only "Recv."). (#9262)
• transport: Return io.ErrUnexpectedEOF when EOF is encountered after partial header or message body reads. Previously, partial reads could return a plain io.EOF, failing to distinguish truncated data from a clean end of stream. (#9204)
  • Special Thanks: @​buger
• transport: Validate metadata supplied by balancers (in PickResult.Metadata) and resolver addresses, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from these sources was sent to the server in outgoing HTTP/2 requests. (#9203)
  • Special Thanks: @​buger
• xds: Fix a rare corner case that could prevent a cluster from being removed when it is no longer in use. (#9140)
• xds: Fix panic during route matching for routes containing header matchers with empty exact_match strings. (#9223)
  • Special Thanks: @​nvxbug
• xds: Reject routes containing header matchers with empty prefix_match or suffix_match strings. Previously, this caused a panic during route matching. (#9223)
  • Special Thanks: @​nvxbug
• xds: Fix EDS drop policies being applied at a much lower rate than configured due to an integer overflow. (#9257)
  • Special Thanks: @​nvxbug
• xds: Reject EDS resources containing drop policies with unsupported denominators. Previously, such resources caused the client to panic when calculating drop rates. (#9218)
  • Special Thanks: @​nvxbug
• xds/rbac: Reject RBAC configurations containing nested Principal or Permission rules with :scheme or grpc- prefixed header matchers. Previously, such configurations could cause DENY policies to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Rewrite host header matchers to :authority in nested Principal and Permission rules. Previously, this rewrite only applied to top-level rules, causing nested host matchers to never match incoming requests and DENY policies to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Reject CidrRanges with an unset prefix length. Previously, an omitted prefix_len field caused a panic during RBAC configuration parsing. (#9250)
  • Special Thanks: @​nvxbug

Performance Improvements

• transport: Avoid a heap allocation when flushing shared write buffers. (#9233)
  • Special Thanks: @​zaidoon1
• credentials/alts: Support dynamic frame size negotiation and add the GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE environment variable (default 4KiB, max 512KiB) to configure the maximum ALTS record frame size. (#9268)

Commits

• e84aa5a Change version to 1.84.0 (#9324)
• c5ae88d Cherrypick #9204 and #9321 to v1.84.x (#9407)
• a592f6a Cherrypick #9351 and #9404 to v1.84.x (#9408)
• d5a4111 cherry-pick #9365 to v1.84.x (#9370)
• 89d55e0 cherry-pick #9346 to v1.84.x (#9372)
• 8a9f866 Cherry-pick #9332 to v1.84.x (#9338)
• f8b54e7 Cherry-pick #9331 to v1.84.x (#9334)
• 30ce1d5 xds: support injecting bootstrap and server config into HTTP filter config pa...
• 54c743e extproc : wait for async RPC to complete in test (#9311)
• 538bb2f endpointsharding: decouple locking, and simplify ChildState API (#9290)
• Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[calebbrown]

@dependabot rebase

[calebbrown]

@dependabot rebase