Skip to content

build(deps): bump the go-deps group across 1 directory with 3 updates - #86

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-e49a4312e2
Open

build(deps): bump the go-deps group across 1 directory with 3 updates#86
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-e49a4312e2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-deps group with 3 updates in the / directory: github.com/gmrtd/gmrtd, github.com/prometheus/client_golang and github.com/sirosfoundation/go-trust.

Updates github.com/gmrtd/gmrtd from 1.2.0 to 1.6.0

Release notes

Sourced from github.com/gmrtd/gmrtd's releases.

v1.6.0

1.6.0 (2026-10-17)

Features

  • document: infer Singapore passport DOB century from the NRIC (fixes #548) (#547) (f40880f)

v1.5.2

1.5.2 (2026-10-17)

Bug Fixes

  • pace: restart PACE from MSE:Set AT when the chip rejects an extended Le (0d38573)
  • pace: restart PACE from MSE:Set AT when the chip rejects an extended Le (#545) (f8df8cb)

v1.5.1

1.5.1 (2026-10-17)

Bug Fixes

  • security: remove the holder's personal data from debug logs and MRZ errors. Debug logs no longer include decrypted chip file contents or parsed DG11/DG12/DG16 details (only file ids, lengths and status words), and MRZ check-digit errors name the field instead of including its value, e.g. document number check digit mismatch (Exp:7, Act:1). Follows on from 1.4.0's removal of passwords and key material from the logs (fixes #542) (#543) (f222e10)

v1.5.0

1.5.0 (2026-10-17)

Features

  • mobile: expose the document rejected by RequireAuthenticDocument. gomobile drops a result returned alongside an error, so iOS and Android apps now get it from Reader.RejectedDocument(), e.g. to show the trust chain behind the rejection. It is nil after any other outcome, including a partial read (#540) (376d0cb)

v1.4.0

1.4.0 (2026-10-17)

⚠ Behaviour change

  • verifier: when verifier checks a serialised document, VerifiedChipAuthStatus no longer trusts the capturing reader's chip-authentication results by default. Chip Authentication and PACE-CAM now report NONE, because replayed CA/CAM evidence can't prove chip presence, and Active Authentication counts only when its signature is bound to the verifier's own challenge (WithAAChallenge, -challenge in gmrtd-verify). Callers that receive documents from a reader they trust can restore the previous behaviour with WithTrustedSource() (-trusted-source in gmrtd-verify, Verifier.WithTrustedSource() in mobile).

Features

  • csca: update to latest DE CSCA master-list, dated 01/10/2026 (fixes #526) (#527) (f6f3287)
  • document: expose a readable passive authentication trust chain in DocumentSummary (fixes #538) (#539) (d9ba2ae)
  • reader: add RequireAuthenticDocument option to fail reads that aren't verifiably authentic (fixes #525) (#537) (f719394)
  • verifier: only count offline chip-auth evidence that proves chip presence (fixes #533) (#534) (60f6954)

... (truncated)

Changelog

Sourced from github.com/gmrtd/gmrtd's changelog.

1.6.0 (2026-10-17)

Features

  • document: infer Singapore passport DOB century from the NRIC (fixes #548) (#547) (f40880f)

1.5.2 (2026-10-17)

Bug Fixes

  • pace: restart PACE from MSE:Set AT when the chip rejects an extended Le (0d38573)
  • pace: restart PACE from MSE:Set AT when the chip rejects an extended Le (#545) (f8df8cb)

1.5.1 (2026-10-17)

Bug Fixes

  • security: remove the holder's personal data from debug logs and MRZ errors. Debug logs no longer include decrypted chip file contents or parsed DG11/DG12/DG16 details (only file ids, lengths and status words), and MRZ check-digit errors name the field instead of including its value, e.g. document number check digit mismatch (Exp:7, Act:1). Follows on from 1.4.0's removal of passwords and key material from the logs (fixes #542) (#543) (f222e10)

1.5.0 (2026-10-17)

Features

  • mobile: expose the document rejected by RequireAuthenticDocument. gomobile drops a result returned alongside an error, so iOS and Android apps now get it from Reader.RejectedDocument(), e.g. to show the trust chain behind the rejection. It is nil after any other outcome, including a partial read (#540) (376d0cb)

1.4.0 (2026-10-17)

⚠ Behaviour change

  • verifier: when verifier checks a serialised document, VerifiedChipAuthStatus no longer trusts the capturing reader's chip-authentication results by default. Chip Authentication and PACE-CAM now report NONE, because replayed CA/CAM evidence can't prove chip presence, and Active Authentication counts only when its signature is bound to the verifier's own challenge (WithAAChallenge, -challenge in gmrtd-verify). Callers that receive documents from a reader they trust can restore the previous behaviour with WithTrustedSource() (-trusted-source in gmrtd-verify, Verifier.WithTrustedSource() in mobile).

Features

  • csca: update to latest DE CSCA master-list, dated 01/10/2026 (fixes #526) (#527) (f6f3287)
  • document: expose a readable passive authentication trust chain in DocumentSummary (fixes #538) (#539) (d9ba2ae)
  • reader: add RequireAuthenticDocument option to fail reads that aren't verifiably authentic (fixes #525) (#537) (f719394)
  • verifier: only count offline chip-auth evidence that proves chip presence (fixes #533) (#534) (60f6954)

Bug Fixes

  • cryptoutils: encode ECDH shared secrets at field size (#524) (fd6e2c5)
  • iso7816: retry auth commands with short Le when chip rejects extended Le (#536) (47c90bf)
  • pace: select the best usable PACEInfo instead of only the top-weighted one (fixes #529) (#531) (77b8b32)

... (truncated)

Commits
  • ed11f24 chore(main): release 1.6.0 (#549)
  • f40880f feat(document): infer Singapore passport DOB century from the NRIC (fixes #54...
  • 5151220 chore(main): release 1.5.2 (#546)
  • 1e6cc3b chore(main): release 1.5.2
  • f8df8cb fix(pace): restart PACE from MSE:Set AT when the chip rejects an extended Le ...
  • f374b53 test: cover MSE:Set AT rejection in PACE and Chip Authentication
  • 82047c3 test(chipauth): cover restart after extended Le rejected
  • 0d38573 fix(pace): restart PACE from MSE:Set AT when the chip rejects an extended Le
  • 185f84f chore(main): release 1.5.1 (#544)
  • 1f3a275 chore: tidy 1.5.1 and 1.5.0 release notes
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.24.1 to 1.25.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.25.0

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

What's Changed

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135
Commits

Updates github.com/sirosfoundation/go-trust from 0.23.2 to 0.25.0

Release notes

Sourced from github.com/sirosfoundation/go-trust's releases.

v0.25.0

Added

  • AuthZEN evaluation responses can now include verified relying party identifiers in context.verifier_ids, controlled by the new per-policy constraints.return_verifier_ids setting. Wallets answering circuit_zk requests get a verified identifier string without parsing certificates or resolving DIDs themselves. Off by default; clients can hint a preferred type via context.verifier_id_type; unknown type names are rejected at startup. (#204, #203)
    • Types follow the OpenID4VP client_id scheme names, semantic being the only exception: semantic, x509_san_dns, x509_san_uri, decentralized_identifier, openid_federation.
    • Everything is fail closed: nothing is emitted for a deny decision, a failed profile validation, or an identifier that was not verified.
    • semantic comes from the access certificate only, and only for a certificate classified as natural or legal person by its WRPAC policy OIDs; an unclassified certificate yields none, since its organizationIdentifier could be a natural person's affiliation.
    • x509_san_dns is the dNSName SAN as an A-label (internationalised names work when the client_id carries the A-label), ASCII lower case, no trailing dot. A U-label client_id is not converted and yields no entry. Empty labels, over-long names, whitespace, wildcards, and a client_id bound only through a wildcard SAN yield no entry. Shared test vectors are in pkg/registry/testdata/x509_san_dns_verifier_id_vectors.json.

Fixed

  • BREAKING: LoTE registry JWS signature verification now works. Previously registries.lote.verify_jws: true was silently ignored; now it requires the new registries.lote.trust_anchor_bundle (PEM file of CA certificates) or the service refuses to start. Verification applies to the LoTL itself and all resolved sources. Configs that set verify_jws without anchors will fail validation. (#211)
  • DID policies now enforce did.required_verification_methods. This constraint was parsed but never checked; DIDs missing any listed verification method type are now denied. Deployments with this setting already configured may see denials after upgrading. (#209)
  • Docker image now listens on 0.0.0.0:6001 by default (was 127.0.0.1:6001), exposes port 6001, and its healthcheck correctly follows GT_PORT and uses GET instead of HEAD. (#206)
  • WRPAC profile no longer warns when access certificates lack keyUsage contentCommitment/nonRepudiation; that bit is for non-repudiable content commitment, not entity authentication. Certificates with only digitalSignature now validate cleanly. (#210)
  • Natural-person WRPAC certificates (NCP-n, QCP-n) are now correctly classified as natural_person and their semantic identifier is read from serialNumber only, not organizationIdentifier. (#204)

Changed

  • Security: minimum Go version is now 1.27.2 (was 1.27.0/1.27.1), clearing stdlib vulnerabilities GO-2026-6611/6612/6613/6617 in net/http. (#214)
  • x509_san_dns client_id binding (DNSSANMatches, also used by the ETSI trust evaluation) now compares ASCII case-insensitively, as DNS names are, so a client_id differing from the SAN only in case now binds. It no longer matches an empty label against a wildcard SAN (.example.com against *.example.com). A non-ASCII client_id still never matches; present internationalised names as A-labels. (#204)
  • Dependency updates: golang.org/x/net v0.60.0 (clears GO-2026-6610/6611/6612/6617), github.com/SUNET/vc v0.7.23, github.com/fxamacker/cbor/v2 v2.9.6, github.com/go-oidfed/lib v0.12.0 and github.com/prometheus/client_golang v1.25.0. (#212, #199, #215)
  • GitHub Actions: ossf/scorecard-action updated to v2.5.0. (#216)

v0.24.1

No release notes provided.

v0.24.0

No release notes provided.

Commits
  • f6633a0 chore(deps): bump the go-deps group with 4 updates (#215)
  • 19a1406 chore(deps): bump ossf/scorecard-action (#216)
  • 402da30 authzen: return verifier identifiers in the evaluation response context (veri...
  • 5df6f14 Fix Docker image port/bind/healthcheck mismatch (default 6001, bind 0.0.0.0) ...
  • c391ce0 build: require Go 1.27.2 (fixes GO-2026-6611/6612/6613/6617 stdlib vulns) (#214)
  • 29ca2ee fix(rpcert): drop wrpac keyUsage/contentCommitment check (#210)
  • a516911 chore(deps): bump github.com/SUNET/vc (#199)
  • f7283bf fix(registry): enforce did.required_verification_methods (#209)
  • 2aaf981 fix(lote): make verify_jws effective, add trust_anchor_bundle (BREAKING) (#211)
  • caf528c deps: bump golang.org/x/net to v0.60.0 (#212)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 15, 2026
@dependabot
build(deps): bump the go-deps group across 1 directory with 3 updates
cf4c46c 
Bumps the go-deps group with 3 updates in the / directory: [github.com/gmrtd/gmrtd](https://github.com/gmrtd/gmrtd), [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) and [github.com/sirosfoundation/go-trust](https://github.com/sirosfoundation/go-trust).


Updates `github.com/gmrtd/gmrtd` from 1.2.0 to 1.6.0
- [Release notes](https://github.com/gmrtd/gmrtd/releases)
- [Changelog](https://github.com/gmrtd/gmrtd/blob/main/CHANGELOG.md)
- [Commits](gmrtd/gmrtd@v1.2.0...v1.6.0)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

Updates `github.com/sirosfoundation/go-trust` from 0.23.2 to 0.25.0
- [Release notes](https://github.com/sirosfoundation/go-trust/releases)
- [Changelog](https://github.com/sirosfoundation/go-trust/blob/main/CHANGELOG.md)
- [Commits](sirosfoundation/go-trust@v0.23.2...v0.25.0)

---
updated-dependencies:
- dependency-name: github.com/gmrtd/gmrtd
  dependency-version: 1.3.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/sirosfoundation/go-trust
  dependency-version: 0.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-deps-e49a4312e2 branch from 7f9c54c to cf4c46c Compare October 22, 2026 08:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants