chore(deps): update bump go dependencies by renovate[bot] · Pull Request #994 · gotify/server

renovate · 2026-07-08T21:03:21Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/gin-contrib/cors	`v1.7.7` → `v1.7.8`
github.com/gin-contrib/gzip	`v1.2.6` → `v1.2.7`
github.com/go-playground/validator/v10	`v10.30.3` → `v10.30.4`
github.com/mattn/go-isatty	`v0.0.22` → `v0.0.24`
github.com/stretchr/testify	`v1.11.1` → `v1.12.1`
github.com/zitadel/oidc/v3	`v3.47.5` → `v3.51.3`
golang.org/x/crypto	`v0.53.0` → `v0.57.0`
gorm.io/driver/postgres	`v1.6.0` → `v1.6.3`

Release Notes

gin-contrib/cors (github.com/gin-contrib/cors)

`v1.7.8`

Compare Source

Changelog

Bug fixes

1c8f3f2: fix(lint): address golangci-lint v2.12 findings (@appleboy)
7f95ead: fix(lint): apply gofmt to formatted files (@appleboy)
b13f591: fix(lint): exclude goconst on test files (@appleboy)
4e1524a: fix(lint): address remaining v2.12 lint findings (@appleboy)

Enhancements

61b6b00: chore(deps): upgrade quic-go to v0.59.1 (@appleboy)
88fbadf: chore(deps): upgrade golang.org/x/crypto and x/net (@appleboy)
7f392d4: chore(deps): update dependencies and bump GitHub Actions (@appleboy)
efab1d5: chore(deps): upgrade golang.org/x/crypto to v0.55.0 (#194) (@appleboy)

Build process updates

b129b08: ci(actions): bump codecov/codecov-action from v5 to v6 (@appleboy)
63b00e5: ci(workflow): pin trivy-action to v0.35.0 tag (@appleboy)
13a0f79: ci(workflow): bump trivy-action from v0.35.0 to v0.36.0 (@appleboy)
d0f8eed: ci(lint): bump golangci-lint to v2.12 (@appleboy)
fded085: ci(actions): bump codecov/codecov-action from v6 to v7 (@appleboy)
76760d4: ci(actions): bump actions/checkout from v6 to v7 (@appleboy)
2046b62: ci(actions): update Go test matrix (#193) (@appleboy)

Documentation updates

53b098d: docs(readme): remove Go Report Card badge (@appleboy)
e9487ec: docs(readme): replace deprecated godoc.org links with pkg.go.dev (@appleboy)

gin-contrib/gzip (github.com/gin-contrib/gzip)

`v1.2.7`

Compare Source

Changelog

Bug fixes

d8207e9: fix(lint): address golangci-lint v2.12 findings (@appleboy)

Enhancements

2f8b8fb: chore(deps): upgrade quic-go to v0.59.1 (@appleboy)
806cace: chore(deps): upgrade golang.org/x/crypto and x/net (@appleboy)
2348539: chore(deps): update dependencies and bump GitHub Actions (@appleboy)
2f50fec: chore(deps): upgrade golang.org/x/crypto to v0.55.0 (#145) (@appleboy)

Build process updates

a1f042f: ci(actions): bump codecov/codecov-action from v5 to v6 (@appleboy)
8a6445f: ci(workflow): pin trivy-action to v0.35.0 tag (@appleboy)
55c4f91: ci(workflow): bump trivy-action from v0.35.0 to v0.36.0 (@appleboy)
f5623f0: ci(lint): bump golangci-lint to v2.12 (@appleboy)
f597cee: ci(actions): bump codecov/codecov-action from v6 to v7 (@appleboy)
cdef9ec: ci(actions): bump actions/checkout from v6 to v7 (@appleboy)
ae5b213: ci(actions): update Go test matrix (#144) (@appleboy)

Documentation updates

b21477d: docs(readme): remove Go Report Card badge (@appleboy)
6da1750: docs(readme): replace deprecated godoc.org links with pkg.go.dev (@appleboy)

Others

bc0be00: test: update decompression content length assertions (#143) (@appleboy)
c5c1649: test(static): make gzip size assertion robust on Go 1.27 (#146) (@appleboy)

go-playground/validator (github.com/go-playground/validator/v10)

`v10.30.4`

Compare Source

What's Changed

Add English translations for prefix and suffix validators by @morning-verlu in #1583
chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in #1589
chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #1591
chore(deps): bump golang.org/x/net from 0.38.0 to 0.55.0 in /_examples/validate_fn by @dependabot[bot] in #1593
chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in #1598
chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /_examples/validate_fn by @dependabot[bot] in #1597
feat: URN RFC 8141 by @leodido in #1224
chore(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #1601
chore(deps): bump github.com/leodido/go-urn from 1.4.0 to 1.5.0 by @dependabot[bot] in #1606
chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.15 by @dependabot[bot] in #1605
fix(fqdn): enforce maximum DNS name length by @matheusgb in #1603
fix: use idiomatic "at most" in English max/lte messages by @snowyukitty in #1600
chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @dependabot[bot] in #1612
test: cover startsnotwith/endsnotwith, RegisterStructValidationMapRules, and float32 comparator branches by @nguyenvantuan2391996 in #1609
docs: clarify fieldexcludes behavior by @1678092075 in #1610
feat(translations): add Armenian translations by @tigran90 in #1604
ci: Fix the linter version by @zemzale in #1617

New Contributors

@morning-verlu made their first contribution in #1583
@matheusgb made their first contribution in #1603
@snowyukitty made their first contribution in #1600
@nguyenvantuan2391996 made their first contribution in #1609
@1678092075 made their first contribution in #1610
@tigran90 made their first contribution in #1604

Full Changelog: go-playground/validator@v10.30.3...v10.30.4

mattn/go-isatty (github.com/mattn/go-isatty)

`v0.0.24`

Compare Source

`v0.0.23`

Compare Source

stretchr/testify (github.com/stretchr/testify)

`v1.12.1`

Compare Source

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

Change yaml library to go.yaml.in/yaml/v3 by @harryzcy in #1935
change yaml library to go.yaml.in/yaml/v3 by @boekkooi-impossiblecloud in #1772

New Contributors

@harryzcy made their first contribution in #1935
@boekkooi-impossiblecloud made their first contribution in #1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

Change yaml library to go.yaml.in/yaml/v3 by @harryzcy in #1935
change yaml library to go.yaml.in/yaml/v3 by @boekkooi-impossiblecloud in #1772

New Contributors

@harryzcy made their first contribution in #1935
@boekkooi-impossiblecloud made their first contribution in #1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

`v1.12.0`

Compare Source

What's Changed

Functional Changes

assert: make *AssertionFunc types just aliases by @dolmen in #1563

Fixes

mock: avoid panic when expected type is nil in Arguments.Diff by @mutaiib in #1775
mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @brackendawson in #1786
suite: validate method signatures and continue execution for valid tests by @vyas-git in #1665
assert.PanicsWithError: report error message by @olivergondza in #1400
assert: IsIncreasing et al can return false w/out failing by @brackendawson in #1787
add type to error message of assert.Same by @egawata in #1792
mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @brackendawson in #1795
assert: truncate very long objects in test failure messages by @brackendawson in #1646
assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @nghiack7 in #1888
suite: prevent panic when SetupTest skips with HandleStats by @blackwell-systems in #1877

Documentation, Build & CI

CI: test also with Go 1.23 by @dolmen in #1783
Vendor unmaintained github.com/pmezard/go-difflib by @brackendawson in #1708
Promote ccoVeille to maintainer by @brackendawson in #1784
build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #1790
assert.YAMLEq: Document mutlidoc behavior by @brackendawson in #1791
_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @dolmen in #1782
doc: remove ineffective inline code blocks by @brackendawson in #1714
Tag generated assertions as non-generated in new .gitattributes by @ubunatic in #1815
chore: vendor go-spew from https://github.com/davecgh/go-spew by @ccoVeille in #1827
require: fix godoc generation for assertions returning a bool by @Baxromumarov in #1850
docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by @a2not in #1821
docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by @a2not in #1842
EMERITUS.md: add @tylerb by @dolmen in #1812
CI: test also with Go 1.24 by @alexandear in #1856
deps: bump objx to v0.5.3 and remove dependency cycle issue by @ccoVeille in #1823
CI: upgrade GitHub Actions and pin hashes by @SuperQ in #1883
CI: add _readme-gofmt tool to reformat Go code in README by @dolmen in #1889
CI: add check of GitHub Action pinned hashes against tag by @dolmen in #1885
_codegen: modernize by @dolmen in #1890
build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #1906
mock: Mock.Return does not exist anymore by @Kentzo in #1905

New Contributors

@mutaiib made their first contribution in #1775
@vyas-git made their first contribution in #1665
@olivergondza made their first contribution in #1400
@egawata made their first contribution in #1792
@ubunatic made their first contribution in #1815
@Baxromumarov made their first contribution in #1850
@a2not made their first contribution in #1821
@nghiack7 made their first contribution in #1888
@blackwell-systems made their first contribution in #1877
@Kentzo made their first contribution in #1905

Full Changelog: stretchr/testify@v1.11.0...v1.12.0

What's Changed

mock: avoid panic when expected type is nil in Arguments.Diff by @mutaiib in #1775
CI: test also with Go 1.23 by @dolmen in #1783
mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @brackendawson in #1786
suite: validate method signatures and continue execution for valid tests by @vyas-git in #1665
Vendor unmaintained github.com/pmezard/go-difflib by @brackendawson in #1708
Promote ccoVeille to maintainer by @brackendawson in #1784
build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #1790
assert.PanicsWithError: report error message by @olivergondza in #1400
assert: IsIncreasing et al can return false w/out failing by @brackendawson in #1787
add type to error message of assert.Same by @egawata in #1792
assert.YAMLEq: Document mutlidoc behavior by @brackendawson in #1791
mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @brackendawson in #1795
_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @dolmen in #1782
assert: truncate very long objects in test failure messages by @brackendawson in #1646
doc: remove ineffective inline code blocks by @brackendawson in #1714
Tag generated assertions as non-generated in new .gitattributes by @ubunatic in #1815
chore: vendor go-spew from https://github.com/davecgh/go-spew by @ccoVeille in #1827
require: fix godoc generation for assertions returning a bool by @Baxromumarov in #1850
docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by @a2not in #1821
docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by @a2not in #1842
EMERITUS.md: add @tylerb by @dolmen in #1812
CI: test also with Go 1.24 by @alexandear in #1856
deps: bump objx to v0.5.3 and remove dependency cycle issue by @ccoVeille in #1823
CI: upgrade GitHub Actions and pin hashes by @SuperQ in #1883
assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @nghiack7 in #1888
suite: prevent panic when SetupTest skips with HandleStats by @blackwell-systems in #1877
CI: add _readme-gofmt tool to reformat Go code in README by @dolmen in #1889
CI: add check of GitHub Action pinned hashes against tag by @dolmen in #1885
_codegen: modernize by @dolmen in #1890
assert: make *AssertionFunc types just aliases by @dolmen in #1563
build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #1906
mock: Mock.Return does not exist anymore by @Kentzo in #1905

New Contributors

@mutaiib made their first contribution in #1775
@vyas-git made their first contribution in #1665
@olivergondza made their first contribution in #1400
@egawata made their first contribution in #1792
@ubunatic made their first contribution in #1815
@Baxromumarov made their first contribution in #1850
@a2not made their first contribution in #1821
@nghiack7 made their first contribution in #1888
@blackwell-systems made their first contribution in #1877
@Kentzo made their first contribution in #1905

Full Changelog: stretchr/testify@v1.11.0...v1.12.0

zitadel/oidc (github.com/zitadel/oidc/v3)

`v3.51.3`

Compare Source

Bug Fixes

op: stop double-escaping fragment response parameters (#979) (5098905), closes zitadel/zitadel#12645

`v3.51.2`

Compare Source

Bug Fixes

op: escape the request id in the auth callback URL (#981) (afe6bee), closes #979

`v3.51.1`

Compare Source

Bug Fixes

add credential hints to the example login form (#977) (83008d6)

`v3.51.0`

Compare Source

Features

rp: limit HTTP response body size (#971) (7464275)

Bug Fixes

oidc: map ErrSubjectInvalid to invalid_grant instead of server_error (#950) (cb9e7df), closes #945

`v3.49.5`

Compare Source

Bug Fixes

op: stop double-decoding redirect_uri in authorization requests (#969) (2d0c9cb), closes #775 #775 #775 #968 #775 #968

`v3.49.4`

Compare Source

Bug Fixes

client: avoid mutating caller http.Client in CallRevokeEndpoint (#963) (7a7a91d), closes #911

`v3.49.3`

Compare Source

Bug Fixes

op: guard against nil claims for opaque access tokens in token exchange (#959) (611e1a6), closes #704

`v3.49.2`

Compare Source

Bug Fixes

tracing key, doc rephrasing and guard slog.SetDefault against nil (#935) (65199e0)

`v3.49.1`

Compare Source

Bug Fixes

op: reject requested_token_type that cannot be issued (#932) (1974dae)

`v3.49.0`

Compare Source

Features

support custom issuer verifier (#928) (4404f82)

`v3.48.1`

Compare Source

Bug Fixes

rp: use redirect host for CLI callback server (#926) (3c8b704)

`v3.48.0`

Compare Source

Features

oidc: add client_id_metadata_document_supported discovery metadata (#905) (bcfceee), closes #904 #782

`v3.47.9`

Compare Source

Bug Fixes

only allow one authenticate method (#858) (b308f56)

`v3.47.8`

Compare Source

Bug Fixes

op: add client ownership check to LegacyServer CodeExchange (#902) (7d910a8)

`v3.47.7`

Compare Source

Bug Fixes

op: resolve client before RedirectToLogin for custom AuthorizeValidator (#910) (8789f50), closes #909

`v3.47.6`

Compare Source

Bug Fixes

made bearer token scheme case-insensitive for non-spec-compliant oidc providers (#877) (4f27480), closes #876

go-gorm/postgres (gorm.io/driver/postgres)

`v1.6.3`

Compare Source

`v1.6.2`

Compare Source

`v1.6.1`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-07-08T21:03:23Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

23 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`github.com/bytedance/gopkg`	`v0.1.3` -> `v0.1.4`
`github.com/bytedance/sonic`	`v1.15.0` -> `v1.15.2`
`github.com/bytedance/sonic/loader`	`v0.5.0` -> `v0.5.1`
`github.com/cloudwego/base64x`	`v0.1.6` -> `v0.1.7`
`github.com/gabriel-vasile/mimetype`	`v1.4.13` -> `v1.4.15`
`github.com/gin-contrib/sse`	`v1.1.0` -> `v1.1.1`
`github.com/go-logr/logr`	`v1.4.3` -> `v1.4.4`
`github.com/goccy/go-json`	`v0.10.5` -> `v0.10.6`
`github.com/jackc/pgx/v5`	`v5.7.6` -> `v5.10.0`
`github.com/klauspost/cpuid/v2`	`v2.3.0` -> `v2.4.0`
`github.com/leodido/go-urn`	`v1.4.0` -> `v1.5.0`
`github.com/pelletier/go-toml/v2`	`v2.2.4` -> `v2.4.3`
`github.com/quic-go/quic-go`	`v0.59.0` -> `v0.60.0`
`go.mongodb.org/mongo-driver/v2`	`v2.5.0` -> `v2.8.0`
`go.opentelemetry.io/otel`	`v1.43.0` -> `v1.45.0`
`go.opentelemetry.io/otel/metric`	`v1.43.0` -> `v1.45.0`
`go.opentelemetry.io/otel/trace`	`v1.43.0` -> `v1.45.0`
`golang.org/x/arch`	`v0.23.0` -> `v0.29.0`
`golang.org/x/net`	`v0.55.0` -> `v0.58.0`
`golang.org/x/sync`	`v0.21.0` -> `v0.23.0`
`golang.org/x/sys`	`v0.46.0` -> `v0.48.0`
`golang.org/x/text`	`v0.38.0` -> `v0.42.0`
`google.golang.org/protobuf`	`v1.36.10` -> `v1.36.11`
`go`	`1.25.0` -> `1.26.0`

codecov · 2026-07-08T21:10:34Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.16%. Comparing base (e6361ca) to head (43890be).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #994   +/-   ##
=======================================
  Coverage   76.16%   76.16%           
=======================================
  Files          66       66           
  Lines        3625     3625           
=======================================
  Hits         2761     2761           
  Misses        653      653           
  Partials      211      211

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

renovate Bot requested a review from a team as a code owner July 8, 2026 21:03

renovate Bot added the dependencies Pull requests that update a dependency file label Jul 8, 2026

chore(deps): update bump go dependencies

43890be

renovate Bot force-pushed the renovate/bump-dependencies-go branch from 796823b to 43890be Compare September 20, 2026 17:23

renovate Bot changed the title ~~chore(deps): update module golang.org/x/crypto to v0.54.0~~ chore(deps): update bump go dependencies Sep 20, 2026

jmattheis approved these changes Sep 20, 2026

View reviewed changes

jmattheis added this pull request to the merge queue Sep 20, 2026

Merged via the queue into master with commit d3331e0 Sep 20, 2026
4 checks passed

renovate Bot deleted the renovate/bump-dependencies-go branch September 20, 2026 18:22

Navigation Menu

Uh oh!

chore(deps): update bump go dependencies - #994

chore(deps): update bump go dependencies#994
jmattheis merged 1 commit into
masterfrom
renovate/bump-dependencies-go

renovate Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Changelog

Bug fixes

Enhancements

Build process updates

Documentation updates

Changelog

Bug fixes

Enhancements

Build process updates

Documentation updates

Others

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

New Contributors

What's Changed

New Contributors

Bug Fixes

Bug Fixes

Bug Fixes

Features

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Configuration

Uh oh!

renovate Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

codecov Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Jul 8, 2026 •

edited

Loading

renovate Bot commented Jul 8, 2026 •

edited

Loading

codecov Bot commented Jul 8, 2026 •

edited

Loading