bagas/tunnel-please
Public Access
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

fix(deps): update all-dependencies #158

Merged
Renovate-Clanker merged 1 commits from renovate/all-dependencies into main 2026-07-19 15:08:05 +07:00
Conversation 1 Commits 1 Files Changed 3
+31 -11
Renovate-Clanker commented 2026-07-19 15:08:02 +07:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Change Age Confidence Type Update
github.com/caddyserver/certmagic v0.25.3 → v0.25.4 age confidence require patch
golang 1.26.2-alpine → 1.26.5-alpine age confidence final patch
golang.org/x/crypto v0.50.0 → v0.54.0 age confidence require minor
google.golang.org/grpc v1.80.0 → v1.82.1 age confidence require minor

Release Notes

caddyserver/certmagic (github.com/caddyserver/certmagic)

v0.25.4

Compare Source

grpc/grpc-go (google.golang.org/grpc)

v1.82.1: Release 1.82.1

Compare Source

Security

  • server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
  • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
  • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
  • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.

v1.82.0: Release 1.82.0

Compare Source

Behavior Changes

  • server: Remove support for GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment varibale. Strict incoming RPC path validation (which has been the default since v1.79.3) can no longer be disabled. (#​9112)
  • transport: Add environment variable to change the default max header list size from 16MB to 8KB. This may be enabled by setting GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true. This will be enabled by default in a subsequent release. (#​9019)
  • balancer: Load Balancing policy registry is now case-sensitive. Set GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false (and file an issue) to revert to case-insensitive behavior. (#​9017)

New Features

  • experimental/stats: Expose a new API, NewContextWithLabelCallback, to register a callback that is invoked when telemetry labels are added. (#​8877)
  • client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (#​8929)
  • server: Add environment variable GRPC_GO_SERVER_GOROUTINE_LABELS that controls setting runtime/pprof.Labels on goroutines spawned by the server. Set GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true to add the grpc.method label on goroutines spawned to handle incoming requests. (#​9082)

Bug Fixes

  • xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (#​9138)
  • grpc: In the deprecated gzip Compressor (used via the deprecated WithCompressor dial option), enforce the MaxRecvMsgSize limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (#​9114)
  • stats/opentelemetry: Record retry attempts, grpc.previous-rpc-attempts, at the call level and not the attempt level. (#​8923)
  • encoding: Ensure Close() is always called on readers returned from Compressor.Decompress if possible. (#​9135)
  • channelz: Fix the LastMessageSentTimestamp and LastMessageReceivedTimestamp fields in SocketMetrics to ensure they contain correct timestamp values. (#​9109)

v1.81.1: Release 1.81.1

Compare Source

Security

  • xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per gRFC A41. (#​9111)

Bug Fixes

  • otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. (#​9081)

v1.81.0: Release 1.81.0

Compare Source

Behavior Changes

  • balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. (#​8808)

Dependencies

  • Minimum supported Go version is now 1.25. (#​8969)

Bug Fixes

  • xds: Use the leaf cluster's security config for the TLS handshake instead of the aggregate cluster's config. (#​8956)
  • transport: Send a RST_STREAM when receiving an END_STREAM when the stream is not already half-closed. (#​8832)
  • xds: Fix ADS resource name validation to prevent a panic. (#​8970)

New Features

  • grpc/stats: Add support for custom labels in per-call metrics (gRFC A108). (#​9008)
  • xds: Add support for Server Name Indication (SNI) and SAN validation (gRFC A101). Disabled by default. To enable, set GRPC_EXPERIMENTAL_XDS_SNI=true environment variable. (#​9016)
  • xds: Add support to control which fields get propagated from ORCA backend metric reports to LRS load reports (gRFC A85). Disabled by default. To enable, set GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION=true. (#​9005)
  • xds: Add metrics to track xDS client connectivity and cached resource state (gRFC A78). (#​8807)
  • stats/otel: Enhance grpc.subchannel.disconnections metric by adding disconnection reason to the grpc.disconnect_error label (gRFC A94). This provides granular insights into why subchannels are closing. (#​8973)
  • mem: Add mem.Buffer.Slice() API to slice the buffer like a slice. (#​8977)

Performance Improvements

  • alts: Pool read buffers to lower memory utilization when sockets are unreadable. (#​8964)
  • transport: Pool HTTP/2 framer read buffers to reduce idle memory consumption. Currently limited to Linux for ALTS and non-encrypted transports (TCP, Unix). To disable, set GRPC_GO_EXPERIMENTAL_HTTP_FRAMER_READ_BUFFER_POOLING=false and report any issues. (#​9032)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | |---|---|---|---|---|---| | [github.com/caddyserver/certmagic](https://github.com/caddyserver/certmagic) | `v0.25.3` → `v0.25.4` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fcaddyserver%2fcertmagic/v0.25.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fcaddyserver%2fcertmagic/v0.25.3/v0.25.4?slim=true) | require | patch | | golang | `1.26.2-alpine` → `1.26.5-alpine` | ![age](https://developer.mend.io/api/mc/badges/age/docker/golang/1.26.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/golang/1.26.2/1.26.5?slim=true) | final | patch | | [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) | [`v0.50.0` → `v0.54.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.50.0...refs/tags/v0.54.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fcrypto/v0.54.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fcrypto/v0.50.0/v0.54.0?slim=true) | require | minor | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `v1.80.0` → `v1.82.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fgrpc/v1.82.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fgrpc/v1.80.0/v1.82.1?slim=true) | require | minor | --- ### Release Notes <details> <summary>caddyserver/certmagic (github.com/caddyserver/certmagic)</summary> ### [`v0.25.4`](https://github.com/caddyserver/certmagic/compare/v0.25.3...v0.25.4) [Compare Source](https://github.com/caddyserver/certmagic/compare/v0.25.3...v0.25.4) </details> <details> <summary>grpc/grpc-go (google.golang.org/grpc)</summary> ### [`v1.82.1`](https://github.com/grpc/grpc-go/releases/tag/v1.82.1): Release 1.82.1 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.82.0...v1.82.1) ### Security - server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable `GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT`. - xds/rbac: Support `Metadata` and `RequestedServerName` permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open. - xds/rbac: Fix panic when parsing unsupported fields in `NotRule`/`NotId` permissions. - xds/rbac: Support the deprecated `source_ip` principal identifier by treating it as equivalent to `direct_remote_ip`. ### [`v1.82.0`](https://github.com/grpc/grpc-go/releases/tag/v1.82.0): Release 1.82.0 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.0) ### Behavior Changes - server: Remove support for `GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING` environment varibale. Strict incoming RPC path validation (which has been the default since `v1.79.3`) can no longer be disabled. ([#&#8203;9112](https://github.com/grpc/grpc-go/issues/9112)) - transport: Add environment variable to change the default max header list size from `16MB` to `8KB`. This may be enabled by setting `GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true`. This will be enabled by default in a subsequent release. ([#&#8203;9019](https://github.com/grpc/grpc-go/issues/9019)) - balancer: Load Balancing policy registry is now case-sensitive. Set `GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false` (and file an issue) to revert to case-insensitive behavior. ([#&#8203;9017](https://github.com/grpc/grpc-go/issues/9017)) ### New Features - experimental/stats: Expose a new API, `NewContextWithLabelCallback`, to register a callback that is invoked when telemetry labels are added. ([#&#8203;8877](https://github.com/grpc/grpc-go/issues/8877)) - Special Thanks: [@&#8203;seth-epps](https://github.com/seth-epps) - client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. ([#&#8203;8929](https://github.com/grpc/grpc-go/issues/8929)) - Special Thanks: [@&#8203;chengxilo](https://github.com/chengxilo) - server: Add environment variable `GRPC_GO_SERVER_GOROUTINE_LABELS` that controls setting `runtime/pprof.Labels` on goroutines spawned by the server. Set `GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true` to add the `grpc.method` label on goroutines spawned to handle incoming requests. ([#&#8203;9082](https://github.com/grpc/grpc-go/issues/9082)) - Special Thanks: [@&#8203;dfinkel](https://github.com/dfinkel) ### Bug Fixes - xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. ([#&#8203;9138](https://github.com/grpc/grpc-go/issues/9138)) - grpc: In the deprecated `gzip` Compressor (used via the deprecated `WithCompressor` dial option), enforce the `MaxRecvMsgSize` limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. ([#&#8203;9114](https://github.com/grpc/grpc-go/issues/9114)) - Special Thanks: [@&#8203;evilgensec](https://github.com/evilgensec) - stats/opentelemetry: Record retry attempts, `grpc.previous-rpc-attempts`, at the call level and not the attempt level. ([#&#8203;8923](https://github.com/grpc/grpc-go/issues/8923)) - encoding: Ensure `Close()` is always called on readers returned from `Compressor.Decompress` if possible. ([#&#8203;9135](https://github.com/grpc/grpc-go/issues/9135)) - channelz: Fix the `LastMessageSentTimestamp` and `LastMessageReceivedTimestamp` fields in `SocketMetrics` to ensure they contain correct timestamp values. ([#&#8203;9109](https://github.com/grpc/grpc-go/issues/9109)) ### [`v1.81.1`](https://github.com/grpc/grpc-go/releases/tag/v1.81.1): Release 1.81.1 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.81.0...v1.81.1) ### Security - xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per [gRFC A41](https://github.com/grpc/proposal/blob/master/A41-xds-rbac.md). ([#&#8203;9111](https://github.com/grpc/grpc-go/issues/9111)) - Special Thanks: [@&#8203;al4an444](https://github.com/al4an444) ### Bug Fixes - otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. ([#&#8203;9081](https://github.com/grpc/grpc-go/issues/9081)) ### [`v1.81.0`](https://github.com/grpc/grpc-go/releases/tag/v1.81.0): Release 1.81.0 [Compare Source](https://github.com/grpc/grpc-go/compare/v1.80.0...v1.81.0) ### Behavior Changes - balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. ([#&#8203;8808](https://github.com/grpc/grpc-go/issues/8808)) ### Dependencies - Minimum supported Go version is now 1.25. ([#&#8203;8969](https://github.com/grpc/grpc-go/issues/8969)) ### Bug Fixes - xds: Use the leaf cluster's security config for the TLS handshake instead of the aggregate cluster's config. ([#&#8203;8956](https://github.com/grpc/grpc-go/issues/8956)) - transport: Send a `RST_STREAM` when receiving an `END_STREAM` when the stream is not already half-closed. ([#&#8203;8832](https://github.com/grpc/grpc-go/issues/8832)) - xds: Fix ADS resource name validation to prevent a panic. ([#&#8203;8970](https://github.com/grpc/grpc-go/issues/8970)) ### New Features - grpc/stats: Add support for custom labels in per-call metrics ([gRFC A108](https://github.com/grpc/proposal/blob/master/A108-otel-custom-per-call-label.md)). ([#&#8203;9008](https://github.com/grpc/grpc-go/issues/9008)) - xds: Add support for Server Name Indication (SNI) and SAN validation ([gRFC A101](https://github.com/grpc/proposal/blob/master/A101-SNI-setting-and-SNI-SAN-validation.md)). Disabled by default. To enable, set `GRPC_EXPERIMENTAL_XDS_SNI=true` environment variable. ([#&#8203;9016](https://github.com/grpc/grpc-go/issues/9016)) - xds: Add support to control which fields get propagated from ORCA backend metric reports to LRS load reports ([gRFC A85](https://github.com/grpc/proposal/blob/master/A85-lrs-custom-metrics-changes.md)). Disabled by default. To enable, set `GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION=true`. ([#&#8203;9005](https://github.com/grpc/grpc-go/issues/9005)) - xds: Add metrics to track xDS client connectivity and cached resource state ([gRFC A78](https://github.com/grpc/proposal/blob/master/A78-grpc-metrics-wrr-pf-xds.md)). ([#&#8203;8807](https://github.com/grpc/grpc-go/issues/8807)) - stats/otel: Enhance `grpc.subchannel.disconnections` metric by adding disconnection reason to the `grpc.disconnect_error` label ([gRFC A94](https://github.com/grpc/proposal/blob/master/A94-subchannel-otel-metrics.md)). This provides granular insights into why subchannels are closing. ([#&#8203;8973](https://github.com/grpc/grpc-go/issues/8973)) - mem: Add `mem.Buffer.Slice()` API to slice the buffer like a slice. ([#&#8203;8977](https://github.com/grpc/grpc-go/issues/8977)) - Special Thanks: [@&#8203;ash2k](https://github.com/ash2k) ### Performance Improvements - alts: Pool read buffers to lower memory utilization when sockets are unreadable. ([#&#8203;8964](https://github.com/grpc/grpc-go/issues/8964)) - transport: Pool HTTP/2 framer read buffers to reduce idle memory consumption. Currently limited to Linux for ALTS and non-encrypted transports (TCP, Unix). To disable, set `GRPC_GO_EXPERIMENTAL_HTTP_FRAMER_READ_BUFFER_POOLING=false` and report any issues. ([#&#8203;9032](https://github.com/grpc/grpc-go/issues/9032)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTcuOSIsInVwZGF0ZWRJblZlciI6IjQzLjI1Ny45IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Renovate-Clanker added 1 commit 2026-07-19 15:08:02 +07:00
fix(deps): update all-dependencies
Tests / Run Tests (pull_request) Successful in 2m30s
Details
04d6ab1661
Renovate-Clanker scheduled this pull request to auto merge when all checks succeed 2026-07-19 15:08:03 +07:00
Renovate-Clanker commented 2026-07-19 15:08:03 +07:00
Author
Collaborator
Copy Link
Copy Source

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 7 additional dependencies were updated

Details:

Package Change
golang.org/x/mod v0.35.0 -> v0.37.0
golang.org/x/net v0.53.0 -> v0.56.0
golang.org/x/sync v0.20.0 -> v0.22.0
golang.org/x/sys v0.43.0 -> v0.47.0
golang.org/x/text v0.36.0 -> v0.40.0
golang.org/x/tools v0.44.0 -> v0.47.0
google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516 -> v0.0.0-20260414002931-afd174a4e478
### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 7 additional dependencies were updated Details: | **Package** | **Change** | | :------------------------------------------ | :--------------------------------------------------------------------------- | | `golang.org/x/mod` | `v0.35.0` -> `v0.37.0` | | `golang.org/x/net` | `v0.53.0` -> `v0.56.0` | | `golang.org/x/sync` | `v0.20.0` -> `v0.22.0` | | `golang.org/x/sys` | `v0.43.0` -> `v0.47.0` | | `golang.org/x/text` | `v0.36.0` -> `v0.40.0` | | `golang.org/x/tools` | `v0.44.0` -> `v0.47.0` | | `google.golang.org/genproto/googleapis/rpc` | `v0.0.0-20260120221211-b8f7ae30c516` -> `v0.0.0-20260414002931-afd174a4e478` |
Renovate-Clanker merged commit 16994d7b7c into main 2026-07-19 15:08:05 +07:00
Renovate-Clanker deleted branch renovate/all-dependencies 2026-07-19 15:08:05 +07:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Renovate-Clanker bagas
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bagas/tunnel-please#158