fix(deps): update go-libraries by renovate-bot · Pull Request #6295 · google/osv.dev

renovate-bot · 2026-11-03T18:00:26Z

This PR contains the following updates:

Package	Change	Age	Confidence
charm.land/bubbletea/v2	`v2.1.0` → `v2.1.1`
cloud.google.com/go/datastore	`v1.27.1` → `v1.28.1`
cloud.google.com/go/monitoring	`v1.31.0` → `v1.32.1`
cloud.google.com/go/pubsub/v2	`v2.7.0` → `v2.8.1`
cloud.google.com/go/storage	`v1.69.0` → `v1.70.0`
github.com/jackc/pgx/v5	`v5.11.0` → `v5.12.0`
github.com/tidwall/gjson	`v1.20.0` → `v1.20.1`
github.com/yuin/goldmark/v2	`v2.1.6` → `v2.1.15`
go.yaml.in/yaml/v4	`v4.0.0-rc.6` → `v4.0.0`
golang.org/x/oauth2	`v0.37.0` → `v0.38.0`
golang.org/x/sync	`v0.24.0` → `v0.25.0`
google.golang.org/api	`v0.306.0` → `v0.311.0`
google.golang.org/grpc	`v1.84.0` → `v1.85.0`
k8s.io/apimachinery	`v0.37.1` → `v0.37.2`

Release Notes

charmbracelet/bubbletea (charm.land/bubbletea/v2)

`v2.1.1`

Compare Source

Terminal size query vulnerability

This patch version fixes a vulnerability reported by @Reload3d. You can find the details of the exploit here.

Best regards,
Charm XX 💫

Changelog

Fixed

9c6c325: fix: ingnore implausible terminal resize reports (#1887) (@andrinoff)

Other stuff

67b4c7a: v2.1.1 (@andrinoff)

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

googleapis/google-cloud-go (cloud.google.com/go/datastore)

`v1.28.1`: datastore: v1.28.1

Bug Fixes

Adds additional validation for REST RPC requests (#20753) (7827181)

`v1.28.0`: video: v1.28.0

v1.28.0 (2026-04-02)

jackc/pgx (github.com/jackc/pgx/v5)

`v5.12.0`

Compare Source

tidwall/gjson (github.com/tidwall/gjson)

`v1.20.1`

Compare Source

yuin/goldmark (github.com/yuin/goldmark/v2)

`v2.1.15`

Compare Source

fix #631 - #640

`v2.1.14`

Compare Source

fix: deprecate shared extensions, closes #630
perf(parser): link parsing
fix(extension): fix #628
fix(renderer): fix #627
fix(parser): fix #626
fix(parser): fix #625

`v2.1.13`

Compare Source

refactor(parse): Value.Str and Value.Bytes should return raw data
fix(util): fix #623
fix(extension): fix #620, fix #621
fix(parser): fix #619

`v2.1.12`

Compare Source

chore: adjust linkify spe
fix(parser): fix #618
fix(extension): fix #617

`v2.1.11`

Compare Source

fix(parser): fix #616

`v2.1.10`

Compare Source

refactor(parser,extension): simplify linkify parser
fix(parser): fix #615
docs(README): update benchmark results

`v2.1.9`

Compare Source

fix(extension): fix footnotes in other footnotes
perf: cache closing tag result
fix: fail to parse unclosed html blocks(6)
perf: limit email local-part length
perf: limit footnote label length
perf: cache isThematicBreak result
fix(extension): fix table parsing when a delimiter-like row follows a table

`v2.1.8`

Compare Source

fix(parser): fixes #613

`v2.1.7`

Compare Source

fix(parser): fix the fast path for emphasis parsing to handle linkify prefixes correctly

yaml/go-yaml (go.yaml.in/yaml/v4)

`v4.0.0`: go-yaml v4.0.0

Compare Source

go-yaml v4.0.0

go-yaml v4.0.0 is the first stable release of the v4 series, maintained by the
YAML organization.
It adds configurable loading and dumping, public plugin interfaces, structured
errors, and a CLI for inspecting YAML processing.
The classic APIs remain supported, so applications can adopt v4 incrementally.

Getting started

Install the release:

go get go.yaml.in/yaml/v4@v4.0.0

Use this import path in your Go code:

import "go.yaml.in/yaml/v4"

For an existing v3 application, start by updating imports, reviewing custom
unmarshalers, and running your tests.
You can continue using Unmarshal, Marshal, NewDecoder, and NewEncoder.
The v2 and v3 APIs remain frozen, with security fixes only; new features and
routine bug fixes are developed in v4.

Why add Load and Dump?

Applications need different YAML policies: strict configuration validation,
particular output layouts, or custom anchor handling.
The new Load and Dump functions and streaming Loader and Dumper accept
functional options and plugins for those choices.
They use YAML's load/dump terminology and are recommended for new code.

The classic entry points keep compatibility settings rather than changing
formatting and error presentation for every existing caller.
Moving to the new API is an explicit choice to use v4 defaults, with presets
available when you want older settings.
Classic APIs remain supported.

For example, load a configuration with strict field checking, then choose its
output indentation:

package main

import (
    "fmt"
    "log"

    "go.yaml.in/yaml/v4"
)

func main() {
    var config struct {
        Name string `yaml:"name"`
        Port int    `yaml:"port"`
    }
    input := []byte("name: api\nport: 8080\n")
    if err := yaml.Load(input, &config, yaml.WithKnownFields()); err != nil {
        log.Fatal(err)
    }
    output, err := yaml.Dump(config, yaml.WithIndent(4))
    if err != nil {
        log.Fatal(err)
    }
    fmt.Print(string(output))
}

Unknown struct fields are ignored by default; WithKnownFields() opts into
rejecting them.
Duplicate mapping keys are rejected by default.
Options apply in order, so later options override earlier settings.

Defaults and compatibility

Setting	Classic Marshal / Unmarshal	Load / Dump defaults
Output indentation	4 spaces	2 spaces
Sequence indentation	Non-compact	Compact
Quote preference	Legacy mixed quoting	Single quotes where possible
Preferred output width	Unlimited for Marshal	80 characters
Error presentation	v3 style	v4 style with stage and position

Quoting still depends on scalar content and styles, and line width is a
preference rather than a guaranteed maximum.
NewDecoder uses v3 error formatting; NewEncoder retains v3 output settings
with v4 error formatting.

Choose WithV3Defaults() to select compatibility defaults through the new API.
When replacing Marshal, also disable wrapping to match its line-width setting:

output, err := yaml.Dump(config,
    yaml.WithV3Defaults(),
    yaml.WithLineWidth(-1),
)

Presets select defaults; they do not reverse every v4 bug fix or reproduce every
legacy code path.
For example, package-level Load requires exactly one document, whereas
Unmarshal retains legacy handling of empty input and trailing content.
WithSingleDocument() deliberately skips validation of later documents.
Use WithAllDocuments() to load or dump slices as document streams, or use a
streaming loader or dumper to process documents individually.

Options, plugins, and nodes

Options control indentation, sequence layout, quoting, document markers,
Unicode escaping, field validation, and more.
OptsYAML accepts YAML configuration for supported settings, which can also be
shared with the CLI.

The public plugin APIs cover six areas:

Loader-Limits: configure depth and alias expansion checks.
Merge-Key: control merge directives and mapping conflicts, or replace the
merge algorithm.
Alias-Data: supply external anchors, retain anchors across documents, use
dotted paths, or reject alias references.
Error-format: select error presentation or implement a custom formatter.
YAML-parser: select an alternative parser implementation.
Tab-indent: opt into tab-aware input and output indentation.

The core module provides implementations for these APIs.
Additional parsers live in separate modules, keeping their dependencies optional.
Existing depth and alias protections remain enabled by default.

yaml.Node gives access to tags, styles, comments, anchors, and source positions.
Node.Load and Node.Dump accept options for node conversion.
Pass construction options explicitly inside custom unmarshaler hooks;
Node.Load starts with fresh defaults independently of its calling loader.
Stream nodes can expose encoding and YAML directives.
Node output retains supported styles and comments without promising identical
source formatting.

Migration details to check

NewLoader and NewDumper return errors; check them before using the stream.
Check dumper Dump and Close errors as well.

Custom UnmarshalYAML(*yaml.Node) error hooks must use the v4 node type.
Recognized v3 node hooks produce a migration error rather than silently losing
custom behavior.
The legacy UnmarshalYAML(func(any) error) error callback remains supported.

Conversion failures return structured *yaml.LoadErrors values.
Use errors.As to inspect structured errors or match legacy *yaml.TypeError
values, rather than relying on a direct type assertion or fixed message text.

Review the migration guide
for the complete compatibility guidance.

Inspect YAML with the CLI

Install the CLI from this release:

go install go.yaml.in/yaml/v4/cmd/go-yaml@v4.0.0

Convert to JSON, inspect nodes, or examine scanner and parser output:

go-yaml -J config.yaml
go-yaml -N config.yaml
go-yaml -T config.yaml
go-yaml -E config.yaml

The CLI also supports reusable options files and pipelines between intermediate
stages, making small bug reports easier to reproduce.
Runtime plugin selection chooses implementations already linked into the binary.

googleapis/google-api-go-client (google.golang.org/api)

`v0.311.0`

Compare Source

Features

all: Auto-regenerate discovery clients (#3798) (045173e)
all: Auto-regenerate discovery clients (#3801) (0c25030)
all: Auto-regenerate discovery clients (#3802) (9521c1f)
all: Auto-regenerate discovery clients (#3803) (a107bde)
all: Auto-regenerate discovery clients (#3805) (9f9ad47)
all: Auto-regenerate discovery clients (#3806) (b58e90f)
all: Auto-regenerate discovery clients (#3808) (1179cf8)

`v0.310.0`

Compare Source

Features

all: Auto-regenerate discovery clients (#3795) (2a636ad)
all: Auto-regenerate discovery clients (#3797) (df2d2b0)

`v0.309.0`

Compare Source

Features

all: Auto-regenerate discovery clients (#3789) (e05cb39)
all: Auto-regenerate discovery clients (#3791) (0aad672)
all: Auto-regenerate discovery clients (#3792) (7a3948f)

`v0.308.0`

Compare Source

Features

all: Auto-regenerate discovery clients (#3787) (527f9a3)

`v0.307.0`

Compare Source

Features

all: Auto-regenerate discovery clients (#3785) (b2487a4)

grpc/grpc-go (google.golang.org/grpc)

`v1.85.0`: Release 1.85.0

Compare Source

New Features

stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
- Special Thanks: @aryansk
metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
- Special Thanks: @yuyangguo42

Bug Fixes

transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
- Special Thanks: @stanhu
server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
- Special Thanks: @winklemad
client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
- Special Thanks: @nvxbug
transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
- Special Thanks: @buger

kubernetes/apimachinery (k8s.io/apimachinery)

`v0.37.2`

Compare Source

Configuration

📅 Schedule: (in timezone Australia/Sydney)

Branch creation
- "before 6am on wednesday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

forking-renovate · 2026-11-03T18:00:30Z

ℹ️ Artifact update notice

File name: bindings/go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package	Change
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260706201446-f0a921348800` -> `v0.0.0-20260817212433-ac3dfec99bb1`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260706201446-f0a921348800` -> `v0.0.0-20260817212433-ac3dfec99bb1`

File name: go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

11 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package	Change
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260928230214-8a89bd6388cc` -> `v0.0.0-20261012220534-4341edf3f941`
`cel.dev/expr`	`v0.25.2` -> `v0.25.3`
`cloud.google.com/go/auth`	`v0.24.1-0.20261001053825-dbc26066f70a` -> `v0.24.1`
`cloud.google.com/go/auth/oauth2adapt`	`v0.3.0` -> `v0.3.1`
`cloud.google.com/go/iam`	`v1.12.0` -> `v1.14.0`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.37.0` -> `v1.39.1-0.20260819172001-e6e3fd93e4be`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.23` -> `v0.3.24`
`github.com/googleapis/gax-go/v2`	`v2.26.2` -> `v2.27.0`
`github.com/jackc/puddle/v2`	`v2.2.2` -> `v2.2.3`
`google.golang.org/genproto`	`v0.0.0-20260715232425-e75dac1f907d` -> `v0.0.0-20261012220534-4341edf3f941`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20261019180522-ce908d29299b` -> `v0.0.0-20261026165753-2ffab32bce7e`

codecov-commenter · 2026-11-13T14:49:33Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.02%. Comparing base (c7a367d) to head (ab9ca82).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #6295   +/-   ##
=======================================
  Coverage   59.02%   59.02%           
=======================================
  Files         170      170           
  Lines       15870    15870           
=======================================
  Hits         9368     9368           
  Misses       6499     6499           
  Partials        3        3

Flag	Coverage Δ
bindings	`77.92% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

forking-renovate Bot added the dependencies Pull requests that update a dependency file label Nov 3, 2026

renovate-bot force-pushed the renovate/go-libraries branch 11 times, most recently from 98262b5 to cf056d7 Compare November 11, 2026 02:59

renovate-bot force-pushed the renovate/go-libraries branch 3 times, most recently from ff611fa to 1a89a5f Compare November 13, 2026 14:48

fix(deps): update go-libraries

ab9ca82

renovate-bot force-pushed the renovate/go-libraries branch from 1a89a5f to ab9ca82 Compare November 13, 2026 21:48

Navigation Menu

Repository navigation

fix(deps): update go-libraries - #6295

fix(deps): update go-libraries#6295
renovate-bot wants to merge 1 commit into
google:masterfrom
renovate-bot:renovate/go-libraries

renovate-bot commented Nov 3, 2026 •

edited

Loading

Uh oh!

forking-renovate Bot commented Nov 3, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Nov 13, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

renovate-bot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Terminal size query vulnerability

Changelog

Fixed

Other stuff

v1.28.1: datastore: v1.28.1

Bug Fixes

v1.28.0: video: v1.28.0

v1.28.0 (2026-04-02)

v4.0.0: go-yaml v4.0.0

go-yaml v4.0.0

Getting started

Why add Load and Dump?

Defaults and compatibility

Options, plugins, and nodes

Migration details to check

Inspect YAML with the CLI

Further reading and thanks

Features

Features

Features

Features

Features

v1.85.0: Release 1.85.0

New Features

Bug Fixes

Configuration

Uh oh!

forking-renovate Bot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: bindings/go/go.mod

File name: go/go.mod

Uh oh!

codecov-commenter commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate-bot commented Nov 3, 2026 •

edited

Loading

`v1.28.1`: datastore: v1.28.1

`v1.28.0`: video: v1.28.0

`v4.0.0`: go-yaml v4.0.0

`v1.85.0`: Release 1.85.0

forking-renovate Bot commented Nov 3, 2026 •

edited

Loading

codecov-commenter commented Nov 13, 2026 •

edited

Loading