Skip to content

build(deps): Bump the go-dependencies group across 1 directory with 5 updates - #4648

Merged
KaloyanTanev merged 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-4ed10d227a
Aug 18, 2026
Merged

build(deps): Bump the go-dependencies group across 1 directory with 5 updates#4648
KaloyanTanev merged 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-4ed10d227a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 4 updates in the / directory: github.com/stretchr/testify, golang.org/x/crypto, golang.org/x/net and golang.org/x/tools.

Updates github.com/stretchr/testify from 1.11.1 to 1.12.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

New Contributors

... (truncated)

Commits
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • d2699be _codegen: modernize
  • a463c8c Merge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashes
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.54.0 to 0.55.0

Commits
  • f44d03d go.mod: update golang.org/x dependencies
  • 5ed4944 crypto/internal/poly1305: provide optimised assembly for riscv64
  • b07833c ssh: return window credit for discarded extended data
  • d701c51 acme: fix nil pointer dereference in pebble test error reporting
  • 999d053 ssh: fix parsing of GSSAPI payloads offering multiple mechanisms
  • 90f76b8 ssh: reject certificate signature keys before recursing
  • b53964a ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs
  • 626e40f ssh: drain stderr on forwarded TCP and Unix channels
  • 31914c6 x509roots/fallback: update bundle
  • f2135b8 all: clean up minor issues found by staticcheck
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.57.0 to 0.58.0

Commits
  • acc78e0 go.mod: update golang.org/x dependencies
  • 90d10f0 internal/http3: delete invalid Content-Length if declared in server handler
  • 08abf4d internal/http3: infer headers when Content-Encoding is set but is empty
  • 8d10596 http2: avoid deadlocks in wrapped ClientConn state callback
  • 99c3b0a http2/hpack: build the table lookup maps lazily, only for encoders
  • 5a920b1 http3: rework registration to allow using a fake network
  • 7fd2842 quic: return an error from Accept after PacketConn reader exits
  • 825111d quic: avoid busy-loop when keep-alive is blocked by congestion control
  • a02ddfa http/httpproxy: prioritize lowercase proxy environment variables
  • 574e5eb quic: halt conn goroutines on close when listener exits early
  • Additional commits viewable in compare view

Updates golang.org/x/text from 0.40.0 to 0.41.0

Commits
  • acdba66 go.mod: update golang.org/x dependencies
  • 02aa981 secure/precis: fix short destination buffer handling in Nickname profile
  • See full diff in compare view

Updates golang.org/x/tools from 0.48.0 to 0.49.0

Commits
  • 18332fe go.mod: update golang.org/x dependencies
  • a5c4651 gopls/internal/protocol/command: fix struct field name in comment
  • 7d08a06 present, cmd/present, cmd/present2md: document lack of security hardening
  • e8a4348 refactor/satisfy: fix "the the" typo
  • 54624f9 internal/typesinternal: suppress jsonv2 warning
  • c117dde gopls/internal/golang: normalize instantiated fields before rename
  • b5b860c gopls/internal/mcp: report one-based reference line numbers
  • bf54bcd gopls/internal/golang/completion: avoid SEGV from double deslicing
  • 4b32d66 refactor/satisfy/find.go: fix panic on type errors
  • e6da7e4 gopls/internal/protocol/semtok: instructions for modifier/type changes
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): Bump the go-dependencies group across 1 directory with 5…
a98e5d8 
… updates

Bumps the go-dependencies group with 4 updates in the / directory: [github.com/stretchr/testify](https://github.com/stretchr/testify), [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/tools](https://github.com/golang/tools).


Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.0
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.0)

Updates `golang.org/x/crypto` from 0.54.0 to 0.55.0
- [Commits](golang/crypto@v0.54.0...v0.55.0)

Updates `golang.org/x/net` from 0.57.0 to 0.58.0
- [Commits](golang/net@v0.57.0...v0.58.0)

Updates `golang.org/x/text` from 0.40.0 to 0.41.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.40.0...v0.41.0)

Updates `golang.org/x/tools` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.48.0...v0.49.0)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 17, 2026
@sonarqubecloud

sonarqubecloud Bot commented Aug 17, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@KaloyanTanev
KaloyanTanev merged commit c5f1304 into main Aug 18, 2026
10 checks passed
@KaloyanTanev
KaloyanTanev deleted the dependabot/go_modules/go-dependencies-4ed10d227a branch August 18, 2026 10:21
KaloyanTanev added a commit that referenced this pull request Aug 19, 2026
@KaloyanTanev @pinebit
@claude @dependabot
*: v1.11.0-rc3 (#4651)
80fc00f 
* app/log: fix slog handler panic on named types (#4640)

* app/log: fix slog handler panic on named types

Stringify all slog values via fmt.Sprint instead of using
zapcore.ReflectType, which panics in the logfmt encoder on
named types like protocol.ID. Add a recover guard in Handle
so future encoding panics drop the log line instead of
crashing the process.

* app/log: log slog handler panics through charon logger

Route the recover output through Error() instead of raw
stderr so it appears in Loki and structured log output.
Also fix test comment accuracy and add bool assertion.

* app/log: add nested recover for slog panic logging

Wrap the Error() call in the recover handler with its own
defer/recover so that if the structured logger itself panics
we fall back to stderr instead of crashing.

* core/validatorapi: preserve sync selections response order (#4641)

* core/validatorapi: preserve SyncCommitteeSelections response order

Build the response by iterating the original request slice instead of
the internal Go map, so response[i] corresponds to request[i]. Prysm
matches aggregated selection proofs to requests by array index; random
map iteration attached proofs to wrong subcommittees, causing
"signature not verified" 500s on submit_contribution_and_proofs.

* core/validatorapi: clone ValidatorSetA in ordering test

Avoid mutating shared package-level map state.

* dkg: validate cluster definition threshold (#4634)

* dkg: validate cluster definition threshold

Reject cluster definitions with a threshold below 2 or above the number
of operators, and log a warning when the threshold differs from the
recommended ceil(2n/3) value. Previously charon dkg ran the ceremony
silently with any threshold, unlike charon create dkg which validates
and warns.

category: bug
ticket: none

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* app/log: make ForT log initializers safe and restorable

Wrap the test write syncer with zapcore.Lock and restore the previous
global logger on test cleanup. Previously Init*ForT replaced the global
logger permanently, so tests running afterwards in the same package
wrote to the test buffer, racing on unsynchronized writers when logging
concurrently (caught by CI in dkg TestFrostDKG after TestCheckThreshold).

* cluster: dedup definition peers by peer ID (#4635)

Reject cluster definitions containing operators whose ENRs encode the
same public key. Peers previously deduplicated operators by ENR string
only, so distinct ENRs sharing a key (and thus a peer ID) passed
verification and collapsed the peer index map built during DKG setup,
causing an index out-of-range panic in newFrostP2P.

category: bug
ticket: none

* cluster: fix dead deposit amounts validation in unmarshalers (#4636)

Validate the parsed deposit amounts instead of the zero-valued named
return in the v1.8, v1.9 and v1.10-11 definition unmarshalers. The
checks called VerifyDepositAmounts on the empty named return value, so
they always passed and definitions with invalid deposit amounts
unmarshaled without error. The v1.10-11 unmarshaler now also passes the
parsed compounding flag.

category: bug
ticket: none

* dkg/bcast: bind broadcast signatures to cluster session (#4638)

* dkg/bcast: bind broadcast signatures to cluster session

Bind reliable-broadcast signatures to the cluster session and message
ID. Previously the signed hash covered only the protobuf type URL and
value, so signatures remained valid across DKG sessions and message
IDs, allowing replay of captured messages into other ceremonies.

* dkg/bcast: propagate hash write errors

* core/priority: gate duties received from peers (#4643)

The priority protocol handler used the duty slot straight off the wire.
A cluster peer could retain a deadliner entry and a request buffer per
distinct slot, neither of which is released until the (attacker chosen)
deadline expires.

Gate received duties with core.DutyGaterFunc before allocating any
per-duty state, as parsigex and the consensus components already do.
Duties initiated locally stay ungated, they come from the scheduler.

category: bug
ticket: none

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

* p2p: bound relay address query responses (#4642)

Relay address resolution read the HTTP response body with io.ReadAll and no
size limit, using a zero-value http.Client with no timeout, in a loop that
runs for the process lifetime. A malicious or compromised configured relay
could stream an endless response and grow the heap until the node was
OOM killed.

Limit the response to 64KB, which is well above a valid ENR string or
multiaddr array, set a 10s per-attempt client timeout, and close the response
body on the non-2xx retry path where it was leaked.

category: bug
ticket: none

* p2p: remove noisy QUIC happy-path debug logs (#4645)

* build(deps): Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 in the go-dependencies group (#4644)

* build(deps): Bump google.golang.org/protobuf

Bumps the go-dependencies group with 1 update: google.golang.org/protobuf.


Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* *: regenerate protobuf files for v1.36.12

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>

* dkg: improved reshare logging (#4650)

* dkg: improved reshare logging

* Logging progression for normal DKG as well

* build(deps): Bump the go-dependencies group across 1 directory with 5 updates (#4648)

Bumps the go-dependencies group with 4 updates in the / directory: [github.com/stretchr/testify](https://github.com/stretchr/testify), [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/tools](https://github.com/golang/tools).


Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.0
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.0)

Updates `golang.org/x/crypto` from 0.54.0 to 0.55.0
- [Commits](golang/crypto@v0.54.0...v0.55.0)

Updates `golang.org/x/net` from 0.57.0 to 0.58.0
- [Commits](golang/net@v0.57.0...v0.58.0)

Updates `golang.org/x/text` from 0.40.0 to 0.41.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.40.0...v0.41.0)

Updates `golang.org/x/tools` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.48.0...v0.49.0)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): Bump the docker-dependencies group across 2 directories with 1 update (#4649)

Bumps the docker-dependencies group with 1 update in the / directory: golang.
Bumps the docker-dependencies group with 1 update in the /testutil/promrated directory: golang.


Updates `golang` from 1.26.5-trixie to 1.26.6-trixie

Updates `golang` from 1.26.5-trixie to 1.26.6-trixie

Updates `golang` from 1.26.5-alpine to 1.26.6-alpine

Updates `golang` from 1.26.5-alpine to 1.26.6-alpine

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.26.6-trixie
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker-dependencies
- dependency-name: golang
  dependency-version: 1.26.6-trixie
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker-dependencies
- dependency-name: golang
  dependency-version: 1.26.6-alpine
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker-dependencies
- dependency-name: golang
  dependency-version: 1.26.6-alpine
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Andrei Smirnov <andrei@obol.tech>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@KaloyanTanev KaloyanTanev KaloyanTanev approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@KaloyanTanev