[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/dlclark/regexp2/v2	v2.8.4 → v2.9.1
github.com/envoyproxy/go-control-plane/envoy	v1.39.0 → v1.40.0
github.com/go-jose/go-jose/v4	v4.1.5 → v4.1.6
github.com/godbus/dbus/v5	v5.2.3 → v5.2.4
github.com/klauspost/cpuid/v2	v2.4.0 → v2.4.1
github.com/philhofer/fwd	v1.2.0 → v1.2.1
github.com/shopspring/decimal	v1.5.0 → v1.6.0

---

Release Notes

dlclark/regexp2 (github.com/dlclark/regexp2/v2)

v2.9.1

Compare Source

v2.9.0

Compare Source

envoyproxy/go-control-plane (github.com/envoyproxy/go-control-plane/envoy)

v1.40.0

Full Changelog: envoy/v1.39.0...envoy/v1.40.0

go-jose/go-jose (github.com/go-jose/go-jose/v4)

v4.1.6

Compare Source

Fixed Security Issues

This release contains a fix for GHSA-mgcc-cww5-fp2q

Breaking Changes

The fix for GHSA-mgcc-cww5-fp2q involves capping the size of the RSA modulus of keys accepted by JWK parsing. This limit is 4096 bits. If you need this to be higher, set MaxRSAModulusBits before performing any JWK parsing.

Changed

• Reject mismatched JWE CEK lengths by @​akshithg in #​266
• Add a tests containerfile and threat model by @​mcpherrinm in #​300
• Fix error message for future issued tokens by @​inahga in #​303

Full Changelog: go-jose/go-jose@v4.1.5...v4.1.6

godbus/dbus (github.com/godbus/dbus/v5)

v5.2.4

Compare Source

What's Changed

• conn: return the system bus error on every OS by @​SashaMIT in #​448

New Contributors

• @​SashaMIT made their first contribution in #​448

Full Changelog: godbus/dbus@v5.2.3...v5.2.4

klauspost/cpuid (github.com/klauspost/cpuid/v2)

v2.4.1

Compare Source

What's Changed

• Add amd64 CPU topology tree enumeration by @​klauspost in #​179
• fix: update riscv vendor ids by @​Jvlegod in #​177
• fix: assign unified L1 cache size to L1D by @​ProjectMutilation in #​180

New Contributors

• @​Jvlegod made their first contribution in #​177
• @​ProjectMutilation made their first contribution in #​180

Full Changelog: klauspost/cpuid@v2.4.0...v2.4.1

philhofer/fwd (github.com/philhofer/fwd)

v1.2.1

Compare Source

shopspring/decimal (github.com/shopspring/decimal)

v1.6.0

Compare Source

BEHAVIOR CHANGES

• Decimal implements fmt.Formatter. %#v prints Go code that recreates the value, like decimal.New(314, -2), instead of the struct fields, and verbs that don't apply, like %d, print %!d(decimal.Decimal=3.14). %v, %s, %q, %x and fmt.Println print the same as before #​463
• Ln rounds correctly, so some results change in the last digit: Ln of 10 to 5 places is 2.30259, not 2.30258 #​471
• ExpHullAbrham returns overallPrecision significant figures for every input. Negative inputs used to lose digits or return 0, like -50 at precision 10, and large inputs returned extra digits #​429 #​470
• Scan converts float32 with NewFromFloat32, so 54.33 stays 54.33 instead of becoming 54.33000183105469. NaN and infinite floats return an error instead of panicking #​469
• On Go 1.10 to 1.12, NewFromFloat can pick a different shortest form in rare cases (golang/go#29491). It still converts back to the same float #​431

FEATURES

• Add BSON Decimal128 support for Decimal and NullDecimal with the official MongoDB Go driver v2, without a new dependency #​460
• Add %f formatting with precision, width and flags, like %.2f and %08.2f #​463
• Add Normalize, which strips trailing zeros so equal decimals also match with reflect.DeepEqual, testify and gomock #​464
• Add Sqrt and SqrtRound #​465
• Add Root and RootRound for n-th roots #​473
• Add NewFromBigFloat constructor #​457
• Scan accepts Decimal, big.Int, *big.Int and all integer sizes, as passed by ClickHouse and other drivers #​469

ENHANCEMENTS

• NewFromFloat and NewFromFloat32 are 3 to 6 times faster. They use strconv instead of a vendored copy of it from 2009, which is removed #​431
• Ln is 3 to 14 times faster #​471
• Slightly faster IsInteger and Ceil #​299
• NewFromString accepts the Unicode minus sign − (U+2212) #​428
• Scanning NULL into a Decimal returns an error that points to NullDecimal or *Decimal #​474
• Document that global settings aren't goroutine-safe, and list them with their per-call alternatives in the README #​466
• README: show how to control the JSON format of one field, add udecimal to the alternative libraries, and update the Go doc and playground links #​475 #​476 #​264
• Fix doc examples that were wrong or didn't compile #​468
• Fix benchmarks that measured their setup or the wrong function #​467

BUGFIXES

• QuoRem and DivRound panic on precision math.MinInt32 instead of returning a wrong quotient #​472

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package	Change
google.golang.org/genproto/googleapis/api	v0.0.0-20260715232425-e75dac1f907d -> v0.0.0-20260720211330-0afa2a65878a