chore(deps): bump the go-dependencies group across 1 directory with 30 updates

[dependabot]

Bumps the go-dependencies group with 24 updates in the / directory:

Package	From	To
github.com/casbin/gorm-adapter/v3	3.39.0	3.41.0
github.com/flanksource/kopper	1.0.14	1.0.15
github.com/google/cel-go	0.26.1	0.27.0
github.com/labstack/echo-contrib	0.17.4	0.50.0
github.com/lib/pq	1.10.9	1.11.1
github.com/onsi/ginkgo/v2	2.27.5	2.28.1
github.com/onsi/gomega	1.39.0	1.39.1
github.com/ory/client-go	1.22.8	1.22.23
k8s.io/apimachinery	0.34.3	0.35.0
k8s.io/client-go	0.34.3	0.35.0
sigs.k8s.io/controller-runtime	0.22.4	0.23.1
github.com/aws/aws-sdk-go-v2/service/s3	1.95.1	1.96.0
github.com/flanksource/clicky	1.16.1	1.16.2
github.com/fluxcd/pkg/gittestserver	0.21.0	0.25.0
github.com/golang-jwt/jwt/v5	5.3.0	5.3.1
github.com/redis/go-redis/v9	9.16.0	9.17.3
github.com/samber/slog-echo	1.18.0	1.20.1
go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho	0.63.0	0.65.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	1.39.0	1.40.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	1.39.0	1.40.0
google.golang.org/genai	1.34.0	1.46.0
cloud.google.com/go/storage	1.59.1	1.59.2
golang.org/x/crypto	0.47.0	0.48.0
google.golang.org/api	0.262.0	0.265.0

Updates github.com/casbin/gorm-adapter/v3 from 3.39.0 to 3.41.0

Release notes

Sourced from github.com/casbin/gorm-adapter/v3's releases.

v3.41.0

3.41.0 (2026-01-20)

Features

• implement persist.BatchAdapter interface (#283) (5335977)

v3.40.0

3.40.0 (2026-01-07)

Bug Fixes

• upgrade CI Go version to 1.24 (98e9740)

Features

• upgrade Casbin to v3.8.1 (#280) (5183beb)

Commits

• 5335977 feat: implement persist.BatchAdapter interface (#283)
• 5183beb feat: upgrade Casbin to v3.8.1 (#280)
• 98e9740 fix: upgrade CI Go version to 1.24
• See full diff in compare view

Updates github.com/flanksource/kopper from 1.0.14 to 1.0.15

Release notes

Sourced from github.com/flanksource/kopper's releases.

v1.0.15

1.0.15 (2026-02-05)

Commits

• ffedcfe refactor: return error on conversion failure, remove unused crdgen
• 0040a74 test: move e2e to kind and cover crd schema change
• See full diff in compare view

Updates github.com/google/cel-go from 0.26.1 to 0.27.0

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.27.0

Release Summary

This release focuses on improving developer tooling and stability. Key highlights include significant enhancements to the REPL (YAML configuration support and parse-only evaluation), the addition of cost estimation for regex operations, and improved test coverage reporting.

On the stability front, this release addresses race conditions in reference types, improves namespace resolution, and ensures formatting directives align strictly with the CEL specification.

Note: This release includes a breaking change regarding how types are handled as variables. Please review the "Breaking Changes" section below.

⚠ Breaking Changes

Remove types as variables: The logic for handling types has been relaxed to support safe rollout of feature packages which introduce new types whose names may collide with existing variables. Please review your policies if you relied on types behaving strictly as variables in previous versions. [PR #1262](google/cel-go#1262)

Features & Enhancements

REPL & Tooling

• YAML Configuration: The REPL now supports reading and writing YAML environment configurations. [PR #1250](google/cel-go#1250)

• Parse-Only Mode: Added parse-only evaluation capabilities to the REPL. [PR #1254](google/cel-go#1254)

• Test Coverage: Introduced logic for CEL test coverage calculation and updated the reporter to handle error/unknown scenarios.[PR #1209](google/cel-go#1209) & [PR #1215](google/cel-go#1215)

Core Library

• Regex Costing: Added support for cost estimation and tracking within the regex library. [PR #1200](google/cel-go#1200)

• JSON Type Exposure: Exposed CEL JSON types to assist developers in converting to native values. [PR #1261](google/cel-go#1261)

• Policy Composition: Source information is now preserved during CEL policy composition, aiding in debugging. [PR #1253](google/cel-go#1253)

Extensibility:

• Updated extension option factory to resolve by ID (#1249).

• Refactored match output compiling to accept user-defined logic (#1246).

• Exposed Match source ID to callers (#1227).

Build & Maintenance

• Bazel: Migrated to use Bazel module only and improved configuration for dependent builds. [PR #1231](google/cel-go#1231) & [PR #1228](google/cel-go#1228)

• Cleanup: Removed strcase dependency, removed AppEngine code from REPL, and performed general linting. [PR #1230](google/cel-go#1230), #1216, #1251

Bug Fixes

• Concurrency: Fixed a race condition in the checker regarding reference types. [PR #1224](google/cel-go#1224)

• Namespace Resolution: Addressed an issue with namespace resolution. [PR #1256](google/cel-go#1256)

• Spec Compliance: Fixed formatting directives to fully support requirements documented in the cel-spec. [PR #1232](google/cel-go#1232)

... (truncated)

Commits

• 450089b Preserve source information during CEL policy composition. (#1253)
• c66b313 Remove types as variables to allow user-defined variables to shadow type decl...
• bff3a72 Expose the CEL JSON types to assist with conversion to native values (#1261)
• 559cbc9 Remove errant diff checked into a prior PR (#1260)
• fe26efa Simplify the disambiguation logic to a single boolean (#1263)
• 52280ba Clean up unused source info after checker rewrites the AST. (#1258)
• 3cb5705 Namespace resolution fix (#1256)
• 409bcbe Refactor match output compiling to accept user-defined logic. (#1246)
• e9f15ea Enable two var comprehension conformance tests. (#1255)
• 057fa1a Add parse only evaluation to REPL (#1254)
• Additional commits viewable in compare view

Updates github.com/labstack/echo-contrib from 0.17.4 to 0.50.0

Release notes

Sourced from github.com/labstack/echo-contrib's releases.

V5 is out

See: https://github.com/labstack/echo/releases/tag/v5.0.0

Retract v0.50.0

Echo 5 support was introduced in this repository with the v0.50.0 release. However, this also means that users who are still on Echo 4 and run go get -u ./... will inadvertently pull in Echo 5, which they neither want nor need at this time.

v0.50.0 will be retracted in v0.18.0 series and v0+ will only support Echo 4. For Echo 5 support use v5 major version of this repository.

Full Changelog: labstack/echo-contrib@v0.17.4...v0.18.0

Relates to labstack/echo-contrib#142

Commits

• fb1b028 Use Echo v5 tag
• e5a435c Remove github.com/labstack/gommon dependency
• 16afb59 Echo V5 support
• 6c28e2b Update deps (#139)
• 109512b Update deps (last one did not update to latest) (#132)
• See full diff in compare view

Updates github.com/lib/pq from 1.10.9 to 1.11.1

Release notes

Sourced from github.com/lib/pq's releases.

v1.11.1

This fixes two regressions present in the v1.11.0 release:

• Fix build on 32bit systems, Windows, and Plan 9 (#1253).

• Named []byte types and pointers to []byte (e.g. *[]byte, json.RawMessage) would be treated as an array instead of bytea (#1252).

#1252: lib/pq#1252 #1253: lib/pq#1253

v1.11.0

This version of pq requires Go 1.21 or newer.

pq now supports only maintained PostgreSQL releases, which is PostgreSQL 14 and newer. Previously PostgreSQL 8.4 and newer were supported.

Features

• The pq.Error.Error() text includes the position of the error (if reported by PostgreSQL) and SQLSTATE code (#1219, #1224):

  pq: column "columndoesntexist" does not exist at column 8 (42703)
  pq: syntax error at or near ")" at position 2:71 (42601)
  

• The pq.Error.ErrorWithDetail() method prints a more detailed multiline message, with the Detail, Hint, and error position (if any) (#1219):

  ERROR:   syntax error at or near ")" (42601)
  CONTEXT: line 12, column 1:
   10 |     name           varchar,
   11 |     version        varchar,
   12 | );
        ^
  
  

• Add Config, NewConfig(), and NewConnectorConfig() to supply connection details in a more structured way (#1240).

• Support hostaddr and $PGHOSTADDR (#1243).

• Support multiple values in host, port, and hostaddr, which are each tried in order, or randomly if load_balance_hosts=random is set (#1246).

• Support target_session_attrs connection parameter (#1246).

• Support [sslnegotiation] to use SSL without negotiation (#1180).

• Allow using a custom tls.Config, for example for encrypted keys (#1228).

• Add PQGO_DEBUG=1 print the communication with PostgreSQL to stderr, to aid in debugging, testing, and bug reports (#1223).

• Add support for NamedValueChecker interface (#1125, #1238).

Fixes

... (truncated)

Changelog

Sourced from github.com/lib/pq's changelog.

v1.11.1 (2025-01-29)

This fixes two regressions present in the v1.11.0 release:

• Fix build on 32bit systems, Windows, and Plan 9 (#1253).

• Named []byte types and pointers to []byte (e.g. *[]byte, json.RawMessage) would be treated as an array instead of bytea (#1252).

#1252: lib/pq#1252 #1253: lib/pq#1253

v1.11.0 (2025-01-28)

This version of pq requires Go 1.21 or newer.

pq now supports only maintained PostgreSQL releases, which is PostgreSQL 14 and newer. Previously PostgreSQL 8.4 and newer were supported.

Features

• The pq.Error.Error() text includes the position of the error (if reported by PostgreSQL) and SQLSTATE code (#1219, #1224):

  pq: column "columndoesntexist" does not exist at column 8 (42703)
  pq: syntax error at or near ")" at position 2:71 (42601)
  

• The pq.Error.ErrorWithDetail() method prints a more detailed multiline message, with the Detail, Hint, and error position (if any) (#1219):

  ERROR:   syntax error at or near ")" (42601)
  CONTEXT: line 12, column 1:
   10 |     name           varchar,
   11 |     version        varchar,
   12 | );
        ^
  
  

• Add Config, NewConfig(), and NewConnectorConfig() to supply connection details in a more structured way (#1240).

• Support hostaddr and $PGHOSTADDR (#1243).

• Support multiple values in host, port, and hostaddr, which are each tried in order, or randomly if load_balance_hosts=random is set (#1246).

• Support target_session_attrs connection parameter (#1246).

• Support [sslnegotiation] to use SSL without negotiation (#1180).

... (truncated)

Commits

• eec526c Release v1.11.1 (#1255)
• 1928a1d Fix []byte types incorrectly converted to PostgreSQL array (#1252)
• 9e2aa8e Run staticcheck on all GOOS/GOARCH combinations
• c9320c4 Fix build on Windows and Plan9
• 2809526 Fix build on 32bit systems
• 8e88f7e Release 1.11.0
• 0ad3049 Handle pre-protocol errors to prevent memory exhaustion
• f1fae2e Add pqtest.Fake.Close()
• 3815d03 Remove assumption that the auth response is AuthenticateOk
• 589ad43 Implement load_balance_hosts=random
• Additional commits viewable in compare view

Updates github.com/onsi/ginkgo/v2 from 2.27.5 to 2.28.1

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.28.1

2.28.1

Update all dependencies. This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.

v2.28.0

2.28.0

Ginkgo's SemVer filter now supports filtering multiple components by SemVer version:

It("should work in a specific version range (1.0.0, 2.0.0) and third-party dependency redis in [8.0.0, ~)", SemVerConstraint(">= 3.2.0"), ComponentSemVerConstraint("redis", ">= 8.0.0") func() {
    // This test will only run when version is between 1.0.0 (exclusive) and 2.0.0 (exclusive) and redis version is >= 8.0.0
})

can be filtered in or out with an invocation like:

ginkgo --sem-ver-filter="2.1.1, redis=8.2.0"

Huge thanks to @​Icarus9913 for working on this!

Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.28.1

Update all dependencies. This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.

2.28.0

Ginkgo's SemVer filter now supports filtering multiple components by SemVer version:

It("should work in a specific version range (1.0.0, 2.0.0) and third-party dependency redis in [8.0.0, ~)", SemVerConstraint(">= 3.2.0"), ComponentSemVerConstraint("redis", ">= 8.0.0") func() {
    // This test will only run when version is between 1.0.0 (exclusive) and 2.0.0 (exclusive) and redis version is >= 8.0.0
})

can be filtered in or out with an invocation like:

ginkgo --sem-ver-filter="2.1.1, redis=8.2.0"

Huge thanks to @​Icarus9913 for working on this!

Commits

• 5d1d628 v2.28.1
• 676f985 update test mu language
• 8032100 appease go vet
• 41ca807 bump dependencies
• 2b2305b v2.28.0
• 71d2d89 feat: support component semantic version filtering
• 8cbbcb4 Fix doclink for ginkgo run
• See full diff in compare view

Updates github.com/onsi/gomega from 1.39.0 to 1.39.1

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.39.1

1.39.1

Update all dependencies. This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.39.1

Update all dependencies. This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.

Commits

• 1a25a36 v1.39.1
• 406faee bump all deps
• See full diff in compare view

Updates github.com/ory/client-go from 1.22.8 to 1.22.23

Commits

• 789a73e autogen: regenerate OpenAPI client for v1.22.23
• 1b2eb11 autogen: regenerate OpenAPI client for v1.22.22
• 5b7d7c4 autogen: regenerate OpenAPI client for v1.22.21
• 78e97a5 autogen: regenerate OpenAPI client for v1.22.16
• 321af55 autogen: regenerate OpenAPI client for v1.22.15
• b26b692 autogen: regenerate OpenAPI client for v1.22.14
• 9a28b8e autogen: regenerate OpenAPI client for v1.22.13
• a45a624 autogen: regenerate OpenAPI client for v1.22.12
• 883cb02 autogen: regenerate OpenAPI client for v1.22.11
• 054e845 autogen: regenerate OpenAPI client for v1.22.10
• Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.34.3 to 0.35.0

Commits

• 72d71ea Merge remote-tracking branch 'origin/master' into release-1.35
• e2a2dbc Bump golang.org/x/crypto to v0.45.0
• 2e9c228 Merge pull request #135131 from Dev1622/sig-storage/mock-expand-flake-fix
• f274aac vendor: update vendor and license metadata after replacing BeTrue usage in cs...
• 9445443 Resolve lint restriction on BeTrue by introducing Succeed() with contextual e...
• 52154f7 Update vendored dependencies
• 5a348c5 KEP-5471: Extend tolerations operators (#134665)
• 6f89492 Merge pull request #133648 from richabanker/merged-discovery
• c77dde2 util/sort: Add MergePreservingRelativeOrder for topological sorting
• 729c13d Merge pull request #134624 from yt2985/podcertificates-beta
• Additional commits viewable in compare view

Updates k8s.io/client-go from 0.34.3 to 0.35.0

Commits

• 9bcb694 Update dependencies to v0.35.0 tag
• 2d83546 Merge remote-tracking branch 'origin/master' into release-1.35
• 56b4af2 Merge pull request #135591 from p0lyn0mial/upstream-watchlist-reflector-log-f...
• 891f94c Merge remote-tracking branch 'origin/master' into release-1.35
• 65ffe04 Merge pull request #135580 from serathius/client-go-transformer
• 2fe4ac2 downgrade reflector watchlist fallback log to V(4)
• 97256a6 Bump golang.org/x/crypto to v0.45.0
• 46360b5 Merge pull request #135131 from Dev1622/sig-storage/mock-expand-flake-fix
• 171ef8c Use transformer in consistency checker
• 3878a64 vendor: update vendor and license metadata after replacing BeTrue usage in cs...
• Additional commits viewable in compare view

Updates sigs.k8s.io/controller-runtime from 0.22.4 to 0.23.1

Release notes

Sourced from sigs.k8s.io/controller-runtime's releases.

v0.23.1

What's Changed

• [release-0.23] 🐛 Cache reader: Wait for cache sync when ReaderFailOnMissingInformer is true by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3433
• [release-0.23] 🐛 Fix panic when using CRs with embedded pointer structs by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3436
• [release-0.23] 🌱 Test cache reader waits for cache sync by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3438
• [release-0.23] 🐛 Fakeclient: Fix status apply if existing object has managedFields set by @​k8s-infra-cherrypick-robot in kubernetes-sigs/controller-runtime#3437

Full Changelog: kubernetes-sigs/controller-runtime@v0.23.0...v0.23.1

v0.23.0

🔆 Highlights

• Client: Add subresource Apply support by @​alvaroaleman in kubernetes-sigs/controller-runtime#3321
• Conversion: Enable implementation of conversion outside of API packages by @​sbueringer in kubernetes-sigs/controller-runtime#3335
• Priorityqueue: Various improvements, bug fixes and now enabled per default
• Webhooks: Generic Validator and Defaulter by @​alvaroaleman in kubernetes-sigs/controller-runtime#3360

⚠️ Breaking changes

• Dependencies: Update to k8s.io/* v1.35 by @​alvaroaleman @​dongjiang1989 @​kannon92 (#3316, #3349, #3386, #3391, #3401)
• Client: Add subresource Apply support by @​alvaroaleman in kubernetes-sigs/controller-runtime#3321
• Events: Migration to the new events API by @​clebs in kubernetes-sigs/controller-runtime#3262
  • Using the new GetEventRecorderFor requires updating your rbac for events to use the events.k8s.io apiGroup rather than the `` (core) apiGroup
• Fakeclient: Set ResourceVersion for SSA Create by @​alvaroaleman in kubernetes-sigs/controller-runtime#3311
• Webhooks: Generic Validator and Defaulter by @​alvaroaleman in kubernetes-sigs/controller-runtime#3360
  • Existing code of the form builder.WebhookManagedBy(mgr).For(&corev1.Deployment{}) has to be changed to builder.WebhookManagedBy(mgr, &appsv1.Deployment{})
  • Existing webhook implementations have to be changed to take the concrete object rather than runtime.Object, for example from ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) to ValidateCreate(ctx context.Context, obj *appsv1.Deployment) (admission.Warnings, error)

✨ Features

• Cache: Allow fine-granular SyncPeriod configuration by @​sbueringer in kubernetes-sigs/controller-runtime#3376
• Client: Add FieldOwner option to client.Options by @​aerfio in kubernetes-sigs/controller-runtime#3389
• Client: Add FieldValidation option to client.Options by @​aerfio in kubernetes-sigs/controller-runtime#3393
• Conversion: Enable implementation of conversion outside of API packages by @​sbueringer in kubernetes-sigs/controller-runtime#3335
• Metrics: Add controller_runtime_reconcile_timeouts_total metric to track ReconciliationTimeout timeouts by @​godwinpang in kubernetes-sigs/controller-runtime#3382
• Priorityqueue: Add optional Priority field to reconcile.Result by @​sbueringer in kubernetes-sigs/controller-runtime#3333
• Priorityqueue: Enable per default by @​sbueringer in kubernetes-sigs/controller-runtime#3332
• Priorityqueue: Use a buffer to optimize priority queue AddWithOpts performance by @​zach593 in kubernetes-sigs/controller-runtime#3415
• Source/Kind: Delay reconciliation until handlers sync by @​GonzaloLuminary in kubernetes-sigs/controller-runtime#3406
• Webhooks: Add WithContextFunc to WebhookBuilder by @​dmvolod in kubernetes-sigs/controller-runtime#3324

🐛 Bugfixes

• Client: Allow SSA after normal resource creation by @​filipcirtog in kubernetes-sigs/controller-runtime#3346
• Client: Fix List in namespaced client to list objects that are cluster scoped by @​troy0820 in kubernetes-sigs/controller-runtime#3351 kubernetes-sigs/controller-runtime#3353
• Envtest: Respect pre-configured binary paths in ControlPlane by @​mzhaom in kubernetes-sigs/controller-runtime#3372
• Fakeclient: Fix a number of bugs when updating through apply by @​alvaroaleman in kubernetes-sigs/controller-runtime#3319
• FakeClient: Fix Apply with Unstructured ApplyConfiguration and resourceVersion unset by @​sbueringer in kubernetes-sigs/controller-runtime#3403
• Fakeclient: Fix SSA after List with non-list kind by @​sbueringer in kubernetes-sigs/controller-runtime#3364

... (truncated)

Commits

• f52bbb8 Merge pull request #3437 from k8s-infra-cherrypick-robot/cherry-pick-3430-to-...
• 4f41337 Merge pull request #3438 from k8s-infra-cherrypick-robot/cherry-pick-3434-to-...
• e29a1b9 seedling: Test cache reader waits for cache sync
• 83c8dc3 bug: Fakeclient: Fix status apply if existing object has managedFields set
• bf6bcd5 Merge pull request #3436 from k8s-infra-cherrypick-robot/cherry-pick-3431-to-...
• b6a3a46 bug: Fix panic when using CRs with embedded pointer structs
• 7866fb0 Merge pull request #3433 from k8s-infra-cherrypick-robot/cherry-pick-3425-to-...
• 90b26f7 check to see if informer is synced and started before returning cache
• 129853d Merge pull request #3419 from alvaroaleman/limit-cardinality
• 00b8b07 🐛 Limit depthWithPriorityMetric cardinality to 25
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.95.1 to 1.96.0

Commits

• bdb98c5 Release 2026-01-28
• c878d57 Regenerated Clients
• 4f5d503 Update API model
• b7bf952 Feat release s3 transfer manager v2 (#3293)
• 0baa1dc Release 2026-01-27
• 11eae4b Regenerated Clients
• 297caa5 Update endpoints model
• 43d96e4 Update API model
• de58dc6 Release 2026-01-26
• dba39e6 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/flanksource/clicky from 1.16.1 to 1.16.2

Release notes

Sourced from github.com/flanksource/clicky's releases.

v1.16.2

1.16.2 (2026-01-27)

🐛 Bug Fixes

• prevent terminal corruption on shutdown/panic (9d68d9a)

Changelog

Sourced from github.com/flanksource/clicky's changelog.

1.16.2 (2026-01-27)

🐛 Bug Fixes

• prevent terminal corruption on shutdown/panic (9d68d9a)

Commits

• 2e43988 chore(release): 1.16.2 [skip ci]
• 9d68d9a fix: prevent terminal corruption on shutdown/panic
• See full diff in compare view

Updates github.com/fluxcd/pkg/gittestserver from 0.21.0 to 0.25.0

Commits

• 090c3ce Merge pull request #886 from dipti-pai/move-github-provider
• 84883b4 Move auth/github to git/github
• 0d627fb Merge pull request #885 from fluxcd/gh-app-cache-key
• 4380ea7 Take the hash of all the parts in the GitHub App token cache key
• 84d0d45 Merge pull request #882 from kathleenfrench/kfrench/cel-eval-string
• 567773d support string evaluation in CEL expressions
• 8b1f852 Merge pull request #881 from fluxcd/token-cache-flags
• 4b34b01 Add CLI flags for the token cache and method to delete all events
• c05eb67 Merge pull request #880 from fluxcd/cache-custom-metric-labels
• 4d91aae Add option for custom event namespace label in cache metrics
• Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.16.5

What's Changed

• build: Update module golang.org/x/crypto to v0.45.0 [SECURITY] (releases/v5.x) by @​go-git-renovate[bot] in go-git/go-git#1744
• build: Bump Go test versions to 1.23-1.25 (v5) by @​pjbgf in go-git/go-git#1746
• [v5] git: worktree, Don't delete local untracked files when resetting worktree by @​Ch00k in go-git/go-git#1800
• Expand packfile checks by @​pjbgf in go-git/go-git#1836

Full Changelog: go-git/go-git@v5.16.4...v5.16.5

Commits

• 48a1ae0 Merge pull request #1836 from go-git/check-v5
• 42bdf1f storage: filesystem, Verify idx matches pack file
• 4146a56 plumbing: format/idxfile, Verify idxfile's checksum
• 63d78ec plumbing: format/packfile, Add new ErrMalformedPackFile
• 25f1624 Merge pull request #1800 from Ch00k/no-delete-untracked-v5
• 600fb13 git: worktree, Don't delete local untracked files when resetting worktree
• 390a569 Merge pull request #1746 from pjbgf/bump-go
• 61c8b85 build: Bump Go test versions to 1.23-1.25 (v5)
• e5a05ec Merge pull request #1744 from go-git/renovate/releases/v5.x-go-golang.org-x-c...
• 1495930 plumbing: Remove use of non-constant format strings
• Additional commits viewable in compare view

Updates github.com/golang-jwt/jwt/v5 from 5.3.0 to 5.3.1

Release notes

Sourced from github.com/golang-jwt/jwt/v5's releases.

v5.3.1

What's Changed

🔐 Features

• Add spellcheck Github action to catch common spelling mistakes by @​equalsgibson in golang-jwt/jwt#458
• Add WithNotBeforeRequired parser option and add test coverage by @​equalsgibson in golang-jwt/jwt#456
• Update godoc example func to properly refer to NewWithClaims() by @​equalsgibson in golang-jwt/jwt#459
• Update github workflows by @​mfridman in golang-jwt/jwt#462
• Additional test for CustomClaims that validates unmarshalling behaviour by @​equalsgibson in golang-jwt/jwt#457
• Fix early file close in jwt cli by @​mfridman in golang-jwt/jwt#472
• Add TPM signature reference by @​salrashid123 in golang-jwt/jwt#473
• Remove misleading ParserOptions documentation in golang-jwt/jwt#484
• Save signature to Token struct after successful signing by @​EgorSheff in golang-jwt/jwt#417
• Set token.Signature in ParseUnverified by @​slickwilli in golang-jwt/jwt#414

👒 Dependencies

• Bump crate-ci/typos from 1.34.0 to 1.35.3 by @​dependabot[bot] in golang-jwt/jwt#461
• Bump crate-ci/typos from 1.35.4 to 1.36.2 by @​dependabot[bot] in golang-jwt/jwt#470
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in golang-jwt/jwt#478
• Bump crate-ci/typos from 1.36.2 to 1.39.0 by @​dependabot[bot] in golang-jwt/jwt#480
• Bump golangci/golangci-lint-action from 8 to 9 by @​dependabot[bot] in golang-jwt/jwt#481
• Bump actions/setup-go from 5 to 6 by @​dependabot[bot] in golang-jwt/jwt#469
• Bump crate-ci/typos from 1.39.0 to 1.40.0 by @​dependabot[bot] in golang-jwt/jwt#488
• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in golang-jwt/jwt#487
• Bump crate-ci/typos from 1.40.0 to 1.41.0 by @​dependabot[bot] in golang-jwt/jwt#490
• Bump crate-ci/typos from 1.41.0 to 1.42.1 by @​dependabot[bot] in golang-jwt/jwt#492

New Contributors

• @​equalsgibson made their first contribution in golang-jwt/jwt#458
• @​salrashid123 made their first contribution in golang-jwt/jwt#473
• @​EgorSheff made their first contribution in golang-jwt/jwt#417
• @​slickwilli made their first contribution in golang-jwt/jwt#414

Full Changelog: golang-jwt/jwt@v5.3.0...v5.3.1

Commits

• 7ceae61 Add release.yml for changelog configuration
• dce8e4d Set token.Signature in ParseUnverified (#414)
• Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.