Skip to content

chore(deps): update all non-major dependencies#265

Open
renovate-bot wants to merge 1 commit intoGoogleCloudPlatform:mainfrom
renovate-bot:renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#265
renovate-bot wants to merge 1 commit intoGoogleCloudPlatform:mainfrom
renovate-bot:renovate/all-minor-patch

Conversation

@renovate-bot
Copy link
Contributor

@renovate-bot renovate-bot commented Apr 1, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Adoption Passing Confidence
GoogleCloudPlatform/functions-framework-conformance action patch v1.8.6 → v1.8.8 age adoption passing confidence
actions/cache action minor v4.2.2 → v4.3.0 age adoption passing confidence
actions/checkout action minor v4.2.2 → v4.3.1 age adoption passing confidence
actions/setup-go action minor v5.3.0 → v5.6.0 age adoption passing confidence
cloud.google.com/go/functions require patch v1.19.3 → v1.19.7 age adoption passing confidence
github.com/cloudevents/sdk-go/v2 require minor v2.15.2 → v2.16.2 age adoption passing confidence
github/codeql-action action minor v3.28.11 → v3.34.1 age adoption passing confidence
ossf/scorecard-action action patch v2.4.1 → v2.4.3 age adoption passing confidence
step-security/harden-runner action minor v2.11.0 → v2.16.0 age adoption passing confidence

Release Notes

GoogleCloudPlatform/functions-framework-conformance (GoogleCloudPlatform/functions-framework-conformance)

v1.8.8

Compare Source

What's Changed
New Contributors

Full Changelog: GoogleCloudPlatform/functions-framework-conformance@v1.8.7...v1.8.8

v1.8.7

Compare Source

What's Changed
New Contributors

Full Changelog: GoogleCloudPlatform/functions-framework-conformance@v1.8.6...v1.8.7

actions/cache (actions/cache)

v4.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/cache@v4...v4.3.0

v4.2.4

Compare Source

What's Changed

New Contributors

Full Changelog: actions/cache@v4...v4.2.4

v4.2.3

Compare Source

What's Changed
New Contributors

Full Changelog: actions/cache@v4.2.2...v4.2.3

actions/checkout (actions/checkout)

v4.3.1

Compare Source

What's Changed

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

Compare Source

What's Changed
New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

actions/setup-go (actions/setup-go)

v5.6.0

Compare Source

What's Changed

Full Changelog: actions/setup-go@v5...v5.6.0

v5.5.0

Compare Source

What's Changed

Bug fixes:
Dependency updates:

New Contributors

Full Changelog: actions/setup-go@v5...v5.5.0

v5.4.0

Compare Source

What's Changed

Dependency updates :

New Contributors

Full Changelog: actions/setup-go@v5...v5.4.0

cloudevents/sdk-go (github.com/cloudevents/sdk-go/v2)

v2.16.2

Compare Source

v2.16.1

Compare Source

CloudEvents SDK Go v2.16.1
🐛 Bug Fixes and Improvements

  • ⚡ NATS JetStream Enhancement: Made send subject optional via context by @​kmpm in #​1143

    • Added WithSubject function to override the default subject when sending messages
    • Added comprehensive tests and updated samples
    • Non-breaking enhancement that adds flexibility for NATS users

  • 📝 CloudEvents JSON Handling Fixes by @​alank-ps:

    • WriteJson Fix in #​1162: Fixed WriteJson to properly handle data as JSON when dataContentType is application/cloudevents+json or batch
    • ConsumeData Fix in #​1164: Fixed consumeData functions to properly recognize structured mode JSON content types
    • Improves compatibility with the CloudEvents specification

  • 🔧 CI/Test Improvements: Fix failing CI tests by @​embano1 in #​1156

🔄 Maintenance and Dependency Updates
  • 🛠️ Dependency Management Overhaul by @​embano1 in #​1145
    • Added script (hack/update-deps.sh) to update Go dependencies across all modules
    • Replaced Dependabot with custom script for better dependency management
    • Removed stale and broken OpenTelemetry samples

📦 Key Dependency Updates:

  • github.com/google/go-cmp: v0.6.0 → v0.7.0
  • golang.org/x/sync: v0.12.0 → v0.13.0
  • github.com/nats-io/nats.go: v1.37.0 → v1.41.2
  • github.com/IBM/sarama: v1.40.1 → v1.45.1
  • github.com/docker/docker: v20.10.17 → v27.1.1
  • go.opentelemetry.io/otel: v1.18.0 → v1.35.0
  • 🐹 Go version: Updated from 1.22 to 1.23.0 (toolchain 1.23.8)
🚨 Breaking Changes

None. All updates are either backward-compatible improvements, bug fixes, or internal refactors.

👥 New Contributors
📋 What's Changed

Full Changelog: cloudevents/sdk-go@v2.16.0...v2.16.1

v2.16.0

Compare Source

✨ Features & Enhancements

  • Confluent Kafka binding [#​988] by @​yanmxa
    Added a new Confluent Kafka protocol binding for CloudEvents, supporting modern Kafka client features.

  • Producer report channel for Confluent Kafka [#​1031] by @​yanmxa
    Exposed a producer report channel via Events() to allow users to track delivery status of Kafka messages.

  • Support structured content type suffixes [#​1007] by @​dan-j
    Improved content type handling by recognizing structured syntax suffixes like +json, increasing compatibility with various encodings.

  • Default timeout via context [#​992] by @​nkreiger
    Introduced support for configuring protocol default timeouts using context.Context.

  • Benchmarks for CESQL [#​1050] by @​Cali0707
    Added benchmark tests to measure CESQL query performance.

  • Optimized CESQL LIKE matching [#​1049] by @​Cali0707
    Improved the performance of CESQL's LIKE pattern matching logic.

  • Expose AddFunction API for CESQL Parser [#​1047 / #​1051] by @​dgeorgievski
    Enabled users to register custom functions in CESQL via the newly exposed AddFunction API.

  • Flexible subject matching for NATS JetStream [#​1084] by @​evankanderson
    Added support for flexible subject pattern matching in NATS JetStream subscriptions.

  • Add v3 version of NATS JetStream protocol [#​1095] by @​stephen-totty-hpe
    Introduced a new version of the NATS JetStream protocol (v3) with enhanced features and forward compatibility.

  • Expose WithHost option [#​1070] by @​jaxtonw
    Added a configurable WithHost option for improved protocol initialization flexibility.

  • Support dataref cloud event extension [Dataref Extension #​1018] by @​matzew
    Implements the Dataref (Claim Check Pattern) as specified by the CloudEvent Extension Attributes spec.

🛠 Fixes

  • Handle multiple AMQP data fields correctly [#​1034] by @​embano1
    Fixed parsing of AMQP messages containing multiple data fields to conform with spec expectations.

  • Fix invalid ce- prefix in Confluent binding [#​1059] by @​embano1
    Corrected an issue where CloudEvents extensions were incorrectly prefixed in the Confluent Kafka binding.

  • Fix LIKE expression error handling [#​1046] by @​Cali0707
    Prevented panics on malformed LIKE expressions in CESQL; now returns a parse error instead.

  • Fix MQTT content-type issue [#​1063] by @​yanmxa
    Corrected how content types are applied in the MQTT protocol to improve interoperability.

  • Fix race condition in MQTT protocol [#​1094] by @​yanmxa
    Resolved a concurrency issue that could occur when sending messages over MQTT.

  • Fix pubsub ack logic [#​1064] by @​chapurlatn
    Updated acknowledgment logic to correctly rely on protocol.IsAck, fixing false negatives in pubsub delivery handling.

  • NATS Ack/Nak support in JetStream v3 [#​1104] by @​stephen-totty-hpe
    Added explicit acknowledgment and negative-ack support in the v3 NATS JetStream protocol.

  • Fix data_base64 decoding [#​1129] by @​duglin
    [Breaking Change] Modified base64 handling to require JSON string-wrapped base64 data; see release notes for migration details.

🧹 Maintenance

  • Sort extensions during JSON serialization [#​1117] by @​sargas
    Ensured deterministic serialization of extensions for improved consistency.

  • Add CODEOWNERS file [#​1038] by @​embano1
    Established code ownership rules to streamline PR review workflows.

  • Update GitHub workflows & Go dependencies [#​1105] by @​embano1
    Routine maintenance of CI workflows and dependency versions.

  • Bump MQTT SDK from v0.12.0 to v0.21.0 [#​1096] by @​yanmxa
    Updated the MQTT SDK for access to newer features and fixes.

  • Pin dependency versions [#​1089] by @​harshitasao
    Locked down dependencies to improve reproducibility and stability.

  • Fix token-permission issue [#​1088] by @​harshitasao
    Resolved permission issues affecting token-based authentication flows.

  • Bump testify to v1.10.0 [#​1114] by @​aalekseevx
    Updated stretchr/testify for testing improvements and bug fixes.

  • CESQL v1 Fixes [#​1066] by @​Cali0707
    Applied several small fixes and improvements to the CESQL v1 engine.

github/codeql-action (github/codeql-action)

v3.34.1

Compare Source

  • Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #​3762

v3.34.0

Compare Source

  • Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #​3569
  • We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #​3584
  • Update default CodeQL bundle version to 2.25.0. #​3585

v3.33.0

Compare Source

  • Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #​3562
    To opt out of this change:
    • Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
    • User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
    • User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
  • Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #​3557
  • The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #​3559
  • Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #​3563
  • Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #​3564
  • A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #​3570

v3.32.6

Compare Source

v3.32.5

Compare Source

  • Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #​3507
  • Added an experimental change so that when improved incremental analysis fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. #​3487
  • The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. #​3515
  • Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. #​3516
  • Added an experimental change which lowers the minimum disk space requirement for improved incremental analysis, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. #​3498
  • Added an experimental change which allows the start-proxy action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. #​3512
  • The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. #​3503, #​3504

v3.32.4

Compare Source

  • Update default CodeQL bundle version to 2.24.2. #​3493
  • Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when private package registries are configured. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. #​3473
  • When the CodeQL Action is run with debugging enabled in Default Setup and private package registries are configured, the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. #​3486
  • Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. #​3485
  • Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a nightly CodeQL CLI release instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. #​3484

v3.32.3

Compare Source

  • Added experimental support for testing connections to private package registries. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for Default Setup. #​3466

v3.32.2

Compare Source

v3.32.1

Compare Source

  • A warning is now shown in Default Setup workflow logs if a private package registry is configured using a GitHub Personal Access Token (PAT), but no username is configured. #​3422
  • Fixed a bug which caused the CodeQL Action to fail when repository properties cannot successfully be retrieved. #​3421

v3.32.0

Compare Source

v3.31.11

Compare Source

  • When running a Default Setup workflow with Actions debugging enabled, the CodeQL Action will now use more unique names when uploading logs from the Dependabot authentication proxy as workflow artifacts. This ensures that the artifact names do not clash between multiple jobs in a build matrix. #​3409
  • Improved error handling throughout the CodeQL Action. #​3415
  • Added experimental support for automatically excluding generated files from the analysis. This feature is not currently enabled for any analysis. In the future, it may be enabled by default for some GitHub-managed analyses. #​3318
  • The changelog extracts that are included with releases of the CodeQL Action are now shorter to avoid duplicated information from appearing in Dependabot PRs. #​3403

v3.31.10

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.10 - 12 Jan 2026
  • Update default CodeQL bundle version to 2.23.9. #​3393

See the full CHANGELOG.md for more information.

v3.31.9

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.9 - 16 Dec 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.31.8

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.8 - 11 Dec 2025
  • Update default CodeQL bundle version to 2.23.8. #​3354

See the full CHANGELOG.md for more information.

v3.31.7

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.31.7 - 05 Dec 2025
  • Update default CodeQL bundle version to 2.23.7. #​3343

See the full CHANGELOG.md for more information.

v3.31.6

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to th

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month ( * 0-3 1 * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@forking-renovate
Copy link

forking-renovate bot commented Apr 1, 2025 •
edited
Loading

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 5 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.21 -> 1.24.0
github.com/json-iterator/go v1.1.10 -> v1.1.12
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421 -> v0.0.0-20180306012644-bacd9c7ef1dd
github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742 -> v1.0.2
go.uber.org/multierr v1.1.0 -> v1.11.0
go.uber.org/zap v1.10.0 -> v1.27.0

@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from b0d0825 to 305ea87 Compare April 8, 2025 01:26
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 1c59042 to 9e5eeb3 Compare April 16, 2025 13:30
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 67cbef7 to 1d0846c Compare April 26, 2025 04:44
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 324d5d7 to 1ac53f6 Compare May 8, 2025 04:34
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch from 1ac53f6 to 6968efa Compare May 16, 2025 14:41
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch from 6968efa to 2575afc Compare June 1, 2025 02:44
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch from 2575afc to b922f89 Compare June 18, 2025 16:05
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch from b922f89 to b2bcf4f Compare July 28, 2025 19:10
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from c177bf6 to 8a09cc9 Compare August 13, 2025 13:22
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch from 8a09cc9 to acb77ee Compare August 19, 2025 11:51
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from e7bc963 to 260025b Compare October 1, 2025 00:23
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from c431c8c to 5822602 Compare October 10, 2025 18:48
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from b65bdb9 to 34f3d4b Compare October 24, 2025 21:03
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch from 34f3d4b to f97eb14 Compare October 30, 2025 15:13
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from b2c3fb9 to ea171a5 Compare December 1, 2025 11:10
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch from ea171a5 to b9bfceb Compare December 2, 2025 07:03
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from dba7068 to 2161a63 Compare December 12, 2025 11:52
@forking-renovate
Copy link

forking-renovate bot commented Dec 12, 2025 •
edited
Loading

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 5 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.21 -> 1.24.0
github.com/json-iterator/go v1.1.10 -> v1.1.12
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421 -> v0.0.0-20180306012644-bacd9c7ef1dd
github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742 -> v1.0.2
go.uber.org/multierr v1.1.0 -> v1.11.0
go.uber.org/zap v1.10.0 -> v1.27.0

@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from aa33aed to f455cf3 Compare December 16, 2025 20:00
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch from f455cf3 to 60e1135 Compare January 12, 2026 19:50
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 4744232 to ad71b35 Compare January 26, 2026 23:02
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 039d987 to d575bbb Compare February 7, 2026 03:01
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 54f4b8c to b3c7c5e Compare February 13, 2026 23:15
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from cbe1cbf to bf3c375 Compare February 25, 2026 01:18
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 2a2cc91 to 40caa59 Compare March 6, 2026 10:56
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from ee33c45 to e8e1d55 Compare March 20, 2026 19:01
@renovate-bot renovate-bot force-pushed the renovate/all-minor-patch branch from e8e1d55 to 7dac8fe Compare March 20, 2026 23:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@renovate-bot