Bump the dependencies group with 3 updates

[dependabot]

Bumps the dependencies group with 3 updates: go.sia.tech/coreutils, go.sia.tech/indexd and go.sia.tech/renterd/v2.

Updates go.sia.tech/coreutils from 0.24.0 to 0.24.1

Release notes

Sourced from go.sia.tech/coreutils's releases.

0.24.1 (2026-09-14)

Fixes

• Update webtransport-go to v0.13.0 and quic-go to v0.62.0

Changelog

Sourced from go.sia.tech/coreutils's changelog.

0.24.1 (2026-09-14)

Fixes

• Update webtransport-go to v0.13.0 and quic-go to v0.62.0

Commits

• 024db88 Merge pull request #471 from SiaFoundation/release
• 45cd12c chore: prepare release 0.24.1
• c2bd503 build(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0
• 5c2d41f changeset
• 6b78438 build(deps): bump github.com/quic-go/webtransport-go
• cee0043 fix formatting
• b5095b6 update workflows to master
• d1961c3 build(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0
• c7a1269 build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0
• See full diff in compare view

Updates go.sia.tech/indexd from 0.4.4 to 0.5.0

Release notes

Sourced from go.sia.tech/indexd's releases.

v0.5.0

Breaking Changes

• ReadSector takes an account token instead of an account key.

Features

Exclude unrecoverable slabs from repairs

A shard that doesn't hash to its pinned root after being reconstructed from its peers can never be migrated, so the slab it belongs to is now marked unrecoverable with a reason and taken out of the repair rotation instead of being retried forever. Such a mismatch no longer interrupts the migration either: the slab's remaining shards finish migrating first.

Two metrics were added to track slab repair health: indexd_num_unrecoverable_slabs and indexd_num_stuck_slabs, the latter counting slabs that failed more than one consecutive repair attempt and are still being retried. Both are maintained by a trigger and reported by GET /stats/sectors.

Fixes

• Raise contract growth-rate funding bounds to 256 GiB minimum and 1 TiB maximum
• Reject sectors that have been uploaded more than the temporary storage duration ago
• Remove the remote migration worker's exponential backoff and pause between productive passes

Changelog

Sourced from go.sia.tech/indexd's changelog.

0.5.0 (2026-09-09)

Breaking Changes

• ReadSector takes an account token instead of an account key.

Features

Exclude unrecoverable slabs from repairs

A shard that doesn't hash to its pinned root after being reconstructed from its peers can never be migrated, so the slab it belongs to is now marked unrecoverable with a reason and taken out of the repair rotation instead of being retried forever. Such a mismatch no longer interrupts the migration either: the slab's remaining shards finish migrating first.

Two metrics were added to track slab repair health: indexd_num_unrecoverable_slabs and indexd_num_stuck_slabs, the latter counting slabs that failed more than one consecutive repair attempt and are still being retried. Both are maintained by a trigger and reported by GET /stats/sectors.

Fixes

• Raise contract growth-rate funding bounds to 256 GiB minimum and 1 TiB maximum
• Reject sectors that have been uploaded more than the temporary storage duration ago
• Remove the remote migration worker's exponential backoff and pause between productive passes

Commits

• 9ec6d9e Merge pull request #1078 from SiaFoundation/release
• 452ea25 chore: prepare release 0.5.0
• bad9c02 address comments
• 0b17ebe mark slab as unrecoverable when recovered sectors don't match their expected ...
• 657b97d remove remote backoff
• ed2cc2f build(deps): bump the dependencies group with 2 updates
• aee3935 Add changeset for growth bound update
• cb03621 Adjust contract funding tests
• a499b63 Update contract growth rate bounds
• 30fa2ac docs: use short instant flag consistently
• Additional commits viewable in compare view

Updates go.sia.tech/renterd/v2 from 2.9.3 to 2.9.4

Release notes

Sourced from go.sia.tech/renterd/v2's releases.

v2.9.4

Fixes

• Update coreutils to v0.24.0

Changelog

Sourced from go.sia.tech/renterd/v2's changelog.

2.9.4 (2026-09-08)

Fixes

• Update coreutils to v0.24.0

Commits

• 7618f06 chore: prepare release 2.9.4
• 536f316 chore(deps): bump the all-dependencies group with 4 updates
• a7def06 chore(deps): bump go.sia.tech/jape in the all-dependencies group
• 912666d chore(deps): bump the all-dependencies group with 3 updates
• 6a9262a chore(deps): bump the all-dependencies group with 2 updates
• 58a7b51 update workflows action
• 543bb1b changeset
• 6510681 fix build
• fbd1c56 chore(deps): bump go.sia.tech/coreutils in the all-dependencies group
• afb3dfe chore(deps): bump github.com/mattn/go-sqlite3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	go.sia.tech/​renterd/​v2@​v2.9.3 ⏵ v2.9.4
	go.sia.tech/​indexd@​v0.4.4 ⏵ v0.5.0	+1
	go.sia.tech/​coreutils@​v0.24.0 ⏵ v0.24.1

View full report