[dependabot]

Bumps the production-dependencies group with 61 updates in the / directory:

Package	From	To
buf.build/go/protovalidate	1.3.0	1.4.0
connectrpc.com/connect	1.20.0	1.21.0
connectrpc.com/otelconnect	0.9.0	0.10.0
github.com/exaring/otelpgx	0.11.1	0.12.0
github.com/go-jose/go-jose/v4	4.1.4	4.1.5
github.com/jackc/pgx/v5	5.10.0	5.11.0
github.com/moby/moby/api	1.55.0	1.56.1
github.com/nats-io/nats.go	1.53.1	1.54.0
github.com/spiffe/go-spiffe/v2	2.8.1	2.8.2
github.com/valkey-io/valkey-go	1.0.77	1.0.78
go.opentelemetry.io/otel	1.46.0	1.47.0
go.opentelemetry.io/otel/log	0.22.0	1.47.0
go.opentelemetry.io/otel/metric	1.46.0	1.47.0
go.opentelemetry.io/otel/sdk	1.46.0	1.47.0
go.opentelemetry.io/otel/sdk/metric	1.46.0	1.47.0
go.opentelemetry.io/otel/trace	1.46.0	1.47.0
golang.org/x/net	0.58.0	0.59.0
golang.org/x/oauth2	0.36.0	0.37.0
golang.org/x/text	0.41.0	0.42.0
google.golang.org/api	0.294.0	0.300.0
google.golang.org/grpc	1.83.2	1.84.0
gorm.io/driver/postgres	1.6.2	1.6.3
cloud.google.com/go/auth	0.23.2	0.24.0
cloud.google.com/go/auth/oauth2adapt	0.2.8	0.3.0
cloud.google.com/go/compute/metadata	0.9.0	0.10.0
cloud.google.com/go/iam	1.13.0	1.14.0
github.com/containerd/log	0.1.0	0.2.0
github.com/ebitengine/purego	0.10.2	0.11.1
github.com/google/s2a-go	0.1.9	0.1.10
github.com/googleapis/enterprise-certificate-proxy	0.3.20	0.3.22
github.com/googleapis/gax-go/v2	2.24.0	2.26.2
github.com/grpc-ecosystem/grpc-gateway/v2	2.30.0	2.31.0
github.com/klauspost/compress	1.19.2	1.20.0
github.com/magiconair/properties	1.18.11	1.18.12
github.com/moby/moby/client	0.5.1	0.6.1
github.com/moby/sys/userns	0.2.0	0.2.1
github.com/prometheus/client_model	0.6.2	0.6.3
github.com/prometheus/common	0.70.1	0.72.0
github.com/prometheus/procfs	0.21.1	0.22.0
github.com/shirou/gopsutil/v4	4.26.7	4.26.9
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	0.70.0	0.71.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc	0.22.0	0.23.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp	0.22.0	0.23.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/prometheus	0.68.0	0.69.0
go.opentelemetry.io/otel/exporters/stdout/stdoutlog	0.22.0	0.23.0
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/stdout/stdouttrace	1.46.0	1.47.0
go.opentelemetry.io/proto/otlp	1.11.0	1.11.1
go.uber.org/atomic	1.11.0	1.12.0
golang.org/x/crypto	0.55.0	0.57.0
golang.org/x/exp	0.0.0-20260718201538-764159d718ef	0.0.0-20260908205506-85c1c2202aba
golang.org/x/sync	0.22.0	0.23.0
golang.org/x/sys	0.47.0	0.48.0
golang.org/x/time	0.15.0	0.16.0
google.golang.org/genproto/googleapis/api	0.0.0-20260825221802-da73d73af1c5	0.0.0-20260928230214-8a89bd6388cc
google.golang.org/genproto/googleapis/rpc	0.0.0-20260825221802-da73d73af1c5	0.0.0-20260928230214-8a89bd6388cc

Updates buf.build/go/protovalidate from 1.3.0 to 1.4.0

Release notes

Sourced from buf.build/go/protovalidate's releases.

v1.4.0

What's Changed

• Update deps and minimum Go version to 1.26 by @​rodaine in bufbuild/protovalidate-go#337

Full Changelog: bufbuild/protovalidate-go@v1.3.0...v1.4.0

Commits

• 5c72b38 Bump buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go from 1.36.12-...
• aa3ed84 Update deps and minimum Go version to 1.26 (#337)
• ff9e432 Bump github.com/stretchr/testify from 1.12.0 to 1.12.1 in the go group (#336)
• 99a2379 Bump the go group with 4 updates (#334)
• See full diff in compare view

Updates connectrpc.com/connect from 1.20.0 to 1.21.0

Release notes

Sourced from connectrpc.com/connect's releases.

v1.21.0

What's Changed

[!IMPORTANT]

This release adds a security-related feature for servers. The new handler option WithRequestGate runs after the request headers are available and before any message is received. Use this new option to register checks (e.g. authentication) that should happen before the request is decompressed or unmarshaled, and before any interceptors are run. See the documentation for details.

Governance

• Add pkwarren as a maintainer by @​bufdev in connectrpc/connect-go#929 🎉

Enhancements

• Add WithRequestGate handler option by @​emcfarlane in connectrpc/connect-go#962
• Create release binary for protoc-gen-connect-go by @​emcfarlane in connectrpc/connect-go#966

Bugfixes

• Fix issue with user-agent getting inappropriately injected into request headers by @​jhump in connectrpc/connect-go#934
• Fix client streaming operations blocking indefinitely after context cancellation by @​haru0017 in connectrpc/connect-go#937
• Fix flaky HTTP2 testcase assertion by @​emcfarlane in connectrpc/connect-go#940
• Fix data race and connection leak in duplexHTTPCall by @​emcfarlane in connectrpc/connect-go#938
• Fix off-by-one in WithHTTPGetMaxURLSize URL length check by @​fchimpan in connectrpc/connect-go#955
• Fix connect.WithGRPC typo in the missing client option error by @​NotAFlightRisk in connectrpc/connect-go#956
• Only send a 304 when the request was a GET by @​NotAFlightRisk in connectrpc/connect-go#957
• Fix panic in stream Spec and Peer when client construction failed by @​NotAFlightRisk in connectrpc/connect-go#959
• Fix dropped headers on errStreamingClientConn by @​mohit-bhandari45 in connectrpc/connect-go#964

New Contributors

• @​haru0017 made their first contribution in connectrpc/connect-go#937
• @​dongjiang1989 made their first contribution in connectrpc/connect-go#945
• @​fchimpan made their first contribution in connectrpc/connect-go#955
• @​NotAFlightRisk made their first contribution in connectrpc/connect-go#956
• @​mohit-bhandari45 made their first contribution in connectrpc/connect-go#964

Full Changelog: connectrpc/connect-go@v1.20.0...v1.21.0

Commits

• 41b7f30 Prepare for v1.21.0 (#972)
• 6058c20 Fix dropped headers on errStreamingClientConn (#964)
• 014693a Refine WithRequestGate API and documentation (#968)
• d9b4b1d Create release binary for protoc-gen-connect-go (#966)
• 5111260 Add WithRequestGate handler option (#962)
• febfc19 Fix panic in stream Spec and Peer when client construction failed (#959)
• cb5da57 Update Go version for CI (#958)
• 9646326 Only send a 304 when the request was a GET (#957)
• 2a02fea Fix connect.WithGRPC typo in the missing client option error (#956)
• eae42d2 Fix off-by-one in WithHTTPGetMaxURLSize URL length check (#955)
• Additional commits viewable in compare view

Updates connectrpc.com/otelconnect from 0.9.0 to 0.10.0

Release notes

Sourced from connectrpc.com/otelconnect's releases.

v0.10.0

What's Changed

This release moves otelconnect to the current OpenTelemetry RPC semantic conventions (semconv v1.43.0). Before this, it emitted the conventions as they stood in v1.21.0. The telemetry it produces has changed a lot, so dashboards, alerts and queries built on earlier versions will need updating:

• Metrics: Each side now records a single histogram, rpc.server.call.duration or rpc.client.call.duration, measured in seconds. It replaces rpc.{server,client}.duration, which was in milliseconds. The request and response size metrics and the per-RPC message count metrics are removed, because OpenTelemetry deprecated them without replacements. Use WithDurationHistogramOptions to set custom buckets.
• Attributes: rpc.system is now rpc.system.name, and ConnectRPC reports connectrpc rather than connect_rpc. rpc.method now holds the fully-qualified method (acme.foo.v1.FooService/Bar), and rpc.service is gone. rpc.grpc.status_code and rpc.connect_rpc.error_code are merged into rpc.response.status_code. It uses uppercase code names (OK, NOT_FOUND) for every protocol and is set on every call. Failed calls also get error.type. Client spans and metrics use server.address and server.port, and server spans use network.peer.address and network.peer.port. Together these replace net.peer.name and net.peer.port. Header attributes are now rpc.{request,response}.metadata.<key>.
• Span events: The per-message rpc.message event is removed, along with the WithoutTraceEvents option.
• Server peer attributes: Server spans no longer include the client's address and port by default. Opt in with WithServerPeerAttributes to add network.peer.address and network.peer.port. WithoutServerPeerAttributes is removed, since its behavior is now the default.

Existing projects can't opt back into the old conventions. See the README for the full attribute set.

Governance

• Add Timo Stamm to maintainers by @​jhump in connectrpc/otelconnect-go#203 🎉

Enhancements

• Add Labeler for custom metric attributes by @​michaljurecko in connectrpc/otelconnect-go#204
• Adopt current OTel RPC semantic conventions by @​emcfarlane in connectrpc/otelconnect-go#215
• Omit server peer attributes by default by @​ConnorsApps in connectrpc/otelconnect-go#213

New Contributors

• @​michaljurecko made their first contribution in connectrpc/otelconnect-go#204
• @​ConnorsApps made their first contribution in connectrpc/otelconnect-go#213

Full Changelog: connectrpc/otelconnect-go@v0.9.0...v0.10.0

Changelog

Sourced from connectrpc.com/otelconnect's changelog.

Releasing otelconnect-go

This document outlines how to create a release of otelconnect-go.

1. Clone the repo, ensuring you have the latest main.

2. On a new branch, open https://github.com/connectrpc/otelconnect-go/blob/main/otelconnect.go and change the version constant to an appropriate semantic version. To select the correct version, look at the version number of the [latest release] and the changes that are included in this new release.

    const (
   -     version             = "0.10.0-dev"
   +     version             = "0.10.0"
         semanticVersion     = "semver:" + version

   This usually entails just removing the "-dev" suffix, but if only a patch release release is warranted, but the "dev" version implied a minor version, then set the minor version back, for example 1.1.0-dev -> 1.0.1. If a release candidate is warranted, use an appropriate suffix.

3. Open a PR titled "Prepare for vX.Y.Z" ([Example PR #200](connectrpc/otelconnect-go#200)) and a description, tagging at least one current maintainer. Once it's reviewed and CI passes, merge it.

   Make sure no new commits are merged until the release is complete.

4. Using the Github UI, create a new release like so:

   • Under “Choose a tag”, type in “vX.Y.Z” to create a new tag for the release upon publish. Note: The release job does infer the version from the release string and expects versions to start with v (e.g. v0.1.0).
   • Target the main branch.
   • Title the Release the same as the tag: “vX.Y.Z”.
   • Click “Set as latest release”.
   • If this is a release candidate, or any other kind of pre-release, click "Set as a pre-release". A pre-v1.0.0 number, like "v0.3.0", should not be marked as a pre-release.
   • Set the last version as the “Previous tag”.
   • Click “Generate release notes” to autogenerate release notes.
   • Edit the release notes.
     • Tweak the change description for each if necessary so it summarizes the salient aspect(s) of the change in a single sentence. Detail is not needed as a user could follow the link to the relevant PR. (Potentially take a pass at PR descriptions and revise to increase clarity for users that visit the PRs from the release notes.)
     • Related commits can be grouped together with a single entry that has links to all relevant PRs (and attributes all relevant contributors).
     • A summary may be added if warranted.
     • The items in the list should be broken up into sub-categories. The typical sub-categories to use follow:
       • Bugfixes: Self-explanatory -- fixes to defects.

... (truncated)

Commits

• edeecb1 Prepare for v0.10.0 (#218)
• 82781ba Omit server peer attributes by default (#213)
• ecbdf53 Adopt current OTel RPC semantic conventions (#215)
• 74242e5 Bump Go and golangci-linter (#214)
• c8f0332 Upgrade lint (#209)
• c039385 Upgrade go libraries and fix test end of stream handling (#210)
• 48e69bc Remove retired Go report card badge (#212)
• 74686ae Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#211)
• 91897cf Add Labeler for custom metric attributes (#204)
• 6ace9b7 Bump go.opentelemetry.io/otel/sdk from 1.29.0 to 1.40.0 (#208)
• Additional commits viewable in compare view

Updates github.com/exaring/otelpgx from 0.11.1 to 0.12.0

Release notes

Sourced from github.com/exaring/otelpgx's releases.

v0.12.0

What's Changed

• feat(tracer)!: default span names to operation name for OTel compliance by @​obitech in exaring/otelpgx#82
• Add explicit bucket boundaries for db.client.operation.duration metric by @​jlordiales in exaring/otelpgx#81
• #83 Add optional per-query filter to WithIncludeQueryParameters by @​nikolayk812 in exaring/otelpgx#84

New Contributors

• @​jlordiales made their first contribution in exaring/otelpgx#81
• @​nikolayk812 made their first contribution in exaring/otelpgx#84

Full Changelog: exaring/otelpgx@v0.11.1...v0.12.0

Commits

• 332afb9 #83 Add optional per-query filter to WithIncludeQueryParameters
• 9f86d84 Add explicit bucket boundaries for db.client.operation.duration metric
• 0a54848 feat(tracer)!: default span names to operation name for OTel compliance
• See full diff in compare view

Updates github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.5

Fixed security issues

• cipher/cbc_hmac: don't panic on empty ciphertext (#292)
• cipher/cbc_hmac: don't panic on invalid key (#291)
• json: limit stack depth (#290)
• jwt: reject out-of-range NumericDate values (#278)
• Check alg against pubkey curve during verify. (#293)
• Reject malformed Ed25519 JWKs (#250)
• jws: choose verification key per-signature (#243)

Breaking Changes

In #226, we un-exported jose.RandReader. This was used to be able to stub out the randomness function in tests, but is ignored as of Go 1.26 in some APIs, so no longer serves a useful function.

Changed

• Verify OpaqueSigner's Public() return is public (#260)
• jws: skip signature on ErrJWKSKidNotFound (#248)
• Handle JWE JSON without protected header (#240)
• jws: don't strip internal whitespace before parsing JSON (#239)
• jws: fewer calls to OpaqueSigner.Public() (#224)
• Return a specific error when parsing empty string (#216)
• Reject typed nil at Verify time (#285)

Commits

• b10771e Reject typed nil at Verify time
• 56f3866 Check alg against pubkey curve during verify. (#293)
• 74114c2 cipher/cbc_hmac: don't panic on empty ciphertext (#292)
• 6b364f3 cipher/cbc_hmac: don't panic on invalid key (#291)
• a31af25 json: limit stack depth (#290)
• 7f5beb3 jwt: reject out-of-range NumericDate values (#278)
• e37f31a Test on Go 1.26 and 1.27 (#284)
• 5b371ae Reject malformed Ed25519 JWKs (#250)
• ad7f32d Bump actions/setup-python from 6 to 7 (#275)
• 1563054 Bump actions/setup-go from 6 to 7 (#274)
• Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0

Release notes

Sourced from github.com/jackc/pgx/v5's releases.

v5.11.0

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

• stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.
• Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.
• pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)
• pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)
• pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

• Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

• pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

• pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

  • timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.
  • timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.
  • Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.
  • time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.
  • Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

  Behavior changes:

  • date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.
  • All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range

... (truncated)

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.11.0 (September 7, 2026)

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

• stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.
• Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.
• pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)
• pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)
• pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

• Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

• pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

• pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

  • timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.
  • timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.
  • Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.
  • time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.
  • Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

  Behavior changes:

  • date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.
  • All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the

... (truncated)

Commits

• 5e583fa Update changelog for v5.11.0
• 3927116 Apply gofumpt formatting required by lint
• eb07165 Quote filesystem paths in development connection strings
• cf5938f Allow unsigned digit counts in binary numeric encoding
• 3930cf5 Accept PostgreSQL POSIX timezone offsets in text timestamps
• 93261be Prefer exact db tag matches when mapping rows to structs
• e8d8ad1 Merge pull request #2647 from sueun-dev/fix-range-text-quoting-20260906
• 01d2fd3 Merge pull request #2644 from eliranbz/fix-failed-prepare-deallocation
• 9b7e3be Merge pull request #2645 from ash2k/move-channel
• 76d78f5 Merge pull request #2643 from AshSgDe29071999/fix/hstore-pairs-estimate-clamp
• Additional commits viewable in compare view

Updates github.com/moby/moby/api from 1.55.0 to 1.56.1

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.56.1

1.56.1

Changelog

• api/scripts: Allow isolated model generation with an API directory. moby/moby#53629
• api/swagger: Improve OpenAPI compatibility. moby/moby#53626
• api/swagger: Quote HTTP response status codes. moby/moby#53759
• api/templates: schema: disable validators and serializer sections. moby/moby#53751
• api: fix G117 (gosec). moby/moby#53721
• api: swagger ImageManifestSummary.ImageData: fix invalid required field. moby/moby#53750
• api: update go-swagger to v0.36.6. moby/moby#53754
• fix: invalid swagger YAML indentation. moby/moby#53606

api/v1.56.0

1.56.0

Changelog

• GET /containers/json now supports an annotation filter to filter containers by annotation, either by key (annotation=key) or by key and value (annotation="key=value"), similar to the existing label filter. moby/moby#53538
• POST /containers/create now supports HostConfig.Umask to set the initial umask for a Unix container. When set, the daemon includes the value in the OCI process configuration for the container's entrypoint, exec processes, and healthchecks. When omitted, the runtime's default behavior applies.moby/moby#53463
• api/docs: sync API docs v1.25 - v1.55. moby/moby#53246
• api/swagger: Align Healthcheck name with Go struct. moby/moby#53567
• api/types/plugin: Deprecated plugin.Privileges sorting methods in favor of slices.SortFunc. moby/moby#53511
• api/types/plugin: fix Privileges Swap implementation. moby/moby#53510
• api: Bump to 1.56. moby/moby#53425
• api: document Task.NetworksAttachments in the swagger definition. moby/moby#53082
• api: remove gotest.tools from tests. moby/moby#53535
• api: swagger: Use int64 for build query params. moby/moby#53520
• api: use blackbox testing. moby/moby#53525
• Fix API reference documenting an unsupported names filter for GET /configs. moby/moby#53447

Commits

• 14ebc60 Merge pull request #53830 from tonistiigi/update-buildkit-v0.34.0-rc1
• 8eded0e Merge pull request #53671 from thaJeztah/add_WithHTTPRequestHook
• c4e39af Merge pull request #53596 from vvoland/c8d-refactor-imgload
• b8a569e client: add WithHTTPRequestHook option
• 0fed273 Merge pull request #53803 from thaJeztah/etchosts_cleanups
• 80c72a3 Merge pull request #53831 from corhere/fix-dnsproxy-servfail-test
• 1cfa161 daemon/containerd: Split image loading into import and unpack steps
• e7272aa Merge pull request #53606 from flostellbrink/fix/swagger-yaml-indentation
• 357096e libnetwork/etchosts: keep file open when updating hosts
• 012b2ef libnetwork/etchosts: propagate file close errors
• Additional commits viewable in compare view

Updates github.com/nats-io/nats.go from 1.53.1 to 1.54.0

Release notes

Sourced from github.com/nats-io/nats.go's releases.

Release v1.54.0

Changelog

This release raises the minimum supported Go version to 1.26 and adds support for nats-server v2.15 stream and consumer info fields.

ADDED

• Core NATS:
  • nats.MultipathTCP() option to enable or disable MPTCP for outbound connections (#2145)
  • Conn.ConnectedDomain() to read the JetStream domain advertised by the connected server (#2139)
• JetStream:
  • ClusterInfo.Desired, PeerInfo.Peer, PeerInfo.Pending and StreamSourceInfo.Seq in stream and consumer info, reported by nats-server v2.15 (#2144)
  • Nats-Schedule-Rollup header const and WithScheduleRollup() publish option (#2142)

FIXED

• Core NATS:
  • Panic in DecodeHeadersMsg on inline status tokens shorter than 3 characters. Thanks @​nikitha-m for the contribution (#2101)
  • Data race on Subscription.sid between applyNewSID and removeSub (#2122)
• JetStream:
  • Messages() iterator going silent after a reconnect that completes between Next() calls. Thanks @​1995parham for the contribution (#2135)
  • Legacy ordered consumer silently losing messages when the subscription hits its pending limits (#2137)
  • Legacy ordered consumer reset resurrecting an unsubscribed or draining subscription (#2133)

IMPROVED

• Core NATS:
  • Avoid allocation when parsing header message arguments with a fifth token. Thanks @​0xAozora for the contribution (#2130)
  • Preallocate reply subject buffers. Thanks @​0xAozora for the contribution (#2123)
• JetStream:
  • Prevent doErr closure escaping to the heap in async publish reply handling. Thanks @​0xAozora for the contribution (#2127)
  • Fix typo in Publisher interface methods comment. Thanks @​sreeram77 for the contribution (#2120)
• Minimum Go version is now 1.26 (#2146)
• Bump klauspost/compress to v1.20.0 and nkeys to v0.4.16 (#2117, #2146)
• Tests run locally without docker via an in-process ntf tester (#2131), and CI now runs against nats-server v2.15.0 (#2146)
• Fix flaky cluster restart tests (#2141) and list consumers test against latest server (#2138)

Complete Changes

nats-io/nats.go@v1.53.1...v1.54.0

Commits

• 7a8404a Release v1.54.0 (#2148)
• 240fb1f [IMPROVED] Bump dependencies and update server version in CI (#2146)
• 203d828 [FIXED] Panic in DecodeHeadersMsg on status tokens shorter than 3 characters ...
• dc92fca [FIXED] Ordered consumer silently losing messages on slow consumer (#2137)
• e18cea8 [IMPROVED] Prevent doErr closure escaping to heap (#2127)
• d8d8c09 [ADDED] nats.MultipathTCP() for enabling or disabling MPTCP (#2145)
• e95c424 [FIXED] Flaky cluster restart tests: waitForStream must see a stream leader (...
• e3abbf4 [ADDED] Nats-Schedule-Rollup header const and publish options (#2142)
• f1289db [ADDED] Desired state, peer ID/pending and source seq in stream and consumer ...
• b84f783 Ignore Claude Code local files and .worktrees (#2140)
• Additional commits viewable in compare view

Updates github.com/spiffe/go-spiffe/v2 from 2.8.1 to 2.8.2

Release notes

Sourced from github.com/spiffe/go-spiffe/v2's releases.

v2.8.2

Fixed

• Data race in workloadapi.X509Source and workloadapi.JWTSource when reading bundles while the Workload API watcher updates them (#420)

Changelog

Sourced from github.com/spiffe/go-spiffe/v2's changelog.

[2.8.2] - 2026-09-18

Fixed

• Data race in workloadapi.X509Source and workloadapi.JWTSource when reading bundles while the Workload API watcher updates them (#420)

Commits

• 2ae1759 v2.8.2 changelog (#421)
• 2b6d4ba Bump actions/setup-go from 6 to 7 (#403)
• 30be436 Bump github.com/stretchr/testify from 1.11.1 to 1.12.1 (#416)
• c43c434 Fix race condition when accessing bundle (#420)
• 9819590 Bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5 (#419)
• cb388d8 Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#414)
• See full diff in compare view

Updates github.com/valkey-io/valkey-go from 1.0.77 to 1.0.78

Release notes

Sourced from github.com/valkey-io/valkey-go's releases.

1.0.78

Changes

• feat: add opt-in PreferClusterShards to use CLUSTER SHARDS before version 8 (#181)
• feat: add CLUSTERSCAN command builders (#171)
• feat: add MSetEX helper (#156)
• feat: provide valkeyaside ser/de funcs with context and cache key (#170)
• feat: add InfoMap to valkeycompat (#163)
• feat: add GetToBuffer to valkeycompat (#158)
• feat: add SetFromBuffer to valkeycompat for go-redis parity (#165)
• feat: add SlowLogLen to valkeycompat (#167)
• feat: add ReplicaOf to valkeycompat (#168)
• fix: re-pick unfinished cluster commands between retry iterations (#151)
• fix: close conns added to c.conns while cluster _refresh is unlocked (#161)
• fix: parse AsIntMap values as base 10
• fix: resolve the ?addr=:port shorthand against the primary host
• fix: prevent canceled valkeyaside cache fills from leaking locks
• fix: make valkeycompatmock Cache() mockable via the expectation queue
• fix: avoid nil cache panic with...

  Description has been truncated

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.