Skip to content

chore(deps)(deps): bump the go-dependencies group with 21 updates - #89

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-e529354216
Open

chore(deps)(deps): bump the go-dependencies group with 21 updates#89
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-e529354216

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown

Bumps the go-dependencies group with 21 updates:

Package From To
github.com/golang-jwt/jwt/v5 5.3.0 5.3.1
github.com/lib/pq 1.10.9 1.12.3
github.com/aws/aws-sdk-go-v2 1.41.1 1.45.1
github.com/aws/aws-sdk-go-v2/credentials 1.19.7 1.20.1
github.com/aws/aws-sdk-go-v2/service/s3 1.95.1 1.109.1
github.com/fxamacker/cbor/v2 2.9.0 2.9.3
github.com/knadh/koanf/parsers/yaml 1.1.0 1.1.1
github.com/knadh/koanf/providers/file 1.2.0 1.2.1
github.com/knadh/koanf/v2 2.3.0 2.3.6
github.com/livekit/protocol 1.43.4 1.50.4
github.com/livekit/server-sdk-go/v2 2.13.1 2.18.1
github.com/prometheus/client_golang 1.23.2 1.24.1
github.com/redis/go-redis/v9 9.17.2 9.20.0
github.com/testcontainers/testcontainers-go 0.40.0 0.44.0
github.com/testcontainers/testcontainers-go/modules/postgres 0.40.0 0.44.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp 0.61.0 0.69.0
go.opentelemetry.io/otel 1.38.0 1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc 1.24.0 1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp 1.24.0 1.44.0
go.opentelemetry.io/otel/sdk 1.38.0 1.46.0
go.opentelemetry.io/otel/trace 1.38.0 1.46.0

Updates github.com/golang-jwt/jwt/v5 from 5.3.0 to 5.3.1

Release notes

Sourced from github.com/golang-jwt/jwt/v5's releases.

v5.3.1

What's Changed

🔐 Features

👒 Dependencies

New Contributors

Full Changelog: golang-jwt/jwt@v5.3.0...v5.3.1

Commits
  • 7ceae61 Add release.yml for changelog configuration
  • dce8e4d Set token.Signature in ParseUnverified (#414)
  • 8889e20 Save signature to Token struct after successful signing (#417)
  • d237f82 ci: update github-actions schedule interval to monthly
  • d8dce95 Bump crate-ci/typos from 1.41.0 to 1.42.1 (#492)
  • e931803 Bump crate-ci/typos from 1.40.0 to 1.41.0 (#490)
  • e6a0afa Bump actions/checkout from 5 to 6 (#487)
  • 9f85c9e Bump crate-ci/typos from 1.39.0 to 1.40.0 (#488)
  • 60a8669 Bump actions/setup-go from 5 to 6 (#469)
  • 76f5828 Remove misleading ParserOptions documentation (#484)
  • Additional commits viewable in compare view

Updates github.com/lib/pq from 1.10.9 to 1.12.3

Release notes

Sourced from github.com/lib/pq's releases.

v1.12.3

  • Send datestyle startup parameter, improving compatbility with database engines that use a different default datestyle such as EnterpriseDB (#1312).

#1312: lib/pq#1312

v1.12.2

  • Treat io.ErrUnexpectedEOF as driver.ErrBadConn so database/sql discards the connection. Since v1.12.0 this could result in permanently broken connections, especially with CockroachDB which frequently sends partial messages (#1299).

#1299: lib/pq#1299

v1.12.1

  • Look for pgpass file in ~/.pgpass instead of ~/.postgresql/pgpass (#1300).

  • Don't clear password if directly set on pq.Config (#1302).

#1300: lib/pq#1300 #1302: lib/pq#1302

v1.12.0

  • The next release may change the default sslmode from require to prefer. See #1271 for details.

  • CopyIn() and CopyInToSchema() have been marked as deprecated. These are simple query builders and not needed for COPY [..] FROM STDIN support (which is not deprecated). (#1279)

    // Old
tx.Prepare(CopyIn("temp", "num", "text", "blob", "nothing"))

    // Replacement
tx.Prepare(copy temp (num, text, blob, nothing) from stdin)

Features

  • Support protocol 3.2, and the min_protocol_version and max_protocol_version DSN parameters (#1258).

  • Support sslmode=prefer and sslmode=allow (#1270).

  • Support ssl_min_protocol_version and ssl_max_protocol_version (#1277).

  • Support connection service file to load connection details (#1285).

  • Support sslrootcert=system and use ~/.postgresql/root.crt as the default value of sslrootcert (#1280, #1281).

  • Add a new pqerror package with PostgreSQL error codes (#1275).

    For example, to test if an error is a UNIQUE constraint violation:

    if pqErr, ok := errors.AsType[*pq.Error](https://github.com/lib/pq/blob/HEAD/err); ok && pqErr.Code == pqerror.UniqueViolation {
    log.Fatalf("email %q already exsts", email)
}

    To make this a bit more convenient, it also adds a pq.As() function:

... (truncated)

Changelog

Sourced from github.com/lib/pq's changelog.

v1.12.3 (2026-04-03)

  • Send datestyle startup parameter, improving compatbility with database engines that use a different default datestyle such as EnterpriseDB (#1312).

#1312: lib/pq#1312

v1.12.2 (2026-04-02)

  • Treat io.ErrUnexpectedEOF as driver.ErrBadConn so database/sql discards the connection. Since v1.12.0 this could result in permanently broken connections, especially with CockroachDB which frequently sends partial messages (#1299).

#1299: lib/pq#1299

v1.12.1 (2026-03-30)

  • Look for pgpass file in ~/.pgpass instead of ~/.postgresql/pgpass (#1300).

  • Don't clear password if directly set on pq.Config (#1302).

#1300: lib/pq#1300 #1302: lib/pq#1302

v1.12.0 (2026-03-18)

  • The next release may change the default sslmode from require to prefer. See #1271 for details.

  • CopyIn() and CopyInToSchema() have been marked as deprecated. These are simple query builders and not needed for COPY [..] FROM STDIN support (which is not deprecated). (#1279)

    // Old
tx.Prepare(CopyIn("temp", "num", "text", "blob", "nothing"))

    // Replacement
tx.Prepare(copy temp (num, text, blob, nothing) from stdin)

Features

  • Support protocol 3.2, and the min_protocol_version and max_protocol_version DSN parameters (#1258).

  • Support sslmode=prefer and sslmode=allow (#1270).

  • Support ssl_min_protocol_version and ssl_max_protocol_version (#1277).

... (truncated)

Commits
  • 1f3e3d9 Send datestyle as a startup parameter (#1312)
  • 32ba56b Expand tests for multiple result sets
  • c2cfac1 Release v1.12.2
  • 859f104 Test CockroachDB
  • 12e464c Allow multiple matches and regexps in pqtest.ErrorContains()
  • 6d77ced Treat io.ErrUnexpectedEOF as driver.ErrBadConn in handleError
  • 71daecb Ensure transactions are closed in pqtest
  • 8f44823 Set PGAPPNAME for tests
  • 4af2196 Fix healthcheck
  • 38a54e4 Split out testdata/init a bit
  • Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.41.1 to 1.45.1

Commits

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.19.7 to 1.20.1

Commits

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.95.1 to 1.109.1

Commits

Updates github.com/fxamacker/cbor/v2 from 2.9.0 to 2.9.3

Release notes

Sourced from github.com/fxamacker/cbor/v2's releases.

v2.9.3

This release fixes a potential panic when decoding into a time.Time from a CBOR byte string, map, or array under certain conditions.

Not affected: standard CBOR time data (RFC 8949 tag 0 or tag 1), and decoders configured with timeTag = DecTagRequired.

Upgrading to v2.9.3 is recommended.

The panic stack trace was publicly reported on 2026-08-17, and the fix was released the same day. Fuzz testing was extended to cover this class of bug, and fuzzing of v2.9.3 is ongoing.

What's Changed

Full Changelog: fxamacker/cbor@v2.9.2...v2.9.3

v2.9.2

This release refactors and hardens the streaming encoder by adding stricter checks for encoding CBOR indefinite-length data. Other changes include minor bugfixes, defensive checks, and more tests.

Projects that don't use CBOR indefinite-length data may also want to upgrade (summary of prior releases).

The stricter checks in the encoder prevent improper use of the library and bad inputs from producing malformed CBOR indefinite-length data that would be rejected by the decoder.

This release passed fuzz tests (billions of execs) and it is production quality.

What's Changed

CI / GitHub Actions and Docs

Full Changelog: fxamacker/cbor@v2.9.1...v2.9.2

v2.9.1

This release includes important bugfixes, defensive checks, improved code quality, and more tests. Although not public, the fuzzer was also improved by adding more fuzz tests.

🐞 Bug fixes related to the keyasint feature

These changes only affect Go struct fields tagged with keyasint:

... (truncated)

Commits
  • f0c90b6 Merge pull request #803 from fxamacker/fxamacker/fix-unmarshal-to-time
  • c20692a Skip data item when decoding to time.Time fails
  • 45589ab Merge pull request #769 from fxamacker/fxamacker/update-readme-release-status
  • 8e98ea5 Update README for v2.9.2 release
  • e501aca Merge pull request #768 from fxamacker/fxamacker/update-docs
  • e6af0aa Merge pull request #767 from fxamacker/fxamacker/refactor-indefinite-length-e...
  • 57f1601 Merge pull request #766 from fxamacker/fxamacker/no-opt-to-remove-nil-type-in...
  • 0cdb674 Fix indefinite-length string chunk validation
  • c0db60f Improve GitHub Workflow code coverage regex
  • 63937fe Fix panic message to print the unrecognized tag
  • Additional commits viewable in compare view

Updates github.com/knadh/koanf/parsers/yaml from 1.1.0 to 1.1.1

Release notes

Sourced from github.com/knadh/koanf/parsers/yaml's releases.

v1.1.1

  • 57e89cf Merge pull request #94 from knadh/fix-posflag-callbacks
  • d3bad45 Merge pull request #91 from knadh/bug-report-template
  • b1985ad Merge pull request #93 from rhnvrm/unit-test-issue-90
  • a72baa3 Merge pull request #92 from knadh/fix-posflag-callbacks
  • adc0b54 tests: add unit test for #90
  • 9e87eba Fix unchanged default posflag value merging via incorrect callback.
  • 2f82a14 Merge pull request #87 from mvrahden/feature/filesystem
  • 6e9c0a7 Add github issue templates
  • 023ecc6 Update README with fs.FS provider
  • f7e28d0 fix call to Close on file descriptor
  • caeef66 Merge pull request #1 from rhnvrm/feature/filesystem
  • 02f42ea fix: add build constraints to maintain compat
  • 149144c add fs.FS provider
  • 139fe40 Merge pull request #85 from mvrahden/fix/base_test
  • 7cc3416 move error assertions and make them error-type dependent
  • 0a31536 fix race condition and reduce test time by half
  • af2e3f4 simplify and unify test arrangements
  • aa62c04 update testify to v1.7.0
  • 5234867 Merge pull request #84 from mr-karan/gh_actions
  • c79fbc5 feat: Replace Travis with GitHub Actions
Commits
  • 57e89cf Merge pull request #94 from knadh/fix-posflag-callbacks
  • d3bad45 Merge pull request #91 from knadh/bug-report-template
  • b1985ad Merge pull request #93 from rhnvrm/unit-test-issue-90
  • a72baa3 Merge pull request #92 from knadh/fix-posflag-callbacks
  • adc0b54 tests: add unit test for #90
  • 9e87eba Fix unchanged default posflag value merging via incorrect callback.
  • 2f82a14 Merge pull request #87 from mvrahden/feature/filesystem
  • 6e9c0a7 Add github issue templates
  • 023ecc6 Update README with fs.FS provider
  • f7e28d0 fix call to Close on file descriptor
  • Additional commits viewable in compare view

Updates github.com/knadh/koanf/providers/file from 1.2.0 to 1.2.1

Release notes

Sourced from github.com/knadh/koanf/providers/file's releases.

v1.2.1

changelog for v1.2.0 -> v1.2.1

  • 29cce50 Merge pull request #101 from e-nikolov/fix-pflag-map-types
  • 0202243 posflag: add support for pflag map types
Commits

Updates github.com/knadh/koanf/v2 from 2.3.0 to 2.3.6

Release notes

Sourced from github.com/knadh/koanf/v2's releases.

v2.3.6

What's Changed

New Contributors

Full Changelog: knadh/koanf@v2.3.5...v2.3.6

v2.3.5

What's Changed

New Contributors

Full Changelog: knadh/koanf@v2.3.4...v2.3.5

v2.3.4

What's Changed

New Contributors

Full Changelog: knadh/koanf@v2.3.3...v2.3.4

v2.3.3

What's Changed

Full Changelog: knadh/koanf@v2.3.2...v2.3.3

... (truncated)

Commits
  • 75e13d9 Fix multiple large int64 handling issues.
  • b133504 skip disabled secret on azure kv read (#437)
  • 1aba4ed deps: upgrade go-toml to v2.4.3 (#419)
  • d2ffdaa Bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /providers/kiln (#427)
  • 4f7edbb Bump google.golang.org/grpc from 1.56.3 to 1.82.1 in /examples (#430)
  • 31dd449 fix: error on scalar/map type mismatch in MergeStrict regardless of order (#424)
  • e09e4c8 fix: report full key var in MergeStrict type-mismatch error message (#418)
  • 7a28d59 Exclude nats, vault providers from global workspace and fix CI test commands.
  • d511690 Fix test action to use local Go toolchain for different versions.
  • 308274c Fix async file provider Watch() test that would race and fail randomly.
  • Additional commits viewable in compare view

Updates github.com/livekit/protocol from 1.43.4 to 1.50.4

Release notes

Sourced from github.com/livekit/protocol's releases.

@​livekit/protocol@​1.50.4

Patch Changes

@​livekit/protocol@​1.50.3

No release notes provided.

@​livekit/protocol@​1.50.2

Patch Changes

  • Export the agent simulation protos (Scenario, SimulationDispatch, SimulationMode, SimulationRun, ...) from the JS package root - #1674 (@​u9g)

@​livekit/protocol@​1.50.1

Patch Changes

  • Fix recursive call to CreateSIPInboundTrunkRequest.ValidateResult. - #1669 (@​alexfish8)

@​livekit/protocol@​1.50.0

Minor Changes

  • Add validation method variants that include information about soft errors. - #1667 (@​alexfish8)

Patch Changes

@​livekit/protocol@​1.49.0

Minor Changes

Patch Changes

@​livekit/protocol@​1.48.2

Patch Changes

@​livekit/protocol@​1.48.1

Patch Changes

@​livekit/protocol@​1.48.0

Minor Changes

... (truncated)

Changelog

Sourced from github.com/livekit/protocol's changelog.

1.50.4

Patch Changes

1.50.3

Patch Changes

  • agent simulation: homogenizes Turn/Job/Run LLM/TTS/STT/Conversation metrics shapes - #1673 (@​Bobronium)

1.50.2

1.50.1

Patch Changes

  • Fix recursive call to CreateSIPInboundTrunkRequest.ValidateResult. - #1669 (@​alexfish8)

  • agent simulation JobMetrics: add TTS.cer, add STT/TTS words/chars counts, replace jobs_failed with jobs_measured - #1670 (@​Bobronium)

1.50.0

Minor Changes

  • agent: add llm_node_tps and llm_node_ttfs to MetricsReport, and an AgentFalseInterruption event to AgentSessionEvent - #1661 (@​Bobronium)

  • agent_simulations: add JobMetrics/RunMetrics to SimulationRun — per-job quality metrics grouped by - #1644 (@​Bobronium) pipeline stage (stt/llm/tts/conversation, plus a per-turn timeline and headline accuracy/experience scores) and run-level aggregates. Unset optional fields mean "not measured";

  • Add validation method variants that include information about soft errors. - #1667 (@​alexfish8)

Patch Changes

1.49.0

Minor Changes

Patch Changes

... (truncated)

Commits

Updates github.com/livekit/server-sdk-go/v2 from 2.13.1 to 2.18.1

Commits

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860...

    Description has been truncated

@dependabot
chore(deps)(deps): bump the go-dependencies group with 21 updates
dff45ec 
Bumps the go-dependencies group with 21 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt) | `5.3.0` | `5.3.1` |
| [github.com/lib/pq](https://github.com/lib/pq) | `1.10.9` | `1.12.3` |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.41.1` | `1.45.1` |
| [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) | `1.19.7` | `1.20.1` |
| [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.95.1` | `1.109.1` |
| [github.com/fxamacker/cbor/v2](https://github.com/fxamacker/cbor) | `2.9.0` | `2.9.3` |
| [github.com/knadh/koanf/parsers/yaml](https://github.com/knadh/koanf) | `1.1.0` | `1.1.1` |
| [github.com/knadh/koanf/providers/file](https://github.com/knadh/koanf) | `1.2.0` | `1.2.1` |
| [github.com/knadh/koanf/v2](https://github.com/knadh/koanf) | `2.3.0` | `2.3.6` |
| [github.com/livekit/protocol](https://github.com/livekit/protocol) | `1.43.4` | `1.50.4` |
| [github.com/livekit/server-sdk-go/v2](https://github.com/livekit/server-sdk-go) | `2.13.1` | `2.18.1` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` |
| [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) | `9.17.2` | `9.20.0` |
| [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go) | `0.40.0` | `0.44.0` |
| [github.com/testcontainers/testcontainers-go/modules/postgres](https://github.com/testcontainers/testcontainers-go) | `0.40.0` | `0.44.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.61.0` | `0.69.0` |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.38.0` | `1.44.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.24.0` | `1.46.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `1.24.0` | `1.44.0` |
| [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.38.0` | `1.46.0` |
| [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | `1.38.0` | `1.46.0` |


Updates `github.com/golang-jwt/jwt/v5` from 5.3.0 to 5.3.1
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Commits](golang-jwt/jwt@v5.3.0...v5.3.1)

Updates `github.com/lib/pq` from 1.10.9 to 1.12.3
- [Release notes](https://github.com/lib/pq/releases)
- [Changelog](https://github.com/lib/pq/blob/main/CHANGELOG.md)
- [Commits](lib/pq@v1.10.9...v1.12.3)

Updates `github.com/aws/aws-sdk-go-v2` from 1.41.1 to 1.45.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.1...v1.45.1)

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.19.7 to 1.20.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/m2/v1.19.7...v1.20.1)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.95.1 to 1.109.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.95.1...service/s3/v1.109.1)

Updates `github.com/fxamacker/cbor/v2` from 2.9.0 to 2.9.3
- [Release notes](https://github.com/fxamacker/cbor/releases)
- [Commits](fxamacker/cbor@v2.9.0...v2.9.3)

Updates `github.com/knadh/koanf/parsers/yaml` from 1.1.0 to 1.1.1
- [Release notes](https://github.com/knadh/koanf/releases)
- [Commits](knadh/koanf@v1.1.0...v1.1.1)

Updates `github.com/knadh/koanf/providers/file` from 1.2.0 to 1.2.1
- [Release notes](https://github.com/knadh/koanf/releases)
- [Commits](knadh/koanf@v1.2.0...v1.2.1)

Updates `github.com/knadh/koanf/v2` from 2.3.0 to 2.3.6
- [Release notes](https://github.com/knadh/koanf/releases)
- [Commits](knadh/koanf@v2.3.0...v2.3.6)

Updates `github.com/livekit/protocol` from 1.43.4 to 1.50.4
- [Release notes](https://github.com/livekit/protocol/releases)
- [Changelog](https://github.com/livekit/protocol/blob/main/CHANGELOG.md)
- [Commits](livekit/protocol@v1.43.4...v1.50.4)

Updates `github.com/livekit/server-sdk-go/v2` from 2.13.1 to 2.18.1
- [Commits](livekit/server-sdk-go@v2.13.1...v2.18.1)

Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.23.2...v1.24.1)

Updates `github.com/redis/go-redis/v9` from 9.17.2 to 9.20.0
- [Release notes](https://github.com/redis/go-redis/releases)
- [Changelog](https://github.com/redis/go-redis/blob/master/RELEASE-NOTES.md)
- [Commits](redis/go-redis@v9.17.2...v9.20.0)

Updates `github.com/testcontainers/testcontainers-go` from 0.40.0 to 0.44.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.40.0...v0.44.0)

Updates `github.com/testcontainers/testcontainers-go/modules/postgres` from 0.40.0 to 0.44.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.40.0...v0.44.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.61.0 to 0.69.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.61.0...zpages/v0.69.0)

Updates `go.opentelemetry.io/otel` from 1.38.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.44.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.24.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.24.0...v1.46.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.24.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.24.0...v1.44.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.38.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.46.0)

Updates `go.opentelemetry.io/otel/trace` from 1.38.0 to 1.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.46.0)

---
updated-dependencies:
- dependency-name: github.com/golang-jwt/jwt/v5
  dependency-version: 5.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/lib/pq
  dependency-version: 1.12.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-version: 1.109.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/fxamacker/cbor/v2
  dependency-version: 2.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/knadh/koanf/parsers/yaml
  dependency-version: 1.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/knadh/koanf/providers/file
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/knadh/koanf/v2
  dependency-version: 2.3.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/livekit/protocol
  dependency-version: 1.50.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/livekit/server-sdk-go/v2
  dependency-version: 2.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/redis/go-redis/v9
  dependency-version: 9.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/testcontainers/testcontainers-go
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/testcontainers/testcontainers-go/modules/postgres
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-version: 0.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: go, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown

NPM Vulnerability Scan Results - web

Severity Count
Critical 3
High 11
Moderate 6
Low 1
Total 21
Click to see details 
# npm audit report

@babel/core  <=7.29.0
@babel/core: Arbitrary File Read via sourceMappingURL Comment - https://github.com/advisories/GHSA-4x5r-pxfx-6jf8
fix available via `npm audit fix`
node_modules/@babel/core

@remix-run/router  1.3.0 - 1.23.2
Severity: moderate
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation - https://github.com/advisories/GHSA-2j2x-hqr9-3h42
fix available via `npm audit fix`
node_modules/@remix-run/router
  react-router  6.0.0 - 7.17.0
  Depends on vulnerable versions of @remix-run/router
  node_modules/react-router
    react-router-dom  6.0.0-alpha.0 - 7.17.0
    Depends on vulnerable versions of @remix-run/router
    Depends on vulnerable versions of react-router
    node_modules/react-router-dom

ajv  <6.14.0
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
fix available via `npm audit fix`
node_modules/ajv

brace-expansion  <=1.1.17 || 2.0.0 - 2.1.3
Severity: high
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - https://github.com/advisories/GHSA-rgw5-rvv9-x895
fix available via `npm audit fix`
node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion
node_modules/brace-expansion

flatted  <=3.4.1
Severity: high
flatted vulnerable to unbounded recursion DoS in parse() revive phase - https://github.com/advisories/GHSA-25h7-pfq9-p65f
Prototype Pollution via parse() in NodeJS flatted - https://github.com/advisories/GHSA-rf6f-7fwh-wjgh
fix available via `npm audit fix`
node_modules/flatted

i18next-http-backend  <3.0.5
Severity: moderate
 i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns - https://github.com/advisories/GHSA-q89c-q3h5-w34g
fix available via `npm audit fix`
node_modules/i18next-http-backend

js-yaml  4.0.0 - 4.3.0
Severity: high
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases - https://github.com/advisories/GHSA-h67p-54hq-rp68
js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported - https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
fix available via `npm audit fix`
node_modules/js-yaml

lodash-es  <=4.17.23
Severity: high
lodash vulnerable to Code Injection via `_.template` imports key names - https://github.com/advisories/GHSA-r5fr-rjxr-66jc
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - https://github.com/advisories/GHSA-f23m-r3pf-42rh
fix available via `npm audit fix`
node_modules/lodash-es

minimatch  <=3.1.3 || 9.0.0 - 9.0.6
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch
node_modules/minimatch

nanoid  <=3.3.17
Severity: high
nanoid: non-secure generators can loop indefinitely with negative size - https://github.com/advisories/GHSA-28wg-ghj8-5hjv
nanoid: custom generators can loop indefinitely when size is zero - https://github.com/advisories/GHSA-2v37-7h3g-55p8
fix available via `npm audit fix`
node_modules/nanoid

picomatch  <=2.3.1 || 4.0.0 - 4.0.3
Severity: high
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
fix available via `npm audit fix`
node_modules/picomatch
node_modules/rollup-plugin-visualizer/node_modules/picomatch
node_modules/tinyglobby/node_modules/picomatch
node_modules/vite/node_modules/picomatch
node_modules/vitest/node_modules/picomatch

postcss  <=8.5.22
Severity: high
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - https://github.com/advisories/GHSA-qx2v-qp2m-jg93
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments - https://github.com/advisories/GHSA-6g55-p6wh-862q
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset - https://github.com/advisories/GHSA-fxqj-rqcc-2cmp
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure - https://github.com/advisories/GHSA-r28c-9q8g-f849
fix available via `npm audit fix`
node_modules/postcss

protocol-buffers-schema  <3.6.1
Severity: moderate
Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution - https://github.com/advisories/GHSA-j452-xhg8-qg39
fix available via `npm audit fix`
node_modules/protocol-buffers-schema



rollup  4.0.0 - 4.58.0
Severity: high
Rollup 4 has Arbitrary File Write via Path Traversal - https://github.com/advisories/GHSA-mw96-cpmx-2vgc
fix available via `npm audit fix`
node_modules/rollup

vite  7.0.0 - 7.3.3
Severity: high
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling - https://github.com/advisories/GHSA-4w7w-66w2-5vf9
Vite: `server.fs.deny` bypassed with queries - https://github.com/advisories/GHSA-v2wj-q39q-566r
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket - https://github.com/advisories/GHSA-p9ff-h696-f583
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows - https://github.com/advisories/GHSA-v6wh-96g9-6wx3
vite: `server.fs.deny` bypass on Windows alternate paths - https://github.com/advisories/GHSA-fx2h-pf6j-xcff
fix available via `npm audit fix`
node_modules/vite

vitest  4.0.0-beta.1 - 4.1.0-beta.6
Severity: critical
Depends on vulnerable versions of @vitest/ui
When Vitest UI server is listening, arbitrary file can be read and executed - https://github.com/advisories/GHSA-5xrq-8626-4rwp
fix available via `npm audit fix`
node_modules/vitest
  @vitest/coverage-v8  4.0.0-beta.1 - 4.1.0-beta.6
  Depends on vulnerable versions of vitest
  node_modules/@vitest/coverage-v8
  @vitest/ui  4.0.0-beta.1 - 4.1.0-beta.6
  Depends on vulnerable versions of vitest
  node_modules/@vitest/ui

ws  8.0.0 - 8.20.1
Severity: high
ws: Uninitialized memory disclosure - https://github.com/advisories/GHSA-58qx-3vcg-4xpx
ws: Memory exhaustion DoS from tiny fragments and data chunks - https://github.com/advisories/GHSA-96hv-2xvq-fx4p
fix available via `npm audit fix`
node_modules/ws

21 vulnerabilities (1 low, 6 moderate, 11 high, 3 critical)

To address all issues, run:
  npm audit fix

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants