build(deps): bump the dependencies group across 1 directory with 13 updates - #234
Open
dependabot[bot] wants to merge 1 commit into
Open
build(deps): bump the dependencies group across 1 directory with 13 updates#234dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
…pdates Bumps the dependencies group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum) | `1.17.4` | `1.17.5` | | [github.com/ethpandaops/go-eth2-client](https://github.com/ethpandaops/go-eth2-client) | `0.1.6` | `0.1.7` | | [github.com/ethpandaops/service-authenticatoor](https://github.com/ethpandaops/service-authenticatoor) | `0.0.2` | `0.0.3` | | [github.com/ethpandaops/spamoor](https://github.com/ethpandaops/spamoor) | `1.2.2` | `1.2.3` | | [github.com/glebarez/go-sqlite](https://github.com/glebarez/go-sqlite) | `1.22.0` | `1.23.0` | | [github.com/mashingan/smapping](https://github.com/mashingan/smapping) | `0.1.19` | `0.1.20` | | [github.com/pressly/goose/v3](https://github.com/pressly/goose) | `3.27.2` | `3.28.0` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` | | [github.com/prometheus/client_model](https://github.com/prometheus/client_model) | `0.6.2` | `0.6.3` | | [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) | `1.9.4` | `1.10.2` | Updates `github.com/ethereum/go-ethereum` from 1.17.4 to 1.17.5 - [Release notes](https://github.com/ethereum/go-ethereum/releases) - [Commits](ethereum/go-ethereum@v1.17.4...v1.17.5) Updates `github.com/ethpandaops/go-eth2-client` from 0.1.6 to 0.1.7 - [Release notes](https://github.com/ethpandaops/go-eth2-client/releases) - [Changelog](https://github.com/ethpandaops/go-eth2-client/blob/master/CHANGELOG.md) - [Commits](ethpandaops/go-eth2-client@v0.1.6...v0.1.7) Updates `github.com/ethpandaops/service-authenticatoor` from 0.0.2 to 0.0.3 - [Release notes](https://github.com/ethpandaops/service-authenticatoor/releases) - [Commits](ethpandaops/service-authenticatoor@v0.0.2...v0.0.3) Updates `github.com/ethpandaops/spamoor` from 1.2.2 to 1.2.3 - [Release notes](https://github.com/ethpandaops/spamoor/releases) - [Commits](ethpandaops/spamoor@v1.2.2...v1.2.3) Updates `github.com/glebarez/go-sqlite` from 1.22.0 to 1.23.0 - [Release notes](https://github.com/glebarez/go-sqlite/releases) - [Commits](glebarez/go-sqlite@v1.22.0...v1.23.0) Updates `github.com/mashingan/smapping` from 0.1.19 to 0.1.20 - [Commits](mashingan/smapping@v0.1.19...v0.1.20) Updates `github.com/pressly/goose/v3` from 3.27.2 to 3.28.0 - [Release notes](https://github.com/pressly/goose/releases) - [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md) - [Commits](pressly/goose@v3.27.2...v3.28.0) Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.23.2...v1.24.1) Updates `github.com/prometheus/client_model` from 0.6.2 to 0.6.3 - [Release notes](https://github.com/prometheus/client_model/releases) - [Commits](prometheus/client_model@v0.6.2...v0.6.3) Updates `github.com/prometheus/common` from 0.69.0 to 0.70.1 - [Release notes](https://github.com/prometheus/common/releases) - [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md) - [Commits](prometheus/common@v0.69.0...v0.70.1) Updates `github.com/sirupsen/logrus` from 1.9.4 to 1.10.2 - [Release notes](https://github.com/sirupsen/logrus/releases) - [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md) - [Commits](sirupsen/logrus@v1.9.4...v1.10.2) Updates `golang.org/x/text` from 0.39.0 to 0.41.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.39.0...v0.41.0) Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12 --- updated-dependencies: - dependency-name: github.com/ethereum/go-ethereum dependency-version: 1.17.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/ethpandaops/go-eth2-client dependency-version: 0.1.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/ethpandaops/service-authenticatoor dependency-version: 0.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/ethpandaops/spamoor dependency-version: 1.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/glebarez/go-sqlite dependency-version: 1.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github.com/mashingan/smapping dependency-version: 0.1.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/pressly/goose/v3 dependency-version: 3.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github.com/prometheus/client_model dependency-version: 0.6.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github.com/prometheus/common dependency-version: 0.70.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: github.com/sirupsen/logrus dependency-version: 1.10.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: golang.org/x/text dependency-version: 0.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![redpandabot[bot]](https://avatars.githubusercontent.com/in/3749543?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
Dependency group bump: 10 listed direct deps (geth 1.17.4→1.17.5, go-eth2-client 0.1.6→0.1.7, service-authenticatoor 0.0.2→0.0.3, spamoor 1.2.2→1.2.3, sqlite, smapping, goose, prometheus ×2, logrus) plus transitive churn and a go.mod go directive raise to 1.26.0. I cross-checked assertoor's usage against the bump-target sources and OSV-scanned every new version: the self-published ethpandaops deps are API-compatible and all direct deps are OSV-clean, but the transitive x/crypto v0.55.0 still has two known ssh DoS CVEs only fixed in v0.56.0, and the raise to go 1.26.0 is inconsistent with the repo's pinned Go 1.25 toolchains.
Issues
- 🔴
go.mod:114— x/crypto v0.55.0 lands with known unpatched CVEs — see the thread on that line - 🟡
go.mod:3— go 1.26.0 directive vs pinned Go 1.25 toolchains — see the thread on that line
Reviewed @ 722f08f1
Red pandas are the original panda — described in 1825, almost half a century before the giant panda.
| golang.org/x/net v0.56.0 // indirect | ||
| golang.org/x/sync v0.21.0 // indirect | ||
| golang.org/x/sys v0.46.0 // indirect | ||
| golang.org/x/crypto v0.55.0 // indirect |
There was a problem hiding this comment.
🔴 x/crypto v0.55.0 lands with known unpatched CVEs
OSV reports GO-2026-6354 (CVE-2026-78662) and GO-2026-6355 (CVE-2026-56855) — ssh channel DoS, both fixed only in x/crypto v0.56.0 — plus GO-2026-5932 (openpgp advisory) for the new version v0.55.0 this PR selects. v0.56.0 was published 2026-09-02, so the group bump should target it rather than 0.55.0 and leave the module on a known-vulnerable x/crypto.
| module github.com/ethpandaops/assertoor | ||
|
|
||
| go 1.25.7 | ||
| go 1.26.0 |
There was a problem hiding this comment.
🟡 go 1.26.0 directive vs pinned Go 1.25 toolchains
pressly/goose v3.28.0 declares go 1.26.0, forcing assertoor's go.mod directive up to 1.26.0, but every build path still pins Go 1.25: FROM golang:1.25 in Dockerfile/Dockerfile-local and go-version: 1.25.x in _shared-check.yaml (and 3x in _shared-build.yaml). The module can no longer be built by the pinned toolchains — it silently auto-downloads Go 1.26.0 at build time (failing outright offline or under GOTOOLCHAIN=local), so the Docker/CI pins should be raised to 1.26.x to match.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the dependencies group with 10 updates in the / directory:
1.17.41.17.50.1.60.1.70.0.20.0.31.2.21.2.31.22.01.23.00.1.190.1.203.27.23.28.01.23.21.24.10.6.20.6.31.9.41.10.2Updates
github.com/ethereum/go-ethereumfrom 1.17.4 to 1.17.5Release notes
Sourced from github.com/ethereum/go-ethereum's releases.
... (truncated)
Commits
9621c6aversion: release v1.17.5 (#35421)cff7fcbgo.mod: update snappy dependency (#35422)ca1f2e4core: fix tx size calculation (#35406)cd65ccaeth/downloader: hold pivotLock when marking pivot committed (#35405)a524f2bnode: check authorization header case-insensitivity (#35408)af03a27cmd/utils: skip memory-limit sanitize when total memory is unknown (#35407)ff44a79core: coordinate the state prefetcher with block processing (#35404)b2ee839eth/catalyst: allow reorg depth equal to maxReorgDepth (#35391)f03b91ccore: optimize block validation (#35403)e317407eth/fetcher: clear partial map when dropping last waitlist peer (#35399)Updates
github.com/ethpandaops/go-eth2-clientfrom 0.1.6 to 0.1.7Release notes
Sourced from github.com/ethpandaops/go-eth2-client's releases.
Commits
15ed59aMerge pull request #41 from ethpandaops/feat/head-v2-sse690bfecfix merge conflict28fe488Merge branch 'master' into feat/head-v2-sse5c907ecMerge pull request #52 from ethpandaops/pk910/heze-alpha.1438c12e3Merge pull request #53 from ethpandaops/bbusa/heze-il-event-dependent-root36d49bfRename inclusion_list_committee_root to dependent_root in the inclusion list ...849ac87chore(spec): drop conversions of values already uint648573c7etest: take the spec vectors from the consensus-specs releases2d0c751fix(spec): render YAML the way the spec vectors write it32c453ffeat(heze): add the Heze containers (EIP-7805)Updates
github.com/ethpandaops/service-authenticatoorfrom 0.0.2 to 0.0.3Release notes
Sourced from github.com/ethpandaops/service-authenticatoor's releases.
Commits
4ad46cfMerge pull request #7 from ethpandaops/pk910/shared-session-handling002ffd6linter fixes5381671minify & inline scriptsc551012linter fixesc36be63Merge pull request #6 from ethpandaops/dependabot/github_actions/actions-293e...9e9fc88implement shared session handler (client v2)16900c5Bump the actions group with 4 updatesUpdates
github.com/ethpandaops/spamoorfrom 1.2.2 to 1.2.3Release notes
Sourced from github.com/ethpandaops/spamoor's releases.
... (truncated)
Commits
3cf5de7Merge pull request #224 from ethpandaops/pk910/authenticatoor-auth-providere59d59aMerge branch 'master' into pk910/authenticatoor-auth-providerf1a9ef2fix merge issuebcb326fMerge pull request #253 from ethpandaops/pk910/seaport6fbaa31Merge branch 'master' into pk910/authenticatoor-auth-provider5c1005eadd new scenarios to default spammers7daf802Merge branch 'master' into pk910/seaport283083eMerge pull request #255 from ethpandaops/pk910/auto-restart-failed-members5189671Merge branch 'master' into pk910/auto-restart-failed-membersa54ddd5Merge pull request #254 from ethpandaops/pk910/rework-default-spammersUpdates
github.com/glebarez/go-sqlitefrom 1.22.0 to 1.23.0Commits
1825f18Bump modernc.org/sqlite to 1.55.0 (SQLite 3.53.3) (#188)ca37feaDocument forke6de9fcbuild(deps): bump modernc.org/sqlite from 1.28.0 to 1.31.0 and upgrade go ver...Updates
github.com/mashingan/smappingfrom 0.1.19 to 0.1.20Commits
191284eadd test for dynamic map scanning rows4401787support for dynamic map scanning rowsUpdates
github.com/pressly/goose/v3from 3.27.2 to 3.28.0Release notes
Sourced from github.com/pressly/goose/v3's releases.
Changelog
Sourced from github.com/pressly/goose/v3's changelog.
Commits
43d2d9crelease: v3.28.0c65c559docs: update changelog674e150fix: use DATETIME instead of TIMESTAMP for MySQL/TiDB tstamp column (Y2K38) (...f604e88fix: include path in duplicate migration file error and use 0666 mode5f12f79fix: return clear error when migration file already exists (#1104)4766566fix: useversion_idinstead ofdateas ordering key (#1085)751ff94docs: add Go 1.26.0 bump and dependency upgrades to changelog34124acfix: wait for an alive StarRocks backend in tests (#1114)f5caf10chore: bump dependencies and go to 1.26.0 (#1113)2e8e87aAdd azuresql driver with EntraID auth (#1109)Updates
github.com/prometheus/client_golangfrom 1.23.2 to 1.24.1Release notes
Sourced from github.com/prometheus/client_golang's releases.
... (truncated)
Changelog
Sourced from github.com/prometheus/client_golang's changelog.
Commits
d6087eerelease: cut v1.24.1 (#2076)48dd383Cut v1.24.0 (#2061)a725305Cut v1.24.0-rc.0 (#2058)77c584fbuild(deps): update all Go dependencies in all go.mod files (#2059)78262a7feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...34e9a7fMerge pull request #2055 from prombot/repo_sync43749bcUpdate common Prometheus filesde19217examples: improve simple main.go example (#1999)20355ebfix: correct typos in comments and test error messages (#2049)4cd2d3atest: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...Updates
github.com/prometheus/client_modelfrom 0.6.2 to 0.6.3Release notes
Sourced from github.com/prometheus/client_model's releases.