chore(deps): bump the go-deps group across 1 directory with 5 updates by dependabot[bot] · Pull Request #13 · GoaCloud/GoaCore

dependabot · 2026-08-05T22:01:10Z

Bumps the go-deps group with 5 updates in the / directory:

Package	From	To
github.com/go-chi/chi/v5	`5.2.1`	`5.3.1`
github.com/go-sql-driver/mysql	`1.7.1`	`1.10.0`
github.com/gorilla/sessions	`1.2.2`	`1.4.0`
github.com/pquerna/otp	`1.4.0`	`1.5.0`
golang.org/x/crypto	`0.52.0`	`0.54.0`

Updates github.com/go-chi/chi/v5 from 5.2.1 to 5.3.1

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.1

What's Changed

Honor Discard() in httpFancyWriter.ReadFrom by @DucMinhNe in go-chi/chi#1110

Tidy build directives by @JRaspass in go-chi/chi#1113

feat(middleware): add text/xml and application/xml to default compressible types by @VojtechVitek in go-chi/chi#1127

Fix defaultLogEntry.Panic not respecting NoColor setting by @doganarif in go-chi/chi#1050

middleware: document printPrettyStack and harden NoColor panic test by @VojtechVitek in go-chi/chi#1131

feat(mux): support http QUERY method ietf rfc10008 by @VojtechVitek in go-chi/chi#1132

ci: pin GitHub Actions to full commit SHAs by @XananasX7 in go-chi/chi#1116

New Contributors

@DucMinhNe made their first contribution in go-chi/chi#1110

@doganarif made their first contribution in go-chi/chi#1050

@XananasX7 made their first contribution in go-chi/chi#1116

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

v5.3.0

What's Changed

Use strings.ReplaceAll where applicable by @JRaspass in go-chi/chi#1046

Propagate inline middlewares across mounted subrouters by @LukasJenicek in go-chi/chi#1049

add go 1.26 to ci by @pkieltyka in go-chi/chi#1052

Remove last uses of io/ioutil by @JRaspass in go-chi/chi#1054

Simplify chi.walk with slices.Concat by @JRaspass in go-chi/chi#1053

Apply the stringscutprefix modernizer by @JRaspass in go-chi/chi#1051

Bump minimum Go to 1.23, always use request.Pattern by @JRaspass in go-chi/chi#1048

middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by @alliasgher in go-chi/chi#1085

Fix typo in Route doc comment by @gouwazi in go-chi/chi#1073

fix: set Request.Pattern from RoutePattern() by @leno23 in go-chi/chi#1097

feat: middleware.ClientIP, a replacement for middleware.RealIP by @VojtechVitek in go-chi/chi#967

New Contributors

@LukasJenicek made their first contribution in go-chi/chi#1049

@alliasgher made their first contribution in go-chi/chi#1085

@gouwazi made their first contribution in go-chi/chi#1073

@leno23 made their first contribution in go-chi/chi#1097

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

@VojtechVitek submitted PR #967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:

GHSA-9g5q-2w5x-hmxf — IP spoofing via XFF in RemoteAddr resolution (convto)

GHSA-rjr7-jggh-pgcp — RealIP allows IP spoofing via unvalidated XFF (rezmoss)

GHSA-3fxj-6jh8-hvhx — IP spoofing in middleware.RealIP (Saku0512, Critical / 9.3)

It also addresses issues outlined at:

go-chi/chi#708

https://adam-p.ca/blog/2022/03/x-forwarded-for/

go-chi/chi#711

go-chi/chi#453

go-chi/chi#908

... (truncated)

Commits

8b258c7 ci: pin GitHub Actions to full commit SHAs (#1116)
caf87e6 feat(mux): support http QUERY method ietf rfc10008 (#1132)
7fcb8a2 middleware: document printPrettyStack and harden NoColor panic test (#1131)
878fe71 Fix defaultLogEntry.Panic not respecting NoColor setting (#1050)
d7b767b feat(middleware): add text/xml and application/xml to default compressible ty...
3b50c7c Tidy build directives (#1113)
2b9fca2 Honor Discard() in httpFancyWriter.ReadFrom (#1110)
3b17157 feat: middleware.ClientIP, a replacement for middleware.RealIP (#967)
818fdcf fix: set Request.Pattern from RoutePattern() (#1097)
f975af0 Fix typo in Route doc comment (#1073)
Additional commits viewable in compare view

Updates github.com/go-sql-driver/mysql from 1.7.1 to 1.10.0

Release notes

Sourced from github.com/go-sql-driver/mysql's releases.

v1.10.0

What's Changed

add Go 1.24 to the test matrix by @shogo82148 in go-sql-driver/mysql#1681

modernize for Go 1.22 by @methane in go-sql-driver/mysql#1695

test stability improvement. by @methane in go-sql-driver/mysql#1698

simplify collation tests by @methane in go-sql-driver/mysql#1700

fix bigint unsigned null column scan to err type int64 by @elonnzhang in go-sql-driver/mysql#1612

Transaction Commit/Rollback returns conn's cached error, if present by @brad-defined in go-sql-driver/mysql#1691

add BenchmarkReceive10kRowsCompress by @methane in go-sql-driver/mysql#1704

optimize readPacket by @methane in go-sql-driver/mysql#1705

MariaDB Metadata skipping and DEPRECATE_EOF by @rusher in go-sql-driver/mysql#1708

Optimization: statements reuse previous column name by @methane in go-sql-driver/mysql#1711

update outdated MySQL internals documentation links by @demouth in go-sql-driver/mysql#1714

fix PING on compressed connections by @methane in go-sql-driver/mysql#1721

add DeepWiki badge by @methane in go-sql-driver/mysql#1722

Update edwards25519 dependency to v1.1.1 by @williamhaw in go-sql-driver/mysql#1749

Configure Dependabot for Go modules by @methane in go-sql-driver/mysql#1755

Bump dominikh/staticcheck-action from 1.3.1 to 1.4.1 by @dependabot[bot] in go-sql-driver/mysql#1759

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in go-sql-driver/mysql#1760

Bump actions/setup-go from 5 to 6 by @dependabot[bot] in go-sql-driver/mysql#1757

fix staticcheck error by @methane in go-sql-driver/mysql#1761

Bump actions/checkout from 4 to 6 by @dependabot[bot] in go-sql-driver/mysql#1758

Fix getSystemVar buffer reuse by @morgo in go-sql-driver/mysql#1754

Consolidate Dependabot update noise by grouping weekly dependency PRs by @Copilot in go-sql-driver/mysql#1762

Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0 by @dependabot[bot] in go-sql-driver/mysql#1756

CI: Update GitHub Actions Go matrix to 1.24–1.26 by @Copilot in go-sql-driver/mysql#1763

Enhance interpolateParams to correctly handle placeholders by @rusher in go-sql-driver/mysql#1732

modernize by @methane in go-sql-driver/mysql#1764

release v1.10.0 by @methane in go-sql-driver/mysql#1765

New Contributors

@elonnzhang made their first contribution in go-sql-driver/mysql#1612

@brad-defined made their first contribution in go-sql-driver/mysql#1691

@rusher made their first contribution in go-sql-driver/mysql#1708

@demouth made their first contribution in go-sql-driver/mysql#1714

@williamhaw made their first contribution in go-sql-driver/mysql#1749

@dependabot[bot] made their first contribution in go-sql-driver/mysql#1759

@morgo made their first contribution in go-sql-driver/mysql#1754

@Copilot made their first contribution in go-sql-driver/mysql#1762

Full Changelog: go-sql-driver/mysql@v1.9.2...v1.10.0

v1.9.3

What's Changed

[1.9] test stability improvement. by @methane in go-sql-driver/mysql#1699

[1.9] Transaction Commit/Rollback returns conn's cached error by @methane in go-sql-driver/mysql#1702

backport benchmark_test by @methane in go-sql-driver/mysql#1706

[1.9] optimize readPacket (#1705) by @methane in go-sql-driver/mysql#1707

[1.9] fix PING on compressed connections by @methane in go-sql-driver/mysql#1723

release v1.9.3 by @methane in go-sql-driver/mysql#1725

... (truncated)

Changelog

Sourced from github.com/go-sql-driver/mysql's changelog.

v1.10.0 (2026-04-28)

Fix getSystemVar("max_allowed_packet") potentially returned wrong value. (#1754) This affects only when maxAllowedPacket=0 is set.

Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0. (#1756) While older versions have reported CVEs, they do not affect go-mysql.

Update Go versions to 1.24-1.26. (#1763)

Enhance interpolateParams to correctly handle placeholders. (#1732) The question mark (?) within strings and comments will no longer be treated as a placeholder.

v1.9.3 (2025-06-13)

tx.Commit() and tx.Rollback() returned ErrInvalidConn always. Now they return cached real error if present. (#1690)

Optimize reading small result sets to fix a performance regression introduced by compression protocol support. ([#1707](https://github.com/go-sql-driver/mysql/issues/1707))

Fix db.Ping() on compressed connection. (#1723)

v1.9.2 (2025-04-07)

v1.9.2 is a re-release of v1.9.1 due to a release process issue; no changes were made to the content.

v1.9.1 (2025-03-21)

Major Changes

Add Charset() option. (#1679)

Bugfixes

go.mod: fix go version format (#1682)

Fix FormatDSN missing ConnectionAttributes (#1619)

v1.9.0 (2025-02-18)

Major Changes

Implement zlib compression. (#1487)

Supported Go version is updated to Go 1.21+. (#1639)

Add support for VECTOR type introduced in MySQL 9.0. (#1609)

Config object can have custom dial function. (#1527)

Bugfixes

... (truncated)

Commits

a065b60 release v1.10.0 (#1765)
09e4187 modernize (#1764)
6c44a9a Enhance interpolateParams to correctly handle placeholders (#1732)
688ce56 Update supported Go version to 1.24–1.26 (#1763)
118d07f Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0 (#1756)
d6b2d3e Consolidate Dependabot update noise by grouping weekly dependency PRs (#1762)
037dfd8 Fix getSystemVar buffer reuse (#1754)
900f330 Bump actions/checkout from 4 to 6 (#1758)
ab9e380 fix staticcheck error (#1761)
f298c66 Bump actions/setup-go from 5 to 6 (#1757)
Additional commits viewable in compare view

Updates github.com/gorilla/sessions from 1.2.2 to 1.4.0

Release notes

Sourced from github.com/gorilla/sessions's releases.

v1.4.0

Summary

There were new features important for compatibility with some of the upcoming cookie security changes with google that required a new Partitioned attribute be added to the cookies, this attribute was only available in go 1.23, which has just recently been released.

If you require a version that is backward compatible with a lower version than go 1.23 then you'll need to use release v1.3.0.

The following notes show the difference between 1.2.2 and the current version because 1.3.0 was a hotfix for go 1.22 and below.

What's Changed

Improve File System Path Handling by @moloch-- in gorilla/sessions#274

#272: feat: Add support for paritioned attribute in cookies as per chrome 3rd party cookie phaseout by @kashishbehl in gorilla/sessions#273

fix no default samesite by @bharat-rajani in gorilla/sessions#276

Fix gorillatoolkit link in README.md by @mbacalan in gorilla/sessions#278

Add mysql store to the readme by @danielepintore in gorilla/sessions#279

New Contributors

@moloch-- made their first contribution in gorilla/sessions#274

@kashishbehl made their first contribution in gorilla/sessions#273

@bharat-rajani made their first contribution in gorilla/sessions#276

@mbacalan made their first contribution in gorilla/sessions#278

@danielepintore made their first contribution in gorilla/sessions#279

Full Changelog: gorilla/sessions@v1.2.2...v1.4.0

v1.3.0

The maintainers of this repo merged a PR into main with the net/http.Cookie field Partitioned which is a field only available in go 1.23. As a result all usage of the main branch will not work unless users are on 1.23 which at the time of writing is currently unreleased. This broke the install for a number of users so the intent of this release is to push out a couple of features and bugfixes with the go 1.23 specific changes removed.

Releases should be used exclusively until go 1.23 is released.

What's Changed

Improve File System Path Handling by @moloch-- in gorilla/sessions#274

#272: feat: Add support for paritioned attribute in cookies as per chrome 3rd party cookie phaseout by @kashishbehl in gorilla/sessions#273

fix no default samesite by @bharat-rajani in gorilla/sessions#276

Fix gorillatoolkit link in README.md by @mbacalan in gorilla/sessions#278

New Contributors

@moloch-- made their first contribution in gorilla/sessions#274

@kashishbehl made their first contribution in gorilla/sessions#273

@bharat-rajani made their first contribution in gorilla/sessions#276

@mbacalan made their first contribution in gorilla/sessions#278

Full Changelog: gorilla/sessions@v1.2.2...v1.3.0

Commits

bb4cd60 chore: Update readme to relect go 1.23 release
e2083f9 chore: update to go 1.23 for workflows
6eef180 fix: Missing SameSite attribute on options
a56e60c Add mysql store to the readme (#279)
466d29e chore: Update readme and copyrights
7a8159e chore(go): Remove go version 1.11 support
ff5660f chore(go): Add warning about main branch
8e2d547 chore(go): Remove vendored dependencies
c373b3e Fix gorillatoolkit link in README.md (#278)
ef99c78 fix(cookie): Add default samesite (#276)
Additional commits viewable in compare view

Updates github.com/pquerna/otp from 1.4.0 to 1.5.0

Release notes

Sourced from github.com/pquerna/otp's releases.

v1.5.0

What's Changed

Replace deprecated ioutil by @erfan-khadem in pquerna/otp#91

Feat: Steam TOTP encoding by @nikicat in pquerna/otp#96

fix(security): Ensure the entire secret is random by @alfrunes in pquerna/otp#100

New Contributors

@erfan-khadem made their first contribution in pquerna/otp#91

@nikicat made their first contribution in pquerna/otp#96

@alfrunes made their first contribution in pquerna/otp#100

Full Changelog: pquerna/otp@v1.4.0...v1.5.0

Commits

5971b1e fix(security): Ensure the entire secret is random (#100)
c95b697 feat: steam totp encoding (#96)
3357de7 Replace deprecated ioutil (#91)
See full diff in compare view

Updates golang.org/x/crypto from 0.52.0 to 0.54.0

Commits

cdce021 go.mod: update golang.org/x dependencies
d9474cc openpgp: make the deprecation message more explicit
7626c50 ssh: verify declared key type matches decoded key in authorized_keys
0471e79 ssh/agent: enforce strict limits on DSA key parameters
6435c37 ssh: sanitize client disconnect messages
7d695da ssh/agent: drain channel stderr in agent forwarders
5b7f841 acme/autocert: fix data race in Manager.createCert
0b316e7 argon2: update RFC 9106 parameter recommendations
55aec0a x509roots/fallback: update bundle
5f2de1a internal: remove wycheproof tests
Additional commits viewable in compare view

AbrahamOP · 2026-08-06T07:58:04Z

@dependabot rebase

AbrahamOP · 2026-08-06T08:09:31Z

@dependabot rebase

AbrahamOP · 2026-08-06T08:13:40Z

@dependabot rebase

AbrahamOP · 2026-08-06T08:14:38Z

@dependabot recreate

Bumps the go-deps group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.2.1` | `5.3.1` | | [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.7.1` | `1.10.0` | | [github.com/gorilla/sessions](https://github.com/gorilla/sessions) | `1.2.2` | `1.4.0` | | [github.com/pquerna/otp](https://github.com/pquerna/otp) | `1.4.0` | `1.5.0` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.52.0` | `0.54.0` | Updates `github.com/go-chi/chi/v5` from 5.2.1 to 5.3.1 - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](go-chi/chi@v5.2.1...v5.3.1) Updates `github.com/go-sql-driver/mysql` from 1.7.1 to 1.10.0 - [Release notes](https://github.com/go-sql-driver/mysql/releases) - [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md) - [Commits](go-sql-driver/mysql@v1.7.1...v1.10.0) Updates `github.com/gorilla/sessions` from 1.2.2 to 1.4.0 - [Release notes](https://github.com/gorilla/sessions/releases) - [Commits](gorilla/sessions@v1.2.2...v1.4.0) Updates `github.com/pquerna/otp` from 1.4.0 to 1.5.0 - [Release notes](https://github.com/pquerna/otp/releases) - [Commits](pquerna/otp@v1.4.0...v1.5.0) Updates `golang.org/x/crypto` from 0.52.0 to 0.54.0 - [Commits](golang/crypto@v0.52.0...v0.54.0) --- updated-dependencies: - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/go-sql-driver/mysql dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/gorilla/sessions dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/pquerna/otp dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 5, 2026

dependabot Bot changed the title ~~chore(deps): bump the go-deps group with 5 updates~~ chore(deps): bump the go-deps group across 1 directory with 5 updates Aug 6, 2026

dependabot Bot force-pushed the dependabot/go_modules/go-deps-4efa0ac034 branch from 3099e0f to 436abfb Compare August 6, 2026 07:59

AbrahamOP mentioned this pull request Aug 6, 2026

fix(ci): suivre la version Go de go.mod #19

Merged

dependabot Bot force-pushed the dependabot/go_modules/go-deps-4efa0ac034 branch from 436abfb to f40adef Compare August 6, 2026 08:10

dependabot Bot force-pushed the dependabot/go_modules/go-deps-4efa0ac034 branch from f40adef to 6df1220 Compare August 6, 2026 08:14

AbrahamOP merged commit 3c5b992 into main Aug 6, 2026
6 checks passed

AbrahamOP deleted the dependabot/go_modules/go-deps-4efa0ac034 branch August 6, 2026 08:16

Navigation Menu

Repository navigation

chore(deps): bump the go-deps group across 1 directory with 5 updates - #13

chore(deps): bump the go-deps group across 1 directory with 5 updates#13
AbrahamOP merged 1 commit into
mainfrom
dependabot/go_modules/go-deps-4efa0ac034

dependabot Bot commented on behalf of github Aug 5, 2026 •

edited

Loading

Uh oh!

AbrahamOP commented Aug 6, 2026

Uh oh!

AbrahamOP commented Aug 6, 2026

Uh oh!

AbrahamOP commented Aug 6, 2026

Uh oh!

AbrahamOP commented Aug 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.3.1

What's Changed

New Contributors

v5.3.0

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

v1.10.0

What's Changed

New Contributors

v1.9.3

What's Changed

v1.10.0 (2026-04-28)

v1.9.3 (2025-06-13)

v1.9.2 (2025-04-07)

v1.9.1 (2025-03-21)

Major Changes

Bugfixes

v1.9.0 (2025-02-18)

Major Changes

Bugfixes

v1.4.0

Summary

What's Changed

New Contributors

v1.3.0

What's Changed

New Contributors

v1.5.0

What's Changed

New Contributors

Uh oh!

AbrahamOP commented Aug 6, 2026

Uh oh!

AbrahamOP commented Aug 6, 2026

Uh oh!

AbrahamOP commented Aug 6, 2026

Uh oh!

AbrahamOP commented Aug 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 5, 2026 •

edited

Loading