Skip to content

chore(deps): bump the minor-and-patch group with 7 updates - #103

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-and-patch-9e64ac6e71
Closed

chore(deps): bump the minor-and-patch group with 7 updates#103
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-and-patch-9e64ac6e71

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 7 updates:

Package From To
github.com/go-webauthn/webauthn 0.17.4 0.18.0
github.com/xraph/chronicle 1.6.2 1.6.3
github.com/xraph/warden 1.6.2 1.6.3
go.mongodb.org/mongo-driver/v2 2.8.0 2.8.2
github.com/xraph/dispatch 1.6.2 1.6.4
github.com/xraph/ledger 1.6.1 1.6.3
github.com/xraph/vault 1.6.1 1.6.2

Updates github.com/go-webauthn/webauthn from 0.17.4 to 0.18.0

Release notes

Sourced from github.com/go-webauthn/webauthn's releases.

v0.18.0

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int https://github.com/go-webauthn/webauthn/blob/HEAD/MIGRATION.md as they are substantial between ths version and prior versions.

Bug Fixes

  • metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
  • metadata: consistent revocation policy and client timeouts (#740) (34d324b)
  • metadata: handle certificate chains of any depth (#737) (309ea69)
  • metadata: honour status report order and effective dates (#736) (8be5355)
  • metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
  • metadata: prevent panic corrupt blob (#698) (c5fd013)
  • metadata: report malformed status report urls (#738) (ed82f7c)
  • protocol: allow any attestation eku (#728) (f4e33fc)
  • protocol: androidkey missing authorization list member (#727) (9b02b19)
  • protocol: androidkey union generated (#729) (3ed3e75)
  • protocol: bind credential public key curve to its algorithm (#752) (314c2be)
  • protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
  • protocol: compound returns incorrect type (#731) (025d897)
  • protocol: credential public key match limited to ECDSA (#732) (b4df26e)
  • protocol: harden credential response and options handling (#763) (de0ae6c)
  • protocol: missing tpm steps (#725) (f9a63f9)
  • protocol: opaque origin matching and validation (#758) (37f065a)
  • protocol: possible panic conditions (#719) (0ea14e7)
  • protocol: safetynet validation steps (#726) (e12f6e8)
  • protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
  • webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
  • webauthncose: validate okp key algorithm (#759) (98c528b)
  • webauthn: deprecations and handle check (#745) (8619bb9)
  • webauthn: include backup flag check in registration (#748) (26a4868)
  • webauthn: only update uv flag (#746) (b39c822)
  • webauthn: use session relying party id (#747) (ebb45e2)

Features

  • metadata: update to r46 anchor (#780) (20f33e6)
  • ml-dsa preference list and gated availability (#768) (db1e068)
  • protocol: client capability enumeration (#765) (62f4489)
  • protocol: compound sub-statement scope (#742) (34271da)
  • protocol: current user details signal constructor (#766) (b6db923)
  • protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
  • protocol: related origins well-known document (#753) (05d54dc)
  • protocol: relying party attestation policy (#741) (3239ed0)

... (truncated)

Changelog

Sourced from github.com/go-webauthn/webauthn's changelog.

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int [MIGRATION.md] as they are substantial between ths version and prior versions.

Bug Fixes

  • metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
  • metadata: consistent revocation policy and client timeouts (#740) (34d324b)
  • metadata: handle certificate chains of any depth (#737) (309ea69)
  • metadata: honour status report order and effective dates (#736) (8be5355)
  • metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
  • metadata: prevent panic corrupt blob (#698) (c5fd013)
  • metadata: report malformed status report urls (#738) (ed82f7c)
  • protocol: allow any attestation eku (#728) (f4e33fc)
  • protocol: androidkey missing authorization list member (#727) (9b02b19)
  • protocol: androidkey union generated (#729) (3ed3e75)
  • protocol: bind credential public key curve to its algorithm (#752) (314c2be)
  • protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
  • protocol: compound returns incorrect type (#731) (025d897)
  • protocol: credential public key match limited to ECDSA (#732) (b4df26e)
  • protocol: harden credential response and options handling (#763) (de0ae6c)
  • protocol: missing tpm steps (#725) (f9a63f9)
  • protocol: opaque origin matching and validation (#758) (37f065a)
  • protocol: possible panic conditions (#719) (0ea14e7)
  • protocol: safetynet validation steps (#726) (e12f6e8)
  • protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
  • webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
  • webauthncose: validate okp key algorithm (#759) (98c528b)
  • webauthn: deprecations and handle check (#745) (8619bb9)
  • webauthn: include backup flag check in registration (#748) (26a4868)
  • webauthn: only update uv flag (#746) (b39c822)
  • webauthn: use session relying party id (#747) (ebb45e2)

Features

  • metadata: update to r46 anchor (#780) (20f33e6)
  • ml-dsa preference list and gated availability (#768) (db1e068)
  • protocol: client capability enumeration (#765) (62f4489)
  • protocol: compound sub-statement scope (#742) (34271da)
  • protocol: current user details signal constructor (#766) (b6db923)
  • protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
  • protocol: related origins well-known document (#753) (05d54dc)
  • protocol: relying party attestation policy (#741) (3239ed0)
  • typed extension inputs and outputs (#734) (0661c81)

... (truncated)

Commits

Updates github.com/xraph/chronicle from 1.6.2 to 1.6.3

Release notes

Sourced from github.com/xraph/chronicle's releases.

v1.6.3

Changes

  • chore: bumped version of forge deps (7c50015)

Installation

go get github.com/xraph/chronicle@v1.6.3

Full Changelog: xraph/chronicle@v1.6.2...v1.6.3

Commits

Updates github.com/xraph/warden from 1.6.2 to 1.6.3

Release notes

Sourced from github.com/xraph/warden's releases.

v1.6.3

Warden v1.6.3 (2026-08-26T14:01:05Z)

Composable RBAC + ABAC + ReBAC + PBAC for Go, with a declarative .warden config language and language server in the box.

Changelog

Installation

Using go install

go install github.com/xraph/warden/cmd/warden@v1.6.3
go install github.com/xraph/warden/cmd/warden-lsp@v1.6.3

Pre-built binaries

Download the appropriate archive for your platform from the assets below. Each archive contains both warden and warden-lsp.

Verify checksums:

shasum -a 256 -c checksums.txt

VS Code extension

The companion VS Code extension is published as xraph.vscode-warden and released on its own vscode-warden/v*.*.* tag schedule. See the extension README.

What's Changed

Full changelog: xraph/warden@v1.6.2...v1.6.3

Commits

Updates go.mongodb.org/mongo-driver/v2 from 2.8.0 to 2.8.2

Release notes

Sourced from go.mongodb.org/mongo-driver/v2's releases.

MongoDB Go Driver 2.8.2

The MongoDB Go Driver Team is pleased to release version 2.8.2 of the official MongoDB Go Driver.

Release Highlights

[!WARNING] Driver versions v2.1.0 through v2.8.1 are affected by a security issue CVE-2026-81521 in Client.BulkWrite that is fixed in this release (v2.8.2). Users are encouraged to upgrade to this version as soon as possible.

This release addresses CVE-2026-81521, a security issue in calling Client.BulkWrite. A caller-controlled database name containing a period ('.') may be interpreted as a different namespace when forwarded to MongoDB. This could redirect operations to a database or collection other than the one intended by the application.

It also fixes a bug in Collection.BulkWrite where, for unordered bulk writes split across multiple batches, a write-concern error from an earlier batch could be non-deterministically silently dropped or replaced by subsequent batches. Now the operation will return the last non-nil writeConcern error, if one occured.

What's Changed

🐛 Fixed

Full Changelog: mongodb/mongo-go-driver@v2.8.1...v2.8.2

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 2.8.1

The MongoDB Go Driver Team is pleased to release version 2.8.1 of the official MongoDB Go Driver.

Release Highlights

This release fixes a bug where failed writes could look like they succeeded. If a write operation's first attempt failed with a NoWritesPerformed error label, the driver could return a nil/ErrNoDocuments result instead of the real failure, and the caller would end up decoding the server's error document as if it were a normal result. The bug has been fixed so the driver now surfaces the real server error, letting applications detect and retry the failure correctly.

What's Changed

🐛 Fixed

Full Changelog: mongodb/mongo-go-driver@v2.8.0...v2.8.1

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

Commits
  • 1af6d00 BUMP v2.8.2
  • 2ccb9c0 Merge commit from fork
  • 0c032cb GODRIVER-4075 Return an error if there are invalid characters in the database...
  • faeba4a GODRIVER-4025 cherry-pick: Preserve the last non-nil WriteConcernError across...
  • 847433b BUMP v2.8.1
  • 1d6850a GODRIVER-4088 Return the server error when the first attempt fails with NoWri...
  • 6948126 GODRIVER-4064 Skip tests that fail due to SERVER-128517 (#2525)
  • 994762e GODRIVER-4026 [release/2.8] Use cmake<4.4 for libmongocrypt build. (#2487)
  • See full diff in compare view

Updates github.com/xraph/dispatch from 1.6.2 to 1.6.4

Release notes

Sourced from github.com/xraph/dispatch's releases.

v1.6.4

Changes

  • Merge pull request #30 from xraph/fix/client-expired-context (79ea9be)
  • fix(client): honour an already-cancelled context before sending (fdfc5ab)

Installation

go get github.com/xraph/dispatch@v1.6.4

What's Changed

Full Changelog: xraph/dispatch@v1.6.3...v1.6.4

Commits
  • 79ea9be Merge pull request #30 from xraph/fix/client-expired-context
  • fdfc5ab fix(client): honour an already-cancelled context before sending
  • b529178 Merge pull request #29 from xraph/fix/shim-sigterm-exit-window
  • c1f25c5 fix(exec/subprocess): wait out the reap before probing the grandchild
  • 634bf87 chore(exec/shim): annotate the gosec findings that are false positives
  • 1ec1ed6 fix(exec/shim): stop a late SIGTERM killing a clean shutdown
  • ba94efa Merge pull request #28 from xraph/track-c-execution-isolation
  • 1f8d57c chore: bumped forge deps
  • See full diff in compare view

Updates github.com/xraph/ledger from 1.6.1 to 1.6.3

Release notes

Sourced from github.com/xraph/ledger's releases.

v1.6.3

Changes

  • chore: go update the forge deps (867a57a)

Installation

go get github.com/xraph/ledger@v1.6.3

Full Changelog: xraph/ledger@v1.6.2...v1.6.3

v1.6.2

Changes

  • chore: bumoed version of forge deps (38f2381)

Installation

go get github.com/xraph/ledger@v1.6.2

Full Changelog: xraph/ledger@v1.6.1...v1.6.2

Commits

Updates github.com/xraph/vault from 1.6.1 to 1.6.2

Release notes

Sourced from github.com/xraph/vault's releases.

v1.6.2

Changes

  • chore: go update the forge deps (2c13355)

Installation

go get github.com/xraph/vault@v1.6.2

Full Changelog: xraph/vault@v1.6.1...v1.6.2

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group with 7 updates
3eb33d7 
Bumps the minor-and-patch group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/go-webauthn/webauthn](https://github.com/go-webauthn/webauthn) | `0.17.4` | `0.18.0` |
| [github.com/xraph/chronicle](https://github.com/xraph/chronicle) | `1.6.2` | `1.6.3` |
| [github.com/xraph/warden](https://github.com/xraph/warden) | `1.6.2` | `1.6.3` |
| [go.mongodb.org/mongo-driver/v2](https://github.com/mongodb/mongo-go-driver) | `2.8.0` | `2.8.2` |
| [github.com/xraph/dispatch](https://github.com/xraph/dispatch) | `1.6.2` | `1.6.4` |
| [github.com/xraph/ledger](https://github.com/xraph/ledger) | `1.6.1` | `1.6.3` |
| [github.com/xraph/vault](https://github.com/xraph/vault) | `1.6.1` | `1.6.2` |


Updates `github.com/go-webauthn/webauthn` from 0.17.4 to 0.18.0
- [Release notes](https://github.com/go-webauthn/webauthn/releases)
- [Changelog](https://github.com/go-webauthn/webauthn/blob/master/CHANGELOG.md)
- [Commits](go-webauthn/webauthn@v0.17.4...v0.18.0)

Updates `github.com/xraph/chronicle` from 1.6.2 to 1.6.3
- [Release notes](https://github.com/xraph/chronicle/releases)
- [Commits](xraph/chronicle@v1.6.2...v1.6.3)

Updates `github.com/xraph/warden` from 1.6.2 to 1.6.3
- [Release notes](https://github.com/xraph/warden/releases)
- [Commits](xraph/warden@v1.6.2...v1.6.3)

Updates `go.mongodb.org/mongo-driver/v2` from 2.8.0 to 2.8.2
- [Release notes](https://github.com/mongodb/mongo-go-driver/releases)
- [Commits](mongodb/mongo-go-driver@v2.8.0...v2.8.2)

Updates `github.com/xraph/dispatch` from 1.6.2 to 1.6.4
- [Release notes](https://github.com/xraph/dispatch/releases)
- [Commits](xraph/dispatch@v1.6.2...v1.6.4)

Updates `github.com/xraph/ledger` from 1.6.1 to 1.6.3
- [Release notes](https://github.com/xraph/ledger/releases)
- [Commits](xraph/ledger@v1.6.1...v1.6.3)

Updates `github.com/xraph/vault` from 1.6.1 to 1.6.2
- [Release notes](https://github.com/xraph/vault/releases)
- [Commits](xraph/vault@v1.6.1...v1.6.2)

---
updated-dependencies:
- dependency-name: github.com/go-webauthn/webauthn
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/xraph/chronicle
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/xraph/warden
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: go.mongodb.org/mongo-driver/v2
  dependency-version: 2.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/xraph/dispatch
  dependency-version: 1.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/xraph/ledger
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/xraph/vault
  dependency-version: 1.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 31, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 1, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/minor-and-patch-9e64ac6e71 branch September 1, 2026 16:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants