chore(deps): bump the go_modules group across 1 directory with 5 updates by dependabot[bot] · Pull Request #18 · kypello-io/kypello

dependabot · 2026-04-20T15:12:55Z

Bumps the go_modules group with 5 updates in the / directory:

Package	From	To
github.com/buger/jsonparser	`1.1.1`	`1.1.2`
github.com/nats-io/nats-server/v2	`2.12.4`	`2.12.6`
github.com/go-jose/go-jose/v4	`4.1.3`	`4.1.4`
go.opentelemetry.io/otel/sdk	`1.40.0`	`1.43.0`
google.golang.org/grpc	`1.77.0`	`1.79.3`

Updates github.com/buger/jsonparser from 1.1.1 to 1.1.2

Release notes

Sourced from github.com/buger/jsonparser's releases.

v1.1.2

What's Changed

Updated travis to build for 1.13 to 1.15 by @janreggie in buger/jsonparser#225

eliminate 2 allocations in EachKey() by @Villenny in buger/jsonparser#223

fix issue #150 (in deleting case) by @daria-kay in buger/jsonparser#226

fixing the oss-fuzz issue by @daria-kay in buger/jsonparser#227

Fix parseInt overflow check false negative by @carsonip in buger/jsonparser#231

Added bespoke error for null cases by @jonomacd in buger/jsonparser#228

Fuzzing: Add CIFuzz by @AdamKorcz in buger/jsonparser#239

Added latest versions of go to tests by @moredure in buger/jsonparser#244

fix EachKey pIdxFlags allocation by @unxcepted in buger/jsonparser#241

fix: prevent panic on negative slice index in Delete with malformed JSON (GO-2026-4514) by @dbarrosop in buger/jsonparser#276

New Contributors

@janreggie made their first contribution in buger/jsonparser#225

@Villenny made their first contribution in buger/jsonparser#223

@daria-kay made their first contribution in buger/jsonparser#226

@carsonip made their first contribution in buger/jsonparser#231

@jonomacd made their first contribution in buger/jsonparser#228

@moredure made their first contribution in buger/jsonparser#244

@unxcepted made their first contribution in buger/jsonparser#241

@dbarrosop made their first contribution in buger/jsonparser#276

Full Changelog: buger/jsonparser@v1.1.1...v1.1.2

Commits

a69e7e0 Merge pull request #276 from dbarrosop/master
d3eacc0 fix: prevent panic on negative slice index in Delete with malformed JSON (GO-...
61b32cf Merge pull request #241 from unxcepted/master
2181e83 Merge pull request #244 from ScaleChamp/patch-2
1510b51 Added latest versions of go to tests
6fc2e48 fix: eachkey allocation
a6f867e Merge pull request #239 from AdamKorcz/cifuzz1
cbc01fd Fuzzing: Add CIFuzz
dc92d69 Merge pull request #228 from jonomacd/null-handling
2d9d634 Merge pull request #231 from carsonip/fix-parseint-overflow-check
Additional commits viewable in compare view

Updates github.com/nats-io/nats-server/v2 from 2.12.4 to 2.12.6

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.12.6

Changelog

Refer to the 2.12 Upgrade Guide for backwards compatibility notes with 2.11.x.

Go Version

1.25.8

Dependencies

golang.org/x/crypto v0.49.0 (#7953)

github.com/nats-io/jwt/v2 v2.8.1 (#7960)

golang.org/x/sys v0.42.0 (#7923)

golang.org/x/time v0.15.0 (#7923)

CVEs

Fixes CVE-2026-33216, CVE-2026-33217, CVE-2026-33215 (affecting systems using MQTT)

Fixes CVE-2026-33246 (affects systems using leafnodes and service imports)

Fixes CVE-2026-33218 (affects systems using leafnodes)

Fixes CVE-2026-33219 (affects systems using WebSockets)

Fixes CVE-2026-33223, CVE-2026-33222 (affects systems using JetStream)

Fixes CVE-2026-33248 (affects systems using mutual TLS)

Fixes CVE-2026-33247 (affects systems providing credentials on the command line)

Fixes CVE-2026-33249 (affects systems where client publish permissions should be restricted)

Improved

General

Non-WebSocket leafnode connections can now be proxied using HTTP CONNECT (#7781)

The $SYS.REQ.USER.INFO response now includes the friendly nametag of the account and/or user if known (#7973)

JetStream

The stream peer-remove command now accepts a peer ID as well as a server name (#7952)

MQTT

Protocol compliance has been improved, including more error handling on invalid or malformed MQTT packets (#7933)

Fixed

General

Client connections are no longer registered after an auth callout timeout (#7932)

Improved handling of duplicate headers

A correctness bug when validating relative distinguished names has been fixed

Secrets are now redacted correctly in trace logging (#7942)

... (truncated)

Commits

0e06390 Release v2.12.6
f593d27 Cherry-picks for 2.12.6 (#61)
9f904de [FIXED] Incomplete route pool on premature pong
b510192 [FIXED] Avoid stalling read loop on leafnode ErrMinimumVersionRequired
53941c2 Report the account and user name in USER.INFO request
1ab002a [IMPROVED] Support HTTP proxy connection from leaf nodes also for TCP
8b64082 Release v2.12.6-RC.3
e6ab7e9 Cherry-picks for 2.12.6-RC.3 (#59)
9f4d960 Make the deduplication window actually work for deduplication for sourcing
304e184 Remove FIXME about auth callout nonce
Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.4

What's Changed

Fixes Panic in JWE decryption. See GHSA-78h2-9frx-2jm8

Full Changelog: go-jose/go-jose@v4.1.3...v4.1.4

Commits

0e59876 Merge commit from fork
ddffdbc Bump actions/checkout from 5 to 6 (#213)
See full diff in compare view

Updates go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)

Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)

Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)

Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)

Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)

Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)

Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)

Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)

Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)

Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)

... (truncated)

Commits

9276201 Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)
61b8c94 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)
97a086e chore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)
5e363de limit response body size for OTLP HTTP exporters (#8108)
35214b6 Use an absolute path when calling bsd kenv (#8113)
290024c fix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)
e70658e fix: support getBody in otelploghttp (#8096)
4afe468 fix(deps): update googleapis to 9d38bb4 (#8117)
b9ca729 chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)
69472ec chore(deps): update fossas/fossa-action action to v1.9.0 (#8118)
Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.77.0 to 1.79.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.79.3

Security

server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#8981)

Release 1.79.2

Bug Fixes

stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (grpc/grpc-go#8874)

Release 1.79.1

Bug Fixes

grpc: Remove the -dev suffix from the User-Agent header. (grpc/grpc-go#8902)

Release 1.79.0

API Changes

mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (#8806)

Special Thanks: @vanja-p

experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (#8780)

Behavior Changes

balancer/weightedtarget: Remove handling of Addresses and only handle Endpoints in resolver updates. (#8841)

New Features

experimental/stats: Add support for asynchronous gauge metrics through the new AsyncMetricReporter and RegisterAsyncReporter APIs. (#8780)

pickfirst: Add support for weighted random shuffling of endpoints, as described in gRFC A113.

This is enabled by default, and can be turned off using the environment variable GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (#8864)

xds: Implement :authority rewriting, as specified in gRFC A81. (#8779)

balancer/randomsubsetting: Implement the random_subsetting LB policy, as specified in gRFC A68. (#8650)

Special Thanks: @marek-szews

Bug Fixes

credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (#8726)

Special Thanks: @Atul1710

xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in CONNECTING state. (#8813)

health: Fix a bug where health checks failed for clients using legacy compression options (WithDecompressor or RPCDecompressor). (#8765)

Special Thanks: @sanki92

transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (#8769)

Special Thanks: @joybestourous

server: Propagate status detail headers, if available, when terminating a stream during request header processing. (#8754)

Special Thanks: @joybestourous

Performance Improvements

credentials/alts: Optimize read buffer alignment to reduce copies. (#8791)

mem: Optimize pooling and creation of buffer objects. (#8784)

transport: Reduce slice re-allocations by reserving slice capacity. (#8797)

... (truncated)

Commits

dda86db Change version to 1.79.3 (#8983)
72186f1 grpc: enforce strict path checking for incoming requests on the server (#8981)
97ca352 Changing version to 1.79.3-dev (#8954)
8902ab6 Change the version to release 1.79.2 (#8947)
a928670 Cherry-pick #8874 to v1.79.x (#8904)
06df363 Change version to 1.79.2-dev (#8903)
782f2de Change version to 1.79.1 (#8902)
850eccb Change version to 1.79.1-dev (#8851)
765ff05 Change version to 1.79.0 (#8850)
68804be Cherry pick #8864 to v1.79.x (#8896)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the go_modules group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/buger/jsonparser](https://github.com/buger/jsonparser) | `1.1.1` | `1.1.2` | | [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) | `2.12.4` | `2.12.6` | | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.1.3` | `4.1.4` | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.40.0` | `1.43.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.77.0` | `1.79.3` | Updates `github.com/buger/jsonparser` from 1.1.1 to 1.1.2 - [Release notes](https://github.com/buger/jsonparser/releases) - [Commits](buger/jsonparser@v1.1.1...v1.1.2) Updates `github.com/nats-io/nats-server/v2` from 2.12.4 to 2.12.6 - [Release notes](https://github.com/nats-io/nats-server/releases) - [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md) - [Commits](nats-io/nats-server@v2.12.4...v2.12.6) Updates `github.com/go-jose/go-jose/v4` from 4.1.3 to 4.1.4 - [Release notes](https://github.com/go-jose/go-jose/releases) - [Commits](go-jose/go-jose@v4.1.3...v4.1.4) Updates `go.opentelemetry.io/otel/sdk` from 1.40.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.43.0) Updates `google.golang.org/grpc` from 1.77.0 to 1.79.3 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.77.0...v1.79.3) --- updated-dependencies: - dependency-name: github.com/buger/jsonparser dependency-version: 1.1.2 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/nats-io/nats-server/v2 dependency-version: 2.12.6 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/go-jose/go-jose/v4 dependency-version: 4.1.4 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-04-20T15:13:16Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
golang/github.com/nats-io/nats-server/v2@v2.12.4 ⏵ v2.12.6	^-3	⁺⁶¹
golang/golang.org/x/crypto@v0.47.0 ⏵ v0.49.0	⁺¹
golang/github.com/nats-io/nats.go@v1.48.0 ⏵ v1.49.0	⁺¹
golang/golang.org/x/sys@v0.40.0 ⏵ v0.42.0	⁺¹
golang/github.com/klauspost/compress@v1.18.3 ⏵ v1.18.4	⁺¹
golang/golang.org/x/sync@v0.19.0 ⏵ v0.20.0
golang/github.com/buger/jsonparser@v1.1.1 ⏵ v1.1.2	⁺¹	⁺¹⁶
golang/golang.org/x/term@v0.39.0 ⏵ v0.41.0
golang/golang.org/x/time@v0.14.0 ⏵ v0.15.0

View full report

socket-security · 2026-04-20T15:13:18Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: golang `github.com/nats-io/nats-server/v2` is 98.0% likely obfuscated Confidence: 0.98 Location: Package overview From: go.mod → `golang/github.com/nats-io/nats-server/v2@v2.12.6` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/github.com/nats-io/nats-server/v2@v2.12.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Apr 20, 2026

Navigation Menu

Uh oh!

chore(deps): bump the go_modules group across 1 directory with 5 updates - #18

chore(deps): bump the go_modules group across 1 directory with 5 updates#18
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/go_modules-4789991b4f

dependabot Bot commented on behalf of github Apr 20, 2026

Uh oh!

socket-security Bot commented Apr 20, 2026

Uh oh!

socket-security Bot commented Apr 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Apr 20, 2026

v1.1.2

What's Changed

New Contributors

Release v2.12.6

Changelog

Go Version

Dependencies

CVEs

Improved

Fixed

v4.1.4

What's Changed

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Changed

Deprecated

Fixed

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

Release 1.79.3

Security

Release 1.79.2

Bug Fixes

Release 1.79.1

Bug Fixes

Release 1.79.0

API Changes

Behavior Changes

New Features

Bug Fixes

Performance Improvements

Uh oh!

socket-security Bot commented Apr 20, 2026

Uh oh!

socket-security Bot commented Apr 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants