chore(deps): bump the all group across 1 directory with 5 updates by dependabot[bot] · Pull Request #520 · vulsio/go-cve-dictionary

dependabot · 2026-08-31T07:43:02Z

Bumps the all group with 5 updates in the / directory:

Package	From	To
github.com/PuerkitoBio/goquery	`1.12.0`	`1.13.0`
github.com/cheggaaa/pb/v3	`3.1.7`	`3.2.1`
github.com/klauspost/compress	`1.18.6`	`1.19.2`
github.com/labstack/echo/v4	`4.15.2`	`4.15.4`
oras.land/oras-go/v2	`2.6.0`	`2.6.2`

Updates github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0

Release notes

Sourced from github.com/PuerkitoBio/goquery's releases.

v1.13.0

Performance improvements and new top-level goquery.Text function to extract text from a selection with more control than the sel.Text jquery-like method.

Commits

4a4f132 Linkify github usernames
e47f384 Add new version to readme to prepare 1.13 release
80a9b7f Run CI on go1.27 (+1.26)
ad18e5a Merge pull request #596 from ChrisJr404/text-toplevel-func
4e49d09 add tests for empty and fully-filtered selections
91ed06d Add top-level Text function for BeautifulSoup-style text extraction
105f399 Merge pull request #595 from PuerkitoBio/dependabot/go_modules/golang.org/x/n...
d329e29 build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0
53a9b37 Merge pull request #586 from jvoisin/cachephwc
50e9856 Merge pull request #593 from PuerkitoBio/dependabot/go_modules/golang.org/x/n...
Additional commits viewable in compare view

Updates github.com/cheggaaa/pb/v3 from 3.1.7 to 3.2.1

Commits

6e37daa Merge pull request #243 from cheggaaa/version-bumps
3b0760a bump versions to 1.0.30 and 3.2.1
e3020d0 Merge pull request #242 from cheggaaa/v3-wasip1-js-stub
6273214 Merge pull request #239 from cheggaaa/dependabot/go_modules/v3/github.com/mat...
d8bb17f Merge branch 'master' into dependabot/go_modules/v3/github.com/mattn/go-runew...
49ec290 termutil: add fallback stub for platforms without terminal control
425842b Merge pull request #240 from cheggaaa/dependabot/go_modules/v3/github.com/mat...
12e27e0 Merge pull request #241 from calvinrp/wasip1-terminal-width
7a78d76 Define terminalWidth on GOOS=wasip1 via the appengine/js stub
e49350a Bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 in /v3
Additional commits viewable in compare view

Updates github.com/klauspost/compress from 1.18.6 to 1.19.2

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.19.2

What's Changed

huff0: add arm64 assembly for Decompress4X/1X via avo lowering by @lizthegrey in klauspost/compress#1172

zstd: Re-enable unsafe decodeSync memory copies (#1168) by @lizthegrey in klauspost/compress#1171

zstd: fix arm64 asm frame offsets placing locals on the saved LR slot by @lizthegrey in klauspost/compress#1176

zstd: avoid racing MaxDecodedSize write on shared dict litEnc by @zanarellidev in klauspost/compress#1182

zstd: keep BuildDict recent-offsets positive and loadable by @zanarellidev in klauspost/compress#1184

zstd: handle zero-literal BuildDict corpus by @cyphercodes in klauspost/compress#1178

zstd: don't clear the registered dictionary when decoding past the window by @sueun-dev in klauspost/compress#1177

New Contributors

@zanarellidev made their first contribution in klauspost/compress#1183

@cyphercodes made their first contribution in klauspost/compress#1178

@sueun-dev made their first contribution in klauspost/compress#1177

Full Changelog: klauspost/compress@v1.19.1...v1.19.2

v1.19.1

What's Changed

zstd: Validate SnappyConverter literal copies by @klauspost in klauspost/compress#1170

flate: use Peek instead of ReadByte for the bufio.Reader decode path by @joechenrh in klauspost/compress#1169

zstd: bump avo pin, regenerate arm64 asm by @lizthegrey in klauspost/compress#1167

New Contributors

@joechenrh made their first contribution in klauspost/compress#1169

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

v1.19.0

What's Changed

zstd: Add true concurrent stream encoding by @klauspost in klauspost/compress#1136

zstd: arm64 decoder asm by @lizthegrey in klauspost/compress#1160

zstd: avoid unused BuildDict encoder allocation by @snissn in klauspost/compress#1147

flate: Add inflate checkpoints by @klauspost in klauspost/compress#1154

snappy/s2: Limit length of varint in decodedLen by @eustas in klauspost/compress#1148

gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @z9z in klauspost/compress#1149

zip: add NameDecoder callback for legacy encoding rewrite by @SAY-5 in klauspost/compress#1150

huff0: Allow building tables from histogram. by @klauspost in klauspost/compress#1155

huff0: Allow building table from oversized histogram. by @klauspost in klauspost/compress#1156

s2sx: Clean symlink targets by @klauspost in klauspost/compress#1163

New Contributors

@snissn made their first contribution in klauspost/compress#1147

@eustas made their first contribution in klauspost/compress#1148

@z9z made their first contribution in klauspost/compress#1149

@SAY-5 made their first contribution in klauspost/compress#1150

@HNO3Miracle made their first contribution in klauspost/compress#1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

... (truncated)

Commits

c3b3439 zstd: don't clear the registered dictionary when decoding past the window (#1...
9874bc9 fix(zstd): handle zero-literal BuildDict corpus (#1178)
71bb6fd zstd: keep BuildDict recent-offsets positive and loadable (#1184)
3d4dacb zstd: avoid racing MaxDecodedSize write on shared dict litEnc (#1182)
3ceaa81 build(deps): bump the github-actions group with 5 updates (#1185)
72cb4d3 chore: add OpenSSF Scorecard GitHub Action (#1183)
69c9db4 zstd: fix arm64 asm locals overwriting the saved link register (#1176)
117430d zstd: Re-enable unsafe decodeSync memory copies (#1168) (#1171)
c73af0c huff0: add arm64 assembly for Decompress4X/1X via avo lowering (#1172)
2602f4a Update changelog for version 1.19.0
Additional commits viewable in compare view

Updates github.com/labstack/echo/v4 from 4.15.2 to 4.15.4

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.15.4

Security

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#3016, released in v5.2.1). Thanks to @a-tt-om and @oran-gugu for reporting.

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:
// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})
Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:
	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")
for static middleware
	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.15.4 - 2026-06-15

Security

Fixes GHSA-vfp3-v2gw-7wfq

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:
// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})
Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:
	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")
for static middleware
	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))
v4.15.3 - 2026-06-14

... (truncated)

Commits

ec79b58 Merge pull request #3020 from aldas/v4_v4-15-4_changelog
2714c07 Changelog for v4.15.4 - security fix
13f0ed1 Merge pull request #3019 from aldas/v4_backport_3016
d16a4ec backport PR 3016 from v4
8f167b9 Merge pull request #3018 from aldas/v4_remove_v5_dep
9afa4ba remove dependency on labstack/echo v5 introduced in go.mod and go.sum
1e05f63 Merge pull request #3017 from aldas/v4_ci_updates
11a3cc4 Update dependencies and add ignore for linting
26bd016 Update CI action versions
aa52f6a ci: run workflows on the v4 branch, not just master (#3013)
Additional commits viewable in compare view

Updates oras.land/oras-go/v2 from 2.6.0 to 2.6.2

Release notes

Sourced from oras.land/oras-go/v2's releases.

v2.6.2

This is a security patch release addressing advisories in the content and remote layers, plus additional hardening and bug fixes since v2.6.1.

Security Fixes

Resolve the hardlink (TypeLink) target before passing it to os.Link, preventing a crafted OCI artifact from hardlinking a file outside the extraction directory via the process CWD (#1232, GHSA-fxhp-mv3v-67qp / CVE-2026-50163)

Bound tag and referrer list pagination to prevent a malicious or misbehaving registry from advertising an endless page chain and forcing unbounded client requests (client-side DoS) (#1215)

Bug Fixes

Bound content.ReadAll allocation by actual content read rather than the descriptor size, correcting the over-broad 32 MiB cap introduced for GHSA-f36w-mj3v-6jqv so legitimate in-memory Push/FetchAll/FetchBytes are not rejected (#1223)

Other Changes

Bump golang.org/x/sync from 0.20.0 to 0.21.0 (#1208)

v2.6.1

This is a security patch release addressing five advisories in the authentication, remote, and content layers, plus accumulated bug fixes and maintenance since v2.6.0.

Security Fixes

Drop the Authorization header on cross-origin redirects to prevent origin credentials leaking to a redirect target on a different scheme/port of the same host (GHSA-vh4v-2xq2-g5cg)

Validate the bearer realm host before sending credentials to prevent credential exfiltration to an attacker-controlled token service, including TLS downgrades and IP-literal metadata endpoints; adds TrustedRealmHosts (GHSA-28r5-37g7-p6mp, GHSA-xf85-363p-868w)

Validate the Location host before blob upload to prevent credentials being forwarded to a cross-host upload endpoint (SSRF / CWE-918) (#1152, GHSA-jxpm-75mh-9fp7)

Reject descriptor sizes exceeding 32 MiB in content.ReadAll to prevent a crafted OCI layout from triggering a makeslice panic and crashing the process (#1153, GHSA-f36w-mj3v-6jqv)

Resolve symlinks when enforcing the workingDir write boundary in content/file, blocking writes that escape the boundary via a symlinked path component when AllowPathTraversalOnWrite=false

Bug Fixes

graph.Memory should use digest as map key (#1095)

Fix credentials key for the Docker registry-1 host (#966)

Support an empty credentials file (#959)

Other Changes

Add GitOps release workflow with goreleaser (#1161)

Shift the Go support window to [1.24, 1.25] (#991)

Run go modernize (#1005)

Sync CODEOWNERS and OWNERS.md from main to v2 (#1122)

Remove scripts reference from the Makefile (#960)

Bump golang.org/x/sync 0.14.0 → 0.20.0 (#971, #978, #1001, #1037, #1078, #1121)

Bump GitHub Actions: actions/checkout 4→5 (#989), actions/setup-go 5→6 (#998), actions/stale 9→10 (#997), github/codeql-action 3→4 (#1016)

Commits

105715e release: v2.6.2 (#1235)
31da196 Merge commit from fork
adab2f2 Merge commit from fork
948a1dc build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 (#1242)
c463c65 fix: prevent hardlink path traversal via process CWD (GHSA-fxhp-mv3v-67qp) (#...
91c04ab fix(content): bound ReadAll allocation by content, not descriptor size (#1223)
314e836 fix: bound tag and referrer list pagination to prevent unbounded requests (#1...
122e88f build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 (#1208)
47b7c80 release: v2.6.1 (#1195)
3c2e884 Merge commit from fork
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

shino · 2026-10-02T02:51:31Z

@dependabot recreate

--- updated-dependencies: - dependency-name: github.com/cheggaaa/pb/v3 dependency-version: 3.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: github.com/klauspost/compress dependency-version: 1.19.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: github.com/labstack/echo/v4 dependency-version: 4.15.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all - dependency-name: github.com/PuerkitoBio/goquery dependency-version: 1.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all - dependency-name: oras.land/oras-go/v2 dependency-version: 2.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 31, 2026

This was referenced Oct 1, 2026

chore(go): bump go directive to 1.27 #523

Merged

chore(go): bump go directive to 1.27 vulsio/goval-dictionary#538

Merged

chore(go): bump go directive to 1.27 vulsio/go-cpe-dictionary#285

Merged

dependabot Bot force-pushed the dependabot/go_modules/master/all-35178a0beb branch from bafcd11 to e6407fa Compare October 2, 2026 03:57

shino merged commit d1af699 into master Oct 2, 2026
10 checks passed

shino deleted the dependabot/go_modules/master/all-35178a0beb branch October 2, 2026 08:45

Navigation Menu

Repository navigation

chore(deps): bump the all group across 1 directory with 5 updates - #520

chore(deps): bump the all group across 1 directory with 5 updates#520
shino merged 1 commit into
masterfrom
dependabot/go_modules/master/all-35178a0beb

dependabot Bot commented on behalf of github Aug 31, 2026 •

edited

Loading

Uh oh!

shino commented Oct 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.13.0

v1.19.2

What's Changed

New Contributors

v1.19.1

What's Changed

New Contributors

v1.19.0

What's Changed

New Contributors

v4.15.4

v4.15.4 - 2026-06-15

v4.15.3 - 2026-06-14

v2.6.2

Security Fixes

Bug Fixes

Other Changes

v2.6.1

Security Fixes

Bug Fixes

Other Changes

Uh oh!

shino commented Oct 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 31, 2026 •

edited

Loading