Visitar URL original
fix(deps): update go-libraries by renovate-bot · Pull Request #5779 · google/osv.dev · GitHub
Skip to content

fix(deps): update go-libraries - #5779

Merged
Ly-Joey merged 2 commits into
google:masterfrom
renovate-bot:renovate/go-libraries
Sep 4, 2026
Merged

Ly-Joey merged 2 commits into
google:masterfrom
renovate-bot:renovate/go-libraries

Conversation

@renovate-bot

@renovate-bot renovate-bot commented Aug 4, 2026 •

Copy link
Copy Markdown
Collaborator

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
charm.land/bubbles/v2 v2.1.1 → v2.2.1 age confidence
charm.land/bubbletea/v2 v2.0.8 → v2.0.9 age confidence
charm.land/lipgloss/v2 v2.0.5 → v2.0.6 age confidence
cloud.google.com/go/datastore v1.25.0 → v1.26.0 age confidence
cloud.google.com/go/pubsub/v2 v2.6.1 → v2.7.0 age confidence
cloud.google.com/go/storage v1.64.0 → v1.66.0 age confidence
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.34.0 → v1.36.0 age confidence
github.com/google/osv-scalibr v0.4.5 → v0.5.2 age confidence
github.com/klauspost/compress v1.19.0 → v1.19.2 age confidence
github.com/package-url/packageurl-go v0.1.6 → v0.1.7 age confidence
github.com/pandatix/go-cvss v0.6.2 → v0.6.4 age confidence
github.com/yuin/goldmark v1.8.4 → v1.8.5 age confidence
go.opentelemetry.io/contrib/detectors/gcp v1.44.0 → v1.46.0 age confidence
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0 → v0.71.0 age confidence
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 → v0.71.0 age confidence
go.opentelemetry.io/otel v1.44.0 → v1.46.0 age confidence
go.opentelemetry.io/otel/sdk v1.44.0 → v1.46.0 age confidence
go.opentelemetry.io/otel/trace v1.44.0 → v1.46.0 age confidence
golang.org/x/text v0.40.0 → v0.41.0 age confidence
google.golang.org/api v0.287.1 → v0.294.0 age confidence
google.golang.org/grpc v1.83.1 → v1.83.2 age confidence
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af → v1.36.12 age confidence
google.golang.org/protobuf v1.36.11 → v1.36.12 age confidence
k8s.io/apimachinery v0.36.3 → v0.37.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

charmbracelet/bubbles (charm.land/bubbles/v2)

v2.2.1

Compare Source

Tiny Monday bugfix

Textarea element had a bug, where you used to be able to go 1 word backwards, even if there was nothing, which resulted in the whole TUI freezing. It was now fixed by @​OxQuasar!

Changelog

Fixed
Docs
Other stuff

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v2.2.0

Compare Source

A new Bubble and some new Textarea stuff

There are a couple nice features in today's release. Let's check em out!

If a tree falls in the forest…

At last, the tree Bubble from all star contributor @​dlvhdr’s is here! He built it for DiffNav and graciously contributed to Bubbles. We've been working with Dolev for a long time and were totally stoked when he offerd to contribute.

Select all, ctrl+c, ctrl+v…done!

Our own @​andrinoff added a bunch of awesome stuff to Textarea, including the long awaited text selection. Select, copy, and cut your way into mini text editing.

For more info see the docs.

And special thanks to @​zoriya for adding ctrl+left/right bindings.

xoxo,
Charm! 💌

Changelog

New!
Fixed
Other stuff

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/bubbletea (charm.land/bubbletea/v2)

v2.0.9

Compare Source

Small patches 🩹

Keybinds missing!

MouseButton11 and media record buttons were improperly handled, now fixed! (thanks to @​Ricardo-M-L and @​bunlongheng)

Weird UI artifacts with some terminals 👽

Sometimes, when switching between tabs in your terminal for example, the screen would not clear, now fixed!

... And some small corrections to docs!

Happy coding 🤖

Changelog

Fixed
Docs
Other stuff

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/lipgloss (charm.land/lipgloss/v2)

v2.0.6

Compare Source

Measure Twice, Draw Once

Mostly a width-measurement release, courtesy of some Ultraviolet and x/ansi bumps, plus a table fix.

Emoji

Ultraviolet now asks the terminal at startup whether it supports Unicode core mode (DEC mode 2027), and when it does, measures widths the same way the terminal does. No more drifting borders on rows with ⚠️ and friends.

It also had a four-column cap on cell width, which meant anything wider was dropped from the screen entirely — 👨‍👩‍👧‍👦 is eight columns. That cap is gone.

Hindi

Terminals without mode 2027 advance the cursor once per codepoint and don't know about cluster boundaries. Unicode 15.1 merged Indic conjuncts into single clusters, so स्ते is one cluster that those terminals still paint in two columns. Measuring it as a unit put everything after it in the wrong place.

The wcwidth path now measures per codepoint, matching what those terminals actually do. If you're rendering through Bubble Tea, Devanagari should line up.

Tables

Columns no longer shrink to zero. There's now a minimum width floor of padding plus one character, with a fallback to the old behavior when the width budget is impossible. Thanks to @​taciturnaxolotl!

Heads up

Canvas.Render() now trims trailing whitespace. Expect goldens to move.


Changelog

Fixed

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

googleapis/google-cloud-go (cloud.google.com/go/datastore)

v1.26.0: datastore: v1.26.0

Features
google/osv-scalibr (github.com/google/osv-scalibr)

v0.5.2

Compare Source

  • New extractors: pyproject.toml, Go vendor modules
  • Line number support in gemspec, composerlock, cargolock, dotnet/paketdependencies extractors
  • SPDX conversion: Support new relationships: DEPENDS_ON, DEPENDENCY_MANIFEST_OF, DESCENDANT_OF
klauspost/compress (github.com/klauspost/compress)

v1.19.2

Compare Source

What's Changed
New Contributors

Full Changelog: klauspost/compress@v1.19.1...v1.19.2

v1.19.1

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

package-url/packageurl-go (github.com/package-url/packageurl-go)

v0.1.7

Compare Source

What's Changed

New Contributors

Full Changelog: package-url/packageurl-go@v0.1.6...v0.1.7

pandatix/go-cvss (github.com/pandatix/go-cvss)

v0.6.4

Compare Source

Changelog

  • 8df5dbd fix(ci): remove deprecated GH token usage in favor of current

v0.6.3

Compare Source

yuin/goldmark (github.com/yuin/goldmark)

v1.8.5

Compare Source

open-telemetry/opentelemetry-go-contrib (go.opentelemetry.io/contrib/detectors/gcp)

v1.46.0: /v2.5.3/v0.71.0/v0.37.3/v0.26.0/v0.20.1/v0.16.3/v0.18.0

Compare Source

This release is the last to support Go 1.25.
The next release will require at least Go 1.26.

Added
  • Add support for the aws.ec2 resource detector in go.opentelemetry.io/contrib/otelconf/x. (#​9139)
  • Support testing of Go 1.27. (#​9524)
  • Add go.opentelemetry.io/contrib/detectors/docker, a resource detector for Docker, ported from processor/resourcedetectionprocessor/internal/docker in opentelemetry-collector-contrib. (#​9001)
  • Add S3AttributeBuilder to go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws that sets S3-specific span attributes following the OpenTelemetry S3 semantic conventions. (#​9292)
  • Add go.opentelemetry.io/contrib/detectors/docker, a resource detector for Docker, ported from processor/resourcedetectionprocessor/internal/docker in opentelemetry-collector-contrib. (#​9001)
Deprecated
  • Deprecate go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho.
    Use github.com/labstack/echo-opentelemetry instead. (#​9136)
Fixed
  • Record error.type attribute on server spans in go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful when a request is cancelled or ends in a 5xx error. (#​9387)
  • Report ot-baggage-* extraction errors from go.opentelemetry.io/contrib/propagators/ot to otel.Handle instead of silently discarding them, while still attaching the successfully parsed baggage members to the context. (#​9395)
  • Set error.type on the rpc.client.call.duration and rpc.server.call.duration metrics in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc when the RPC fails with a non-OK status, per the RPC semantic conventions. (#​9429)
  • Reject OTLP exporter headers with an empty name in go.opentelemetry.io/contrib/otelconf, go.opentelemetry.io/contrib/otelconf/x, and go.opentelemetry.io/contrib/otelconf/v0.3.0, instead of forwarding invalid header names to OTLP exporters. (#​9102)
  • go.opentelemetry.io/contrib/detectors/aws/lambda no longer returns an error when run outside of an AWS Lambda environment, matching the no-op behavior of other resource detectors. (#​9464)
  • Convert Prometheus untyped metrics to OTLP Gauges in go.opentelemetry.io/contrib/bridges/prometheus. (#​9099)
What's Changed

✂ Note

PR body was truncated to here.


Configuration

📅 Schedule: (in timezone Australia/Sydney)

  • Branch creation
    • "before 6am on wednesday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@forking-renovate forking-renovate Bot added the dependencies Pull requests that update a dependency file label Aug 4, 2026
@forking-renovate

forking-renovate Bot commented Aug 4, 2026 •

Copy link
Copy Markdown

ℹ️ Artifact update notice

File name: bindings/go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package Change
golang.org/x/net v0.55.0 -> v0.58.0
golang.org/x/sys v0.45.0 -> v0.47.0
golang.org/x/text v0.39.0 -> v0.41.0
File name: go/cmd/tools/reimport-tui/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package Change
github.com/charmbracelet/ultraviolet v0.0.0-20260713092251-4bee1914c0cf -> v0.0.0-20260811164956-006e29f97886
github.com/charmbracelet/x/ansi v0.11.7 -> v0.11.8
github.com/lucasb-eyer/go-colorful v1.4.0 -> v1.4.1
github.com/mattn/go-runewidth v0.0.24 -> v0.0.27
File name: go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 24 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package Change
google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 -> v0.0.0-20260715232425-e75dac1f907d
cloud.google.com/go/auth v0.20.0 -> v0.23.2
cloud.google.com/go/iam v1.11.0 -> v1.12.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 -> v1.36.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.58.0 -> v0.60.0
github.com/charmbracelet/ultraviolet v0.0.0-20251205161215-1948445e3318 -> v0.0.0-20260811164956-006e29f97886
github.com/charmbracelet/x/ansi v0.11.7 -> v0.11.8
github.com/felixge/httpsnoop v1.0.4 -> v1.1.0
github.com/go-logr/logr v1.4.3 -> v1.4.4
github.com/googleapis/enterprise-certificate-proxy v0.3.17 -> v0.3.20
github.com/googleapis/gax-go/v2 v2.23.0 -> v2.24.0
github.com/lucasb-eyer/go-colorful v1.4.0 -> v1.4.1
github.com/mattn/go-runewidth v0.0.23 -> v0.0.24
github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af -> v1.9.4
github.com/tidwall/match v1.1.1 -> v1.2.0
github.com/tidwall/pretty v1.2.0 -> v1.2.1
go.opentelemetry.io/otel/metric v1.44.0 -> v1.46.0
go.opentelemetry.io/otel/sdk/metric v1.44.0 -> v1.46.0
go.yaml.in/yaml/v2 v2.4.3 -> v2.4.4
golang.org/x/crypto v0.54.0 -> v0.55.0
golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 -> v0.0.0-20260508232706-74f9aab9d74a
golang.org/x/net v0.57.0 -> v0.58.0
google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94 -> v0.0.0-20260715232425-e75dac1f907d
google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 -> v0.0.0-20260825221802-da73d73af1c5

@renovate-bot
renovate-bot force-pushed the renovate/go-libraries branch 5 times, most recently from a754a60 to bae8620 Compare August 7, 2026 21:30
@another-rex
another-rex enabled auto-merge (squash) August 10, 2026 01:32
another-rex
another-rex previously approved these changes Aug 10, 2026
auto-merge was automatically disabled August 11, 2026 05:08

Head branch was pushed to by a user without write access

@renovate-bot
renovate-bot force-pushed the renovate/go-libraries branch 10 times, most recently from 07b3916 to ce5cb53 Compare August 18, 2026 04:14
@renovate-bot
renovate-bot force-pushed the renovate/go-libraries branch 6 times, most recently from 7a9fd3e to 188bf5f Compare August 25, 2026 05:16
@renovate-bot
renovate-bot force-pushed the renovate/go-libraries branch 3 times, most recently from 5dc33a3 to 8ce3c9e Compare August 26, 2026 05:29
@renovate-bot
renovate-bot force-pushed the renovate/go-libraries branch 25 times, most recently from b0b6b06 to c41d62e Compare September 2, 2026 00:15
Ly-Joey
Ly-Joey previously approved these changes Sep 2, 2026
Ly-Joey
Ly-Joey previously approved these changes Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants