Skip to content

fix(deps): update go-libraries - #5779

Open
renovate-bot wants to merge 1 commit into
google:masterfrom
renovate-bot:renovate/go-libraries
Open

fix(deps): update go-libraries#5779
renovate-bot wants to merge 1 commit into
google:masterfrom
renovate-bot:renovate/go-libraries

Conversation

@renovate-bot

@renovate-bot renovate-bot commented Aug 4, 2026

Copy link
Copy Markdown
Collaborator

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
charm.land/bubbles/v2 v2.1.1v2.2.0 age confidence require minor v2.2.1
charm.land/bubbletea/v2 v2.0.8v2.0.9 age confidence require patch
charm.land/lipgloss/v2 v2.0.5v2.0.6 age confidence require patch
cloud.google.com/go/datastore v1.25.0v1.26.0 age confidence require minor
cloud.google.com/go/pubsub/v2 v2.6.1v2.6.2 age confidence require patch v2.7.0
cloud.google.com/go/storage v1.64.0v1.65.0 age confidence require minor v1.66.0 (+1)
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/trace v1.34.0v1.36.0 age confidence require minor
github.com/google/osv-scalibr v0.4.5v0.5.2 age confidence require minor
github.com/klauspost/compress v1.19.0v1.19.2 age confidence require patch
github.com/pandatix/go-cvss v0.6.2v0.6.4 age confidence require patch
github.com/yuin/goldmark v1.8.4v1.8.5 age confidence require patch
go (source) 1.26.51.27.0 age confidence golang minor
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0v0.70.0 age confidence require minor v0.71.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0v0.70.0 age confidence require minor v0.71.0
go.opentelemetry.io/otel v1.44.0v1.45.0 age confidence require minor v1.46.0
go.opentelemetry.io/otel/sdk v1.44.0v1.45.0 age confidence require minor v1.46.0
go.opentelemetry.io/otel/trace v1.44.0v1.45.0 age confidence require minor v1.46.0
golang.org/x/text v0.40.0v0.41.0 age confidence require minor
google.golang.org/api v0.287.1v0.293.0 age confidence require minor v0.295.0 (+1)
google.golang.org/grpc v1.82.1v1.83.1 age confidence require minor v1.83.2
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996afv1.36.12 age confidence require patch
google.golang.org/protobuf v1.36.11v1.36.12 age confidence require patch
k8s.io/apimachinery v0.36.3v0.36.4 age confidence require patch v0.37.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

charmbracelet/bubbles (charm.land/bubbles/v2)

v2.2.0

Compare Source

A new Bubble and some new Textarea stuff

There are a couple nice features in today's release. Let's check em out!

If a tree falls in the forest…

At last, the tree Bubble from all star contributor @​dlvhdr’s is here! He built it for DiffNav and graciously contributed to Bubbles. We've been working with Dolev for a long time and were totally stoked when he offerd to contribute.

Select all, ctrl+c, ctrl+v…done!

Our own @​andrinoff added a bunch of awesome stuff to Textarea, including the long awaited text selection. Select, copy, and cut your way into mini text editing.

For more info see the docs.

And special thanks to @​zoriya for adding ctrl+left/right bindings.

xoxo,
Charm! 💌

Changelog

New!
Fixed
Other stuff

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/bubbletea (charm.land/bubbletea/v2)

v2.0.9

Compare Source

Small patches 🩹

Keybinds missing!

MouseButton11 and media record buttons were improperly handled, now fixed! (thanks to @​Ricardo-M-L and @​bunlongheng)

Weird UI artifacts with some terminals 👽

Sometimes, when switching between tabs in your terminal for example, the screen would not clear, now fixed!

... And some small corrections to docs!

Happy coding 🤖

Changelog

Fixed
Docs
Other stuff

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/lipgloss (charm.land/lipgloss/v2)

v2.0.6

Compare Source

Measure Twice, Draw Once

Mostly a width-measurement release, courtesy of some Ultraviolet and x/ansi bumps, plus a table fix.

Emoji

Ultraviolet now asks the terminal at startup whether it supports Unicode core mode (DEC mode 2027), and when it does, measures widths the same way the terminal does. No more drifting borders on rows with ⚠️ and friends.

It also had a four-column cap on cell width, which meant anything wider was dropped from the screen entirely — 👨‍👩‍👧‍👦 is eight columns. That cap is gone.

Hindi

Terminals without mode 2027 advance the cursor once per codepoint and don't know about cluster boundaries. Unicode 15.1 merged Indic conjuncts into single clusters, so स्ते is one cluster that those terminals still paint in two columns. Measuring it as a unit put everything after it in the wrong place.

The wcwidth path now measures per codepoint, matching what those terminals actually do. If you're rendering through Bubble Tea, Devanagari should line up.

Tables

Columns no longer shrink to zero. There's now a minimum width floor of padding plus one character, with a fallback to the old behavior when the width budget is impossible. Thanks to @​taciturnaxolotl!

Heads up

Canvas.Render() now trims trailing whitespace. Expect goldens to move.


Changelog

Fixed

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

google/osv-scalibr (github.com/google/osv-scalibr)

v0.5.2

Compare Source

  • New extractors: pyproject.toml, Go vendor modules
  • Line number support in gemspec, composerlock, cargolock, dotnet/paketdependencies extractors
  • SPDX conversion: Support new relationships: DEPENDS_ON, DEPENDENCY_MANIFEST_OF, DESCENDANT_OF
klauspost/compress (github.com/klauspost/compress)

v1.19.2

Compare Source

What's Changed
New Contributors

Full Changelog: klauspost/compress@v1.19.1...v1.19.2

v1.19.1

Compare Source

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

pandatix/go-cvss (github.com/pandatix/go-cvss)

v0.6.4

Compare Source

Changelog

  • 8df5dbd fix(ci): remove deprecated GH token usage in favor of current

v0.6.3

Compare Source

yuin/goldmark (github.com/yuin/goldmark)

v1.8.5

Compare Source

golang/go (go)

v1.27.0

v1.26.7

v1.26.6

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)

v1.45.0

Compare Source

googleapis/google-api-go-client (google.golang.org/api)

v0.293.0

Compare Source

Features

v0.292.0

Compare Source

Features

v0.291.0

Compare Source

Features
Bug Fixes
  • transport: Use ds.GetUniverseDomain() instead of raw ds.UniverseDomain field (#​3660) (6bad358)

v0.290.0

Compare Source

Features

v0.289.0

Compare Source

Features

v0.288.0

Compare Source

Features
grpc/grpc-go (google.golang.org/grpc)

v1.83.1: Release 1.83.1

Compare Source

Security

  • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#​9258)
  • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#​9258)
  • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#​9332)
  • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#​9332)
  • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#​9332)

Performance

  • transport: Restrict memory overhead of buffering small data frames. (#​9331)

v1.83.0: Release 1.83.0

Compare Source

Security

  • server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
  • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
  • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
  • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
  • xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#​9223)

New Features

  • xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#​9133)
  • xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#​9145)
  • authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#​9142)
  • xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
    • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#​9119)
  • xds: Add support for xDS-based HTTP CONNECT proxies.
    • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#​9151)
  • xds: Add support for contains_match in route header matchers. (#​9223)

Bug Fixes

  • credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#​9197)
  • grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#​9255)

v1.82.2: Release 1.82.2

Compare Source

Security

  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#​9365)
kubernetes/apimachinery (k8s.io/apimachinery)

v0.36.4

Compare Source


Configuration

📅 Schedule: (in timezone Australia/Sydney)

  • Branch creation
    • "before 6am on wednesday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@forking-renovate forking-renovate Bot added the dependencies Pull requests that update a dependency file label Aug 4, 2026
@forking-renovate

forking-renovate Bot commented Aug 4, 2026

Copy link
Copy Markdown

ℹ️ Artifact update notice

File name: bindings/go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated

Details:

Package Change
google.golang.org/genproto/googleapis/rpc v0.0.0-20260523011958-0a33c5d7ca68 -> v0.0.0-20260526163538-3dc84a4a5aaa
File name: go/cmd/tools/reimport-tui/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated

Details:

Package Change
github.com/charmbracelet/ultraviolet v0.0.0-20260713092251-4bee1914c0cf -> v0.0.0-20260811164956-006e29f97886
github.com/charmbracelet/x/ansi v0.11.7 -> v0.11.8
github.com/lucasb-eyer/go-colorful v1.4.0 -> v1.4.1
github.com/mattn/go-runewidth v0.0.24 -> v0.0.27
File name: go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 20 additional dependencies were updated

Details:

Package Change
cel.dev/expr v0.25.1 -> v0.25.2
cloud.google.com/go/auth v0.20.0 -> v0.23.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 -> v1.33.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.58.0 -> v0.60.0
github.com/charmbracelet/ultraviolet v0.0.0-20251205161215-1948445e3318 -> v0.0.0-20260811164956-006e29f97886
github.com/charmbracelet/x/ansi v0.11.7 -> v0.11.8
github.com/felixge/httpsnoop v1.0.4 -> v1.1.0
github.com/go-logr/logr v1.4.3 -> v1.4.4
github.com/googleapis/enterprise-certificate-proxy v0.3.17 -> v0.3.20
github.com/lucasb-eyer/go-colorful v1.4.0 -> v1.4.1
github.com/mattn/go-runewidth v0.0.23 -> v0.0.24
github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af -> v1.9.4
github.com/spiffe/go-spiffe/v2 v2.6.0 -> v2.7.0
github.com/tidwall/match v1.1.1 -> v1.2.0
github.com/tidwall/pretty v1.2.0 -> v1.2.1
go.opentelemetry.io/otel/metric v1.44.0 -> v1.45.0
go.opentelemetry.io/otel/sdk/metric v1.44.0 -> v1.45.0
go.yaml.in/yaml/v2 v2.4.3 -> v2.4.4
golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 -> v0.0.0-20260508232706-74f9aab9d74a
google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 -> v0.0.0-20260807164820-c8921c73eeea

@renovate-bot
renovate-bot force-pushed the renovate/go-libraries branch 5 times, most recently from a754a60 to bae8620 Compare August 7, 2026 21:30
@another-rex
another-rex enabled auto-merge (squash) August 10, 2026 01:32
another-rex
another-rex previously approved these changes Aug 10, 2026
auto-merge was automatically disabled August 11, 2026 05:08

Head branch was pushed to by a user without write access

@renovate-bot
renovate-bot force-pushed the renovate/go-libraries branch 10 times, most recently from 07b3916 to ce5cb53 Compare August 18, 2026 04:14
@renovate-bot
renovate-bot force-pushed the renovate/go-libraries branch 6 times, most recently from 7a9fd3e to 188bf5f Compare August 25, 2026 05:16
@renovate-bot
renovate-bot force-pushed the renovate/go-libraries branch 3 times, most recently from 5dc33a3 to 8ce3c9e Compare August 26, 2026 05:29
@renovate-bot
renovate-bot force-pushed the renovate/go-libraries branch 16 times, most recently from b37fe00 to 8b6620a Compare August 29, 2026 21:16
@renovate-bot
renovate-bot force-pushed the renovate/go-libraries branch from 8b6620a to 63d7aa3 Compare August 30, 2026 01:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants