Skip to content

build(deps): bump the gomod-backward-compatible group with 9 updates#1189

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-backward-compatible-6863c39167
Open

build(deps): bump the gomod-backward-compatible group with 9 updates#1189
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-backward-compatible-6863c39167

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the gomod-backward-compatible group with 9 updates:

Package From To
github.com/brianvoe/gofakeit/v7 7.14.1 7.15.0
github.com/go-chi/chi/v5 5.2.5 5.3.0
github.com/go-co-op/gocron/v2 2.21.1 2.21.2
github.com/mattn/go-sqlite3 1.14.42 1.14.44
github.com/oapi-codegen/runtime 1.4.0 1.4.1
github.com/tidwall/gjson 1.18.0 1.19.0
github.com/urfave/cli/v3 3.8.0 3.9.0
github.com/wneessen/go-mail 0.7.2 0.7.3
golang.org/x/crypto 0.50.0 0.52.0

Updates github.com/brianvoe/gofakeit/v7 from 7.14.1 to 7.15.0

Commits
  • 010dc54 email - better email generation with weighted mix and testing valid email gen...
  • 794efc9 password - space usage adjustment
  • See full diff in compare view

Updates github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.0

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

@​VojtechVitek submitted PR #967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:

It also addresses issues outlined at:

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
</tr></table>

... (truncated)

Commits

Updates github.com/go-co-op/gocron/v2 from 2.21.1 to 2.21.2

Release notes

Sourced from github.com/go-co-op/gocron/v2's releases.

v2.21.2

What's Changed

New Contributors

Full Changelog: go-co-op/gocron@v2.21.1...v2.21.2

Commits

Updates github.com/mattn/go-sqlite3 from 1.14.42 to 1.14.44

Commits
  • 20826e8 Merge pull request #1394 from mattn/sqlite-amalgamation-3053000
  • 2d4d220 fix changelog URL when minor or patch version is zero
  • 3761cf7 Upgrade SQLite to version 3053000
  • 1aa7317 Merge pull request #1388 from mattn/stmt-cache-lru
  • c719e20 Merge pull request #1392 from mattn/fix-issue-1390-query-comment-panic
  • 869e516 fix panic when querying input with no SQL (only comments/whitespace)
  • 6690238 extract finalizeCachedStmt helper and drop redundant tail reset
  • 59e8e75 only set stmt cacheKey when cache is enabled
  • 2badb4c use slice len/cap for stmt cache instead of separate counters
  • 7716c20 evict LRU stmt when stmt cache is full
  • Additional commits viewable in compare view

Updates github.com/oapi-codegen/runtime from 1.4.0 to 1.4.1

Release notes

Sourced from github.com/oapi-codegen/runtime's releases.

Bug fixes

This is a bug fix release.

Changes in v1.4.0, coupled with changes in v2.7.0 of oapi-codegen exposed some new problems. deepObject style marshaling behavior now supports encoding unicode. UTF-8 can't be directly included in parameters, so we need to % escape it.

Form binding now detects maps, which makes binding to a Nullable possible. We can't use generics around Nullable[T], so we handle maps generically, assuming they're a Nullable with its behavior assumptions.

🐛 Bug fixes

📦 Dependency updates

Sponsors

We would like to thank our sponsors for their support during this release.

Commits
  • 2755f15 Fix form binding of Nullables (#133)
  • 17de1dd Percent-encode deepObject parameter wire output (#132)
  • d2b7c4c chore(deps): update oapi-codegen/actions action to v0.7.0
  • 6fd6c25 chore(deps): update github/codeql-action action to v4
  • 19040cc fix(deps): update module github.com/kataras/iris/v12 to v12.2.11
  • e05282e chore(deps): update release-drafter/release-drafter action to v7.2.0 (#122)
  • See full diff in compare view

Updates github.com/tidwall/gjson from 1.18.0 to 1.19.0

Commits

Updates github.com/urfave/cli/v3 from 3.8.0 to 3.9.0

Release notes

Sourced from github.com/urfave/cli/v3's releases.

v3.9.0

What's Changed

New Contributors

Full Changelog: urfave/cli@v3.8.0...v3.9.0

Commits
  • b5aa710 Merge pull request #2321 from wucm667/fix/bool-inverse-alias-help
  • 2f662c8 docs: update testdata/godoc-v3.x.txt for BoolWithInverseFlag alias support
  • b6aec8e docs: regenerate godoc-current.txt for BoolWithInverseFlag alias support
  • c3a86f7 fix: show BoolWithInverseFlag aliases in help text
  • f2cd020 Merge pull request #2319 from barry3406/fix/help-subcommand-flag-parsing
  • 5af9500 fix: parse flags for help subcommand (#2271)
  • b79d768 Merge pull request #2316 from morozov/fix-completion-double-dash
  • 2925d6f Merge pull request #2317 from barry3406/fix/completion-shebang
  • 65406c0 Merge pull request #2308 from gabelluardo/refactor-bash
  • eb4cfc3 fix: drop shebang from bash completion template
  • Additional commits viewable in compare view

Updates github.com/wneessen/go-mail from 0.7.2 to 0.7.3

Release notes

Sourced from github.com/wneessen/go-mail's releases.

v0.7.3: Skippable UTF-8 support, improved Base64LineBreaker, binary size reducing, fixes and more

Welcome to go-mail v0.7.3! 🎉

This release brings some cool improvements, new features, and fixes to go-mail. We hope you enjoy it!

Notable changes/improvements/features/fixes

Deadline fix for connections to a TLS port without TLS

PR #521 fixes a missing deadline in the Client that could cause a deadlock for connections to a TLS port without TLS enabled. Thanks to @​james-d-elliott for finding and fixing this issue!

Preseve EHLO and HELO errors

PR #528 fixes an error for cases in which both the HELO and EHLO fail during a client connect. In this case the first error would be overwritten by the 2nd action, potentially deleting valuable information. In go-mail v0.7.3 both errors are now combined. Thanks to @​Yanhu007 for their contribution!

Improved Base64LineBreaker

In PR #512 @​srpvpn refactored the Base64LineBreaker type to be more performant and easier to read by removing the recursion. Thanks for your contribution!

Reduce binary size by making text/template and html/template support optional

In PR #518 @​sblinch introduced a new compile time flag gomailnotpl which will make the text/template and html/template optional. Background is, that using reflect.Value.Method or reflect.Value.MethodByName prevents Go from performing full dead-code elimination because any exported method of any struct in the codebase could potentially be referenced at runtime. Unfortunately text/template and html/template do exactly this to allow method invocation from within templates. So in case your code does not need template support, you can use the new compile flag to remove the support for both packages completely and same some bytes in the resulting binary. Thanks for your contribution!

Fix nil pointer panic in partWriter

PR #543 fixes a potential nil pointer panic in the partWriter in case the underlying io.Writer returns an error during a multipart message write. Thanks to @​UgurTheG for reporting and fixing the issue!

Provide access to HELO responses in the SMTP client

PR #530 adds support to access the HELO/EHLO responses via the smtp.Client. This feature is useful when using an SMTP servers pool behind a load balancer, to know which instance took the job. Thanks to @​maxatome for submitting this feature!

Multiple addresses support in ReplyTo header

PR #517 adds support for multiple Reply-To addresses within a Msg, as permitted in RFC5322. Thanks to @​christian-heusel for pointing this out and for comitting the PR!

Support to disable SMTPUTF8 in the MAIL FROM even if the server announces it

PR #548 adds support for skipping the SMTPUTF8 extension to MAIL FROM commands. By default, when a server announces SMTPUTF8 support in the EHLO, go-mail will add SMTPUTF8 to the MAIL FROM command. As pointed out in #545, some SMTP servers (e. g. specific MS Exchange versions) announce the SMTPUTF8 extension in the EHLO response but when adding the SMTPUTF8 to the MAIL FROM, they will fail with an error. The PR introduces a new WithoutSMTPUTF8() option for the Client which will make sure to skip the SMTPUTF8 extension in the MAIL FROM, even if the server announced it previously. Thanks @​mkalus for reporting this issue and for their detailed analysis in #545.

What's Changed

CI/CD maintenance changes

... (truncated)

Commits
  • 52312c1 Update doc.go
  • c34d456 Merge pull request #517 from christian-heusel/feat/multiple-reply-to
  • c8710cf Update msg_test.go
  • 709d037 Merge pull request #548 from wneessen/feature/545_add-support-for-buggy-excha...
  • dc452e5 Add tests to validate SMTPUTF8 handling in MAIL FROM scenarios
  • de64e2a Add test case for WithoutSMTPUTF8 functionality
  • 59ac026 feat: add option to skip SMTPUTF8 in "MAIL FROM" commands
  • dff98cb Merge pull request #530 from maxatome/hello-mesg
  • 9a51737 Merge pull request #543 from UgurTheG/fix/writeto-nil-panic
  • 01cc9d8 Merge pull request #544 from wneessen/dependabot/github_actions/github/codeql...
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.50.0 to 0.52.0

Commits
  • a1c0d99 go.mod: update golang.org/x dependencies
  • 3c7c869 ssh: fix deadlock on unexpected channel responses
  • 533fb3f ssh: fix source-address critical option bypass
  • abbc44d ssh: fix incorrect operator order
  • e052873 ssh: fix infinite loop on large channel writes due to integer overflow
  • b61cf85 ssh: enforce user presence verification for security keys
  • 9c2cd33 ssh: enforce strict limits on DSA key parameters
  • 8907318 ssh: reject RSA keys with excessively large moduli
  • ffd87b4 ssh: fix panic when authority callbacks are nil
  • 4e7a738 ssh: fix deadlock on unexpected global responses
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the gomod-backward-compatible group with 9 updates
be15fa3 
Bumps the gomod-backward-compatible group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/brianvoe/gofakeit/v7](https://github.com/brianvoe/gofakeit) | `7.14.1` | `7.15.0` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.2.5` | `5.3.0` |
| [github.com/go-co-op/gocron/v2](https://github.com/go-co-op/gocron) | `2.21.1` | `2.21.2` |
| [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) | `1.14.42` | `1.14.44` |
| [github.com/oapi-codegen/runtime](https://github.com/oapi-codegen/runtime) | `1.4.0` | `1.4.1` |
| [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.18.0` | `1.19.0` |
| [github.com/urfave/cli/v3](https://github.com/urfave/cli) | `3.8.0` | `3.9.0` |
| [github.com/wneessen/go-mail](https://github.com/wneessen/go-mail) | `0.7.2` | `0.7.3` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.50.0` | `0.52.0` |


Updates `github.com/brianvoe/gofakeit/v7` from 7.14.1 to 7.15.0
- [Release notes](https://github.com/brianvoe/gofakeit/releases)
- [Commits](brianvoe/gofakeit@v7.14.1...v7.15.0)

Updates `github.com/go-chi/chi/v5` from 5.2.5 to 5.3.0
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.2.5...v5.3.0)

Updates `github.com/go-co-op/gocron/v2` from 2.21.1 to 2.21.2
- [Release notes](https://github.com/go-co-op/gocron/releases)
- [Commits](go-co-op/gocron@v2.21.1...v2.21.2)

Updates `github.com/mattn/go-sqlite3` from 1.14.42 to 1.14.44
- [Release notes](https://github.com/mattn/go-sqlite3/releases)
- [Commits](mattn/go-sqlite3@v1.14.42...v1.14.44)

Updates `github.com/oapi-codegen/runtime` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/oapi-codegen/runtime/releases)
- [Commits](oapi-codegen/runtime@v1.4.0...v1.4.1)

Updates `github.com/tidwall/gjson` from 1.18.0 to 1.19.0
- [Commits](tidwall/gjson@v1.18.0...v1.19.0)

Updates `github.com/urfave/cli/v3` from 3.8.0 to 3.9.0
- [Release notes](https://github.com/urfave/cli/releases)
- [Changelog](https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md)
- [Commits](urfave/cli@v3.8.0...v3.9.0)

Updates `github.com/wneessen/go-mail` from 0.7.2 to 0.7.3
- [Release notes](https://github.com/wneessen/go-mail/releases)
- [Commits](wneessen/go-mail@v0.7.2...v0.7.3)

Updates `golang.org/x/crypto` from 0.50.0 to 0.52.0
- [Commits](golang/crypto@v0.50.0...v0.52.0)

---
updated-dependencies:
- dependency-name: github.com/brianvoe/gofakeit/v7
  dependency-version: 7.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-backward-compatible
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-backward-compatible
- dependency-name: github.com/go-co-op/gocron/v2
  dependency-version: 2.21.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-backward-compatible
- dependency-name: github.com/mattn/go-sqlite3
  dependency-version: 1.14.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-backward-compatible
- dependency-name: github.com/oapi-codegen/runtime
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-backward-compatible
- dependency-name: github.com/tidwall/gjson
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-backward-compatible
- dependency-name: github.com/urfave/cli/v3
  dependency-version: 3.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-backward-compatible
- dependency-name: github.com/wneessen/go-mail
  dependency-version: 0.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-backward-compatible
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-backward-compatible
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants