Skip to content

Bump the go-minor-patch group with 2 updates - #341

Merged
qiuyuzhou merged 2 commits into
masterfrom
dependabot/go_modules/go-minor-patch-3c26118de7
Oct 21, 2026
Merged

qiuyuzhou merged 2 commits into
masterfrom
dependabot/go_modules/go-minor-patch-3c26118de7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-minor-patch group with 2 updates: github.com/v2fly/v2ray-core/v5 and google.golang.org/protobuf.

Updates github.com/v2fly/v2ray-core/v5 from 5.53.0 to 5.54.2

Release notes

Sourced from github.com/v2fly/v2ray-core/v5's releases.

v5.54.2

Security Update

This update fixes an issue with quic transport where it sends V2Ray specific handshake parameters that differs from quic-go defaults. Thanks Jackson Sippe, et al. for reporting this issue.

This update includes a change that requires a protocol update of QUIC transport. Please update the server first to allow connections from both older and latest clients with a transition graceful period. This transition period will last until v5.61.0, and you end this transition immediately by manually setting QUIC transport's server alpn to h3.

-----> ⚠️ Important Message ⚠️<-----

This update includes security fix recommended for QUIC transport.

-----> ⚠️ 重要消息 ⚠️<-----

本更新含适用于 QUIC transport 的安全更新。

New Features

Fixes

  • Add safe defaults for QUIC connections in v2fly/v2ray-core#3820
  • Add safe defaults for QUIC connections on server side in v2fly/v2ray-core#3830
  • Allow quic server to accept clients with mismatching alpn temporaryly

Chores

Full Changelog: v2fly/v2ray-core@v5.53.0...v5.54.1

v5.54.1

Security Update

This update fixes an issue with quic transport where it sends V2Ray specific handshake parameters that differs from quic-go defaults. Thanks Jackson Sippe, et al. for reporting this issue.

-----> ⚠️ Important Message ⚠️<-----

This update includes security fix recommended for QUIC transport.

-----> ⚠️ 重要消息 ⚠️<-----

本更新含适用于 QUIC transport 的安全更新。

New Features

... (truncated)

Commits
  • e29ac2e update version to v5.54.2
  • 6d096cf Allow quic server to accept clients with mismatching alpn temporaryly (#3832)
  • 4f8c8a7 Add safe defaults for quic connections on server side (#3830)
  • 58073c8 update version to v5.54.1
  • 505fe21 Add safe defaults for quic connections (#3820)
  • 89f90bd update version to v5.54.0
  • ebd7787 Chore: bump golang.org/x/net from 0.58.0 to 0.59.0 (#3805)
  • 967f36a Chore: bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#3807)
  • 56cd1c1 Chore: bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#3802)
  • 2f566d4 Chore: bump github.com/pion/stun/v3 from 3.1.6 to 3.1.7 (#3808)
  • Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-minor-patch group with 2 updates: [github.com/v2fly/v2ray-core/v5](https://github.com/v2fly/v2ray-core) and google.golang.org/protobuf.


Updates `github.com/v2fly/v2ray-core/v5` from 5.53.0 to 5.54.2
- [Release notes](https://github.com/v2fly/v2ray-core/releases)
- [Commits](v2fly/v2ray-core@v5.53.0...v5.54.2)

Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12

---
updated-dependencies:
- dependency-name: github.com/v2fly/v2ray-core/v5
  dependency-version: 5.54.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 21, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 21, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: go. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@qiuyuzhou
qiuyuzhou merged commit 7cdb5b9 into master Oct 21, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/go_modules/go-minor-patch-3c26118de7 branch October 21, 2026 15:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant