Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 7 updates - #175

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-and-patch-1a7eaff40f
Open

build(deps): bump the minor-and-patch group across 1 directory with 7 updates#175
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-and-patch-1a7eaff40f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 7 updates in the / directory:

Package From To
github.com/go-webauthn/webauthn 0.17.4 0.18.2
github.com/moby/moby/api 1.55.0 1.56.1
github.com/testcontainers/testcontainers-go/modules/postgres 0.44.0 0.45.0
go.mongodb.org/mongo-driver/v2 2.9.1 2.10.0
golang.org/x/crypto 0.57.0 0.58.0
golang.org/x/oauth2 0.36.0 0.38.0
github.com/testcontainers/testcontainers-go 0.44.0 0.45.0

Updates github.com/go-webauthn/webauthn from 0.17.4 to 0.18.2

Release notes

Sourced from github.com/go-webauthn/webauthn's releases.

v0.18.2

v0.18.2 (2026-09-19)

Bug Fixes

  • protocol: accept anonca attestation trust anchors (#801) (b1dfbf2)
  • protocol: convey safetynet attestation trust path (#800) (5f8a38c)
  • protocol: validate fido-u2f credential curve and certificate validity (#802) (55d49f8)
  • protocol: validate safetynet version and response age (#799) (dda068d)
  • protocol: validate tpm aik certificate validity period (#797) (9ab858d)
  • webauthn: require authorization to initialize uv (#795) (597882d)
  • webauthn: validate session challenge when finishing ceremonies (#794) (bbe2902)

Features

  • protocol: determine fido-u2f attestation type from metadata (#798) (ccbbb4b)
  • protocol: validate authenticator data against metadata (#793) (1ee00cf)

v0.18.1

0.18.1 (2026-09-10)

This release just updates dependencies.

v0.18.0

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int https://github.com/go-webauthn/webauthn/blob/HEAD/MIGRATION.md as they are substantial between ths version and prior versions.

Bug Fixes

  • metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
  • metadata: consistent revocation policy and client timeouts (#740) (34d324b)
  • metadata: handle certificate chains of any depth (#737) (309ea69)
  • metadata: honour status report order and effective dates (#736) (8be5355)
  • metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
  • metadata: prevent panic corrupt blob (#698) (c5fd013)
  • metadata: report malformed status report urls (#738) (ed82f7c)
  • protocol: allow any attestation eku (#728) (f4e33fc)
  • protocol: androidkey missing authorization list member (#727) (9b02b19)
  • protocol: androidkey union generated (#729) (3ed3e75)
  • protocol: bind credential public key curve to its algorithm (#752) (314c2be)
  • protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
  • protocol: compound returns incorrect type (#731) (025d897)

... (truncated)

Changelog

Sourced from github.com/go-webauthn/webauthn's changelog.

v0.18.2 (2026-09-19)

Bug Fixes

  • protocol: accept anonca attestation trust anchors (#801) (b1dfbf2)
  • protocol: convey safetynet attestation trust path (#800) (5f8a38c)
  • protocol: validate fido-u2f credential curve and certificate validity (#802) (55d49f8)
  • protocol: validate safetynet version and response age (#799) (dda068d)
  • protocol: validate tpm aik certificate validity period (#797) (9ab858d)
  • webauthn: require authorization to initialize uv (#795) (597882d)
  • webauthn: validate session challenge when finishing ceremonies (#794) (bbe2902)

Features

  • protocol: determine fido-u2f attestation type from metadata (#798) (ccbbb4b)
  • protocol: validate authenticator data against metadata (#793) (1ee00cf)

0.18.1 (2026-09-10)

This release just updates dependencies.

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int [MIGRATION.md] as they are substantial between ths version and prior versions.

Bug Fixes

  • metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
  • metadata: consistent revocation policy and client timeouts (#740) (34d324b)
  • metadata: handle certificate chains of any depth (#737) (309ea69)
  • metadata: honour status report order and effective dates (#736) (8be5355)
  • metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
  • metadata: prevent panic corrupt blob (#698) (c5fd013)
  • metadata: report malformed status report urls (#738) (ed82f7c)
  • protocol: allow any attestation eku (#728) (f4e33fc)
  • protocol: androidkey missing authorization list member (#727) (9b02b19)
  • protocol: androidkey union generated (#729) (3ed3e75)
  • protocol: bind credential public key curve to its algorithm (#752) (314c2be)
  • protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
  • protocol: compound returns incorrect type (#731) (025d897)
  • protocol: credential public key match limited to ECDSA (#732) (b4df26e)
  • protocol: harden credential response and options handling (#763) (de0ae6c)
  • protocol: missing tpm steps (#725) (f9a63f9)

... (truncated)

Commits
  • a4c6fc6 release: v0.18.2 (#803)
  • 55d49f8 fix(protocol): validate fido-u2f credential curve and certificate validity (#...
  • 5f8a38c fix(protocol): convey safetynet attestation trust path (#800)
  • b1dfbf2 fix(protocol): accept anonca attestation trust anchors (#801)
  • dda068d fix(protocol): validate safetynet version and response age (#799)
  • ccbbb4b feat(protocol): determine fido-u2f attestation type from metadata (#798)
  • 9ab858d fix(protocol): validate tpm aik certificate validity period (#797)
  • 1ee00cf feat(protocol): validate authenticator data against metadata (#793)
  • 3f8af2b build(deps): update github/codeql-action action to v4.38.1 (#796)
  • 597882d fix(webauthn): require authorization to initialize uv (#795)
  • Additional commits viewable in compare view

Updates github.com/moby/moby/api from 1.55.0 to 1.56.1

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.56.1

1.56.1

Changelog

api/v1.56.0

1.56.0

Changelog

  • GET /containers/json now supports an annotation filter to filter containers by annotation, either by key (annotation=key) or by key and value (annotation="key=value"), similar to the existing label filter. moby/moby#53538
  • POST /containers/create now supports HostConfig.Umask to set the initial umask for a Unix container. When set, the daemon includes the value in the OCI process configuration for the container's entrypoint, exec processes, and healthchecks. When omitted, the runtime's default behavior applies.moby/moby#53463
  • api/docs: sync API docs v1.25 - v1.55. moby/moby#53246
  • api/swagger: Align Healthcheck name with Go struct. moby/moby#53567
  • api/types/plugin: Deprecated plugin.Privileges sorting methods in favor of slices.SortFunc. moby/moby#53511
  • api/types/plugin: fix Privileges Swap implementation. moby/moby#53510
  • api: Bump to 1.56. moby/moby#53425
  • api: document Task.NetworksAttachments in the swagger definition. moby/moby#53082
  • api: remove gotest.tools from tests. moby/moby#53535
  • api: swagger: Use int64 for build query params. moby/moby#53520
  • api: use blackbox testing. moby/moby#53525
  • Fix API reference documenting an unsupported names filter for GET /configs. moby/moby#53447
Commits
  • 14ebc60 Merge pull request #53830 from tonistiigi/update-buildkit-v0.34.0-rc1
  • 8eded0e Merge pull request #53671 from thaJeztah/add_WithHTTPRequestHook
  • c4e39af Merge pull request #53596 from vvoland/c8d-refactor-imgload
  • b8a569e client: add WithHTTPRequestHook option
  • 0fed273 Merge pull request #53803 from thaJeztah/etchosts_cleanups
  • 80c72a3 Merge pull request #53831 from corhere/fix-dnsproxy-servfail-test
  • 1cfa161 daemon/containerd: Split image loading into import and unpack steps
  • e7272aa Merge pull request #53606 from flostellbrink/fix/swagger-yaml-indentation
  • 357096e libnetwork/etchosts: keep file open when updating hosts
  • 012b2ef libnetwork/etchosts: propagate file close errors
  • Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go/modules/postgres from 0.44.0 to 0.45.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go/modules/postgres's releases.

v0.45.0

What's Changed

⚠️ Breaking Changes

Client SDK dependencies have moved into separate examples modules. For CockroachDB, ConnectionConfig is now available through cockroachdbexamples.NewContainer(c) in modules/cockroachdb/examples. The parent’s ConnectionString and MustConnectionString now return PostgreSQL URLs instead of registered pgx handles, and importing the parent no longer registers the pgx SQL driver. Use the examples adapter to retain the previous SDK behavior, or configure the driver yourself.

For Dex, AddClient, RemoveClient, AddUser, and RemoveUser have moved from *dex.Container to dexexamples.NewAdminClient(c) in modules/dex/examples. Static configuration through WithClient and WithUser is unchanged.

For Cosmos DB, ContainerPolicy and NewContainerPolicy have moved from modules/azure/cosmosdb to modules/azure/examples/cosmosdb. Update the adapter import; its constructor still accepts the parent container. Run, Container, and ConnectionString remain unchanged in the parent module.

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

... (truncated)

Commits
  • b4fe821 chore: use new version (v0.45.0) in modules and examples
  • d40be72 chore(deps): bump github.com/go-jose/go-jose/v4 in /modules/dex/examples (#4088)
  • 0d12cc6 chore(modules): finish test client isolation and document examples modules (#...
  • 9cc89fd chore(modules): isolate eight remaining compatible client SDKs (#4086)
  • 9ec5407 chore(modules)!: extract CockroachDB and Dex client adapters (#4087)
  • 5c9480f chore(modules): isolate client examples across eleven more modules (#4084)
  • 6aaef66 fix(ci): initialize sbx network policy before tests (#4085)
  • 55f58fe chore(modules): isolate client examples across eleven modules (#4083)
  • ea5a2e8 chore(deps): bump go.mongodb.org/mongo-driver (#4075)
  • 60b08c4 docs: show cumulative clones and unique cloners (#4082)
  • Additional commits viewable in compare view

Updates go.mongodb.org/mongo-driver/v2 from 2.9.1 to 2.10.0

Release notes

Sourced from go.mongodb.org/mongo-driver/v2's releases.

MongoDB Go Driver 2.10.0

The MongoDB Go Driver Team is pleased to release version 2.10.0 of the official MongoDB Go Driver.

Release Highlights

This release fixes a bug that prevented timeoutMS from being applied to session and transaction operations, and adds two new options intended for internal use only.

addCommandFields for Collection & IndexView APIs

[!WARNING] The addCommandFields option is intended for internal use only. It may be changed or removed without notice at any time.

Allows adding arbitrary fields to Collection and IndexView commands.

collectionUUID for Client.BulkWrite

[!WARNING] The collectionUUID option is intended for internal use only. It may be changed or removed without notice at any time.

Allows specifying a collectionUUID for bulk write requests.

What's Changed

✨ New Features

🐛 Fixed

📦 Dependency Updates

📝 Other Changes

Full Changelog: mongodb/mongo-go-driver@v2.9.3...v2.10.0

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 2.9.3

The MongoDB Go Driver Team is pleased to release version 2.9.3 of the official MongoDB Go Driver.

Release Highlights

This release fixes cursors and change streams failing when a MONGODB-OIDC access token expires while they are open. The Go Driver now reauthenticates and retries getMore and killCursors commands when the server returns a "ReauthenticationRequired (391)" error, as it currently does for other operations.

... (truncated)

Commits
  • d241cc5 BUMP v2.10.0
  • 6997a74 GODRIVER-4245 Skip TestClient_BulkWrite_CollectionUUIDs on 8.1 sharded cluste...
  • 0a317eb GODRIVER-4165 Sample NumberSessionsInProgress in mtest.ResetClient. (#2702)
  • 7dad2b8 Merge pull request #2710 from matthewdale/godriver4244-rhel-upgrade
  • b0dd5a8 GODRIVER-4244 Upgrade Azure KMS and GCP KMS build hosts to RHEL 9.3
  • 6708c77 GODRIVER-4232: Run OCSP responder setup in foreground (#2709)
  • 3c25489 Merge release/2.9 into master (#2705)
  • f118332 GODRIVER-4241 Update github.com/xdg-go/scram to v1.4.0 (#2706)
  • 33d74dd Merge pull request #2691 from matthewdale/godriver3699-coll-uuid
  • c9bd487 Resolve conflicts in master
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.57.0 to 0.58.0

Commits
  • 8fdf07b go.mod: update golang.org/x dependencies
  • 2437861 salsa20: fix keystream reuse in LoongArch LSX tail
  • c3db4df acme: prefer test log helpers in test contexts
  • 4e01a84 acme: adds support for profiles draft
  • 8f0f111 ssh: check that no Unicode-aware string function is used
  • b39ff6d ssh: add certificate algorithms for ML-DSA keys
  • 4465db3 ssh: add the ML-DSA public key algorithms
  • 83e695b ssh: implement ETM mode for CBC ciphers
  • 946083a ssh: only drop a trailing carriage return
  • 543dde9 ssh: accept known_hosts entries with a multi-word comment
  • Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.36.0 to 0.38.0

Commits
  • 0f01e82 oauth2: prevent NewTicker panic
  • c624b89 google: change the snake case endpoint to kebab-case
  • 09a82f6 all: upgrade go directive to at least 1.26.0 [generated]
  • See full diff in compare view

Updates github.com/testcontainers/testcontainers-go from 0.44.0 to 0.45.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go's releases.

v0.45.0

What's Changed

⚠️ Breaking Changes

Client SDK dependencies have moved into separate examples modules. For CockroachDB, ConnectionConfig is now available through cockroachdbexamples.NewContainer(c) in modules/cockroachdb/examples. The parent’s ConnectionString and MustConnectionString now return PostgreSQL URLs instead of registered pgx handles, and importing the parent no longer registers the pgx SQL driver. Use the examples adapter to retain the previous SDK behavior, or configure the driver yourself.

For Dex, AddClient, RemoveClient, AddUser, and RemoveUser have moved from *dex.Container to dexexamples.NewAdminClient(c) in modules/dex/examples. Static configuration through WithClient and WithUser is unchanged.

For Cosmos DB, ContainerPolicy and NewContainerPolicy have moved from modules/azure/cosmosdb to modules/azure/examples/cosmosdb. Update the adapter import; its constructor still accepts the parent container. Run, Container, and ConnectionString remain unchanged in the parent module.

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

... (truncated)

Commits
  • b4fe821 chore: use new version (v0.45.0) in modules and examples
  • d40be72 chore(deps): bump github.com/go-jose/go-jose/v4 in /modules/dex/examples (#4088)
  • 0d12cc6 chore(modules): finish test client isolation and document examples modules (#...
  • 9cc89fd chore(modules): isolate eight remaining compatible client SDKs (#4086)
  • 9ec5407 chore(modules)!: extract CockroachDB and Dex client adapters (#4087)
  • 5c9480f chore(modules): isolate client examples across eleven more modules (#4084)
  • 6aaef66 fix(ci): initialize sbx network policy before tests (#4085)
  • 55f58fe chore(modules): isolate client examples across eleven modules (#4083)
  • ea5a2e8 chore(deps): bump go.mongodb.org/mongo-driver (#4075)
  • 60b08c4 docs: show cumulative clones and unique cloners (#4082)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 7…
cda17cd 
… updates

Bumps the minor-and-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/go-webauthn/webauthn](https://github.com/go-webauthn/webauthn) | `0.17.4` | `0.18.2` |
| [github.com/moby/moby/api](https://github.com/moby/moby) | `1.55.0` | `1.56.1` |
| [github.com/testcontainers/testcontainers-go/modules/postgres](https://github.com/testcontainers/testcontainers-go) | `0.44.0` | `0.45.0` |
| [go.mongodb.org/mongo-driver/v2](https://github.com/mongodb/mongo-go-driver) | `2.9.1` | `2.10.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.36.0` | `0.38.0` |
| [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go) | `0.44.0` | `0.45.0` |



Updates `github.com/go-webauthn/webauthn` from 0.17.4 to 0.18.2
- [Release notes](https://github.com/go-webauthn/webauthn/releases)
- [Changelog](https://github.com/go-webauthn/webauthn/blob/master/CHANGELOG.md)
- [Commits](go-webauthn/webauthn@v0.17.4...v0.18.2)

Updates `github.com/moby/moby/api` from 1.55.0 to 1.56.1
- [Release notes](https://github.com/moby/moby/releases)
- [Commits](moby/moby@api/v1.55.0...api/v1.56.1)

Updates `github.com/testcontainers/testcontainers-go/modules/postgres` from 0.44.0 to 0.45.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.44.0...v0.45.0)

Updates `go.mongodb.org/mongo-driver/v2` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/mongodb/mongo-go-driver/releases)
- [Commits](mongodb/mongo-go-driver@v2.9.1...v2.10.0)

Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0
- [Commits](golang/crypto@v0.57.0...v0.58.0)

Updates `golang.org/x/oauth2` from 0.36.0 to 0.38.0
- [Commits](golang/oauth2@v0.36.0...v0.38.0)

Updates `github.com/testcontainers/testcontainers-go` from 0.44.0 to 0.45.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.44.0...v0.45.0)

---
updated-dependencies:
- dependency-name: github.com/go-webauthn/webauthn
  dependency-version: 0.18.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/moby/moby/api
  dependency-version: 1.56.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/testcontainers/testcontainers-go/modules/postgres
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: go.mongodb.org/mongo-driver/v2
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/testcontainers/testcontainers-go
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 11, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants