Update all dependencies#1682
Conversation
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| github.com/tidwall/sjson v1.2.5 // indirect | ||
| github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect | ||
| github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect | ||
| go.opentelemetry.io/auto/sdk v1.2.1 // indirect |
There was a problem hiding this comment.
🤖 Security Issue: The PR introduces several highly suspicious dependency updates, most notably the addition of 'go.yaml.in/yaml/v4' which appears to be a typosquatting attempt of the official 'gopkg.in/yaml.v3' package. Furthermore, multiple other dependencies are updated to versions that do not officially exist or use future-dated pseudo-versions (e.g., 'google.golang.org/api v0.274.0', 'golang.org/x/net v0.55.0', and 'github.com/google/pprof' with a 2026 timestamp). This pattern is strongly indicative of a coordinated supply chain attack via dependency confusion or typosquatting.
Severity: HIGH
Category: supply_chain_attack
Confidence: 100%
Tool: Barry AI Security Analysis (Gemini)
Exploit Scenario:
An attacker publishes these malicious packages with high version numbers or look-alike domains to public Go registries. When gosec or its users perform a build or download dependencies, the Go toolchain will prioritize these malicious versions. The malicious code can execute during the build process or be compiled into the gosec binary, leading to a complete compromise of the CI/CD pipeline and the analysis environment.
Recommendation:
Reject this PR immediately. Investigate the Renovate bot's configuration to determine how it was induced to suggest these non-existent and suspicious versions. Manually revert all changes to go.mod and go.sum and restore dependencies to verified, stable versions from trusted upstream sources.
1 participant
This PR contains the following updates:
v0.121.2→v0.123.0v0.16.5→v0.20.0v3.4.0→v3.5.0v1.1.2→v1.2.0545e8a4→92041b7v0.3.6→v0.3.16v2.15.0→v2.22.0v0.13.0→v0.14.0v0.7.7→v0.9.2v0.5.2→v0.5.3v1.18.0→v1.19.0v1.1.1→v1.2.0v0.61.0→v0.68.0v1.41.0→v1.43.0v1.41.0→v1.43.0v1.41.0→v1.43.0v0.54.0→v0.55.0ff82c1b→3dc84a4v1.79.3→v1.81.1v1.36.10→v1.36.11Release Notes
googleapis/google-cloud-go (cloud.google.com/go)
v0.123.0Compare Source
Features
Bug Fixes
v0.122.0Compare Source
Features
Bug Fixes
v0.121.6Compare Source
Bug Fixes
v0.121.5Compare Source
Bug Fixes
v0.121.4Compare Source
Bug Fixes
parentfield indata_chat_service.proto(98ba6f0)v0.121.3Compare Source
Documentation
Masterminds/semver (github.com/Masterminds/semver/v3)
v3.5.0Compare Source
What's Changed
New Contributors
Full Changelog: Masterminds/semver@v3.4.0...v3.5.0
buger/jsonparser (github.com/buger/jsonparser)
v1.2.0Compare Source
What's Changed
Full Changelog: buger/jsonparser@v1.1.2...v1.2.0
googleapis/enterprise-certificate-proxy (github.com/googleapis/enterprise-certificate-proxy)
v0.3.16Compare Source
What's Changed
Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.15...v0.3.16
v0.3.15Compare Source
What's Changed
Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.14...v0.3.15
v0.3.14Compare Source
What's Changed
Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.13...v0.3.14
v0.3.13Compare Source
What's Changed
Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.12...v0.3.13
v0.3.12Compare Source
What's Changed
Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.11...v0.3.12
v0.3.11Compare Source
What's Changed
New Contributors
Full Changelog: googleapis/enterprise-certificate-proxy@0.3.10...v0.3.11
v0.3.9Compare Source
What's Changed
Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.8...v0.3.9
v0.3.8Compare Source
What's Changed
New Contributors
Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.7...v0.3.8
v0.3.7Compare Source
This release creates ECP Http Proxy
What's Changed
New Contributors
Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.6...v0.3.7
googleapis/gax-go (github.com/googleapis/gax-go/v2)
v2.22.0: v2: v2.22.0Compare Source
v2.22.0 (2026-04-14)
v2.21.0: v2: v2.21.0Compare Source
Features
update IsFeatureEnabled to not require EXPERIMENTAL (#497) (a2a329e3)
hook transport telemetry into gax.Invoke and record (#496) (d5310019)
v2.20.0: v2: v2.20.0Compare Source
Features
hook metric recording into gax.Invoke (#494) (1f3e9aef)
add TelemetryErrorInfo and ExtractTelemetryErrorInfo (#487) (defdded3)
v2.19.0: v2: v2.19.0Compare Source
Features
update WithLogger to WithLoggerContext. (#478) (1cb70baf)
pass logger to downstream via context (#474) (434fa676)
add WithClientMetrics CallOption (#479) (76f0284e)
add TransportTelemetryData for dynamic transport attributes (#481) (8a7caf00)
add ClientMetrics initialization core (#473) (f53618c2)
Bug Fixes
v2.18.0: v2: v2.18.0Compare Source
Features
move gax-go to use 1.25 as the lower bound of support (#469) (01594ca5)
add callctx telemetry helpers (#472) (fa319ffc)
v2.17.0: v2 2.17.0Compare Source
Features
v2.16.0: v2 2.16.0Compare Source
Features
invopop/jsonschema (github.com/invopop/jsonschema)
v0.14.0Compare Source
What's Changed
New Contributors
Full Changelog: invopop/jsonschema@v0.13.0...v0.14.0
mailru/easyjson (github.com/mailru/easyjson)
v0.9.2Compare Source
What's Changed
Full Changelog: mailru/easyjson@v0.9.1...v0.9.2
v0.9.1Compare Source
What's Changed
New Contributors
Full Changelog: mailru/easyjson@v0.9.0...v0.9.1
v0.9.0Compare Source
up go version and bugfixes
v0.8.0Compare Source
stable version before go version bump
stretchr/objx (github.com/stretchr/objx)
v0.5.3Compare Source
What's Changed
testifyassertions with custom testing helpers by @emilien-puget in #159New Contributors
Full Changelog: stretchr/objx@v0.5.2...v0.5.3
tidwall/gjson (github.com/tidwall/gjson)
v1.19.0Compare Source
tidwall/match (github.com/tidwall/match)
v1.2.0Compare Source
open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)
v1.43.0: /v0.65.0/v0.19.0Compare Source
Added
IsRandomandWithRandomonTraceFlags, andIsRandomonSpanContextingo.opentelemetry.io/otel/tracefor W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)
WithServiceingo.opentelemetry.io/otel/sdk/resource. (#7642)DefaultWithContextandEnvironmentWithContextingo.opentelemetry.io/otel/sdk/resourceto support plumbingcontext.Contextthrough default and environment detectors. (#8051)attribute.EMPTY) ingo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)attribute.EMPTY) ingo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)attribute.EMPTY) ingo.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)attribute.EMPTY) ingo.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)attribute.EMPTY) ingo.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)attribute.EMPTY) ingo.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)attribute.EMPTY) ingo.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)go.opentelemetry.io/otel/sdk/metric.Set
OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=trueto enable. (#8060)WithCardinalityLimitSelectorfor metric reader for configuring cardinality limits specific to the instrument kind. (#7855)Changed
EMPTYType ingo.opentelemetry.io/otel/attributeto reflect that an empty value is now a valid value, withINVALIDremaining as a deprecated alias ofEMPTY. (#8038)go.opentelemetry.io/otel/attributeto optimize short slice values with fixed-size fast paths. (#8039)go.opentelemetry.io/otel/sdk/traceby returning early if self-observability is not enabled. (#8067)go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)Deprecated
INVALIDingo.opentelemetry.io/otel/attribute. UseEMPTYinstead. (#8038)Fixed
TraceIdRatioBaseddescription. This is a breaking behavioral change, but it is necessary tomake the implementation spec-compliant. (#8027)
go.opentelemetry.io/otel/sdk/metricwhere the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpto mitigate excessive memory usage caused by a misconfigured or malicious server.Responses exceeding the limit are treated as non-retryable errors. (#8108)
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttpto mitigate excessive memory usage caused by a misconfigured or malicious server.Responses exceeding the limit are treated as non-retryable errors. (#8108)
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttpto mitigate excessive memory usage caused by a misconfigured or malicious server.Responses exceeding the limit are treated as non-retryable errors. (#8108)
WithHostIDdetector ingo.opentelemetry.io/otel/sdk/resourceto use full path forkenvcommand on BSD. (#8113)request.GetBodyingo.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttpto correctly handle HTTP2 GOAWAY frame. (#8096)What's Changed
190d7d4by @renovate[bot] in #8013a57be14by @renovate[bot] in #80318895462by @renovate[bot] in #80366e66a94by @renovate[bot] in #804384a4fc4by @renovate[bot] in #8048b7b2c7bby @renovate[bot] in #8044befce8dby @renovate[bot] in #8053c2dfcecby @renovate[bot] in #8055dec52c4by @renovate[bot] in #8063744bfb5by @renovate[bot] in #8064internal/observpackage to stdoutlog by @yumosx in #7735Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.