Skip to content

fix(deps): update go major updates (major) - #38

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-go-major-updates
Open

fix(deps): update go major updates (major)#38
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-go-major-updates

Conversation

@renovate

@renovate renovate Bot commented Feb 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/labstack/echo/v4 v4.15.1 → v5.4.0 age confidence
helm.sh/helm/v3 v3.20.2 → v4.3.0 age confidence

Release Notes

labstack/echo (github.com/labstack/echo/v4)

v5.4.0

Compare Source

Security

This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below.

  • Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket. Before this, any client could send X-Forwarded-Proto: https over plain HTTP and skip HTTPSRedirect. When X-Forwarded-Proto is present, only it is used (its last value), and the scheme is returned in lowercase. Echo#SchemeExtractor (and Config.SchemeExtractor) selects the strategy: ExtractSchemeFromHeaders(...TrustOption) (default), ExtractSchemeDirect() or LegacySchemeExtractor(). The Secure middleware now sets HSTS based on Context.Scheme(). The Proxy middleware always sets X-Forwarded-Proto from Context.Scheme() and removes X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme before forwarding. GHSA-2ffq-g2xg-c22p
  • Proxy middleware: always sets X-Real-IP from Context.RealIP(), so a client can no longer pass a spoofed X-Real-IP to the upstream. GHSA-99jh-6h7p-pp36
  • JSONP: Context.JSONP and Context.JSONPBlob accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, _ and $). Any other callback returns a 400 Bad Request error that wraps the new ErrInvalidJSONPCallback, and nothing is written. JSONP responses now carry X-Content-Type-Options: nosniff. JSONP lets any website read the response with the user's cookies, so do not use it for data that needs authentication. GHSA-h9g5-28mm-hx3g
  • MethodOverride: a POST can no longer be overridden to GET, HEAD, OPTIONS, TRACE or CONNECT. Before this, with the MethodFromForm or MethodFromQuery getter and MethodOverride registered with Use before the CSRF middleware, _method=GET skipped the CSRF check. Register MethodOverride with Echo#Pre. GHSA-r7w9-592q-9vg4
  • Redirects: the trailing slash middlewares and the static directory redirect percent-encode control characters in the redirect path. Before this, /%09/evil.example/ redirected browsers to evil.example. GHSA-v753-g4cw-jm48
  • Static files: with the default settings, the Static middleware resolves files from the same form of the path that the router matched, so /admin%2Fsecret.txt or /%61dmin/secret.txt can no longer reach a file under a guarded /admin/* route. GHSA-375p-5qhx-8wq4 The Static middleware and StaticDirectoryHandler (used by Echo.Static, Echo.StaticFS, Group.Static and Group.StaticFS) no longer serve paths with a ., .. or empty segment, such as /assets/../admin/secret.txt, also after path unescaping. GHSA-3pmx-cf9f-34xr

Behavior changes to check before upgrading

  • Proxies or load balancers with public IP addresses. If a proxy connects to your app from a public (or 100.64.0.0/10) address, its X-Forwarded-Proto is now ignored: HTTPSRedirect redirects in a loop and the Secure middleware stops sending HSTS. This affects, for example, Cloudflare, CloudFront and Azure Front Door connecting to a public origin, the GCP external HTTP(S) load balancer including GKE Ingress (35.191.0.0/16, 130.211.0.0/22), and networks that use 100.64.0.0/10 (such as Alibaba Cloud SLB or EKS custom networking). Trust the proxy's address ranges: 
    _, gclb1, _ := net.ParseCIDR("35.191.0.0/16")
_, gclb2, _ := net.ParseCIDR("130.211.0.0/22")
e.SchemeExtractor = echo.ExtractSchemeFromHeaders(echo.TrustIPRange(gclb1), echo.TrustIPRange(gclb2))
    Proxies on the same host, in a private network (AWS ALB, in-cluster ingress controllers such as ingress-nginx or Traefik, most PaaS routers) or on a unix socket keep working without changes. echo.LegacySchemeExtractor() restores the old behavior but is not safe unless every request passes through a proxy that sets these headers. Serverless adapters or middleware that set RemoteAddr to the client's address also make X-Forwarded-Proto ignored (or, if they take it from a header, spoofable).
  • Trusted proxies must set X-Forwarded-Proto. A proxy on a trusted address that passes the client's X-Forwarded-Proto through (for example nginx without proxy_set_header X-Forwarded-Proto $scheme;) still lets the client choose the scheme. An invalid X-Forwarded-Proto value now results in http instead of falling back to the other scheme headers.
  • Your own tests. httptest.NewRequest sets RemoteAddr to 192.0.2.1:1234, which is not trusted, so tests that set X-Forwarded-Proto now see http. Set req.RemoteAddr = "10.0.0.1:1234" or use e.SchemeExtractor = echo.LegacySchemeExtractor() in such tests.
  • Proxy middleware headers. X-Real-IP sent to the upstream is now always Context.RealIP(). In a chain like nginx → Echo Proxy → upstream, configure Echo#IPExtractor (for example echo.ExtractIPFromRealIPHeader()) to pass the client address on. X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme are no longer forwarded; X-Forwarded-Proto carries the scheme.
  • MethodOverride. Overriding a POST to GET (for example with X-HTTP-Method-Override: GET to send a long query in a POST body) is no longer done; such requests keep the POST method.
  • Static files. Paths with a double slash or dot segment (for example /assets//app.js) now return 404; in HTML5 mode the index is still served. The Static middleware no longer finds file names that the client sends with non-default escaping (for example %2C, %40 or lowercase hex like %c3%a9) unless StaticConfig.EnablePathUnescaping is set; Echo.Static has behaved this way since v5.2.1. With StaticConfig.EnablePathUnescaping or Config.EnablePathUnescapingStaticFiles, encoded dots (%2e%2e) no longer traverse directories, but encoded slashes are still decoded, so do not combine these options with route-based access control.
  • JSONP. Context.JSONP returns an error for callbacks that are not JavaScript identifiers.

Documentation

  • IPExtractor docs: corrected the description of the default (the direct peer address has been used since v5.1.0).
  • Static middleware: when registered with Echo#Use it runs before route and group middleware, so route guards do not protect the files it serves.

v5.3.1

Compare Source

Fixes

  • fix(static): preserve matched handler 404s by @​JSap0914 in #​3043
  • fix(group): Implicitly registered group routes should be allowed overwritten in default routes by @​aldas in #​3049

Enhancements

v5.3.0

Compare Source

Logic changes
PR #​2996 revert back to v4 behavior for a group registering implicit 404 handlers.

If you do not want this behavior, can do not want implicit 404 handlers for groups, use:

e :=  echo.NewWithConfig(echo.Config{NoGroupAutoRegister404Routes: true})
g := e.Group("/api")

some other noteworthy echancements:

e.QUERY("/", func(c *Context) error {
  return c.String(http.StatusTeapot, "OK")
})
  • Router: automatically handle HEAD request by GET handlers in labtack#2949
e := echo.NewWithConfig(echo.Config{
  Router: echo.NewRouter(echo.RouterConfig{
    AutoHandleHEAD: true,
  }),
})

Enhancements

v5.2.1

Compare Source

Security

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt

// 1. share `public/` folder contents from the server root. This folder actually contains subfolder `admin` which
// contents we want to forbid from downloading
e.Static("/", "public")

// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
    return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

  • revert PR #​3009 changes to just disabling path escaping by default in static methods/middleware by @​aldas in #​3016

Closes GHSA-vfp3-v2gw-7wfq more completely: the previous fix (#​3009) rejected explicitly encoded
separators at the handler level; this patch makes the no-unescape behavior the default so new configurations are safe without extra opt-out steps.

What changed: DisablePathUnescaping (on StaticConfig and StaticDirectoryHandlerConfig) is deprecated and replaced by EnablePathUnescaping (default false). Path unescaping is now opt-in.

What this protects: With EnablePathUnescaping: false (new default), encoded separators (%2F, %5C) are never decoded before routing or file lookup, so they cannot
bypass route-level authentication or other middleware guards.

What this does NOT protect: Serving a directory with Static, StaticFS, or StaticDirectoryHandler exposes its entire subtree. Sibling routes are not a reliable
ACL boundary — attach authorization middleware directly to the static mount, or serve sensitive sub-trees under separate guarded routes.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

// Static middleware
e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
    EnablePathUnescaping: true, // only safe when NOT relying on route-based ACL guards
    ...
}))

// StaticDirectoryHandler
middleware.StaticDirectoryHandler(fs, &middleware.StaticDirectoryHandlerConfig{
    EnablePathUnescaping: true,
})

Full Changelog: labstack/echo@v5.2.0...v5.2.1

v5.2.0

Compare Source

Security

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler/StaticFS and the Static middleware are affected. Thanks to @​a-tt-om and @​oran-gugu for reporting.

Enhancements

New Contributors

Full Changelog: labstack/echo@v5.1.1...v5.2.0

v5.1.1

Compare Source

Security

Thanks to @​shblue21 for reporting this issue.

Enhancements

v5.1.0

Compare Source

Security

This change does not break the API contract, but it does introduce breaking changes in logic/behavior.
If your application is using c.RealIP() beware and read https://echo.labstack.com/docs/ip-address

v4 behavior can be restored with:

e := echo.New()
e.IPExtractor = echo.LegacyIPExtractor()
  • Remove legacy IP extraction logic from context.RealIP method by @​aldas in #​2933

Enhancements

v5.0.4

Compare Source

Enhancements

v5.0.3

Compare Source

Security

  • Fix directory traversal vulnerability under Windows in Static middleware when default Echo filesystem is used. Reported by @​shblue21.

This applies to cases when:

  • Windows is used as OS
  • middleware.StaticConfig.Filesystem is nil (default)
  • echo.Filesystem is has not been set explicitly (default)

Exposure is restricted to the active process working directory and its subfolders.

v5.0.2

Compare Source

Security

  • Fix Static middleware with config.Browse=true lists all files/subfolders from config.Filesystem root and not starting from config.Root in #​2887

v5.0.1

Compare Source

v5.0.0

Compare Source

Echo v5 is maintenance release with major breaking changes

  • Context is now struct instead of interface and we can add method to it in the future in minor versions.
  • Adds new Router interface for possible new routing implementations.
  • Drops old logging interface and uses moderm log/slog instead.
  • Rearranges alot of methods/function signatures to make them more consistent.

Upgrade notes and v4 support:

  • Echo v4 is supported with security* updates and bug fixes until 2026-12-31
  • If you are using Echo in a production environment, it is recommended to wait until after 2026-03-31 before upgrading.
  • Until 2026-03-31, any critical issues requiring breaking v5 API changes will be addressed, even if this violates semantic versioning.

See API_CHANGES_V5.md for public API changes between v4 and v5, notes on upgrading.

Upgrading TLDR:

If you are using Linux you can migrate easier parts like that:

find . -type f -name "*.go" -exec sed -i 's/ echo.Context/ *echo.Context/g' {} +
find . -type f -name "*.go" -exec sed -i 's/echo\/v4/echo\/v5/g' {} +

macOS

find . -type f -name "*.go" -exec sed -i '' 's/ echo.Context/ *echo.Context/g' {} +
find . -type f -name "*.go" -exec sed -i '' 's/echo\/v4/echo\/v5/g' {} +

or in your favorite IDE

Replace all:

  1. echo.Context -> *echo.Context
  2. echo/v4 -> echo/v5

This should solve most of the issues. Probably the hardest part is updating all the tests.

v4.16.0

Compare Source

Security

This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below.

  • Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket. Before this, any client could send X-Forwarded-Proto: https over plain HTTP and skip HTTPSRedirect. When X-Forwarded-Proto is present, only it is used (its last value), and the scheme is returned in lowercase. the new Echo#SchemeExtractor field selects the strategy: ExtractSchemeFromHeaders(...TrustOption) (default), ExtractSchemeDirect() or LegacySchemeExtractor(). The Secure middleware now sets HSTS based on Context.Scheme(). The Proxy middleware always sets X-Forwarded-Proto from Context.Scheme() and removes X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme before forwarding. GHSA-2ffq-g2xg-c22p
  • JSONP: Context.JSONP and Context.JSONPBlob accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, _ and $). Any other callback returns a 400 Bad Request error that wraps the new ErrInvalidJSONPCallback, and nothing is written. JSONP responses now carry X-Content-Type-Options: nosniff. JSONP lets any website read the response with the user's cookies, so do not use it for data that needs authentication. GHSA-h9g5-28mm-hx3g
  • MethodOverride: a POST can no longer be overridden to GET, HEAD, OPTIONS, TRACE or CONNECT. Before this, with the MethodFromForm or MethodFromQuery getter and MethodOverride registered with Use before the CSRF middleware, _method=GET skipped the CSRF check. Register MethodOverride with Echo#Pre. GHSA-r7w9-592q-9vg4
  • Redirects: the trailing slash middlewares and the static directory redirect percent-encode control characters in the redirect path. Before this, /%09/evil.example/ redirected browsers to evil.example. GHSA-v753-g4cw-jm48
  • Static files: with the default settings, the Static middleware resolves files from the same form of the path that the router matched, so /admin%2Fsecret.txt or /%61dmin/secret.txt can no longer reach a file under a guarded /admin/* route. GHSA-375p-5qhx-8wq4 The Static middleware and StaticDirectoryHandler (used by Echo.Static, Echo.StaticFS, Group.Static and Group.StaticFS) no longer serve paths with a ., .. or empty segment, such as /assets/../admin/secret.txt, also after path unescaping. GHSA-3pmx-cf9f-34xr
  • Dependencies: update golang.org/x/text to v0.40.0 (GO-2026-5970).

Client IP address (no code change in v4)

Without Echo#IPExtractor, Context.RealIP() in v4 trusts the X-Forwarded-For and X-Real-IP headers from any client, so the rate limiter can be bypassed and the Proxy middleware forwards a spoofed X-Real-IP (GHSA-246p-cpwv-v3jq, GHSA-99jh-6h7p-pp36). Changing this default in v4 would put all clients behind a proxy into one rate-limit bucket, so v4 keeps it. Set an extractor that matches your deployment:

e.IPExtractor = echo.ExtractIPDirect()        // no proxy in front of the app
e.IPExtractor = echo.ExtractIPFromXFFHeader() // behind proxies in private networks that set X-Forwarded-For
// behind a proxy with public addresses (e.g. a CDN), also trust its ranges:
// e.IPExtractor = echo.ExtractIPFromXFFHeader(echo.TrustIPRange(cdnRange))

v5 uses the direct peer address by default since v5.1.0.

Behavior changes to check before upgrading

  • Proxies or load balancers with public IP addresses. If a proxy connects to your app from a public (or 100.64.0.0/10) address, its X-Forwarded-Proto is now ignored: HTTPSRedirect redirects in a loop and the Secure middleware stops sending HSTS. This affects, for example, Cloudflare, CloudFront and Azure Front Door connecting to a public origin, the GCP external HTTP(S) load balancer including GKE Ingress (35.191.0.0/16, 130.211.0.0/22), and networks that use 100.64.0.0/10 (such as Alibaba Cloud SLB or EKS custom networking). Trust the proxy's address ranges: 
    _, gclb1, _ := net.ParseCIDR("35.191.0.0/16")
_, gclb2, _ := net.ParseCIDR("130.211.0.0/22")
e.SchemeExtractor = echo.ExtractSchemeFromHeaders(echo.TrustIPRange(gclb1), echo.TrustIPRange(gclb2))
    Proxies on the same host, in a private network (AWS ALB, in-cluster ingress controllers such as ingress-nginx or Traefik, most PaaS routers) or on a unix socket keep working without changes. echo.LegacySchemeExtractor() restores the old behavior but is not safe unless every request passes through a proxy that sets these headers. Serverless adapters or middleware that set RemoteAddr to the client's address also make X-Forwarded-Proto ignored (or, if they take it from a header, spoofable).
  • Trusted proxies must set X-Forwarded-Proto. A proxy on a trusted address that passes the client's X-Forwarded-Proto through (for example nginx without proxy_set_header X-Forwarded-Proto $scheme;) still lets the client choose the scheme. An invalid X-Forwarded-Proto value now results in http instead of falling back to the other scheme headers.
  • Your own tests. httptest.NewRequest sets RemoteAddr to 192.0.2.1:1234, which is not trusted, so tests that set X-Forwarded-Proto now see http. Set req.RemoteAddr = "10.0.0.1:1234" or use e.SchemeExtractor = echo.LegacySchemeExtractor() in such tests.
  • Proxy middleware headers. X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme are no longer forwarded to the upstream; X-Forwarded-Proto carries the scheme.
  • MethodOverride. Overriding a POST to GET (for example with X-HTTP-Method-Override: GET to send a long query in a POST body) is no longer done; such requests keep the POST method.
  • Static files. Paths with a double slash or dot segment (for example /assets//app.js) now return 404; in HTML5 mode the index is still served. The Static middleware no longer finds file names that the client sends with non-default escaping (for example %2C, %40 or lowercase hex like %c3%a9) unless StaticConfig.EnablePathUnescaping is set; Echo.Static has behaved this way since v4.15.4. With StaticConfig.EnablePathUnescaping or Echo#EnablePathUnescapingStaticFiles, encoded dots (%2e%2e) no longer traverse directories, but encoded slashes are still decoded, so do not combine these options with route-based access control.
  • JSONP. Context.JSONP returns an error for callbacks that are not JavaScript identifiers.

Documentation

  • Static middleware: when registered with Echo#Use it runs before route and group middleware, so route guards do not protect the files it serves.

v4.15.4

Compare Source

Security

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#​3016, released in v5.2.1). Thanks to @​a-tt-om and @​oran-gugu for reporting.

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt

// 1. share `public/` folder contents from the server root. This folder actually contains subfolder `admin` which
// contents we want to forbid from downloading
e.Static("/", "public")

// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
    return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")

for static middleware

	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

Full Changelog: labstack/echo@v4.15.3...v4.15.4

v4.15.3: - Static encoded-separator route bypass fix (GHSA-vfp3-v2gw-7wfq)

Compare Source

Security

  • fix(static): reject encoded path separators that bypass route-level middleware by @​vishr in #​3011

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#​3009, released in v5.2.0). Thanks to @​a-tt-om and @​oran-gugu for reporting.

Full Changelog: labstack/echo@v4.15.2...v4.15.3

v4.15.2: - Context.Scheme() header validation

Compare Source

Security

Thanks to @​shblue21 for reporting this issue.

Full Changelog: labstack/echo@v4.15.1...v4.15.2

helm/helm (helm.sh/helm/v3)

v4.3.0: Helm v4.3.0

Compare Source

Helm v4.3.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

Installation and Upgrading

Download Helm v4.3.0. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.3.1 and 3.22.1 are the next patch releases scheduled for October 14, 2026
  • 4.4.0 is the next minor release scheduled for January 13, 2027. There will be no further Helm 3 minor releases (see https://helm.sh/blog/helm-v3-end-of-life)

Changelog

  • chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 bec5b06 (dependabot[bot])
  • chore(deps): bump the k8s-io group across 1 directory with 6 updates d0d42e7 (dependabot[bot])
  • bump version to 4.3 (#​32605) 7328f42 (Scott Rigby)
  • chore: Fix independent-merge lint issues ca6681c (George Jenkins)
  • refactor(repo): Use byte buffer to build index file (#​32579) 37752b7 (Tom Wieczorek)
  • chore: fix gofumpt extra-rules (#​32486) 28e64bd (Matthieu MOREL)
  • Remove deprecated internal/chart/v3/ code (#​32365) 4dfbaa4 (George Jenkins)
  • fix(template): regression - route registry messages to stderr in template and show (#​32217) 9a3c040 (Aaron Mark)
  • refactor: remove per-file decompression size limit (#​31748) 11e2010 (Benoit Tigeot)
  • Updating the Go version b5b498b (Matt Farina)
  • Updating the Go version 6d1f67c (Matt Farina)
  • chore(deps): bump the github-actions group across 1 directory with 4 updates (#​32574) 0f4decb (dependabot[bot])
  • chore(deps): bump the k8s-io group with 7 updates (#​32572) fb19300 (dependabot[bot])
  • fix: correct 'doest not match' in readiness debug logs 6888b0a (MsfPablo)
  • fix(provenance): support GnuPG keybox (pubring.kbx) keyrings (#​32281) 67d54fd (Ruslan Shaydullin)
  • chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#​32562) e9b85e4 (dependabot[bot])
  • chore(deps): bump the github-actions group across 1 directory with 4 updates (#​32556) c000a40 (dependabot[bot])
  • chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#​32555) bafdcde (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#​32545) 2a29f17 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.40.0 to 0.41.0 (#​32543) edb94f8 (dependabot[bot])
  • test(loader): cover 8192-byte EOF boundary for LoadValues fd4ed49 (Dean Chen)
  • fix(loader): do not drop values files ending at a 4096-byte boundary 601445e (Dean Chen)
  • chore(deps): bump the github-actions group with 4 updates (#​32523) f3d68cd (dependabot[bot])
  • fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158 (#​32521) a0c2f6d (Terry Howe)
  • chore(deps): bump github.com/santhosh-tekuri/jsonschema/v6 (#​32514) f8a308c (dependabot[bot])
  • chore(deps): bump the github-actions group with 4 updates 47eb219 (dependabot[bot])
  • chore(deps): bump the github-actions group with 4 updates (#​32508) ae877c8 (dependabot[bot])
  • test(action): poll for the interrupted install goroutine instead of a zero-margin sleep (#​32328) a8ab76e (Nikolaus Schuetz)
  • chore(deps): bump actions/stale in the github-actions group (#​32487) ac1c687 (dependabot[bot])
  • test(package): fix errorlint + exact path match in lock test e923167 (Ilya Kiselev)
  • fix(chart): normalize StampModTimes timestamp + Chart.lock test 3c3be92 (Ilya Kiselev)
  • chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 ce27485 (dependabot[bot])
  • fix(scripts): clarify cache-busting behavior [bc0114c](https://redirect.github.

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 3am on sunday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch 3 times, most recently from b57315c to ee66195 Compare February 9, 2026 18:51
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch 2 times, most recently from dc44a2a to b30ccb5 Compare February 15, 2026 18:08
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from b30ccb5 to 90b8eee Compare March 1, 2026 07:34
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch 3 times, most recently from 10bd318 to 6d730e3 Compare March 15, 2026 05:07
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from 6d730e3 to 7a81fb1 Compare March 30, 2026 14:01
@renovate renovate Bot changed the title fix(deps): update go major updates (major) fix(deps): update module helm.sh/helm/v3 to v4 Mar 30, 2026
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from 7a81fb1 to 4cb723f Compare March 30, 2026 17:14
@renovate renovate Bot changed the title fix(deps): update module helm.sh/helm/v3 to v4 fix(deps): update go major updates (major) Mar 30, 2026
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch 2 times, most recently from 59f577f to f072eb9 Compare April 5, 2026 05:21
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch 2 times, most recently from 5c392e7 to d635612 Compare April 12, 2026 05:43
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from d635612 to cbf4f46 Compare May 1, 2026 20:30
@renovate

renovate Bot commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 44 additional dependencies were updated
  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.25.1 -> 1.26.0
github.com/labstack/echo/v5 v5.4.0 -> v5.4.0
helm.sh/helm/v4 v4.3.0 -> v4.3.0
k8s.io/api v0.35.3 -> v0.37.0
k8s.io/apiextensions-apiserver v0.35.3 -> v0.37.0
k8s.io/apimachinery v0.35.3 -> v0.37.0
k8s.io/cli-runtime v0.35.3 -> v0.37.0
k8s.io/client-go v0.35.3 -> v0.37.0
sigs.k8s.io/controller-runtime v0.23.3 -> v0.24.1
github.com/Masterminds/semver/v3 v3.4.0 -> v3.5.0
github.com/cyphar/filepath-securejoin v0.6.1 -> v0.7.0
github.com/emicklei/go-restful/v3 v3.12.2 -> v3.13.0
github.com/fatih/color v1.18.0 -> v1.19.0
github.com/fxamacker/cbor/v2 v2.9.0 -> v2.9.1
github.com/go-openapi/jsonpointer v0.21.1 -> v1.0.0
github.com/go-openapi/jsonreference v0.21.0 -> v1.0.0
github.com/go-openapi/swag v0.23.1 -> v0.27.1
github.com/klauspost/compress v1.18.2 -> v1.19.0
github.com/lib/pq v1.10.9 -> v1.12.3
github.com/moby/spdystream v0.5.0 -> v0.5.1
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 -> v6.0.3
github.com/sirupsen/logrus v1.9.3 -> v1.9.4
go.yaml.in/yaml/v2 v2.4.3 -> v2.4.4
go.yaml.in/yaml/v3 v3.0.4 -> v3.0.5
golang.org/x/crypto v0.47.0 -> v0.55.0
golang.org/x/mod v0.32.0 -> v0.38.0
golang.org/x/net v0.49.0 -> v0.57.0
golang.org/x/oauth2 v0.34.0 -> v0.36.0
golang.org/x/sync v0.19.0 -> v0.22.0
golang.org/x/sys v0.40.0 -> v0.47.0
golang.org/x/term v0.39.0 -> v0.45.0
golang.org/x/text v0.33.0 -> v0.41.0
golang.org/x/time v0.14.0 -> v0.15.0
golang.org/x/tools v0.41.0 -> v0.48.0
google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 -> v0.0.0-20260526163538-3dc84a4a5aaa
google.golang.org/grpc v1.78.0 -> v1.83.1
google.golang.org/protobuf v1.36.11 -> v1.36.12-0.20260120151049-f2248ac996af
k8s.io/apiserver v0.35.3 -> v0.37.0
k8s.io/component-base v0.35.3 -> v0.37.0
k8s.io/klog/v2 v2.130.1 -> v2.140.0
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 -> v0.0.0-20260721132016-d427ff9ee9ad
k8s.io/kubectl v0.35.1 -> v0.37.0
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 -> v0.0.0-20260626114624-be93311217bd
oras.land/oras-go/v2 v2.6.0 -> v2.6.2
sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482 -> v6.4.2

@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from cbf4f46 to ee5d8f2 Compare May 14, 2026 01:37
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch 4 times, most recently from fce7c66 to b31ffa1 Compare June 18, 2026 01:13
@renovate renovate Bot changed the title fix(deps): update go major updates (major) fix(deps): update module github.com/labstack/echo/v4 to v5 Jun 25, 2026
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch 2 times, most recently from 7695f9f to 3cf7e2b Compare June 25, 2026 13:58
@renovate renovate Bot changed the title fix(deps): update module github.com/labstack/echo/v4 to v5 fix(deps): update go major updates (major) Jun 25, 2026
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch 2 times, most recently from 0071014 to c5c8185 Compare July 12, 2026 05:46
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch 2 times, most recently from f6b26d4 to 6a907bc Compare July 13, 2026 03:29
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from 6a907bc to f9a8d62 Compare July 21, 2026 16:36
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch 3 times, most recently from 2e069c9 to eed8582 Compare August 19, 2026 07:03
@renovate renovate Bot changed the title fix(deps): update go major updates (major) fix(deps): update module helm.sh/helm/v3 to v4 Aug 19, 2026
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from eed8582 to c1775e3 Compare August 19, 2026 18:04
@renovate renovate Bot changed the title fix(deps): update module helm.sh/helm/v3 to v4 fix(deps): update go major updates (major) Aug 19, 2026
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from c1775e3 to ed6a3cc Compare August 24, 2026 06:55
@renovate renovate Bot changed the title fix(deps): update go major updates (major) fix(deps): update module helm.sh/helm/v3 to v4 Aug 24, 2026
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from ed6a3cc to 035896b Compare August 24, 2026 22:10
@renovate renovate Bot changed the title fix(deps): update module helm.sh/helm/v3 to v4 fix(deps): update go major updates (major) Aug 24, 2026
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from 035896b to fcfda48 Compare August 28, 2026 22:26
@renovate renovate Bot changed the title fix(deps): update go major updates (major) fix(deps): update module github.com/labstack/echo/v4 to v5 Aug 28, 2026
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from fcfda48 to 3ca32cc Compare September 4, 2026 20:15
@renovate renovate Bot changed the title fix(deps): update module github.com/labstack/echo/v4 to v5 fix(deps): update go major updates (major) Sep 4, 2026
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from 3ca32cc to 46493c3 Compare September 10, 2026 02:06
@renovate
renovate Bot force-pushed the renovate/major-go-major-updates branch from 46493c3 to 8ca63f6 Compare September 28, 2026 02:27

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants