Skip to content

chore(deps): bump the minor-and-patch group with 6 updates - #216

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/go_modules/dev/minor-and-patch-5cd5b9f0cc
Open

chore(deps): bump the minor-and-patch group with 6 updates#216
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/go_modules/dev/minor-and-patch-5cd5b9f0cc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 6 updates:

Package From To
github.com/compose-spec/compose-go/v2 2.9.1 2.16.1
github.com/go-git/go-git/v5 5.17.0 5.19.2
github.com/jedib0t/go-pretty/v6 6.7.8 6.8.3
github.com/rs/zerolog 1.34.0 1.35.1
github.com/stretchr/testify 1.11.1 1.12.1
golang.org/x/term 0.39.0 0.44.0

Updates github.com/compose-spec/compose-go/v2 from 2.9.1 to 2.16.1

Release notes

Sourced from github.com/compose-spec/compose-go/v2's releases.

v2.16.1

What's Changed

Full Changelog: compose-spec/compose-go@v2.16.0...v2.16.1

v2.16.0

⚠️ Breaking change (Go API)

types.ServiceConfig now embeds types.ContainerSpec and types.WorkloadSpec, shared with the new jobs element and pre_start init containers. Field access is unchanged (svc.Image), but struct literals must now set moved fields through the embedded structs, and code walking ServiceConfig with reflection will see these two embedded structs instead of a flat list of fields:

types.ServiceConfig{Name: "web", ContainerSpec: types.ContainerSpec{Image: "nginx"}}

ServiceConfig.PreStart is now a []types.PreStartHook (was []types.ServiceHook), which embeds a full ContainerSpec; Image and PerReplica are no longer fields of ServiceHook.

The order of keys in the YAML and JSON produced for a service also changes (service-level keys first, then container-level, then workload-level ones). The content is the same, but expected files compared as text need to be regenerated.

What's Changed

New Contributors

Full Changelog: compose-spec/compose-go@v2.15.0...v2.16.0

v2.15.0

What's Changed

... (truncated)

Commits
  • 32d8d5d override: share the by-key compaction and reject null ipam config items
  • 7ed4d72 override: pin the merge of KEY=VALUE entries that are not interpolated
  • be0aa2f override: compact repeated keys and keep empty lists in KEY=VALUE merge
  • 398bcb3 override: merge KEY=VALUE lists by key so the last entry wins
  • 832c7b5 override: accept a null value when merging a list or mapping attribute
  • 6ec8efb lint: fix gocritic, gofumpt and govet issues
  • 98fd653 loader: reuse deepClone instead of duplicating it as cloneYaml
  • e93a134 loader: merge an extension into the attribute it stands for
  • f33989c loader: pin promotion of extensions before extends merges services
  • 732bdd9 loader: apply !reset and !override to the attribute an extension stands for
  • Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.17.0 to 5.19.2

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.2

What's Changed

Full Changelog: go-git/go-git@v5.19.1...v5.19.2

v5.19.1

What's Changed

Full Changelog: go-git/go-git@v5.19.0...v5.19.1

v5.19.0

What's Changed

Full Changelog: go-git/go-git@v5.18.0...v5.19.0

v5.18.0

What's Changed

Full Changelog: go-git/go-git@v5.17.2...v5.18.0

... (truncated)

Commits
  • 3eeb238 Merge pull request #2277 from go-git/checkout-v5
  • 008a78f git: worktree, make the filesystem wrapper a symlink-safe boundary
  • 2263fb5 Merge pull request #2268 from go-git/renovate/releases/v5.x-go-golang.org-x-t...
  • 77b7625 build: Update module golang.org/x/text to v0.39.0 [SECURITY]
  • 85ea767 Merge pull request #2267 from go-git/renovate/releases/v5.x-go-golang.org-x-n...
  • 198675a build: Update module golang.org/x/net to v0.56.0 [SECURITY]
  • 4a0e66d Merge pull request #2254 from pjbgf/v5-dotgit-ref-name-containment
  • 3b306ef storage: dotgit, align reference-name safety with refname_is_safe
  • f3d0cc1 storage: dotgit, reject path traversal in reference names
  • 979cfe9 Merge pull request #2262 from joshblum/joshblum/to-slash-v5
  • Additional commits viewable in compare view

Updates github.com/jedib0t/go-pretty/v6 from 6.7.8 to 6.8.3

Release notes

Sourced from github.com/jedib0t/go-pretty/v6's releases.

v6.8.3

What's Changed

Full Changelog: jedib0t/go-pretty@v6.8.2...v6.8.3

v6.8.2

What's Changed

New Contributors

Full Changelog: jedib0t/go-pretty@v6.8.1...v6.8.2

v6.8.1

What's Changed

A hardening pass across the table, list, progress, and text packages, fixing security issues, crash/race bugs, and performance problems in the render hot paths, with benchmarks added to back the optimizations.

Security

  • table/list (HTML): escape the title, caption, and CSS class names in RenderHTML() to prevent HTML/attribute injection.
  • table (CSV): make RenderCSV() output RFC 4180 compliant, and add an opt-in Style().CSV.FieldProtection option that neutralizes spreadsheet formula-injection fields (=, +, -, @, tab, CR).
  • text: sanitize hyperlink URLs and bound the escape-sequence parser buffer so adversarial input can't grow it without limit.

Correctness

  • progress: fix a render panic on tiny tracker lengths, data races on tracker/indicator state, and a leaked time.Ticker in the terminal-size watcher.
  • table: guard auto-index rendering against empty maxColumnLengths.
  • text: prevent a panic in VAlign.Apply on negative maxLines.

Performance

  • table: compile regex filters once per render; pre-size render builders.
  • list: hoist repeated width math out of the render loops.
  • text: speed up Align.Apply and StringWidthWithoutEscSequences.
  • progress: build PacManChomp frames with a strings.Builder.

Tooling

  • Moved root-level benchmarks into their packages and wired up make bench; added benchmarks for the table/text/list/progress render hot paths and tests covering the retained-done-tracker render paths.

... (truncated)

Commits
  • db0aac2 README.md: drop Go Report Card badge (#412)
  • 7f91001 table: stack vertically-merged rows into wrapped cell height; fixes #261 (#411)
  • a4201b7 text: trim to display width so CJK content respects maxLen (#410)
  • 22c68f6 fix panics, races, and injection vectors; speed up render hot paths (#409)
  • 45fb00d text: wrap wide runes when wrapLen is odd in WrapHard (#408)
  • ad17549 progress: fix speed decay on done trackers and log overwrite; fixes #405 (#406)
  • 66563fd text: fix panic on align with unicode (#404)
  • 017a359 table: markdown padding for human-friendly output; fixes #402 (#403)
  • See full diff in compare view

Updates github.com/rs/zerolog from 1.34.0 to 1.35.1

Commits
  • 116c806 event: restore Err() logging when ErrorStackMarshaler returns nil (#763)
  • 1396655 Bump CI Go matrix minimum from 1.21 to 1.23
  • 4b65a2f Bump actions/cache from 4 to 5 (#741)
  • b835796 Bump actions/setup-go from 5 to 6 (#742)
  • 134caf8 Added sanitization of journald keys (#751)
  • e133b6a Added variadic StrsV, ObjectsV, and StringersV (#752)
  • 82017d8 Bump github.com/coreos/go-systemd/v22 from 22.6.0 to 22.7.0 (#753)
  • 2f5b8a9 fix: UpdateContext skips Nop and zero-value loggers (#754)
  • d64c9a7 Add slog.Handler implementation for zerolog (#755)
  • a0d61dc fix: return dict to Event pool (#749)
  • Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

Updates golang.org/x/term from 0.39.0 to 0.44.0

Commits
  • 3b43943 go.mod: update golang.org/x dependencies
  • 3c3e485 go.mod: update golang.org/x dependencies
  • 52b71d3 go.mod: update golang.org/x dependencies
  • 9d2dc07 go.mod: update golang.org/x dependencies
  • d954e03 all: upgrade go directive to at least 1.25.0 [generated]
  • 3aff304 go.mod: update golang.org/x dependencies
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group with 6 updates
7fb904c 
Bumps the minor-and-patch group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/compose-spec/compose-go/v2](https://github.com/compose-spec/compose-go) | `2.9.1` | `2.16.1` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.17.0` | `5.19.2` |
| [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty) | `6.7.8` | `6.8.3` |
| [github.com/rs/zerolog](https://github.com/rs/zerolog) | `1.34.0` | `1.35.1` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.1` |
| [golang.org/x/term](https://github.com/golang/term) | `0.39.0` | `0.44.0` |


Updates `github.com/compose-spec/compose-go/v2` from 2.9.1 to 2.16.1
- [Release notes](https://github.com/compose-spec/compose-go/releases)
- [Commits](compose-spec/compose-go@v2.9.1...v2.16.1)

Updates `github.com/go-git/go-git/v5` from 5.17.0 to 5.19.2
- [Release notes](https://github.com/go-git/go-git/releases)
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md)
- [Commits](go-git/go-git@v5.17.0...v5.19.2)

Updates `github.com/jedib0t/go-pretty/v6` from 6.7.8 to 6.8.3
- [Release notes](https://github.com/jedib0t/go-pretty/releases)
- [Commits](jedib0t/go-pretty@v6.7.8...v6.8.3)

Updates `github.com/rs/zerolog` from 1.34.0 to 1.35.1
- [Commits](rs/zerolog@v1.34.0...v1.35.1)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

Updates `golang.org/x/term` from 0.39.0 to 0.44.0
- [Commits](golang/term@v0.39.0...v0.44.0)

---
updated-dependencies:
- dependency-name: github.com/compose-spec/compose-go/v2
  dependency-version: 2.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.19.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/jedib0t/go-pretty/v6
  dependency-version: 6.8.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/rs/zerolog
  dependency-version: 1.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/term
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 4, 2026
This was referenced Oct 4, 2026
Closed
Closed
Closed
Closed
Closed
@coderabbitai

coderabbitai Bot commented Oct 4, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 0e5c59e1-7156-4729-abab-a99c660cdbcc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants