Skip to content

chore(deps): bump the go-modules group across 1 directory with 23 updates - #236

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-modules-7edde2da46
Open

chore(deps): bump the go-modules group across 1 directory with 23 updates#236
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-modules-7edde2da46

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-modules group with 23 updates in the / directory:

Package From To
cloud.google.com/go/pubsub/v2 2.7.0 2.8.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity 1.14.1 1.15.0
github.com/aws/aws-sdk-go-v2 1.47.3 1.47.5
github.com/aws/aws-sdk-go-v2/config 1.33.9 1.33.12
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue 1.21.11 1.21.16
github.com/aws/aws-sdk-go-v2/service/cloudwatch 1.73.3 1.75.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs 1.89.3 1.90.3
github.com/aws/aws-sdk-go-v2/service/dynamodb 1.70.3 1.72.2
github.com/aws/aws-sdk-go-v2/service/sns 1.47.5 1.47.7
github.com/aws/aws-sdk-go-v2/service/sqs 1.52.4 1.52.7
github.com/dapr/dapr 1.18.16 1.19.0
github.com/dapr/go-sdk 1.15.0 1.16.0
github.com/nats-io/nats.go 1.54.0 1.55.0
github.com/posthog/posthog-go 1.34.0 1.39.0
github.com/quic-go/quic-go 0.63.0 0.64.1
github.com/rabbitmq/amqp091-go 1.14.0 1.16.0
github.com/rabbitmq/rabbitmq-stream-go-client 1.8.3 1.9.0
github.com/twmb/franz-go 1.22.1 1.22.2
google.golang.org/api 0.287.1 0.288.0
google.golang.org/grpc 1.83.2 1.85.0
k8s.io/apimachinery 0.37.1 0.37.2
k8s.io/client-go 0.37.1 0.37.2
modernc.org/sqlite 1.60.1 1.61.0

Updates cloud.google.com/go/pubsub/v2 from 2.7.0 to 2.8.0

Commits
  • 2b317b5 chore(main): release pubsub 2.8.0 (#20529)
  • ab1da9d feat: update API sources and regenerate (#20728)
  • e97e555 chore: release main (#20729)
  • d80b4e8 feat(firestore): add x-goog-is-transaction routing header (#20701)
  • 3266de7 chore(all): update module github.com/klauspost/compress to v1.18.7 [SECURITY]...
  • 79b0fd3 chore: release main (#20702)
  • 2f94448 chore(deps): bump github.com/klauspost/compress from 1.16.7 to 1.18.7 in /big...
  • 612ddfa chore(deps): bump github.com/klauspost/compress from 1.16.7 to 1.18.7 in /int...
  • a279d2a fix(bigtable): raise the accelerator's gRPC message size limits to match the ...
  • 2ace946 chore: update librarian version to v0.49.0 (#20722)
  • Additional commits viewable in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.1 to 1.15.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/azidentity/v1.15.0

1.15.0 (2026-10-14)

Features Added

  • ManagedIdentityCredential and DefaultAzureCredential support user-assigned managed identities on Azure Arc when the agent supports them
  • WorkloadIdentityCredential supports identity binding mode via WorkloadIdentityCredentialOptions.EnableAzureProxy

Bugs Fixed

  • ManagedIdentityCredential verifies the Service Fabric endpoint's certificate against IDENTITY_SERVER_THUMBPRINT and rejects redirects

Other Changes

  • On Service Fabric, a custom ClientOptions.Transport must be an *http.Client with a nil Transport or a standard *http.Transport without custom TLS dialing or verification callbacks. Unsupported transports now cause credential construction to fail
  • Upgraded dependencies
Commits
  • bb7200c Update azcore v1.15.0 release date (#23569)
  • d112082 [azopenaiextensions] Pushing release date to Monday (#23565)
  • 9522165 [azopenai] 2024-08-01-preview generation (#23554)
  • 42922c1 [azeventhubs,azservicebus] Applying retry fix to both eventhubs and servicebu...
  • 5df372c Use common OIDC token env vars in post scripts (#23549)
  • 1c2a108 BearerTokenPolicy handles CAE claims challenges by default (#23414)
  • 8759ee6 [azopenaiextensions] Prepping for release tomorrow (#23551)
  • a230ef2 [Search] Remove myself from CODEOWNERS (#23560)
  • a743757 Sync eng/common directory with azure-sdk-tools for PR 9106 (#23555)
  • 7c2d3a7 Use equality function check for persist oidc token step (#23559)
  • Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.5

Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.12

Commits

Updates github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue from 1.21.11 to 1.21.16

Commits

Updates github.com/aws/aws-sdk-go-v2/service/cloudwatch from 1.73.3 to 1.75.2

Commits

Updates github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.89.3 to 1.90.3

Commits

Updates github.com/aws/aws-sdk-go-v2/service/dynamodb from 1.70.3 to 1.72.2

Commits

Updates github.com/aws/aws-sdk-go-v2/service/sns from 1.47.5 to 1.47.7

Commits

Updates github.com/aws/aws-sdk-go-v2/service/sqs from 1.52.4 to 1.52.7

Commits

Updates github.com/dapr/dapr from 1.18.16 to 1.19.0

Release notes

Sourced from github.com/dapr/dapr's releases.

Dapr Runtime v1.19.0

Dapr 1.19

We're excited to announce the release of Dapr 1.19!

The main changes in this release:

  • Faster workflows, jobs and reminders. In the nightly performance tests against 1.18.0, workflow throughput is up to 40% higher. The p99 latency of actor reminder registration is 71% lower, and the p99 latency of Jobs scheduling is 33% lower. Workflow workers in the Python, Java, .NET and Go SDKs now get only the new events of each turn, not the full history.
  • Workflows across apps. A workflow client can now start, get, raise events on, pause, resume, terminate, purge and rerun a workflow that another app owns. Access policies decide which app can do what. A new requires rule allows a schedule only when the caller's history contains the required upstream events. A workflow can also start a detached workflow that outlives it.
  • New building blocks (alpha). Binary Store stores large files in Amazon S3 and S3-compatible stores, Azure Blob Storage, Azure Data Lake Storage, Google Cloud Storage and OCI Object Storage. Search and Vector index and query documents and vectors, with Meilisearch components.
  • Dapr MCP server (alpha). The Dapr MCP server gives AI agents and IDE assistants the building blocks of a sidecar as Model Context Protocol tools. It ships as a separate binary, on its own release cycle.
  • Actors. With actor placement in the Scheduler (opt-in), each reminder goes straight to the host that runs the actor. The cluster then does not need the Placement service. New APIs list and get actor timers over HTTP and gRPC, and list reminders over HTTP. When an actor moves to another host, the old host deletes its timers, so they no longer fire twice.
  • Kafka transactions. Kafka pub/sub can make a bulk publish atomic, read only committed records, and run consume-transform-produce in one transaction. All three are opt-in.
  • Operations. Logs can go to several destinations, with file rotation and a configurable timestamp format. Workload identity certificates carry the image references of the pod. Every Kubernetes Service that Dapr creates sets appProtocol for service meshes.
  • Security. Five security fixes. Four of them, for service invocation, the Scheduler and workflows, also shipped in 1.18.6. The fifth makes the Operator enforce app scopes and configuration assignment, and it also shipped in 1.18.9 and 1.17.18. Four of the five change behavior.

Read Breaking Changes and Deprecation Notices before you upgrade. 1.19 contains behavior changes that can affect an upgrade, mostly in the SDKs.

Thanks to all the new and existing contributors who helped make this release happen.

If you're new to Dapr, visit the getting started page and familiarize yourself with Dapr.

The docs have been updated with all the new features and changes of this release. To get started with new capabilities introduced in this release, go to the Concepts and the Developing applications.

Go to the upgrading Dapr section for steps to upgrade to version 1.19.

Acknowledgements

Thanks to everyone who made this release possible!

@​acroca, @​adam6878, @​Advait2912, @​anneheartrecord, @​anxkhn, @​arturotrenard, @​baltasarblanco, @​CasperGN, @​cicoyle, @​DamienCassou, @​famarting, @​gargsajal9, @​GHX5T-SOL, @​icmp0x8, @​ihopenre-eng, @​javier-aliaga, @​jjcollinge, @​jongep86, @​JoshVanL, @​jslatten, @​kayvonkhosrowpour, @​kshitizj03, @​LiBaoxuan-Neil, @​LilDojd, @​LindseyZ1205, @​lrascao, @​m3nax, @​magic-peach, @​manduinca, @​marcduiker, @​matheusandre1, @​mikeee, @​MrMint, @​MsfPablo, @​mtaghavi2005, @​Mukuwul, @​MyMirelHub, @​nelson-parente, @​olitomlinson, @​pablochacin, @​passuied, @​Psingle20, @​pujitha24, @​RakeshCodeLab, @​Rishabh-git10, @​SaiPisey2, @​SarthakB11, @​seherv, @​sicoyle, @​siri-varma, @​somaz94, @​stywzn, @​tezizzm, @​vip892766gma, @​WhitWaldo, @​yaron2, @​Yash121l

Highlights

These are the v1.19 release highlights:

Faster workflows, jobs and reminders

Compared with the published v1.18.0 run, the nightly performance tests on master show:

  • Workflows: throughput is 40% higher in TestWorkflowWithConstantVUs and 32% higher in TestSeriesWorkflowWithMaxVUs.
  • Jobs scheduling: p99 latency is 33% lower (39.5 ms to 26.3 ms), and the test now sustains the full requested 1000 QPS (921 QPS on 1.18.0).
  • Actor reminder registration: p99 latency is 71% lower (148 ms to 43 ms), at 43% more registrations per second.
  • Configuration subscribe: throughput is 67% higher over HTTP and about 2.8x over gRPC. This test varies up to 3x between runs, so treat the gRPC figure as indicative.

Service invocation, state and pub/sub publish show no change beyond run-to-run noise. The figures are medians of 8 runs from 23/09/2026 to 02/10/2026, on the same cluster as the v1.18.0 run.

Changes in this area include:

... (truncated)

Commits

Updates github.com/dapr/go-sdk from 1.15.0 to 1.16.0

Release notes

Sourced from github.com/dapr/go-sdk's releases.

Release v1.16.0

Automatic Go Dapr client release

Release v1.16.0-rc.2

Automatic Go Dapr client release

Release v1.16.0-rc.1

Automatic Go Dapr client release

Commits
  • c90047c Merge pull request #850 from nelson-parente/chore/dapr-1.19.0
  • e4f0121 chore: pin SDK version and go.mod for Dapr 1.19.0
  • 6f6d55b Merge pull request #849 from nelson-parente/chore/dapr-1.19.0-rc.4-pins
  • 9cca693 chore: pin go.mod for Dapr 1.19.0-rc.5
  • d62cebd chore: pin go.mod for Dapr 1.19.0-rc.4
  • cb62853 Merge pull request #847 from nelson-parente/chore/dapr-1.19.0-rc.3-pins
  • 0e4559a chore: pin SDK version and go.mod for Dapr 1.19.0-rc.3
  • 6489fe3 Merge pull request #842 from nelson-parente/test/crypto-context-deadline-race
  • 3439e1b Merge branch 'main' into test/crypto-context-deadline-race
  • 827dab4 Merge pull request #843 from nelson-parente/ci/actor-examples-step-timeout
  • Additional commits viewable in compare view

Updates github.com/nats-io/nats.go from 1.54.0 to 1.55.0

Release notes

Sourced from github.com/nats-io/nats.go's releases.

Release v1.55.0

Changelog

This is the biggest nats.go release in a long time: 47 changes with more than half of them coming from 18 external contributors - thank you all!

Most of this release is a robustness effort. Nearly 30 bug fixes address deadlocks, goroutine and timer leaks, data races and stalls in reconnect and drain handling, pull and ordered consumers, async publish and service API. It also adds the FetchMaxBytes() option and Conn.RemoteAccount().

ADDED

  • Core NATS:
    • Conn.RemoteAccount() and ServerInfo.RemoteAccount exposing the account the client is bound to (#2156)
  • JetStream:
    • FetchMaxBytes() option to limit both the number of messages and total bytes in a single Fetch() request. Thanks @​manenim for the contribution (#2198)
    • StreamInfo.Domain, StreamInfo.Alternates, StreamState.Lost, StreamSourceInfo.External and StreamSourceInfo.Error in stream info (#2168)
    • ErrStreamMessageExceedsMaximum for JetStream error code 10054, returned when a message exceeds the stream's MaxMsgSize. Thanks @​matehsan for the contribution (#2110)

FIXED

  • Core NATS:
    • ForceReconnect() called while already reconnecting disabling ReconnectWait and custom reconnect delays, so the client dialed in a tight loop. Thanks @​Arsen302 for the contribution and @​MokiMeow for the diagnosis and test (#2179)
    • Connection closing for good instead of reconnecting after a partial write left a truncated message on the wire (#2169)
    • Connection status listeners losing an unread event and being unregistered when the next status was sent (#2193)
    • Message headers not counted against subscription pending byte limits, so header-heavy subscriptions could exceed the limit without reporting a slow consumer. Thanks @​Grivn for the contribution (#2200)
    • Requests interrupted by a reconnect returning ErrConnectionClosed instead of ErrDisconnected. Thanks @​AshSgDe29071999 for the contribution (#2129)
    • Default port added to the path instead of the host for server URLs with a path and no port, e.g. ws://host/nats. Thanks @​dannyshafer for the contribution (#2177)
    • Close() during Drain() flipping the closed connection back to DRAINING_PUBS and flushing on it. Thanks @​Kshot3000 for the contribution (#2163)
    • Drain() waiting for the full DrainTimeout when the connection was closed mid-drain (#2171)
    • IsSystemAccount() reset to false by async INFO updates, such as cluster topology changes or lame duck mode (#2156)
  • JetStream:
    • Pull consumer Consume() and Messages() deadlocking on Stop() or Drain() while buffered messages were still being delivered. Thanks @​clwluvw for the contribution (#2165)
    • Messages() iterator goroutines leaking after the connection is closed. Thanks @​clwluvw for the contribution (#2166)
    • Heartbeat timer and status listener left running when Consume() ends because the connection was closed. Thanks @​clwluvw for the contribution (#2164)
    • Messages() iterator returning ErrMsgIteratorClosed instead of the remaining buffered messages when Next() raced with Drain() (#2188)
    • Pull consumer with StopAfter stalling until the missed heartbeat check (30s by default) after a pull expired. Thanks @​huynguyen7 for the contribution (#2208)
    • Ordered consumer with StopAfter hanging on Stop()/Drain(), delivering too many or too few messages, or panicking after a consumer reset. Thanks @​clwluvw for the contribution (#2167)
    • Ordered consumer Fetch(), Next() and FetchBytes() blocking forever after returning ErrOrderedConsumerConcurrentRequests, and FetchNoWait() restarting from the beginning of the stream (#2211)
    • Ordered consumer Consume() and Messages() using the 15s pull consumer heartbeat instead of the 5s ordered default, so a stalled consumer was reset after ~30s instead of ~10s. Thanks @​arminazimi for the contribution (#2182)
    • PublishAsync() exceeding WithPublishAsyncMaxPending() under concurrent calls. Thanks @​ShravanthReddy for the contribution (#2126)
    • Async publish error callbacks for messages pending during a reconnect delayed until the publisher shut down. Thanks @​H-XX-D for the contribution (#2150)
    • Data race between Info() and CachedInfo() on streams and consumers. Thanks @​vulragrag-star for the contribution (#2152)
    • Reusing the same KeyValueConfig.Sources for several KeyValue buckets carrying the first bucket's subject transform into the next ones, so their reads returned ErrKeyNotFound. Thanks @​zhechen-cs for the contribution (#2190)
    • Object Store GetFile() leaving trailing bytes of an existing destination file when downloading a shorter object. Thanks @​zhechen-cs for the contribution (#2197)
  • Legacy JetStream:
    • Async publish error callbacks for messages pending during a reconnect delayed until the publisher shut down. Thanks @​H-XX-D for the contribution (#2150)
    • KeyValue Create() and Update() on a cross-domain mirrored bucket failing with nats: no response from stream. Thanks @​spicysharkco for the contribution (#2203)
    • Object Store GetFile() leaving trailing bytes of an existing destination file when downloading a shorter object. Thanks @​zhechen-cs for the contribution (#2197)
  • Service API:
    • Panic in AddService() on a closed connection (#2154)
    • Panic with send on closed channel when callbacks were queued during Stop() (#2173)
    • Service stopping on async errors from unrelated subscriptions with overlapping subjects. Async errors are now matched by subscription, recorded in endpoint stats and passed to ErrorHandler, and only a closed connection stops the service (#2174)

... (truncated)

Commits
  • 6068694 Release v1.55.0 (#2214)
  • 063b4ad [FIXED] Honor ReconnectWait after ForceReconnect during reconnect (#2179)
  • 0a4cfc1 [ADDED] JetStream: stream alternates, lost data, source external/error (#2168)
  • c3830a0 [IMPROVED] Document default MaxAckPending for legacy JetStream subscriptions ...
  • 2560ee4 [IMPROVED] Avoid per-message metadata allocations in JetStream consumers (#2212)
  • 8afc207 [FIXED] Ordered consumer Fetch deadlock and FetchNoWait redelivery (#2211)
  • d1936d7 [FIXED] Correct StopAfter pending accounting for pull consumers (#2208)
  • b431a07 [FIXED] micro: service and endpoint metadata can be changed after it is set (...
  • ef8ce42 [FIXED] micro: Reset clears the endpoint queue group in stats (#2195)
  • e28f7be [FIXED] Connection status listeners losing unread events (#2193)
  • Additional commits viewable in compare view

Updates github.com/posthog/posthog-go from 1.34.0 to 1.39.0

Release notes

Sourced from github.com/posthog/posthog-go's releases.

1.39.0

Unreleased

1.38.0

Unreleased

1.37.0

Unreleased

1.36.2

Unreleased

1.36.1

Unreleased

1.36.0

Unreleased

1.35.3

Unreleased

1.35.2

Unreleased

1.35.1

Unreleased

1.35.0

Unreleased

Changelog

Sourced from github.com/posthog/posthog-go's changelog.

1.39.0

Minor Changes

  • 401e68f: Report flags that local evaluation could not resolve on EvaluateFlags snapshots. FeatureFlagEvaluations.UnresolvedFlags() maps each such flag to an UnresolvedFlagReason (experience_continuity, unsupported_definition, unresolved_dependency or missing_context), and InconclusiveMatchError and RequiresServerEvaluationError carry the reason in a new Reason field. When definitions load, log one warning per flag that local evaluation can never resolve (experience continuity, a static cohort, an unknown operator, a malformed value, or a missing or circular flag dependency), and again only when its definition changes.

    Behavior changes:

    • A condition with a filter that local evaluation can't check and a filter that does not match now resolves locally as no match. Before, such a flag fell back to a remote request, or stayed unresolved with OnlyEvaluateLocally.
    • An inactive flag with experience continuity enabled now resolves to false locally instead of falling back to a remote request.
    • $feature_flag_called events from snapshot reads of these flags report local_evaluation_inconclusive instead of flag_missing.
    • The load-time warning is logged with Logger.Warnf, so it shows without debug logging.

1.38.0

Minor Changes

  • 94ff576: Add an optional OpenTelemetry context processor and HTTP middleware for session and person IDs on application spans. Both take the PostHog client and add no IDs when that client is nil, disabled, or closed.

1.37.0

Minor Changes

  • 729bcf7: Add an opt-in OpenTelemetry enqueue helper that adds active trace and span IDs to exception events.

1.36.2

Patch Changes

  • e8c7d37: Fall back to remote feature flag evaluation for regex syntax and character-class semantics that cannot be evaluated consistently with the flags service, including through negated cohorts.

1.36.1

Patch Changes

  • 6b734dd: Preserve captured events with non-finite numeric properties by serializing NaN and infinities as null in both capture protocols. Arbitrary structs containing these numbers are replaced with null as a whole property.

1.36.0

Minor Changes

  • d170fc5: Local flag evaluation honors experiment holdouts. A flag whose definition carries filters.holdout now resolves a held-out identifier to holdout-<id> before its release conditions, matching the server instead of silently bucketing the identifier into a regular variant.

1.35.3

Patch Changes

  • 870af8a: Fix local feature flag string and regex operators to stringify explicit null values as "null", matching the flags service. Flag results and variant selection can change for explicit-null properties; missing properties remain inconclusive and eligible for remote evaluation.

1.35.2

... (truncated)

Commits
  • e13d11c chore: release v1.39.0 [version bump] [skip ci]
  • 401e68f feat(flags): report unresolved local flags on EvaluateFlags snapshots (#396)
  • b0a9fae chore: release v1.38.0 [version bump] [skip ci]
  • 94ff576 feat(otel): add request context to application spans (#375)
  • 5d73532 chore: release v1.37.0 [version bump] [skip ci]
  • 729bcf7 feat(otel): add opt-in exception trace context (#374)
  • 32f2522 chore: release v1.36.2 [version bump] [skip ci]
  • e8c7d37 fix(flags): fall back for incompatible local regex evaluation (#387)
  • 56aa91d docs: require signed commits in contributor docs (#388)
  • aef332c chore: release v1.36.1 [version bump] [skip ci]
  • Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.63.0 to 0.64.1

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.64.1

This patch release fixes datagram receive cancellation and stream reset handling.

Notable Fixes

  • Conn.ReceiveDatagram now fails immediately if the context is already canceled: #5947
  • http3: Stream.ReceiveDatagram and RequestStream.ReceiveDatagram now fail immediately if the context is already canceled: #5948
  • Stream reset handling now ignores reliable boundary updates after cancellation: #5950

Changelog

Full Changelog: quic-go/quic-go@v0.64.0...v0.64.1

v0.64.0

This release improves congestion control and performance, especially on paths with packet reordering:

  • Slow-start pacing now uses twice the estimated bandwidth, allowing the sending rate to double each RTT: #5882
  • Application-data loss detection now disables packet-threshold detection after a spurious loss, avoiding repeated unnecessary retransmissions caused by packet reordering: #5905
  • Application-data loss detection now uses an adaptive time threshold that increases after spurious losses, allowing more time for reordered packets to arrive: #5925
  • The congestion controller now restores its congestion window and recovery state after a reduction caused entirely by spurious packet loss: #5923

Notable Fixes

  • Congestion recovery now respects send order across Initial, Handshake and application-data packets, fixing incorrect recovery decisions caused by comparing packet numbers from different spaces: #5920
  • Connections now fall back to 1200-byte Initial packets on EMSGSIZE when Config.InitialPacketSize is unset, allowing handshakes over paths with smaller MTUs: #5911
  • Oversized packets are now rejected before serialization, including Initial packets with excessively large address-validation tokens: #5937
  • Path MTU discovery now restarts correctly after connection migration and NAT rebinding: #5887
  • Servers now retry unanswered PATH_CHALLENGEs with exponential backoff as more packets arrive on the candidate path, preventing path validation from stalling when a challenge is acknowledged but no PATH_RESPONSE arrives: #5930
  • Servers now continue responding to PATH_CHALLENGEs on existing candidate paths when the candidate path limit is reached: #5929
  • Writes after closing a SendStream or Stream now return quic.ErrStreamClosed, which is also used as the stream context's cancellation cause: #5885
  • Conn.SendDatagram now returns the connection's close error after shutdown, instead of accepting datagrams that will be silently dropped: #5880
  • http3: SendDatagram now immediately returns an error after the stream's send side closes, including after STOP_SENDING or connection shutdown: #5884
  • http3: request header, response header and trailer buffers now grow as data arrives, avoiding large allocations based solely on a peer's advertised HEADERS frame length: #5886
  • Spurious losses are now detected when an ACK only acknowledges packets previously declared lost: #5895
  • Spurious losses are now detected when ACKs arrive out of order: #5900
  • Path migration now clears the old path's loss history, preventing stale spurious-loss reports and recovery adjustments: #5903
  • MTU and path probes no longer trigger spurious-loss reports or adaptive loss-recovery changes: #5906

Notable Changes

  • ConnectionStats now exposes CongestionWindow, reporting the local sender's congestion window on the active network path in bytes: #5901
  • http3.Stream and http3.RequestStream now expose QlogTrace, allowing applications to add events to the underlying connection's qlog trace: #5935
  • http3/qlog.RedactHeaders allows applications to redact HTTP/3 header and trailer values, including pseudo-headers, before they are written to qlog: #5932
  • qlog: locally dropped QUIC datagrams are now ...

    Description has been truncated

@dependabot
chore(deps): bump the go-modules group across 1 directory with 23 upd…
29c6d14 
…ates

Bumps the go-modules group with 23 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/pubsub/v2](https://github.com/googleapis/google-cloud-go) | `2.7.0` | `2.8.0` |
| [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go) | `1.14.1` | `1.15.0` |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.47.3` | `1.47.5` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.33.9` | `1.33.12` |
| [github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue](https://github.com/aws/aws-sdk-go-v2) | `1.21.11` | `1.21.16` |
| [github.com/aws/aws-sdk-go-v2/service/cloudwatch](https://github.com/aws/aws-sdk-go-v2) | `1.73.3` | `1.75.2` |
| [github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs](https://github.com/aws/aws-sdk-go-v2) | `1.89.3` | `1.90.3` |
| [github.com/aws/aws-sdk-go-v2/service/dynamodb](https://github.com/aws/aws-sdk-go-v2) | `1.70.3` | `1.72.2` |
| [github.com/aws/aws-sdk-go-v2/service/sns](https://github.com/aws/aws-sdk-go-v2) | `1.47.5` | `1.47.7` |
| [github.com/aws/aws-sdk-go-v2/service/sqs](https://github.com/aws/aws-sdk-go-v2) | `1.52.4` | `1.52.7` |
| [github.com/dapr/dapr](https://github.com/dapr/dapr) | `1.18.16` | `1.19.0` |
| [github.com/dapr/go-sdk](https://github.com/dapr/go-sdk) | `1.15.0` | `1.16.0` |
| [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go) | `1.54.0` | `1.55.0` |
| [github.com/posthog/posthog-go](https://github.com/posthog/posthog-go) | `1.34.0` | `1.39.0` |
| [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) | `0.63.0` | `0.64.1` |
| [github.com/rabbitmq/amqp091-go](https://github.com/rabbitmq/amqp091-go) | `1.14.0` | `1.16.0` |
| [github.com/rabbitmq/rabbitmq-stream-go-client](https://github.com/rabbitmq/rabbitmq-stream-go-client) | `1.8.3` | `1.9.0` |
| [github.com/twmb/franz-go](https://github.com/twmb/franz-go) | `1.22.1` | `1.22.2` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.287.1` | `0.288.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.83.2` | `1.85.0` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.37.1` | `0.37.2` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.37.1` | `0.37.2` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.60.1` | `1.61.0` |



Updates `cloud.google.com/go/pubsub/v2` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](googleapis/google-cloud-go@pubsub/v2.7.0...pubsub/v2.8.0)

Updates `github.com/Azure/azure-sdk-for-go/sdk/azidentity` from 1.14.1 to 1.15.0
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Commits](Azure/azure-sdk-for-go@sdk/azidentity/v1.14.1...sdk/azcore/v1.15.0)

Updates `github.com/aws/aws-sdk-go-v2` from 1.47.3 to 1.47.5
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.47.3...v1.47.5)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.33.9 to 1.33.12
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.33.9...config/v1.33.12)

Updates `github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue` from 1.21.11 to 1.21.16
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/rum/v1.21.11...service/rum/v1.21.16)

Updates `github.com/aws/aws-sdk-go-v2/service/cloudwatch` from 1.73.3 to 1.75.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/eks/v1.73.3...service/s3/v1.75.2)

Updates `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs` from 1.89.3 to 1.90.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ecs/v1.89.3...service/ecs/v1.90.3)

Updates `github.com/aws/aws-sdk-go-v2/service/dynamodb` from 1.70.3 to 1.72.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/emr/v1.70.3...service/s3/v1.72.2)

Updates `github.com/aws/aws-sdk-go-v2/service/sns` from 1.47.5 to 1.47.7
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.47.5...service/s3/v1.47.7)

Updates `github.com/aws/aws-sdk-go-v2/service/sqs` from 1.52.4 to 1.52.7
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ssm/v1.52.4...service/sqs/v1.52.7)

Updates `github.com/dapr/dapr` from 1.18.16 to 1.19.0
- [Release notes](https://github.com/dapr/dapr/releases)
- [Changelog](https://github.com/dapr/dapr/blob/master/RELEASE.md)
- [Commits](https://github.com/dapr/dapr/commits/v1.19.0)

Updates `github.com/dapr/go-sdk` from 1.15.0 to 1.16.0
- [Release notes](https://github.com/dapr/go-sdk/releases)
- [Commits](dapr/go-sdk@v1.15.0...v1.16.0)

Updates `github.com/nats-io/nats.go` from 1.54.0 to 1.55.0
- [Release notes](https://github.com/nats-io/nats.go/releases)
- [Commits](nats-io/nats.go@v1.54.0...v1.55.0)

Updates `github.com/posthog/posthog-go` from 1.34.0 to 1.39.0
- [Release notes](https://github.com/posthog/posthog-go/releases)
- [Changelog](https://github.com/PostHog/posthog-go/blob/main/CHANGELOG.md)
- [Commits](PostHog/posthog-go@v1.34.0...v1.39.0)

Updates `github.com/quic-go/quic-go` from 0.63.0 to 0.64.1
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.63.0...v0.64.1)

Updates `github.com/rabbitmq/amqp091-go` from 1.14.0 to 1.16.0
- [Release notes](https://github.com/rabbitmq/amqp091-go/releases)
- [Changelog](https://github.com/rabbitmq/amqp091-go/blob/main/CHANGELOG.md)
- [Commits](rabbitmq/amqp091-go@v1.14.0...v1.16.0)

Updates `github.com/rabbitmq/rabbitmq-stream-go-client` from 1.8.3 to 1.9.0
- [Release notes](https://github.com/rabbitmq/rabbitmq-stream-go-client/releases)
- [Changelog](https://github.com/rabbitmq/rabbitmq-stream-go-client/blob/main/CHANGELOG.md)
- [Commits](rabbitmq/rabbitmq-stream-go-client@v1.8.3...v1.9.0)

Updates `github.com/twmb/franz-go` from 1.22.1 to 1.22.2
- [Changelog](https://github.com/twmb/franz-go/blob/master/CHANGELOG.md)
- [Commits](twmb/franz-go@v1.22.1...v1.22.2)

Updates `google.golang.org/api` from 0.287.1 to 0.288.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.287.1...v0.288.0)

Updates `google.golang.org/grpc` from 1.83.2 to 1.85.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.83.2...v1.85.0)

Updates `k8s.io/apimachinery` from 0.37.1 to 0.37.2
- [Commits](kubernetes/apimachinery@v0.37.1...v0.37.2)

Updates `k8s.io/client-go` from 0.37.1 to 0.37.2
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.37.1...v0.37.2)

Updates `modernc.org/sqlite` from 1.60.1 to 1.61.0
- [Release notes](https://gitlab.com/cznic/sqlite/tags)
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.60.1...v1.61.0)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/pubsub/v2
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azidentity
  dependency-version: 1.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.47.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue
  dependency-version: 1.21.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/aws/aws-sdk-go-v2/service/cloudwatch
  dependency-version: 1.75.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
  dependency-version: 1.90.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/aws/aws-sdk-go-v2/service/dynamodb
  dependency-version: 1.72.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/aws/aws-sdk-go-v2/service/sns
  dependency-version: 1.47.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/aws/aws-sdk-go-v2/service/sqs
  dependency-version: 1.52.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/dapr/dapr
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/dapr/go-sdk
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/nats-io/nats.go
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/posthog/posthog-go
  dependency-version: 1.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.64.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/rabbitmq/amqp091-go
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/rabbitmq/rabbitmq-stream-go-client
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/twmb/franz-go
  dependency-version: 1.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: google.golang.org/api
  dependency-version: 0.288.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: google.golang.org/grpc
  dependency-version: 1.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: k8s.io/client-go
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: modernc.org/sqlite
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants