Repository navigation
fix(deps): update weekly dependencies - #1995
Conversation
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by Details:
File name: tools/demo-metrics/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by Details:
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
| Layer / File(s) | Summary |
|---|---|
GitHub Actions pins .github/workflows/*, action.yml |
Workflows and action metadata update pinned versions of setup-node, upload-artifact, download-artifact, and Scorecard actions. |
Application Go dependencies go.mod |
The module updates Sentry, go-jose, Prometheus, go-spiffe, and golang.org/x dependencies, including indirect Prometheus dependencies. |
Verifier dependencies sdk/conformance/pyverify-requirements.txt, sdk/verifiers/python/requirements.txt, sdk/verifiers/rust/Cargo.toml, sdk/verifiers/ts/package.json |
Python pins and hashes change for cryptography and pycparser. Rust dependency pins and TypeScript development dependencies are also updated. |
Demo metrics dependencies tools/demo-metrics/go.mod |
The Go version requirement and Prometheus-related dependency versions are updated. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Other
Merge Risk: 
357ab
-
No actionable merge-blocking issue is established; the update is ready for normal validation.
Architecture risk: 
357ab
-
The change affects 4 systems.
Changed systems:
sdk,action.yml,go.mod,toolsArchitecture concerns
No architecture-level concerns identified.Review details
-
Systems and components
- observed — sdk (service) was modified; 4 changed files map to changed impact.
- observed — action.yml (service) was modified; 1 changed file maps to changed impact.
- observed — go.mod (service) was modified; 1 changed file maps to changed impact.
- observed — tools (service) was modified; 1 changed file maps to changed impact.
Before / after behavior
- observed — Modified behavior in action.yml: The audit report upload step now uses
actions/upload-artifactpinned to commitcf430e030ddbb5b0abf93d22962f4752f3646cd9(v7.0.2) instead of the v7.0.1 commit. - observed — Modified behavior in go.mod: Updated the versions of Sentry (0.49.0 → 0.50.0), go-jose (4.1.5 → 4.1.6), Prometheus client_golang (1.24.1 → 1.25.0), go-spiffe (2.8.2 → 2.9.0), and
golang.org/x/crypto(0.57.0 → 0.58.0),x/net(0.60.0 → 0.61.0),x/sys(0.48.0 → 0.49.0), andx/text(0.42.0 → 0.43.0). - observed — Modified behavior in go.mod: Updated indirect Prometheus common from 0.70.1 to 0.72.0 and procfs from 0.21.1 to 0.22.0.
- observed — Modified behavior in sdk/conformance/pyverify-requirements.txt: The pinned
cryptographyversion changes from50.0.1to50.0.2, and its SHA-256 hashes are replaced. Its dependency annotation changes frompyverify-requirements.intocryptography.
-
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title "fix(deps): update weekly dependencies" matches the PR's stated intent. The changeset updates many dependencies across Go, Python, Rust, TypeScript, and GitHub Actions. The title is conventi… Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title "fix(deps): update weekly dependencies" matches the PR's stated intent. The changeset updates many dependencies across Go, Python, Rust, TypeScript, and GitHub Actions. The title is conventional-commit style and specific enough to convey the primary change. It does not name the most significant updates, such as go-jose, prometheus/client_golang, or sentry-go, but it does not need to list every detail.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (15 skipped: 15 unsupported.)
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
357abf4 to
7b5e72f
Compare
7b5e72f to
d535dd9
Compare
Handle shutdown errors and avoid shadowing builtins under the updated linter. Refresh artifact-action assertions to match the new pins. Advance the shared verifier package version to 0.6.8 because its dependency inputs changed, keeping publication pending in the installer inventory.
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
|
/review |
|
@coderabbitai review |
|
|
Completed Reviewer source Declared exclusions: Review depth: Scope: Models used: Reported token usage: |
Diff review 🔍
Reviewed base Reviewer source Declared exclusions: Review depth: Scope: |
|
/review |
|
@coderabbitai review |
|
|
Diff review started for base Reviewer source Declared exclusions: Review depth: |
|
/review |
|
Completed Reviewer source Declared exclusions: Review depth: Scope: Models used: Reported token usage: |
Diff review 🔍
Reviewed base Reviewer source Declared exclusions: Review depth: Scope: |
|
/review |
|
Completed Reviewer source Declared exclusions: Review depth: Scope: Models used: Reported token usage: |
Diff review 🔍
Reviewed base Reviewer source Declared exclusions: Review depth: Scope: |
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
24.19.1→24.19.2v8.0.1→v8.0.2v7.0.0→v7.1.0v7.0.1→v7.0.2==50.0.1→==50.0.2v0.49.0→v0.50.0v4.1.5→v4.1.6v1.24.1→v1.25.0v2.8.2→v2.9.0v0.57.0→v0.58.0v0.60.0→v0.61.0v0.48.0→v0.49.0v0.42.0→v0.43.0v2.14.0→v2.15.0=0.2.15→=0.3.0=0.2.189→=0.2.1900.2.191v2.4.4→v2.5.03.9.9→3.9.10==3.0→==3.113.12=1.0.151→=1.0.154=0.11.0→=0.11.1Release Notes
actions/download-artifact
v8.0.2Compare Source
What's Changed
New Contributors
Full Changelog: actions/download-artifact@v8.0.1...v8.0.2
actions/setup-node
v7.1.0Compare Source
What's Changed
Enhancements:
Bug fixes:
Documentation updates:
Dependency updates:
New Contributors
Full Changelog: actions/setup-node@v7.0.0...v7.1.0
actions/upload-artifact
v7.0.2Compare Source
What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2
pyca/cryptography (cryptography)
v50.0.2Compare Source
getsentry/sentry-go (github.com/getsentry/sentry-go)
v0.50.0: 0.50.0Compare Source
Breaking Changes 🛠
client.IsEnabled. by @giortzisg in #1365New Features ✨
Crons
sentry.WithMonitorandHub.WithMonitorto wrap a job in cron check-ins and create or update the monitor from code. by @wedamija in #1443sentrycron.AddFuncto report robfig/cron jobs to Sentry Crons, using the job's spec as the monitor schedule. by @wedamija in #1443Bug Fixes 🐛
Internal Changes 🔧
Deps
4013fc6to36c7292by @dependabot in #1442go-jose/go-jose (github.com/go-jose/go-jose/v4)
v4.1.6Compare Source
Fixed Security Issues
This release contains a fix for GHSA-mgcc-cww5-fp2q
Breaking Changes
The fix for GHSA-mgcc-cww5-fp2q involves capping the size of the RSA modulus of keys accepted by JWK parsing. This limit is 4096 bits. If you need this to be higher, set
MaxRSAModulusBitsbefore performing any JWK parsing.Changed
Full Changelog: go-jose/go-jose@v4.1.5...v4.1.6
prometheus/client_golang (github.com/prometheus/client_golang)
v1.25.0Compare Source
api/prometheus/v1(see the [CHANGE] entries below).1.25.0 / 2026-10-07
Query,QueryRange,Series,LabelNames, andLabelValuesnow returnInfosannotations in addition toWarnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and ofapi.Client'sDo/DoGetFallback; custom API client implementations must be updated. #1963TSDBBlocksresult types to align with the Prometheus server'stsdb.BlockMeta:TSDBBlocksResultnow containsBlocks []TSDBBlockMetadirectly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta,TSDBBlockStats,TSDBBlockMetaCompaction), stat fields areuint64withomitemptytags, and the optional compactionparentsfield is included. #1928GatherAndFormatto encode a subset of metrics from a Gatherer. #2091HandlerOpts.AcceptedFormatsto customize the formats negotiated from the incomingAcceptheader, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146Varyheader. #2142GatherAndFormatandCollectAndFormat(terminating# EOF). #2125:fooargument no longer substitutes inside:foobar. #2136What's changed
What's Changed
New Contributors
Full Changelog: prometheus/client_golang@v1.24.1...v1.25.0
spiffe/go-spiffe (github.com/spiffe/go-spiffe/v2)
v2.9.0Compare Source
Added
spiffeid.MatchIDPrefixmatcher andtlsconfig.AuthorizeIDPrefixauthorizer, which accept any SPIFFE ID in the same trust domain whose path matches the given prefix's path or extends it on a segment boundary. The prefix must have a nonempty path, otherwise no ID matches (#406)Changed
PeerIDon connections returned byspiffetls, andspiffetls.PeerIDFromConn, now complete the TLS handshake if needed, so the peer ID can be retrieved before the first read. When the handshake is still pending, the call performs I/O like aReadwould and honors the connection deadlines (#422)golangci/golangci-lint
v2.15.0Compare Source
Released on 2026-10-16
errcheck: from 1.20.0 to 1.30.0exhaustive: from 0.13.0 to 0.15.0 (gocognit: from 1.2.1 to 1.3.0golines: from 0.15.0 to 0.16.0govet-modernize: from 0.50.0 to 0.52.0loggercheck: from 0.12.0 to 0.13.0predeclared: from 0.2.2 to 0.3.0wrapcheck: from 2.12.0 to 2.13.0bidichk: from 0.3.3 to 0.3.4canonicalheader: froma25c71ctoe18e5c5gofumpt: improve deprecation logsgosec: improve concurrency default valueiface: from 1.5.1 to 1.5.3paralleltest: from 1.0.15 to 1.0.16revive: from 1.17.0 to 1.17.1revive: the rulescontext-keys-type,errorf,modifies-value-receiver,range-val-address,string-of-int,time-equal,time-naming,unexported-return,unhandled-error,var-declarationare working (less randomly).rowserrcheck: fromc5f79b8toe0740d5staticcheck: from 0.8.1 to 0.8.2revive)exhaustivelinter:explicit-exhaustive-switchandexplicit-exhaustive-maphave been replaced byexplicit-exhaustive.checkthe valuemaphas been replaced bymapliteral.ignore-enum-members(string) has been replaced byignore-constants(slice).ignore-enum-types(string) has been replaced byignore-types(slice).magiclen/html-escape (html-escape)
v0.3.0Compare Source
rust-lang/libc (libc)
v0.2.190Compare Source
There is now a single config for enabling 64-bit
time_t:libc_unstable_time64. This can be setunconditionally; it opts in to 64-bit
time_ton the following platforms that use 32-bit bydefault:
musl v1.2.
Most other 32-bit platforms are either already using 64-bit
time_t, or are considered legacyand will not be gaining support from their upstream maintainers.
You can enable this using
RUSTFLAGS:RUSTFLAGS='--cfg=libc_unstable_time64' cargo ...Note that there may still be some changes to features gated by this config option, hence "unstable"
in its name. In the near future we will rename it to just
libc_time64. Until then, please test itout and report any bugs you find!
Support
Added
We are slowly filling out the
Defaultimplementations, to reduce the need formem::zeroed()in user code:Defaultfor a number of structs, especially on Apple platforms (#5576)statvfsaDefaultimpl (#5583)Defaultto alinux/can.rsstructs (#5257)Other additions:
libc_unstable_time64cfg (#5411)pthread_gettid_np(#5359)RTLD_NEXT(#5323)NET_RT_DUMP2(#5442)posix_spawn_file_actions_add(f)chdir(_np)(#5558)BPF_WORDALIGN(#5320)lchmodandlchflagswhere supported (#5400)minheritand related constants (#4849)AT_RENAME_*andRENAME_*constants (#5560)renameat2(#5563)rt_msghdrandrt_metrics(#5367)libc_unstable_gnu_time_bits(#5242)environ(#5339)f_typefield tostatvfsandstatvfs64(#5434)STATX_*constants (#5412)SIGEV_THREAD_ID(#5375)*_SUPER_MAGICconstants (#5453)statxalways available (#5448)max_align_t(#5389)BCACHEFS_SUPER_MAGIC(#5516)ETH_P_LLDP(#5438)FUTEX_ROBUST_UNLOCKandFUTEX_ROBUST_LIST32(#5525)NLMSG_*helpers (#5321)siginfo_tand add more getter functions (#5345)SYS_futex_waitv(#5527)__errno(#5346)RTLD_NODELETEandRTLD_NOLOAD(#5377)getexecpath(#5465)sensors.h(#5510)HW_*sysctl constants (#5371)FILENAME_MAX(#5530)clock_settimeandpause(#5363)getrandombindings (#5333)group_req/group_source_reqandMCAST_*where supported (#5236)HOST_NAME_MAX(#5531)_PATH_BSHELLand_PATH_DEFPATHwhere available (#5449)SOCK_CLOEXEC(#5336)time_ton 32-bit platforms via cfg (#5261)Deprecated
_kernel_simple_lock(#5380)*_MIN/*_MAXin favor of e.g.c_int::MAX(#5404)fallocate64, which does not exist on the platform (#5242)glob64types and routines (#5242)syscall,mincore, andKERN_NSELCOLL, all of which have been removed upstream (87992e9895c2)tmpnam,tempnam(#5478)Fixed
BPF_ALIGNMENTtosize_tto match upstream and harmonize with other platforms. (#5373)BPF_ALIGNMENTtosize_tto match upstream and harmonize with other platforms. (#5348)fileops_t.fo_select(#5380)file(#5380)ucontext_t(#5189)O_flags (#5554)mcontext_tanducontext_tand make them usable on more platforms (#5127)glob_tandstatvfs(#5127)sigeventand correct the layout of otherpthread.htypes (#5127)sem_t(#5351)statvfs64on 32-bit RISC-V (#5518)ipc_perm(#5527)uc_flagsfield inucontext_t(#5527)WIFSTOPPED(#5458)time_talias. This is a correction on Arm32 RTEMS (#5132)O_open flags (#5414)socket.hdefinitions (#5313)signal.htypes (#5436)Changed
libc_unstable_musl_v1_2_3has been renamed to a more accuratelibc_unstable_musl_v1_2. The old version will continue to work for now, but will be removed in1-2 releases. (#5376)
unsafe(#5380)POSIX_SPAWN_*flags toc_short(#5572)FD_*functions (#5528)__riscv_mc_q_ext_state.__reservedand make it private (#5533)statfields non-pub(#5542)Removed
libcexposed quite a bit of API on all Apple platforms that is not actually available anywhere other than MacOS. This release removes a number of these cases.mach.hAPI on Apple mobile OSs (e6bfb187513c)exec*andforkcalls from tvOS and watchOS (#5158)Additionally, this release cleans up a lot of API that has been deprecated since at least libc 0.2.100, released 2021-08-20.
af_alg_ivtrait implementations. The have been deprecated for a long time because they allowed out-of-bounds reads via safe functions. (444db4456f38)Other removed items:
INHERIT_ZEROthat does not exist upstream (#5587)REG_*definitions (#5527)REG_NARGS(#5527)A huge thank you to our GSoC student Adam Martinez ([@dybucc](https://redirect.github.c
Configuration
📅 Schedule: (UTC)
* * * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.