chore(deps): bump the go-runtime group across 1 directory with 12 updates by dependabot[bot] · Pull Request #332 · ArdurAI/sith

dependabot · 2026-09-14T14:09:13Z

Bumps the go-runtime group with 11 updates in the / directory:

Package	From	To
charm.land/bubbletea/v2	`2.0.8`	`2.0.9`
github.com/jackc/pgx/v5	`5.10.0`	`5.11.0`
github.com/modelcontextprotocol/go-sdk	`1.6.1`	`1.8.0`
github.com/prometheus/client_golang	`1.24.0`	`1.24.1`
github.com/wailsapp/wails/v2	`2.13.0`	`2.15.0`
go.yaml.in/yaml/v3	`3.0.4`	`3.0.5`
golang.org/x/sys	`0.47.0`	`0.48.0`
golang.org/x/term	`0.45.0`	`0.46.0`
google.golang.org/grpc	`1.82.1`	`1.83.2`
k8s.io/apimachinery	`0.36.2`	`0.37.0`
k8s.io/client-go	`0.36.2`	`0.37.0`

Updates charm.land/bubbletea/v2 from 2.0.8 to 2.0.9

Release notes

Sourced from charm.land/bubbletea/v2's releases.

v2.0.9

Small patches 🩹

Keybinds missing!

MouseButton11 and media record buttons were improperly handled, now fixed! (thanks to @Ricardo-M-L and @bunlongheng)

Weird UI artifacts with some terminals 👽

Sometimes, when switching between tabs in your terminal for example, the screen would not clear, now fixed!

... And some small corrections to docs!

Happy coding 🤖

Changelog

Fixed

dc4b01750c5262f511164148e24de2cc7aabff47: fix(key): map media record to ultraviolet code (#1757) (@Ricardo-M-L)

1862dfba1151de8f583b598d2ed1cfedf3f5b405: fix: assign MouseButton11 = uv.MouseButton11 (#1754) (@bunlongheng)

930e18c9668417db1908c7a694ee49676116b46e: fix: don't panic in ProgressBarState.String() for out-of-range values (#1748) (@ankit090701)

faf4dcf54a92bab2fe3bf6f4715adf44f2fc245d: fix: pendingErase in cursedRenderer (#1755) (@andrinoff)

0d3e281d1436499b40df085a352bb81b3c9de7d0: fix: restore kitty keyboard stack on exit (#1750) (@deepakganesh78)

0ef9fc90dcb665e6ecfb160fa2b3fb4652b9b04c: fix: typo in doc (#1756) (@andrinoff)

Docs

d40db141fa4dc3644d116fcea819e1b94ea15b19: docs: fix background color detection example in doc comment (@meowgorithm)

882727b7304802aebf4513bde83a2d7751c81687: docs: fix links to tutorials & examples (#1645) (@mhdna)

Other stuff

708ee757a83cec3dcff684f7d9837479ec567ef1: ci: fix examples workflow (#1734) (@kobihikri)

351d2159f8d8a85613aa2a6e98c8c63df3c98623: ci: sync dependabot config (#1763) (@charmcli)

6fb1f47b6c7b598835f5d56597877f10cb980e9e: examples/sequence: fix milisecond typo in SleepPrintln (@makoto-developer)

73b6d91ac1c3854dd4af046ab5f9e51d3b3b4290: v2.0.9 (@andrinoff)

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

Commits

73b6d91 v2.0.9
0d3e281 fix: restore kitty keyboard stack on exit (#1750)
930e18c fix: don't panic in ProgressBarState.String() for out-of-range values (#1748)
faf4dcf fix: pendingErase in cursedRenderer (#1755)
351d215 ci: sync dependabot config (#1763)
dc4b017 fix(key): map media record to ultraviolet code (#1757)
708ee75 ci: fix examples workflow (#1734)
1862dfb fix: assign MouseButton11 = uv.MouseButton11 (#1754)
0ef9fc9 fix: typo in doc (#1756)
af9a33e chore: remove deprecated windows note (#1695)
Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0

Release notes

Sourced from github.com/jackc/pgx/v5's releases.

v5.11.0

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.

Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.

pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)

pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)

pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.

timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.

Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.

time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.

Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

Behavior changes:

date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.

All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range

... (truncated)

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.11.0 (September 7, 2026)

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.

Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.

pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)

pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)

pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.

timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.

Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.

time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.

Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

Behavior changes:

date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.

All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the

... (truncated)

Commits

5e583fa Update changelog for v5.11.0
3927116 Apply gofumpt formatting required by lint
eb07165 Quote filesystem paths in development connection strings
cf5938f Allow unsigned digit counts in binary numeric encoding
3930cf5 Accept PostgreSQL POSIX timezone offsets in text timestamps
93261be Prefer exact db tag matches when mapping rows to structs
e8d8ad1 Merge pull request #2647 from sueun-dev/fix-range-text-quoting-20260906
01d2fd3 Merge pull request #2644 from eliranbz/fix-failed-prepare-deallocation
9b7e3be Merge pull request #2645 from ash2k/move-channel
76d78f5 Merge pull request #2643 from AshSgDe29071999/fix/hstore-pairs-estimate-clamp
Additional commits viewable in compare view

Updates github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.8.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.8.0

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

internal/json: json nesting depth check by @yarolegovich (#1200)

mcp: add an sse event size cap by @yarolegovich (#1205)

mcp: add a max request body size of the old transport by @yarolegovich (#1224)

oauthex: bound dcr read to 1mb by @yarolegovich (#1206)

oauthex: oauth discovery checks by @yarolegovich (#1220)

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction. Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

mcp: allow restricting the protocol versions a server supports by @guglielmo-san (#1199)

mcp: return json-rpc error on stateful server serving protocolVersion20260728 requests by @guglielmo-san (#1143)

mcp: limit SSE discover supportedVersions to SSE-defined revisions by @arimu1 (#1121)

mcp: prefer the negotiated protocol version over the request context by @gwyszynski-sa (#1163)

mcp: export ClientSessionOptions.ProtocolVersion by @arimu1 (#1127)

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

mcp: allow per request Cacheable customization by @guglielmo-san (#1203)

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #1143.

blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #1151.

Options below were removed, according to plan:

seterroroverwrite

enableoriginverification

disablecontenttypecheck

... (truncated)

Commits

3f3b699 refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1...
830f0b7 mcp: update conformance tests (#1231)
12cbafe oauthex: oauth discovery checks (#1220)
3632967 mcp: add an sse event size cap (#1205)
0d3036f mcp: allow per request Cacheable customization (#1203)
cb0de64 mcp: add a max request body size of the old transport (#1224)
2fdabde mcp: do not check metatada on notifications (#1215)
59185e6 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#1217)
a6764cf build(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#1218)
8227246 fix: only subscribe when server advertises capability (#1221)
Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.24.0 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Commits

d6087ee release: cut v1.24.1 (#2076)
See full diff in compare view

Updates github.com/wailsapp/wails/v2 from 2.13.0 to 2.15.0

Release notes

Sourced from github.com/wailsapp/wails/v2's releases.

Wails v2.14.0

Installation
go install github.com/wailsapp/wails/v2/cmd/wails@v2.14.0
Changes

Fixed

Fixed nil pointer crash and swallowed network error when downloading the WebView2 bootstrapper, which made the app exit instead of showing the installation error dialog by @jannskiee

Commits

713dc89 release: v2.15.0
fbdbd50 chore: update sponsors.svg and contributors.svg [skip ci]
9b3cd78 chore(v3): bump to v3.0.0-beta.9 and update changelog
9c1edf2 chore(changelog): auto-add entry for PR #5988 — docs: document custom JSON ma...
b5e33bb docs: document custom JSON marshalling gotcha (#5988)
9079e60 test(v3): remove stream name-limit handler race (#5958)
2c7113d chore(changelog): auto-add entry for PR #5987 — Support rpm-ostree installs o...
9e280ba Support rpm-ostree installs on atomic Linux systems (#5987)
1196be0 Add secure Wails project MCP server (#5896)
25fc198 fix(v3): cancel aborted Apple asset requests (#5969)
Additional commits viewable in compare view

Updates go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5

Commits

e16c7af Remove empty go.sum file
6abcd01 Fix unhandled nil-errors in tests
9481db7 Remove suite_test.go and gopkg.in/check.v1
485f5fc Use standard testing library for limit_test.go
3e00046 Use standard testing library for node_test.go
f612058 Use standard testing library for decode_test.go
078f958 Use standard testing library encode_test.go
3847ac0 [v3] backport CodeQL workflow
1666663 Revert incorrect gofmt changes
73290cb Retract v3 tags that cannot be installed
See full diff in compare view

Updates golang.org/x/sys from 0.47.0 to 0.48.0

Commits

613e257 cpu: add riscv64 hwprobe drift test
6f7b10f unix: add MLOCK_ONFAULT constant
663e7c8 cpu: add basic support for GOARCH=sparc64
de5f12f cpu: add ppc64le POWER10 detection
80e8acf unix: run go fix
1e3c182 unix: add IPMI interface
d429e20 unix: stop generating sparc termbits from the generic header
bd3bddf unix: add missing HWTSTAMP_* constants
e812f53 windows: add SO_SNDTIMEO constant for socket options
f6989c5 unix: align Ifreq so its union accessors cannot fault
Additional commits viewable in compare view

Updates golang.org/x/term from 0.45.0 to 0.46.0

Commits

6226200 go.mod: update golang.org/x dependencies
7c2fb74 term: process bytes returned with a read error
3963fce all: upgrade go directive to at least 1.26.0 [generated]
See full diff in compare view

Updates google.golang.org/grpc from 1.82.1 to 1.83.2

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.2

Security

server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)

Special Thanks: @winklemad

Release 1.83.1

Security

xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)

Special Thanks: @nvxbug

xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)

Special Thanks: @nvxbug

xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)

Special Thanks: @alimony

xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)

Special Thanks: @alimony

xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)

Special Thanks: @alimony

Performance

transport: Restrict memory overhead of buffering small data frames. (#9331)

Release 1.83.0

Security

server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.

xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.

xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.

xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.

xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

New Features

xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)

xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)

authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)

Special Thanks: @hnefatl

xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.

This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)

xds: Add support for xDS-based HTTP CONNECT proxies.

This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)

xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)

grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)

Special Thanks: @Yusufihsangorgel

... (truncated)

Commits

030ee8b Update version to 1.83.2 (#9375)
8668b69 cherry-pick #9365 to v1.83.x (#9366)
a3e952d cherry-pick #9346 to v1.83.x and update x/net dependency (#9369)
58f8fd9 Change version to 1.83.2-dev (#9337)
1550d9e Change version to 1.83.1 (#9336)
ebba6f3 Cherry-pick #9258 and #9332 into v1.83.x (#9335)
8cfeca0 Cherry-pick #9331 to v1.83.x (#9333)
dec6951 Change version to 1.83.1-dev (#9229)
4c226da Change version to 1.83.0 (#9228)
c198988 Cherrypick 9223 into v1.83.x (#9279)
Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.36.2 to 0.37.0

Commits

7164e39 Update dependencies to v0.37.0 tag
e55f9ba feat(api): Update node restriction admission to use new API
cb0680d Merge pull request #129125 from pohly/log-client-go-tools-apis
97b2132 Merge pull request #140194 from gnufied/implement-volume-health-api
f21afab Add validation for camelcase in reason field
d7ad413 Merge pull request #140782 from dims/update-kube-openapi
e15ad7c Merge pull request #138808 from chenk008/cbor-streaminglist
464b5d1 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
0de14ec Merge pull request #140732 from thockin/dv-add-prefixed-label-key
95258eb Merge pull request #134037 from ibihim/ibihim/2025-09-09_unsafe-delete-of-cor...
Additional commits viewable in compare view

Updates k8s.io/client-go from 0.36.2 to 0.37.0

Commits

2807644 Update dependencies to v0.37.0 tag
50c6f9b metrics: Register: Fix incorrect assignment
49f0a7b Merge pull request #140931 from pohly/client-go-changelog-adding-apigroups
74d4b1e Merge pull request #140966 from alancaldelas/client-go-fakecustomstore-store
2bf14f2 Merge pull request #140990 from xigang/revert-140448
7b892fe Revert "Merge pull request #140448 from xigang/event_broadcaster_goroutine_leak"
df92378 Merge pull request #140334 from nojnhuh/dra-workloadresourceclaims-beta
45a0ff1 client-go: restore FakeCustomStore conformance to cache.Store
9d3b531 Merge pull request #139795 from omeryahud/worktree-kep-5963-device-compat-groups
694f4eb apidiff: ignore adding entirely new API groups
Additional commits viewable in compare view

Updates k8s.io/streaming from 0.36.2 to 0.37.0

Commits

cdd8da2 bump github.com/google/cadvisor/lib from v0.60.3 to v0.60.4
68009e8 Merge pull request #140021 from dims/conntrack-cpuset
bed9c7d kube-proxy: detect host CPU count via cpuset.NumCPU instead of cadvisor
0a84e25 Merge pull request #139420 from dims/update-x-net-deps
9ef12fe Bump golang.org/x/net to HEAD for http2 go1.27 wrap fixes
f00c6a5 Merge pull request #139258 from dims/update-x-net-deps
a1f0619 Bump golang.org/x/net from v0.54.0 to v0.55.0
2d09b61 Merge pull request #139248 from dims/bump-golang.org/x/crypto-to-v0.52.0
eb30797 Bump golang.org/x/crypto to v0.52.0
99242c8 Merge pull request #138561 from dims/update-xnet-dep
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ates Bumps the go-runtime group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [charm.land/bubbletea/v2](https://github.com/charmbracelet/bubbletea) | `2.0.8` | `2.0.9` | | [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.10.0` | `5.11.0` | | [github.com/modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) | `1.6.1` | `1.8.0` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.0` | `1.24.1` | | [github.com/wailsapp/wails/v2](https://github.com/wailsapp/wails) | `2.13.0` | `2.15.0` | | [go.yaml.in/yaml/v3](https://github.com/yaml/go-yaml) | `3.0.4` | `3.0.5` | | [golang.org/x/sys](https://github.com/golang/sys) | `0.47.0` | `0.48.0` | | [golang.org/x/term](https://github.com/golang/term) | `0.45.0` | `0.46.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.82.1` | `1.83.2` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.36.2` | `0.37.0` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.2` | `0.37.0` | Updates `charm.land/bubbletea/v2` from 2.0.8 to 2.0.9 - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Commits](charmbracelet/bubbletea@v2.0.8...v2.0.9) Updates `github.com/jackc/pgx/v5` from 5.10.0 to 5.11.0 - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.10.0...v5.11.0) Updates `github.com/modelcontextprotocol/go-sdk` from 1.6.1 to 1.8.0 - [Release notes](https://github.com/modelcontextprotocol/go-sdk/releases) - [Commits](modelcontextprotocol/go-sdk@v1.6.1...v1.8.0) Updates `github.com/prometheus/client_golang` from 1.24.0 to 1.24.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.24.0...v1.24.1) Updates `github.com/wailsapp/wails/v2` from 2.13.0 to 2.15.0 - [Release notes](https://github.com/wailsapp/wails/releases) - [Commits](wailsapp/wails@v2.13.0...v2.15.0) Updates `go.yaml.in/yaml/v3` from 3.0.4 to 3.0.5 - [Commits](yaml/go-yaml@v3.0.4...v3.0.5) Updates `golang.org/x/sys` from 0.47.0 to 0.48.0 - [Commits](golang/sys@v0.47.0...v0.48.0) Updates `golang.org/x/term` from 0.45.0 to 0.46.0 - [Commits](golang/term@v0.45.0...v0.46.0) Updates `google.golang.org/grpc` from 1.82.1 to 1.83.2 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.82.1...v1.83.2) Updates `k8s.io/apimachinery` from 0.36.2 to 0.37.0 - [Commits](kubernetes/apimachinery@v0.36.2...v0.37.0) Updates `k8s.io/client-go` from 0.36.2 to 0.37.0 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.36.2...v0.37.0) Updates `k8s.io/streaming` from 0.36.2 to 0.37.0 - [Commits](kubernetes/streaming@v0.36.2...v0.37.0) --- updated-dependencies: - dependency-name: charm.land/bubbletea/v2 dependency-version: 2.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-runtime - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: github.com/modelcontextprotocol/go-sdk dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-runtime - dependency-name: github.com/wailsapp/wails/v2 dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: go.yaml.in/yaml/v3 dependency-version: 3.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-runtime - dependency-name: golang.org/x/sys dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: golang.org/x/term dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: google.golang.org/grpc dependency-version: 1.83.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: k8s.io/apimachinery dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: k8s.io/client-go dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: k8s.io/streaming dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-09-14T14:09:20Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 27510ac6-843c-49d3-8ffc-91fb27c0c01a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot · 2026-09-28T14:08:35Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 14, 2026

dependabot Bot closed this Sep 28, 2026

dependabot Bot deleted the dependabot/go_modules/dev/go-runtime-9e621053c9 branch September 28, 2026 14:08

Navigation Menu

Repository navigation

chore(deps): bump the go-runtime group across 1 directory with 12 updates - #332

chore(deps): bump the go-runtime group across 1 directory with 12 updates#332
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/go_modules/dev/go-runtime-9e621053c9

dependabot Bot commented on behalf of github Sep 14, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 14, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Sep 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.0.9

Small patches 🩹

Keybinds missing!

Weird UI artifacts with some terminals 👽

Changelog

Fixed

Docs

Other stuff

v5.11.0

Features

Changes

5.11.0 (September 7, 2026)

Features

Changes

v1.8.0

Hardening against resource exhaustion

Restricting the protocol versions a server supports

Per-request cache control

Behavior changes guarded by MCPGODEBUG

v1.24.1 / 2026-07-23

What's Changed

1.24.1 / 2026-07-23

Wails v2.14.0

Installation

Changes

Fixed

Release 1.83.2

Security

Release 1.83.1

Security

Performance

Release 1.83.0

Security

New Features

Bug Fixes

Uh oh!

coderabbitai Bot commented Sep 14, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Sep 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 14, 2026 •

edited

Loading