chore(deps): bump the go-runtime group across 1 directory with 13 updates by dependabot[bot] · Pull Request #334 · ArdurAI/sith

dependabot · 2026-09-28T14:09:11Z

Bumps the go-runtime group with 13 updates in the / directory:

Package	From	To
charm.land/bubbletea/v2	`2.0.8`	`2.0.10`
github.com/jackc/pgx/v5	`5.10.0`	`5.11.0`
github.com/modelcontextprotocol/go-sdk	`1.6.1`	`1.8.0`
github.com/prometheus/client_golang	`1.24.0`	`1.24.1`
github.com/wailsapp/wails/v2	`2.13.0`	`2.16.0`
go.yaml.in/yaml/v3	`3.0.4`	`3.0.5`
golang.org/x/sys	`0.47.0`	`0.48.0`
golang.org/x/term	`0.45.0`	`0.46.0`
google.golang.org/grpc	`1.82.1`	`1.84.0`
k8s.io/apimachinery	`0.36.2`	`0.37.1`
k8s.io/client-go	`0.36.2`	`0.37.1`
k8s.io/streaming	`0.36.2`	`0.37.1`
sigs.k8s.io/apiserver-network-proxy/konnectivity-client	`0.36.0`	`0.37.0`

Updates charm.land/bubbletea/v2 from 2.0.8 to 2.0.10

Release notes

Sourced from charm.land/bubbletea/v2's releases.

v2.0.10

Change to no input programs

This is a small change to programs with no WithInput. Removed capability queries, which resulted in leaking of raw ANSI escape sequences.

Changelog

Fixed

8b10e22689cdaf2c6f7adc70c8fe2241fe0f9404: fix: skip capability queries when input is disabled (#1801) (@drawmeanelephant)

Other stuff

d5bfd5c2ff7480a6b94536c1cf4e73569b8d523e: v2.0.10 (@andrinoff)

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

v2.0.9

Small patches 🩹

Keybinds missing!

MouseButton11 and media record buttons were improperly handled, now fixed! (thanks to @Ricardo-M-L and @bunlongheng)

Weird UI artifacts with some terminals 👽

Sometimes, when switching between tabs in your terminal for example, the screen would not clear, now fixed!

... And some small corrections to docs!

Happy coding 🤖

Changelog

Fixed

dc4b01750c5262f511164148e24de2cc7aabff47: fix(key): map media record to ultraviolet code (#1757) (@Ricardo-M-L)

1862dfba1151de8f583b598d2ed1cfedf3f5b405: fix: assign MouseButton11 = uv.MouseButton11 (#1754) (@bunlongheng)

930e18c9668417db1908c7a694ee49676116b46e: fix: don't panic in ProgressBarState.String() for out-of-range values (#1748) (@ankit090701)

faf4dcf54a92bab2fe3bf6f4715adf44f2fc245d: fix: pendingErase in cursedRenderer (#1755) (@andrinoff)

0d3e281d1436499b40df085a352bb81b3c9de7d0: fix: restore kitty keyboard stack on exit (#1750) (@deepakganesh78)

0ef9fc90dcb665e6ecfb160fa2b3fb4652b9b04c: fix: typo in doc (#1756) (@andrinoff)

Docs

d40db141fa4dc3644d116fcea819e1b94ea15b19: docs: fix background color detection example in doc comment (@meowgorithm)

882727b7304802aebf4513bde83a2d7751c81687: docs: fix links to tutorials & examples (#1645) (@mhdna)

Other stuff

708ee757a83cec3dcff684f7d9837479ec567ef1: ci: fix examples workflow (#1734) (@kobihikri)

351d2159f8d8a85613aa2a6e98c8c63df3c98623: ci: sync dependabot config (#1763) (@charmcli)

6fb1f47b6c7b598835f5d56597877f10cb980e9e: examples/sequence: fix milisecond typo in SleepPrintln (@makoto-developer)

73b6d91ac1c3854dd4af046ab5f9e51d3b3b4290: v2.0.9 (@andrinoff)

... (truncated)

Commits

d5bfd5c v2.0.10
8b10e22 fix: skip capability queries when input is disabled (#1801)
657aaae chore: bump go to 1.26.0 (#1807)
73b6d91 v2.0.9
0d3e281 fix: restore kitty keyboard stack on exit (#1750)
930e18c fix: don't panic in ProgressBarState.String() for out-of-range values (#1748)
faf4dcf fix: pendingErase in cursedRenderer (#1755)
351d215 ci: sync dependabot config (#1763)
dc4b017 fix(key): map media record to ultraviolet code (#1757)
708ee75 ci: fix examples workflow (#1734)
Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0

Release notes

Sourced from github.com/jackc/pgx/v5's releases.

v5.11.0

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.

Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.

pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)

pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)

pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.

timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.

Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.

time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.

Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

Behavior changes:

date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.

All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range

... (truncated)

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.11.0 (September 7, 2026)

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.

Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.

pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)

pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)

pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.

timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.

Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.

time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.

Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

Behavior changes:

date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.

All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the

... (truncated)

Commits

5e583fa Update changelog for v5.11.0
3927116 Apply gofumpt formatting required by lint
eb07165 Quote filesystem paths in development connection strings
cf5938f Allow unsigned digit counts in binary numeric encoding
3930cf5 Accept PostgreSQL POSIX timezone offsets in text timestamps
93261be Prefer exact db tag matches when mapping rows to structs
e8d8ad1 Merge pull request #2647 from sueun-dev/fix-range-text-quoting-20260906
01d2fd3 Merge pull request #2644 from eliranbz/fix-failed-prepare-deallocation
9b7e3be Merge pull request #2645 from ash2k/move-channel
76d78f5 Merge pull request #2643 from AshSgDe29071999/fix/hstore-pairs-estimate-clamp
Additional commits viewable in compare view

Updates github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.8.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.8.0

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

internal/json: json nesting depth check by @yarolegovich (#1200)

mcp: add an sse event size cap by @yarolegovich (#1205)

mcp: add a max request body size of the old transport by @yarolegovich (#1224)

oauthex: bound dcr read to 1mb by @yarolegovich (#1206)

oauthex: oauth discovery checks by @yarolegovich (#1220)

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction. Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

mcp: allow restricting the protocol versions a server supports by @guglielmo-san (#1199)

mcp: return json-rpc error on stateful server serving protocolVersion20260728 requests by @guglielmo-san (#1143)

mcp: limit SSE discover supportedVersions to SSE-defined revisions by @arimu1 (#1121)

mcp: prefer the negotiated protocol version over the request context by @gwyszynski-sa (#1163)

mcp: export ClientSessionOptions.ProtocolVersion by @arimu1 (#1127)

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

mcp: allow per request Cacheable customization by @guglielmo-san (#1203)

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #1143.

blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #1151.

Options below were removed, according to plan:

seterroroverwrite

enableoriginverification

disablecontenttypecheck

... (truncated)

Commits

3f3b699 refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1...
830f0b7 mcp: update conformance tests (#1231)
12cbafe oauthex: oauth discovery checks (#1220)
3632967 mcp: add an sse event size cap (#1205)
0d3036f mcp: allow per request Cacheable customization (#1203)
cb0de64 mcp: add a max request body size of the old transport (#1224)
2fdabde mcp: do not check metatada on notifications (#1215)
59185e6 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#1217)
a6764cf build(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#1218)
8227246 fix: only subscribe when server advertises capability (#1221)
Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.24.0 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Commits

d6087ee release: cut v1.24.1 (#2076)
See full diff in compare view

Updates github.com/wailsapp/wails/v2 from 2.13.0 to 2.16.0

Release notes

Sourced from github.com/wailsapp/wails/v2's releases.

Wails v2.14.0

Installation
go install github.com/wailsapp/wails/v2/cmd/wails@v2.14.0
Changes

Fixed

Fixed nil pointer crash and swallowed network error when downloading the WebView2 bootstrapper, which made the app exit instead of showing the installation error dialog by @jannskiee

Commits

457bf21 release: v2.16.0
110571b chore: update sponsors.svg and contributors.svg [skip ci]
e9e3a8a chore(v3): bump to v3.0.0-beta.21 and update changelog
16ba478 chore(changelog): auto-add entry for PR #6118 — docs: repair credits embeds a...
8d8ce15 docs: repair credits SVG embeds in all languages
43cdbe6 ci: read M-Press route metadata as JSON values
ae61034 chore(changelog): auto-add entry for PR #6116 —
ac1492a ci: build the changelog helper inside its Go module
6be7874 Merge remote-tracking branch 'origin/master' into codex/wails-v3-mpress-current
566c2a5 docs: prepare M-Press production builds and migrate release automation
Additional commits viewable in compare view

Updates go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5

Commits

e16c7af Remove empty go.sum file
6abcd01 Fix unhandled nil-errors in tests
9481db7 Remove suite_test.go and gopkg.in/check.v1
485f5fc Use standard testing library for limit_test.go
3e00046 Use standard testing library for node_test.go
f612058 Use standard testing library for decode_test.go
078f958 Use standard testing library encode_test.go
3847ac0 [v3] backport CodeQL workflow
1666663 Revert incorrect gofmt changes
73290cb Retract v3 tags that cannot be installed
See full diff in compare view

Updates golang.org/x/sys from 0.47.0 to 0.48.0

Commits

613e257 cpu: add riscv64 hwprobe drift test
6f7b10f unix: add MLOCK_ONFAULT constant
663e7c8 cpu: add basic support for GOARCH=sparc64
de5f12f cpu: add ppc64le POWER10 detection
80e8acf unix: run go fix
1e3c182 unix: add IPMI interface
d429e20 unix: stop generating sparc termbits from the generic header
bd3bddf unix: add missing HWTSTAMP_* constants
e812f53 windows: add SO_SNDTIMEO constant for socket options
f6989c5 unix: align Ifreq so its union accessors cannot fault
Additional commits viewable in compare view

Updates golang.org/x/term from 0.45.0 to 0.46.0

Commits

6226200 go.mod: update golang.org/x dependencies
7c2fb74 term: process bytes returned with a read error
3963fce all: upgrade go directive to at least 1.26.0 [generated]
See full diff in compare view

Updates google.golang.org/grpc from 1.82.1 to 1.84.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.84.0

Behavior Changes

stats/otel: The grpc.lb.pick_first.* metrics have been removed and replaced with grpc.subchannel.* metrics. See gRFC A94 for more details. (#9215)

New Features

xds: Add support for contains_match in route header matchers. (#9223)

Special Thanks: @nvxbug

Bug Fixes

client: Fix a bug where a ClientConn could get permanently stuck in IDLE when an RPC was canceled during stream creation. Previously, such cancellations triggered stream cleanup twice, corrupting the channel's idleness state and causing subsequent RPCs to fail with deadline exceeded errors. (#9191)

Special Thanks: @utkuozdemir

client: Fix a bug where non-gRPC HTTP responses ending with an empty DATA frame failed the RPC with status code Internal instead of preserving the HTTP-mapped status code and response body. (#9217)

Special Thanks: @chengxilo

credentials: Validate metadata returned by per-RPC credentials, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from credentials was sent to the server in outgoing HTTP/2 requests. (#9202)

Special Thanks: @buger

credentials/sts: Prevent potential token leakage by disallowing HTTP redirects during STS token exchange. Previously, 3xx redirects were followed automatically, replaying the request body containing authentication tokens to the redirect destination. (#9299)

Special Thanks: @nvxbug

randomsubsetting: Ignore endpoints that contain no addresses. Previously, this could cause the policy to panic while computing hashes. (#9259)

Special Thanks: @fallintoplace

stats/otel: Ensure method names are populated in trace spans when metrics are disabled. Previously, running with tracing enabled and metrics disabled resulted in server trace spans lacking the RPC method name (recording only "Recv."). (#9262)

transport: Return io.ErrUnexpectedEOF when EOF is encountered after partial header or message body reads. Previously, partial reads could return a plain io.EOF, failing to distinguish truncated data from a clean end of stream. (#9204)

Special Thanks: @buger

transport: Validate metadata supplied by balancers (in PickResult.Metadata) and resolver addresses, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from these sources was sent to the server in outgoing HTTP/2 requests. (#9203)

Special Thanks: @buger

xds: Fix a rare corner case that could prevent a cluster from being removed when it is no longer in use. (#9140)

xds: Fix panic during route matching for routes containing header matchers with empty exact_match strings. (#9223)

Special Thanks: @nvxbug

xds: Reject routes containing header matchers with empty prefix_match or suffix_match strings. Previously, this caused a panic during route matching. (#9223)

Special Thanks: @nvxbug

xds: Fix EDS drop policies being applied at a much lower rate than configured due to an integer overflow. (#9257)

Special Thanks: @nvxbug

xds: Reject EDS resources containing drop policies with unsupported denominators. Previously, such resources caused the client to panic when calculating drop rates. (#9218)

Special Thanks: @nvxbug

xds/rbac: Reject RBAC configurations containing nested Principal or Permission rules with :scheme or grpc- prefixed header matchers. Previously, such configurations could cause DENY policies to fail open. (#9258)

Special Thanks: @nvxbug

xds/rbac: Rewrite host header matchers to :authority in nested Principal and Permission rules. Previously, this rewrite only applied to top-level rules, causing nested host matchers to never match incoming requests and DENY policies to fail open. (#9258)

Special Thanks: @nvxbug

xds/rbac: Reject CidrRanges with an unset prefix length. Previously, an omitted prefix_len field caused a panic during RBAC configuration parsing. (#9250)

Special Thanks: @nvxbug

Performance Improvements

transport: Avoid a heap allocation when flushing shared write buffers. (#9233)

Special Thanks: @zaidoon1

credentials/alts: Support dynamic frame size negotiation and add the GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE environment variable (default 4KiB, max 512KiB) to configure the maximum ALTS record frame size. (#9268)

Release 1.83.2

... (truncated)

Commits

e84aa5a Change version to 1.84.0 (#9324)
c5ae88d Cherrypick #9204 and #9321 to v1.84.x (#9407)
a592f6a Cherrypick #9351 and #9404 to v1.84.x (#9408)
d5a4111 cherry-pick #9365 to v1.84.x (#9370)
89d55e0 cherry-pick #9346 to v1.84.x (#9372)
8a9f866 Cherry-pick #9332 to v1.84.x (#9338)
f8b54e7 Cherry-pick #9331 to v1.84.x (#9334)
30ce1d5 xds: support injecting bootstrap and server config into HTTP filter config pa...
54c743e extproc : wait for async RPC to complete in test (#9311)
538bb2f endpointsharding: decouple locking, and simplify ChildState API (#9290)
Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.36.2 to 0.37.1

Commits

e3a4b17 Update dependencies to v0.37.1 tag
e55f9ba feat(api): Update node restriction admission to use new API
cb0680d Merge pull request #129125 from pohly/log-client-go-tools-apis
97b2132 Merge pull request #140194 from gnufied/implement-volume-health-api
f21afab Add validation for camelcase in reason field
d7ad413 Merge pull request #140782 from dims/update-kube-openapi
e15ad7c Merge pull request #138808 from chenk008/cbor-streaminglist
464b5d1 Update k8s.io/kube-openapi to v0.0.0-20260721132016-d427ff9ee9ad
0de14ec Merge pull request #140732 from thockin/dv-add-prefixed-label-key
95258eb Merge pull request #134037 from ibihim/ibihim/2025-09-09_unsafe-delete-of-cor...
Additional commits viewable in compare view

Updates k8s.io/client-go from 0.36.2 to 0.37.1

Commits

066ed4e Update dependencies to v0.37.1 tag
50c6f9b metrics: Register: Fix incorrect assignment
49f0a7b Merge pull request #140931 from pohly/client-go-changelog-adding-apigroups
74d4b1e Merge pull request #140966 from alancaldelas/client-go-fakecustomstore-store
2bf14f2 Merge pull request #140990 from xigang/revert-140448
7b892fe Revert "Merge pull request #140448 from xigang/event_broadcaster_goroutine_leak"
df92378 Merge pull request #140334 from nojnhuh/dra-workloadresourceclaims-beta
45a0ff1 client-go: restore FakeCustomStore conformance to cache.Store
9d3b531 Merge pull request #139795 from omeryahud/worktree-kep-5963-device-compat-groups
694f4eb apidiff: ignore adding entirely new API groups
Additional commits viewable in compare view

Updates k8s.io/streaming from 0.36.2 to 0.37.1

Commits

cdd8da2 bump github.com/google/cadvisor/lib from v0.60.3 to v0.60.4
68009e8 Merge pull request #140021 from dims/conntrack-cpuset
bed9c7d kube-proxy: detect host CPU count via cpuset.NumCPU instead of cadvisor
0a84e25 Merge pull request #139420 from dims/update-x-net-deps
9ef12fe Bump golang.org/x/net to HEAD for http2 go1.27 wrap fixes
f00c6a5 Merge pull request #139258 from dims/update-x-net-deps
a1f0619 Bump golang.org/x/net from v0.54.0 to v0.55.0
2d09b61 Merge pull request #139248 from dims/bump-golang.org/x/crypto-to-v0.52.0
eb30797 Bump golang.org/x/crypto to v0.52.0
99242c8 Merge pull request #138561 from dims/update-xnet-dep
Additional commits viewable in compare view

Updates sigs.k8s.io/apiserver-network-proxy/konnectivity-client from 0.36.0 to 0.37.0

Commits

ed32d91 Merge pull request #923 from cheftako/protocUpdate
db84127 Update to use the latest stable protoc v36.2
f415f5d Merge pull request #922 from kubernetes-sigs/dependabot/go_modules/gomod-depe...
1b51515 chore(deps): bump google.golang.org/grpc
2530f36 Merge pull request #920 from cheftako/bump-gomod-dependencies-916
d276b33 Merge pull request #919 from cheftako/deps
9257d2f Merge pull request #918 from kinvolk/imran/http-connect-zero-write-queue
8eae64f Updated go.mod to match https://github.com/kubernetes/kubernetes/blob/release...
c488ee3 chore(deps): bump the gomod-dependencies group across 1 directory with 9 updates
8068b6e server: allow disabling the HTTP CONNECT writer queue
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ates Bumps the go-runtime group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [charm.land/bubbletea/v2](https://github.com/charmbracelet/bubbletea) | `2.0.8` | `2.0.10` | | [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.10.0` | `5.11.0` | | [github.com/modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) | `1.6.1` | `1.8.0` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.0` | `1.24.1` | | [github.com/wailsapp/wails/v2](https://github.com/wailsapp/wails) | `2.13.0` | `2.16.0` | | [go.yaml.in/yaml/v3](https://github.com/yaml/go-yaml) | `3.0.4` | `3.0.5` | | [golang.org/x/sys](https://github.com/golang/sys) | `0.47.0` | `0.48.0` | | [golang.org/x/term](https://github.com/golang/term) | `0.45.0` | `0.46.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.82.1` | `1.84.0` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.36.2` | `0.37.1` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.2` | `0.37.1` | | [k8s.io/streaming](https://github.com/kubernetes/streaming) | `0.36.2` | `0.37.1` | | [sigs.k8s.io/apiserver-network-proxy/konnectivity-client](https://github.com/kubernetes-sigs/apiserver-network-proxy) | `0.36.0` | `0.37.0` | Updates `charm.land/bubbletea/v2` from 2.0.8 to 2.0.10 - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Commits](charmbracelet/bubbletea@v2.0.8...v2.0.10) Updates `github.com/jackc/pgx/v5` from 5.10.0 to 5.11.0 - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.10.0...v5.11.0) Updates `github.com/modelcontextprotocol/go-sdk` from 1.6.1 to 1.8.0 - [Release notes](https://github.com/modelcontextprotocol/go-sdk/releases) - [Commits](modelcontextprotocol/go-sdk@v1.6.1...v1.8.0) Updates `github.com/prometheus/client_golang` from 1.24.0 to 1.24.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.24.0...v1.24.1) Updates `github.com/wailsapp/wails/v2` from 2.13.0 to 2.16.0 - [Release notes](https://github.com/wailsapp/wails/releases) - [Commits](wailsapp/wails@v2.13.0...v2.16.0) Updates `go.yaml.in/yaml/v3` from 3.0.4 to 3.0.5 - [Commits](yaml/go-yaml@v3.0.4...v3.0.5) Updates `golang.org/x/sys` from 0.47.0 to 0.48.0 - [Commits](golang/sys@v0.47.0...v0.48.0) Updates `golang.org/x/term` from 0.45.0 to 0.46.0 - [Commits](golang/term@v0.45.0...v0.46.0) Updates `google.golang.org/grpc` from 1.82.1 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.82.1...v1.84.0) Updates `k8s.io/apimachinery` from 0.36.2 to 0.37.1 - [Commits](kubernetes/apimachinery@v0.36.2...v0.37.1) Updates `k8s.io/client-go` from 0.36.2 to 0.37.1 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.36.2...v0.37.1) Updates `k8s.io/streaming` from 0.36.2 to 0.37.1 - [Commits](kubernetes/streaming@v0.36.2...v0.37.1) Updates `sigs.k8s.io/apiserver-network-proxy/konnectivity-client` from 0.36.0 to 0.37.0 - [Release notes](https://github.com/kubernetes-sigs/apiserver-network-proxy/releases) - [Changelog](https://github.com/kubernetes-sigs/apiserver-network-proxy/blob/master/RELEASE.md) - [Commits](kubernetes-sigs/apiserver-network-proxy@v0.36.0...v0.37.0) --- updated-dependencies: - dependency-name: charm.land/bubbletea/v2 dependency-version: 2.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-runtime - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: github.com/modelcontextprotocol/go-sdk dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-runtime - dependency-name: github.com/wailsapp/wails/v2 dependency-version: 2.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: go.yaml.in/yaml/v3 dependency-version: 3.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-runtime - dependency-name: golang.org/x/sys dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: golang.org/x/term dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: google.golang.org/grpc dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: k8s.io/apimachinery dependency-version: 0.37.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: k8s.io/client-go dependency-version: 0.37.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: k8s.io/streaming dependency-version: 0.37.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime - dependency-name: sigs.k8s.io/apiserver-network-proxy/konnectivity-client dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-runtime ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-09-28T14:09:35Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 20b59a32-9bc7-4066-9e77-e4bf649cf459

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 28, 2026

Navigation Menu

Repository navigation

chore(deps): bump the go-runtime group across 1 directory with 13 updates - #334

chore(deps): bump the go-runtime group across 1 directory with 13 updates#334
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/go_modules/dev/go-runtime-dc4cd800a2

dependabot Bot commented on behalf of github Sep 28, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 28, 2026

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.0.10

Change to no input programs

Changelog

Fixed

Other stuff

v2.0.9

Small patches 🩹

Keybinds missing!

Weird UI artifacts with some terminals 👽

Changelog

Fixed

Docs

Other stuff

v5.11.0

Features

Changes

5.11.0 (September 7, 2026)

Features

Changes

v1.8.0

Hardening against resource exhaustion

Restricting the protocol versions a server supports

Per-request cache control

Behavior changes guarded by MCPGODEBUG

v1.24.1 / 2026-07-23

What's Changed

1.24.1 / 2026-07-23

Wails v2.14.0

Installation

Changes

Fixed

Release 1.84.0

Behavior Changes

New Features

Bug Fixes

Performance Improvements

Release 1.83.2

Uh oh!

coderabbitai Bot commented Sep 28, 2026

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 28, 2026 •

edited

Loading