Skip to content

chore(deps): bump the go-dependencies group across 1 directory with 6 updates - #3

Merged
qboileau merged 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-d5994de497
Aug 11, 2026
Merged

chore(deps): bump the go-dependencies group across 1 directory with 6 updates#3
qboileau merged 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-d5994de497

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 6 updates in the / directory:

Package From To
github.com/Masterminds/semver/v3 3.2.1 3.5.0
github.com/fatih/color 1.18.0 1.19.0
github.com/google/cel-go 0.26.0 0.31.0
github.com/kaptinlin/jsonschema 0.7.11 0.9.8
github.com/yannh/kubeconform 0.7.0 0.8.0
helm.sh/helm/v3 3.15.4 3.21.3

Updates github.com/Masterminds/semver/v3 from 3.2.1 to 3.5.0

Release notes

Sourced from github.com/Masterminds/semver/v3's releases.

v3.5.0

What's Changed

New Contributors

Full Changelog: Masterminds/semver@v3.4.0...v3.5.0

v3.4.0

There are a few changes in this release to highlight:

  1. Constraints now has a property IncludePrerelease. When set to true the Check and Validate methods will include prereleases.
  2. When an AND group has one constraint with a prerelease but more than one constraint then prereleases will be included. For example, >1.0.0-beta.1 < 2. In the past this would not have included prereleases because each constraint needed to have a prerelease. Now, only one constraint needs to have a prerelease. This is considered a long standing bug fix. Note, this does not carry across OR groups. For example, >1.0.0-beta.1 < 2 || > 3. In this case, prereleases will not be included when evaluating against >3.
  3. NewVersion coercion with leading "0"'s is restored. This can be disabled by setting the package level property CoerceNewVersion to false.

What's Changed

New Contributors

Full Changelog: Masterminds/semver@v3.3.1...v3.4.0

v3.3.1

What's Changed

Full Changelog: Masterminds/semver@v3.3.0...v3.3.1

v3.3.0

What's Changed

... (truncated)

Changelog

Sourced from github.com/Masterminds/semver/v3's changelog.

Changelog

3.4.0 (2025-06-27)

Added

  • #268: Added property to Constraints to include prereleases for Check and Validate

Changed

  • #263: Updated Go testing for 1.24, 1.23, and 1.22
  • #269: Updated the error message handling for message case and wrapping errors
  • #266: Restore the ability to have leading 0's when parsing with NewVersion. Opt-out of this by setting CoerceNewVersion to false.

Fixed

  • #257: Fixed the CodeQL link (thanks @​dmitris)
  • #262: Restored detailed errors when failed to parse with NewVersion. Opt-out of this by setting DetailedNewVersionErrors to false for faster performance.
  • #267: Handle pre-releases for an "and" group if one constraint includes them

3.3.1 (2024-11-19)

Fixed

  • #253: Fix for allowing some version that were invalid

3.3.0 (2024-08-27)

Added

Changed

  • #241: Simplify StrictNewVersion parsing (thanks @​grosser)
  • Testing support up through Go 1.23
  • Minimum version set to 1.21 as this is what's tested now
  • Fuzz testing now supports caching
Commits
  • 8b89c86 Merge pull request #287 from mattfarina/fix-da-issues
  • 29d51d0 Fixing some quality issues
  • 87f651d Merge pull request #286 from mattfarina/update-devcontainer
  • 158a685 Updating gitignore for devcontainers
  • 7e83c08 Merge pull request #284 from Masterminds/dependabot/github_actions/golangci/g...
  • 697e27f Merge pull request #283 from Masterminds/dependabot/github_actions/actions/ca...
  • 1591f8e Merge pull request #282 from Masterminds/dependabot/github_actions/github/cod...
  • 3f5ff17 Bump golangci/golangci-lint-action from 7.0.1 to 9.2.0
  • 04baa33 Bump actions/cache from 4.2.3 to 5.0.5
  • 45939fe Bump github/codeql-action from 4.35.1 to 4.35.2
  • Additional commits viewable in compare view

Updates github.com/fatih/color from 1.18.0 to 1.19.0

Release notes

Sourced from github.com/fatih/color's releases.

v1.19.0

What's Changed

New Contributors

Full Changelog: fatih/color@v1.18.0...v1.19.0

Commits
  • ca25f6e Merge pull request #266 from fatih/dependabot/github_actions/actions/setup-go-6
  • 1205984 Bump actions/setup-go from 5 to 6
  • 5715c20 Merge pull request #269 from UnSubble/main
  • 2f6e200 Merge branch 'main' into main
  • f72ec94 Merge pull request #273 from fatih/dependabot/github_actions/actions/checkout-6
  • 848e633 Merge branch 'main' into main
  • 4c2cd34 Add tests
  • 7f812f0 Bump actions/checkout from 4 to 6
  • b7fc9f9 Merge pull request #259 from fatih/dependabot/github_actions/dominikh/staticc...
  • 239a88f Bump dominikh/staticcheck-action from 1.3.1 to 1.4.0
  • Additional commits viewable in compare view

Updates github.com/google/cel-go from 0.26.0 to 0.31.0

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.31.0

This release introduces critical performance breakthroughs, simplifies integration with native Go structures, and hardens the safety limits of evaluated expressions.

Features

Pull Request Description and Impact
Env copy on write (#1405) Introduces Copy-on-Write (COW) mechanics for environment definitions, dramatically slashing CPU and memory allocation overhead when building child or extended environments.
Optimize NativeToValue call paths (#1400) Optimizes reflection-heavy conversion paths, significantly improving evaluation speeds when feeding native Go types directly to the runtime engine.
Support self-describing, self-adapting struct types (#1395) Simplifies struct integration by enabling native Go struct types to self-describe and adapt directly to the CEL type system without verbose boilerplate.
Move native type support into the Core CEL library (#1396) Moves native Go type mapping utilities directly into the Core CEL package to unify dependency structure and improve native API access.
Regex program plan size controls (#1383) Introduces critical compiled size constraints on regex expressions to mitigate CPU/memory exhaustion vectors during evaluation.
Simplify support for native object types (#1393) Streamlines setup workflows for mapping standard Go structures inside the CEL compiler environment.
Tag automation for go submodules (#1401) Automates the submodule tagging process to streamline multi-module releases.

Fixes

Pull Request Impact and Technical Details
Respect composed adapter for unregistered structs (#1384) Corrects behavior so that unregistered Go structs properly fall back to composed adapter configurations.
reject out-of-range hours in timezone offset parsing (#1391) Tightens datetime validation by rejecting invalid out-of-range hour offsets during timezone parsing.
Fix the expression limit node test (#1390) Restores stability to environment node test suites verifying size-limit assertions.
Correct documented default max value for lists.range (#1392) Resolves documentation drift regarding the default maximum limit for the lists.range function.

Breaking Changes

There are no breaking changes, but all ext.NativeTypes features are now available via cel.NativeTypes

Notes on Performance

This release targets two primary computational bottlenecks in high-throughput CEL environments: environment construction and reflection-based type coercion.

Expected Impact

  1. Dynamic Environment Extension: Applications that dynamically extend a base CEL environment per request (e.g., policy validation engines or API gateways adding request-scoped variables) will see near-zero initialization costs. The Copy-on-Write (COW) optimization prevents copying underlying maps of variables, functions, and adapters.
  2. Type Coercion Speed: Bypassing heavy reflection paths during NativeToValue conversions significantly cuts down CPU cycle usage and drastically reduces garbage collection overhead in processing hot paths.
  3. AST Pruning: Consolidating sequential list concatenations (#1406) and optimizing optional macros (#1387) ensures that generated program plans are leaner, reducing both compilation and execution memory footprints.

Go-lang Benchmark Citation (benchstat)

The performance improvements can be verified running the repository's native benchmark harness with benchstat:

name old time/op new time/op delta
BenchmarkEnvExtension/10_vars 3.56µs ± 1% 0.15µs ± 0% -95.79% (p=0.000 n=10+10)
BenchmarkNativeToValue/struct 120ns ± 2% 42ns ± 1% -65.00% (p=0.000 n=10+10)
BenchmarkOptionalMapEvaluation 245ns ± 1% 195ns ± 1% -20.41% (p=0.000 n=10+10)

name old allocs/op new allocs/op delta
BenchmarkEnvExtension/10_vars 32.0 ± 0% 1.0 ± 0% -96.88% (p=0.000 n=10+10)
BenchmarkNativeToValue/struct 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10)

... (truncated)

Commits

Updates github.com/kaptinlin/jsonschema from 0.7.11 to 0.9.8

Release notes

Sourced from github.com/kaptinlin/jsonschema's releases.

v0.9.8

What's Changed

Fixed

  • Restore the publicly available github.com/kaptinlin/go-i18n v0.6.3 dependency, fixing go mod download failures for consumers.
  • Restore the compatible localization API and MF1 catalog syntax while preserving localized validation behavior.

Full Changelog: kaptinlin/jsonschema@v0.9.7...v0.9.8

v0.9.7

What's Changed

Fixed

  • Migrate localized validation messages to github.com/agentable/go-i18n.
  • Update embedded locale catalogs from MF1 placeholders to MF2 variable syntax.
  • Preserve missing-translation fallback and localized validation result behavior.

Dependencies

  • Use agentable/go-i18n v0.1.3, go-intl v0.2.17, and messageformat-go v0.8.6.

v0.9.0

Multi-draft validation

jsonschema now validates Draft 2019-09, Draft-07, Draft-06, and Draft-04 in addition to Draft 2020-12, selected automatically from each schema's $schema. When a schema omits $schema it defaults to Draft 2020-12, so existing code is unaffected.

// Opt a $schema-less schema into a specific draft:
compiler := jsonschema.NewCompiler().SetDefaultDialect(jsonschema.Draft7)

Each dialect's keyword semantics are honored — Draft-04 id, boolean exclusiveMinimum/exclusiveMaximum, dependencies (→ dependentRequired/dependentSchemas), tuple items + additionalItems, and Draft 2019-09 $recursiveRef/$recursiveAnchor (mapped to dynamic refs). Behavior is verified against the official JSON Schema Test Suite for all five drafts.

New API

  • Dialect type with constants Draft202012, Draft201909, Draft7, Draft6, Draft4
  • (*Compiler).SetDefaultDialect(Dialect) — dialect used when a schema has no $schema (default Draft202012)
  • (*Schema).Dialect() — the resolved dialect of a compiled schema
  • Schema.Comment and Schema.Vocabulary typed fields for $comment and $vocabulary

Dialect-aware keyword recognition

A keyword is recognized only under the dialects that define it; anything else is preserved verbatim in Schema.Extra (with SetPreserveExtra(true)) and ignored for validation. $comment and $vocabulary are modeled as fields and round-trip cleanly.

Performance

The compile/parse path was reworked: schema objects decode in a single pass, the dialect walk allocates nothing, and unknown keywords are decoded lazily. newSchema allocations dropped ~73% and bytes ~55% on a representative schema.

... (truncated)

Commits
  • 559e4c8 fix: restore public go-i18n dependency
  • 0981c01 fix: migrate localization to agentable go-i18n
  • 43ab963 chore: refresh development submodules
  • 8550f08 docs: clarify foreign serializer number ownership
  • f8c6ce0 fix: preserve exact JSON number semantics
  • bf5e3a2 fix: preserve exact JSON number validation
  • 7febadc fix: preserve exact schema number serialization
  • e39feff fix: support updated dependencies
  • 2910757 Merge pull request #121 from kaptinlin/dependabot/github_actions/actions/chec...
  • 5e748dd chore(deps): bump actions/checkout from 6 to 7
  • Additional commits viewable in compare view

Updates github.com/yannh/kubeconform from 0.7.0 to 0.8.0

Release notes

Sourced from github.com/yannh/kubeconform's releases.

v0.8.0

Changelog

  • e60892483e5b7e5dffa95fc3f121646a96ca270f Fix typo (#339)
  • b83bf792b26c69f31b6121c66c22da143c242c78 Openapi2jsonschema-go (#357)
  • d412494432c720f6b723546baf6e2002a5592654 Read resources from multiple workers (#354)
  • 1f6792c093d007ca0a20a178de2e211944cda985 Small fixes, better sanitization (#359)
  • 02374e583d700721f57300fae78e11acd27ee539 Update README (#360)
  • ab97ec7693f8da48b48f4c3f336e82f18e831953 Update deps, make sure we use vendored dependencies (#358)
  • c7f8490e52eede11e384b6925587d4f8a26270d8 fix: Github -> GitHub (#340)
  • 8e634e18c0f629874b591c26dae01e84ea3fd499 fix: avoid panic when a schema document decodes to null (#356)
  • e5c533b154158267ad14466a35cb890022dbaf80 fix: update duration validation to use strfmt package (#348)
Commits

Updates helm.sh/helm/v3 from 3.15.4 to 3.21.3

Release notes

Sourced from helm.sh/helm/v3's releases.

Helm v3.21.3 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.21.3. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • Apply suggestions from code review 1ad6e68924fdf6fb0c7dcef8e9e1dfc0f36eaed6 (Benoit Tigeot)
  • fix: drop containerd v1 dep to resolve govulncheck CVEs 037733e7d51b08e30a0233bd546c345ab3ea3bba (Benoit Tigeot)
  • chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 d3e178ba06a8a1eeacaab1df9162b658b1e07fe9 (dependabot[bot])

Helm v3.21.2 is a patch release to correct bump the Kubernetes client libraries (client-go, etc) to match the expected Kubernetes v1.36 release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

... (truncated)

Commits
  • 1ad6e68 Apply suggestions from code review
  • 037733e fix: drop containerd v1 dep to resolve govulncheck CVEs
  • d3e178b chore(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33
  • 1259634 chore(deps): bump the k8s-io group with 2 updates
  • b52e276 fixes
  • 3342dbf chore(deps): bump the k8s-io group across 1 directory with 2 updates
  • c56dd00 fix(action): avoid nil REST client getter panic when installing CRDs
  • 702529f fix(registry): keep credentials on plain-HTTP fallback with oras-go v2.6.1
  • 178e120 chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1
  • dcf35f8 chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the go-dependencies group across 1 directory with 6…
b4084f4 
… updates

Bumps the go-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver) | `3.2.1` | `3.5.0` |
| [github.com/fatih/color](https://github.com/fatih/color) | `1.18.0` | `1.19.0` |
| [github.com/google/cel-go](https://github.com/google/cel-go) | `0.26.0` | `0.31.0` |
| [github.com/kaptinlin/jsonschema](https://github.com/kaptinlin/jsonschema) | `0.7.11` | `0.9.8` |
| [github.com/yannh/kubeconform](https://github.com/yannh/kubeconform) | `0.7.0` | `0.8.0` |
| [helm.sh/helm/v3](https://github.com/helm/helm) | `3.15.4` | `3.21.3` |



Updates `github.com/Masterminds/semver/v3` from 3.2.1 to 3.5.0
- [Release notes](https://github.com/Masterminds/semver/releases)
- [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md)
- [Commits](Masterminds/semver@v3.2.1...v3.5.0)

Updates `github.com/fatih/color` from 1.18.0 to 1.19.0
- [Release notes](https://github.com/fatih/color/releases)
- [Commits](fatih/color@v1.18.0...v1.19.0)

Updates `github.com/google/cel-go` from 0.26.0 to 0.31.0
- [Release notes](https://github.com/google/cel-go/releases)
- [Commits](cel-expr/cel-go@v0.26.0...v0.31.0)

Updates `github.com/kaptinlin/jsonschema` from 0.7.11 to 0.9.8
- [Release notes](https://github.com/kaptinlin/jsonschema/releases)
- [Commits](kaptinlin/jsonschema@v0.7.11...v0.9.8)

Updates `github.com/yannh/kubeconform` from 0.7.0 to 0.8.0
- [Release notes](https://github.com/yannh/kubeconform/releases)
- [Commits](yannh/kubeconform@v0.7.0...v0.8.0)

Updates `helm.sh/helm/v3` from 3.15.4 to 3.21.3
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](helm/helm@v3.15.4...v3.21.3)

---
updated-dependencies:
- dependency-name: github.com/Masterminds/semver/v3
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/fatih/color
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/google/cel-go
  dependency-version: 0.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/kaptinlin/jsonschema
  dependency-version: 0.9.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/yannh/kubeconform
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.21.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 10, 2026
@qboileau
qboileau merged commit 4c92db4 into main Aug 11, 2026
1 check passed
@dependabot
dependabot Bot deleted the dependabot/go_modules/go-dependencies-d5994de497 branch August 11, 2026 19:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@qboileau qboileau qboileau approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@qboileau