fix(deps): update all patch dependencies by renovate[bot] · Pull Request #2350 · theopenlane/core

renovate · 2026-05-04T05:18:23Z

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/grpc-ecosystem/grpc-health-probe	final	patch	`v0.4.48` → `v0.4.49`
github.com/aws/aws-sdk-go-v2/config	require	patch	`v1.32.16` → `v1.32.17`
github.com/aws/aws-sdk-go-v2/credentials	require	patch	`v1.19.15` → `v1.19.16`
github.com/aws/aws-sdk-go-v2/feature/s3/manager	require	patch	`v1.22.16` → `v1.22.18`
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager	require	patch	`v0.1.18` → `v0.1.21`
github.com/aws/aws-sdk-go-v2/service/configservice	require	patch	`v1.62.2` → `v1.62.3`
github.com/aws/aws-sdk-go-v2/service/iam	require	patch	`v1.53.8` → `v1.53.10`
github.com/aws/aws-sdk-go-v2/service/sts	require	patch	`v1.42.0` → `v1.42.1`
github.com/go-webauthn/webauthn	require	patch	`v0.17.2` → `v0.17.3`
github.com/labstack/echo/v4	require	patch	`v4.15.1` → `v4.15.2`
github.com/lestrrat-go/jwx/v3	require	patch	`v3.1.0` → `v3.1.1`
github.com/theopenlane/core	require	patch	`v1.20.3` → `v1.20.4`
golang	stage	patch	`1.26.2` → `1.26.3`
redis	stage	patch	`7.4.8` → `7.4.9`
redis		patch	`7.4.8-alpine` → `7.4.9-alpine`
sigstore/cosign-installer	action	patch	`v4.1.1` → `v4.1.2`

Release Notes

aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager)

`v0.1.20`

Module Highlights

github.com/aws/aws-sdk-go-v2/feature/cloudfront/sign: v1.10.0
- Feature: Support ECDSA for CloudFront sign cookies
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager: v0.1.20
- Bug Fix: Reinstate Location output field on Upload operations.
github.com/aws/aws-sdk-go-v2/service/bedrockagentcore: v1.24.0
- Feature: AgentCore Identity now supports on-behalf-of token exchange OAuth2. AgentCore Memory now supports metadata for LongTerm Memory Records.
github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol: v1.34.0
- Feature: AgentCore Identity now supports on-behalf-of token exchange OAuth2. AgentCore Memory now supports metadata for LongTerm Memory Records.
github.com/aws/aws-sdk-go-v2/service/datazone: v1.59.0
- Feature: Adds support for asynchronous notebook runs
github.com/aws/aws-sdk-go-v2/service/eks: v1.83.0
- Feature: Vended logs update param for capability vended logs feature
github.com/aws/aws-sdk-go-v2/service/kafka: v1.51.0
- Feature: Adds support for ZookeeperAccess field to control the Client-Zookeeper connectivity.
github.com/aws/aws-sdk-go-v2/service/observabilityadmin: v1.15.0
- Feature: Observability Admin enablement launch for AWS Kafka, Bedrock Agent Core Workload Identity and OTel metric enablement.
github.com/aws/aws-sdk-go-v2/service/paymentcryptography: v1.29.0
- Feature: Adds support for resource-based policies on AWS Payment Cryptography keys, enabling cross-account key sharing. Also adds Multi-Party Approval (MPA) team association APIs for protecting sensitive import root public key operations.
github.com/aws/aws-sdk-go-v2/service/route53globalresolver: v1.2.0
- Feature: Adds support for regions in the UpdateGlobalResolver input.
github.com/aws/aws-sdk-go-v2/service/sagemaker: v1.244.0
- Feature: Add InstancePools support to Endpoint for flexible provisioning across a prioritized list of instance types. Add Specifications support to InferenceComponent for per-instance-type model configurations.
github.com/aws/aws-sdk-go-v2/service/ssoadmin: v1.38.0
- Feature: Add InstanceArn and IdentityStoreArn in the response of CreateApplication API and IdentityStoreArn in the response of DescribeApplication API

go-webauthn/webauthn (github.com/go-webauthn/webauthn)

`v0.17.3`

Compare Source

Dependency Updates

This release just contains updates to dependencies.

labstack/echo (github.com/labstack/echo/v4)

`v4.15.2`: - Context.Scheme() header validation

Compare Source

Security

Context.Scheme() should validate values taken from header by @aldas in #2962

Thanks to @shblue21 for reporting this issue.

Full Changelog: labstack/echo@v4.15.1...v4.15.2

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)

`v3.1.1`

Compare Source

For more detailed release notes, see Changes.

What's Changed

build(deps): bump pozil/auto-assign-issue from 2.2.0 to 2.2.1 by @dependabot[bot] in #2045
guard ecdsa coordinates against oversized big.Int by @lestrrat in #2050
reject jwe with conflicting alg in protected vs per-recipient by @lestrrat in #2052
fix AddressClaim.MarshalJSON for non-printable bytes by @lestrrat in #2056
jwt: only call ParseForm when WithFormKey is supplied by @lestrrat in #2058
jws: jkuProvider rejects fetched keys marked use=enc by @lestrrat in #2060
jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by @lestrrat in #2066
build(deps): bump pozil/auto-assign-issue from f245a91 to 7bf9d82 by @dependabot[bot] in #2065
cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by @lestrrat in #2071
jws: refuse "b64" header in VerifyCompactFast by @lestrrat in #2081
jws: VerifyCompactFast refusals match jws.VerifyError() class by @lestrrat in #2083
jws: name loose keySet options in fan-out verify error by @lestrrat in #2085
jws: honor RFC 7797 b64=false in Message.MarshalJSON by @lestrrat in #2087
jws: reject literal-JSON "protected" in general-form JWS by @lestrrat in #2089
jwt: ParseRequest: don't skip form body on chunked transfer by @lestrrat in #2091
jwt: pedantic mode enforces cty=JWT nested-envelope shape by @lestrrat in #2094
jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by @lestrrat in #2099
jwt: ParseInsecure: parse loop-local payload, not original input by @lestrrat in #2097
jws: Verify rejects b64=false without "b64" listed in "crit" by @lestrrat in #2102
jws: Sign auto-declares "b64" in "crit" when emitting b64=false by @lestrrat in #2104
jws: declare "b64" as typed bool header field by @lestrrat in #2106
jws: reject general-form JWS with top-level "header" sibling of "signatures" by @lestrrat in #2108
jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by @lestrrat in #2110
jws: VerifyMessage observes ctx cancellation between loop iterations by @lestrrat in #2112
jws: cleanup follow-ups from recent review (low-severity batch) by @lestrrat in #2114
jwe: DecryptMessage observes ctx cancellation between loop iterations by @lestrrat in #2117
jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by @lestrrat in #2119
jwe: WithKey validates alg-vs-key shape at option-time by @lestrrat in #2121
jwe: compression cap error names "decompressed" payload, the option, and the size by @lestrrat in #2123
jwe: bound joined-error count and drop redundant outer Decrypt prefix by @lestrrat in #2125
jwe: keySetProvider surfaces per-key errors via errors.Join by @lestrrat in #2127
jwe: add WithDisabledKeyAlgorithms global policy hook by @lestrrat in #2129
jwe: document WithMaxDecompressBufferSize behavior at non-positive values by @lestrrat in #2131
jwk: stop duplicating JWK fields at JWKS top level on parse by @lestrrat in #2133
jwk: wrap ParseKey errors with ParseError sentinel by @lestrrat in #2135
jwk: stream the keys array with cap-before-allocate by @lestrrat in #2137
jwk: treat nil key from custom KeyParser as continue, not success by @lestrrat in #2140
jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by @lestrrat in #2142
Changes: draft v3.1.1 release notes by @lestrrat in #2155

Full Changelog: lestrrat-go/jwx@v3.1.0...v3.1.1

theopenlane/core (github.com/theopenlane/core)

`v1.20.4`

Compare Source

What's Changed

Bug Fixes 🐛

fix: policy revision always bumping minor by @golanglemonade in #2366

👒 Dependencies

fix(deps): update module github.com/theopenlane/core to v1.20.3 by @renovate[bot] in #2363
fix(deps): update github.com/elimity-com/scim digest to 830e1ca by @renovate[bot] in #2361
chore(deps): update openfga/openfga docker tag to v1.15.1 by @renovate[bot] in #2359
fix(deps): update module github.com/fsnotify/fsnotify to v1.10.1 by @renovate[bot] in #2356
fix(deps): update module cloud.google.com/go/securitycenter to v1.43.0 by @renovate[bot] in #2355
chore(deps): bump github.com/microsoft/kiota-http-go from 1.5.4 to 1.5.5 in the go_modules group across 1 directory by @dependabot[bot] in #2368
fix(deps): update module github.com/zitadel/oidc/v3 to v3.47.5 by @renovate[bot] in #2371
fix(deps): update module google.golang.org/api to v0.278.0 by @renovate[bot] in #2372
fix(deps): update aws-sdk-go-v2 monorepo by @renovate[bot] in #2369

Other Changes

Add longer review timelines per customer request by @LemonAid711 in #2379

New Contributors

@LemonAid711 made their first contribution in #2379

Full Changelog: v1.20.3...v1.20.4

sigstore/cosign-installer (sigstore/cosign-installer)

`v4.1.2`

Compare Source

What's Changed

Bump cosign to 3.0.6 in #232

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-05-04T05:18:25Z

ℹ️ Artifact update notice

File name: common/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

5 additional dependencies were updated

Details:

Package	Change
`github.com/fxamacker/cbor/v2`	`v2.9.1` -> `v2.9.2`
`github.com/go-webauthn/x`	`v0.2.3` -> `v0.2.5`
`golang.org/x/crypto`	`v0.50.0` -> `v0.51.0`
`golang.org/x/sys`	`v0.43.0` -> `v0.44.0`
`golang.org/x/text`	`v0.36.0` -> `v0.37.0`

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

10 additional dependencies were updated

Details:

Package	Change
`golang.org/x/crypto`	`v0.50.0` -> `v0.51.0`
`golang.org/x/text`	`v0.36.0` -> `v0.37.0`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.10` -> `v1.0.11`
`golang.org/x/term`	`v0.42.0` -> `v0.43.0`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.22` -> `v1.18.23`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.16` -> `v1.30.17`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.20` -> `v1.35.21`
`github.com/fxamacker/cbor/v2`	`v2.9.1` -> `v2.9.2`
`github.com/go-webauthn/x`	`v0.2.3` -> `v0.2.5`
`golang.org/x/sys`	`v0.43.0` -> `v0.44.0`

sonarqubecloud · 2026-05-09T14:07:43Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

renovate Bot added the dependencies label May 4, 2026

renovate Bot requested a review from a team as a code owner May 4, 2026 05:18

renovate Bot added the dependencies label May 4, 2026

renovate Bot requested review from adelowo, matoszz and theopenlane-bender May 4, 2026 05:18

github-actions Bot added cli common labels May 4, 2026

renovate Bot force-pushed the renovate/all-patch branch 9 times, most recently from 1b18884 to eb3e7df Compare May 5, 2026 20:46

github-actions Bot added the local-development label May 5, 2026

renovate Bot changed the title ~~Update all patch dependencies~~ fix(deps): update all patch dependencies May 5, 2026

renovate Bot force-pushed the renovate/all-patch branch 2 times, most recently from 5bf0d28 to bff966d Compare May 6, 2026 16:51

github-actions Bot removed cli common labels May 6, 2026

renovate Bot force-pushed the renovate/all-patch branch from bff966d to e4f456c Compare May 6, 2026 16:59

github-actions Bot added the common label May 6, 2026

renovate Bot force-pushed the renovate/all-patch branch from e4f456c to 72d2bc6 Compare May 6, 2026 17:30

github-actions Bot removed the common label May 6, 2026

renovate Bot force-pushed the renovate/all-patch branch 2 times, most recently from f0d1820 to 941645a Compare May 6, 2026 21:07

renovate Bot force-pushed the renovate/all-patch branch 2 times, most recently from 6a73ffd to 1160248 Compare May 7, 2026 04:50

github-actions Bot added the ci label May 7, 2026

renovate Bot force-pushed the renovate/all-patch branch 3 times, most recently from 1a208ee to 49b1d35 Compare May 9, 2026 00:15

github-actions Bot added cli common labels May 9, 2026

fix(deps): update all patch dependencies

ad21682

renovate Bot force-pushed the renovate/all-patch branch from 49b1d35 to ad21682 Compare May 9, 2026 13:46

golanglemonade approved these changes May 9, 2026

View reviewed changes

golanglemonade merged commit 9789e65 into main May 9, 2026
19 checks passed

golanglemonade deleted the renovate/all-patch branch May 9, 2026 16:50

Navigation Menu

Uh oh!

fix(deps): update all patch dependencies - #2350

fix(deps): update all patch dependencies#2350
golanglemonade merged 1 commit into
mainfrom
renovate/all-patch

renovate Bot commented May 4, 2026 •

edited

Loading

Uh oh!

renovate Bot commented May 4, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented May 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.1.20

Module Highlights

v0.17.3

Dependency Updates

v4.15.2: - Context.Scheme() header validation

v3.1.1

What's Changed

v1.20.4

What's Changed

Bug Fixes 🐛

👒 Dependencies

Other Changes

New Contributors

v4.1.2

What's Changed

Configuration

Uh oh!

renovate Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: common/go.mod

File name: go.mod

Uh oh!

sonarqubecloud Bot commented May 9, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented May 4, 2026 •

edited

Loading

`v0.1.20`

`v0.17.3`

`v4.15.2`: - Context.Scheme() header validation

`v3.1.1`

`v1.20.4`

`v4.1.2`

renovate Bot commented May 4, 2026 •

edited

Loading