chore(deps): bump the security-updates group across 1 directory with 20 updates#161
chore(deps): bump the security-updates group across 1 directory with 20 updates#161dependabot[bot] wants to merge 1 commit into
Conversation
…20 updates Bumps the security-updates group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml) | `1.5.0` | `1.6.0` | | [github.com/gin-gonic/gin](https://github.com/gin-gonic/gin) | `1.11.0` | `1.12.0` | | [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.9.2` | `1.10.0` | | [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) | `9.19.0` | `9.20.0` | | [go.etcd.io/etcd/api/v3](https://github.com/etcd-io/etcd) | `3.5.21` | `3.6.12` | | [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.5.21` | `3.6.12` | | [go.etcd.io/etcd/server/v3](https://github.com/etcd-io/etcd) | `3.5.21` | `3.6.12` | | [go.opentelemetry.io/contrib/propagators/autoprop](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.63.0` | `0.69.0` | | [go.opentelemetry.io/contrib/samplers/jaegerremote](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.37.0` | `0.37.1` | | [go.opentelemetry.io/otel/bridge/opentracing](https://github.com/open-telemetry/opentelemetry-go) | `1.36.0` | `1.44.0` | | [go.opentelemetry.io/otel/exporters/jaeger](https://github.com/open-telemetry/opentelemetry-go) | `1.16.0` | `1.17.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.38.0` | `1.44.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.38.0` | `1.44.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `1.36.0` | `1.44.0` | | [go.uber.org/zap](https://github.com/uber-go/zap) | `1.27.0` | `1.28.0` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.34.1` | `0.36.1` | Updates `github.com/BurntSushi/toml` from 1.5.0 to 1.6.0 - [Release notes](https://github.com/BurntSushi/toml/releases) - [Commits](BurntSushi/toml@v1.5.0...v1.6.0) Updates `github.com/gin-gonic/gin` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/gin-gonic/gin/releases) - [Changelog](https://github.com/gin-gonic/gin/blob/master/CHANGELOG.md) - [Commits](gin-gonic/gin@v1.11.0...v1.12.0) Updates `github.com/go-sql-driver/mysql` from 1.9.2 to 1.10.0 - [Release notes](https://github.com/go-sql-driver/mysql/releases) - [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md) - [Commits](go-sql-driver/mysql@v1.9.2...v1.10.0) Updates `github.com/redis/go-redis/v9` from 9.19.0 to 9.20.0 - [Release notes](https://github.com/redis/go-redis/releases) - [Changelog](https://github.com/redis/go-redis/blob/master/RELEASE-NOTES.md) - [Commits](redis/go-redis@v9.19.0...v9.20.0) Updates `go.etcd.io/etcd/api/v3` from 3.5.21 to 3.6.12 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.5.21...v3.6.12) Updates `go.etcd.io/etcd/client/v3` from 3.5.21 to 3.6.12 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.5.21...v3.6.12) Updates `go.etcd.io/etcd/server/v3` from 3.5.21 to 3.6.12 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.5.21...v3.6.12) Updates `go.opentelemetry.io/contrib/propagators/autoprop` from 0.63.0 to 0.69.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.63.0...zpages/v0.69.0) Updates `go.opentelemetry.io/contrib/samplers/jaegerremote` from 0.37.0 to 0.37.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.37.0...samplers/jaegerremote/v0.37.1) Updates `go.opentelemetry.io/otel` from 1.43.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0) Updates `go.opentelemetry.io/otel/bridge/opentracing` from 1.36.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.44.0) Updates `go.opentelemetry.io/otel/exporters/jaeger` from 1.16.0 to 1.17.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.16.0...v1.17.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.38.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.44.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.38.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.44.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.36.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.36.0...v1.44.0) Updates `go.opentelemetry.io/otel/sdk` from 1.43.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0) Updates `go.opentelemetry.io/otel/trace` from 1.43.0 to 1.44.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0) Updates `go.uber.org/zap` from 1.27.0 to 1.28.0 - [Release notes](https://github.com/uber-go/zap/releases) - [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md) - [Commits](uber-go/zap@v1.27.0...v1.28.0) Updates `golang.org/x/sys` from 0.42.0 to 0.45.0 - [Commits](golang/sys@v0.42.0...v0.45.0) Updates `k8s.io/client-go` from 0.34.1 to 0.36.1 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.34.1...v0.36.1) --- updated-dependencies: - dependency-name: github.com/BurntSushi/toml dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: github.com/gin-gonic/gin dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: github.com/go-sql-driver/mysql dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: github.com/redis/go-redis/v9 dependency-version: 9.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.etcd.io/etcd/api/v3 dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.etcd.io/etcd/client/v3 dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.etcd.io/etcd/server/v3 dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/contrib/propagators/autoprop dependency-version: 0.69.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/contrib/samplers/jaegerremote dependency-version: 0.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/bridge/opentracing dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/exporters/jaeger dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.opentelemetry.io/otel/trace dependency-version: 1.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: go.uber.org/zap dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: golang.org/x/sys dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates - dependency-name: k8s.io/client-go dependency-version: 0.36.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-updates ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
|
📝 WalkthroughWalkthroughThe PR updates the Go module manifest to version 1.26.0 toolchain and bumps a comprehensive set of direct and indirect dependencies. Core dependencies like etcd, OpenTelemetry, and gRPC are upgraded, while transitive dependencies across validation, encoding, infrastructure, and API layers are refreshed with newer versions. ChangesDependency Versions
🎯 2 (Simple) | ⏱️ ~10 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 38: The go.mod pins grpc to a vulnerable version via the replace
directive "replace google.golang.org/grpc => google.golang.org/grpc v1.63.2"
which overrides the required "google.golang.org/grpc v1.81.1"; remove or update
that replace to a safe release (at minimum v1.79.3, ideally v1.81.1) so the
resolved module is not v1.63.2, then run go mod tidy to refresh go.sum and
verify builds/tests; look for and update the exact "replace
google.golang.org/grpc => google.golang.org/grpc v1.63.2" line and ensure the
require entry "google.golang.org/grpc v1.81.1" is preserved.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2b826bec-6410-4e08-9d97-2bd15baa0293
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| google.golang.org/grpc v1.80.0 | ||
| go.uber.org/zap v1.28.0 | ||
| golang.org/x/sys v0.45.0 | ||
| google.golang.org/grpc v1.81.1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod: require/replace for google.golang.org/grpc =="
# Print relevant sections around the reported lines and any grpc-related directives
if [ -f go.mod ]; then
echo "--- Top (lines 1-120) ---"
sed -n '1,120p' go.mod | nl -ba | sed -n '1,120p'
echo "--- Middle (lines 120-220) ---"
sed -n '120,220p' go.mod | nl -ba | sed -n '1,120p'
echo "--- Exact matches for grpc ---"
rg -n "google\.golang\.org/grpc" go.mod || true
else
echo "go.mod not found at repo root"
fiRepository: kubeservice-stack/common
Length of output: 212
🌐 Web query:
GHSA auth bypass google.golang.org/grpc v1.63.2
💡 Result:
The security vulnerability you are inquiring about is identified as CVE-2026-33186 (also tracked as GHSA-p77j-4mvh-x3m3) [1][2]. It is an authorization bypass vulnerability in the gRPC-Go library (google.golang.org/grpc) that allows an attacker to potentially circumvent path-based authorization policies [3][4][5]. The issue arises because, in versions prior to 1.79.3, the gRPC-Go server was overly permissive when processing the HTTP/2:path pseudo-header [3][6]. According to RFC 7540, this header must begin with a leading slash (e.g., /Service/Method) [6]. However, previous versions of the library accepted requests where this leading slash was omitted (e.g., Service/Method) [3][7]. While the server correctly routed these malformed requests to the appropriate handler, the raw, non-canonical path string was passed to authorization interceptors (such as the official grpc/authz package) [3][8][1]. Consequently, if a server's security policy relied on "deny" rules based on canonical paths (starting with /) but contained a fallback "allow" rule, the policy would fail to match the incoming non-canonical path, resulting in an authorization bypass [3][4][5]. This vulnerability is patched in google.golang.org/grpc version 1.79.3 [3][1][5]. The fix ensures that any request with a:path header lacking a leading slash is immediately rejected with a codes.Unimplemented error, preventing the request from reaching authorization interceptors [3][4][1]. Note: The version 1.63.2 referenced in your query is an affected version, as it is earlier than 1.79.3 [1][2]. Users are strongly advised to upgrade to 1.79.3 or newer [3][1][5]. If an immediate upgrade is not possible, mitigations include implementing a validating interceptor to reject malformed paths, ensuring infrastructure-level normalization of HTTP/2 headers, or hardening authorization policies to default-deny [4][8][5].
Citations:
- 1: GHSA-p77j-4mvh-x3m3
- 2: https://pkg.go.dev/vuln/GO-2026-4762
- 3: https://osv.dev/vulnerability/GHSA-p77j-4mvh-x3m3
- 4: https://osv.dev/vulnerability/CVE-2026-33186
- 5: https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGGRPC-15691172
- 6: https://www.systemshardening.com/articles/kubernetes/grpc-go-path-auth-bypass/
- 7: https://advisories.gitlab.com/golang/google.golang.org/grpc/CVE-2026-33186/
- 8: https://guide.sonatype.com/vulnerability/CVE-2026-33186
🌐 Web query:
google.golang.org/grpc 1.63.2 security advisory
💡 Result:
There is no security advisory specifically targeting version 1.63.2 of the google.golang.org/grpc library [1][2]. Version 1.63.2 was released in April 2024 to address minor bug fixes, such as correcting user agent strings and un-deprecating certain API methods [2]. The security-related information you may have encountered is likely conflated with a more recent vulnerability, CVE-2026-33186 (GHSA-p77j-4mvh-x3m3), which affects gRPC-Go versions prior to 1.79.3 [3][4][5]. This vulnerability involves an authorization bypass caused by improper input validation of the HTTP/2:path pseudo-header [3][5]. It specifically impacts servers that use path-based authorization interceptors and have specific "deny" rules for canonical paths [4][5][6]. Users of earlier versions, including 1.63.2, are advised to upgrade to version 1.79.3 or newer to mitigate this issue [3][4][5].
Citations:
- 1: https://pkg.go.dev/google.golang.org/grpc@v1.63.2
- 2: build(deps): Bump google.golang.org/grpc from 1.63.0 to 1.63.2 terraform-linters/tflint#2023
- 3: GHSA-p77j-4mvh-x3m3
- 4: https://osv.dev/vulnerability/GHSA-p77j-4mvh-x3m3
- 5: https://osv.dev/vulnerability/CVE-2026-33186
- 6: https://advisories.gitlab.com/golang/google.golang.org/grpc/CVE-2026-33186/
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod: exact grpc require/replace directives =="
# Show all grpc-related directives with line numbers using awk (no nl dependency)
awk '{ if ($0 ~ /google\.golang\.org\/grpc/) print NR ":" $0 }' go.mod || true
echo
echo "== go.mod: context around reported lines (38 and 170) =="
for ln in 38 170; do
start=$((ln-5))
end=$((ln+5))
echo "--- around line $ln ($start-$end) ---"
sed -n "${start},${end}p" go.mod | nl -ba
doneRepository: kubeservice-stack/common
Length of output: 476
Critical security fix: grpc is still pinned to vulnerable v1.63.2 via replace
go.mod requires google.golang.org/grpc v1.81.1 (line 38), but replace google.golang.org/grpc => google.golang.org/grpc v1.63.2 (line 170) overrides it—so the resolved dependency remains v1.63.2. That version is affected by GHSA-p77j-4mvh-x3m3 / CVE-2026-33186 (patched in grpc v1.79.3).
Suggested fix
-replace google.golang.org/grpc => google.golang.org/grpc v1.63.2
+replace google.golang.org/grpc => google.golang.org/grpc v1.81.1🧰 Tools
🪛 OSV Scanner (2.3.8)
[CRITICAL] 38-38: google.golang.org/grpc 1.63.2: Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
(GO-2026-4762)
[CRITICAL] 38-38: google.golang.org/grpc 1.63.2: gRPC-Go has an authorization bypass via missing leading slash in :path
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 38, The go.mod pins grpc to a vulnerable version via the
replace directive "replace google.golang.org/grpc => google.golang.org/grpc
v1.63.2" which overrides the required "google.golang.org/grpc v1.81.1"; remove
or update that replace to a safe release (at minimum v1.79.3, ideally v1.81.1)
so the resolved module is not v1.63.2, then run go mod tidy to refresh go.sum
and verify builds/tests; look for and update the exact "replace
google.golang.org/grpc => google.golang.org/grpc v1.63.2" line and ensure the
require entry "google.golang.org/grpc v1.81.1" is preserved.
Source: Linters/SAST tools
1 participant
Bumps the security-updates group with 16 updates in the / directory:
1.5.01.6.01.11.01.12.01.9.21.10.09.19.09.20.03.5.213.6.123.5.213.6.123.5.213.6.120.63.00.69.00.37.00.37.11.36.01.44.01.16.01.17.01.38.01.44.01.38.01.44.01.36.01.44.01.27.01.28.00.34.10.36.1Updates
github.com/BurntSushi/tomlfrom 1.5.0 to 1.6.0Release notes
Sourced from github.com/BurntSushi/toml's releases.
Commits
5253492Enable TOML 1.1 by default (#457)e954445Reject duplicate arrays (#455)6b16cbdUpdate toml-test test cases from upstream (#456)011fa2bEnsure constant format strings in wf calls4b439bfRemove itemNila473c12Add test for out of range float64b535ff8Add some boring tests for lex.go6011ef0Remove unreachable condition in lexTableNameStartc8ca9e6Remove unreachable condition1121f81Make tomlv read from stdinUpdates
github.com/gin-gonic/ginfrom 1.11.0 to 1.12.0Release notes
Sourced from github.com/gin-gonic/gin's releases.
... (truncated)
Changelog
Sourced from github.com/gin-gonic/gin's changelog.
Commits
73726dcdocs: update documentation to reflect Go version changes (#4552)e292e5cdocs: document and finalize Gin v1.12.0 release (#4551)ae3f524ci: update Go version support to 1.25+ across CI and docs (#4550)38534e2chore(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#4548)472d086fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535)fb25834test(context): use http.StatusContinue constant instead of magic number 100 (...6f1d5fetest(render): add comprehensive error handling tests (#4541)5c00df8fix(render): write content length in Data.Render (#4206)db30908chore(logger): allow skipping query string output (#4547)ba093d1chore(binding): upgrade bson dependency to mongo-driver v2 (#4549)Updates
github.com/go-sql-driver/mysqlfrom 1.9.2 to 1.10.0Release notes
Sourced from github.com/go-sql-driver/mysql's releases.
... (truncated)
Changelog
Sourced from github.com/go-sql-driver/mysql's changelog.
Commits
a065b60release v1.10.0 (#1765)09e4187modernize (#1764)6c44a9aEnhance interpolateParams to correctly handle placeholders (#1732)688ce56Update supported Go version to 1.24–1.26 (#1763)118d07fBump filippo.io/edwards25519 from 1.1.1 to 1.2.0 (#1756)d6b2d3eConsolidate Dependabot update noise by grouping weekly dependency PRs (#1762)037dfd8Fix getSystemVar buffer reuse (#1754)900f330Bump actions/checkout from 4 to 6 (#1758)ab9e380fix staticcheck error (#1761)f298c66Bump actions/setup-go from 5 to 6 (#1757)Updates
github.com/redis/go-redis/v9from 9.19.0 to 9.20.0Release notes
Sourced from github.com/redis/go-redis/v9's releases.
... (truncated)
Changelog
Sourced from github.com/redis/go-redis/v9's changelog.
... (truncated)
Commits
7d05dd3chore(release): v9.20.0 (#3832)9756882fix(test): make waitForSentinelClusterStable robust to disconnected r… (#3830)875ce21fix(sentinel): do not close sentinel when replica list is empty (#3795)8a027f2chore(ci): add govulncheck workflow (#3779)d8407dffix(pubsub): include shard channels in newConn routing list (#3829)6af9bdcfix(cluster): fall back to origin port when CLUSTER SLOTS reports port 0 (#3828)fa5aa8cchore(doc): Update README and CI image. (#3822)fdcc6f9refactor(keyPos): Enhance key position retrieval with CommandInfo caching (#3...68a8bc1fix(sentinel): close non-winning sentinel clients in MasterAddr concurrent pr...00bf6d3fix: avoid retrying ClusterClient Watch callback errors (#3821)Updates
go.etcd.io/etcd/api/v3from 3.5.21 to 3.6.12Release notes
Sourced from go.etcd.io/etcd/api/v3's releases.
... (truncated)
Commits
90b034aversion: bump up to 3.6.128b95963Merge pull request #21811 from Deln0r/release-3.6-backport-21666576a6a0server: allow non-admin maintenance status2286051Merge pull request #21794 from vivekpatani/cherry-pick-21788-release-3.6e1468c8client/pkg/fileutil: use os.Getuid() to skip TestIsDirWriteable as rootaaf38f8Merge pull request #21768 from silentred/release-3.6-etcdutl-invalid-datadir449e34betcdutl: validate data file path and return consistent errors instead of pani...00e1b15Merge pull request #21736 from silentred/release-3.6-bugfix-memberupdate-learner49cd4a4bugfix: MemberUpdate implicitly and unexpectedly promotes a learner9bbe31bMerge pull request #21727 from silentred/release-3.6-bump-go-1.25.10Updates
go.etcd.io/etcd/client/v3from 3.5.21 to 3.6.12Release notes
Sourced from