Skip to content

chore(deps): bump the common group across 1 directory with 19 updates #10050

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
dependabot wants to merge 2 commits into from
Closed

chore(deps): bump the common group across 1 directory with 19 updates #10050

dependabot wants to merge 2 commits into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 14, 2026 •
edited
Loading

Bumps the common group with 18 updates in the / directory:

Package From To
github.com/BurntSushi/toml 1.5.0 1.6.0
github.com/GoogleCloudPlatform/docker-credential-gcr/v2 2.1.30 2.1.31
github.com/bmatcuk/doublestar/v4 4.9.1 4.9.2
github.com/containerd/containerd/v2 2.2.0 2.2.1
github.com/gocsaf/csaf/v3 3.5.0 3.5.1
github.com/hashicorp/go-getter 1.8.3 1.8.4
github.com/open-policy-agent/opa 1.11.0 1.12.2
github.com/secure-systems-lab/go-securesystemslib 0.9.1 0.10.0
github.com/spdx/tools-golang 0.5.5 0.5.7
github.com/tetratelabs/wazero 1.10.1 1.11.0
github.com/zclconf/go-cty-yaml 1.1.0 1.2.0
golang.org/x/mod 0.31.0 0.32.0
golang.org/x/term 0.38.0 0.39.0
golang.org/x/text 0.32.0 0.33.0
helm.sh/helm/v3 3.19.2 3.19.4
modernc.org/sqlite 1.40.1 1.43.0
github.com/nikolalohinski/gonja/v2 2.4.2 2.5.1

Updates github.com/BurntSushi/toml from 1.5.0 to 1.6.0

Release notes

Sourced from github.com/BurntSushi/toml's releases.

v1.6.0

TOML 1.1 is now enabled by default. The TOML changelog has an overview of changes: https://github.com/toml-lang/toml/blob/main/CHANGELOG.md

Also two small fixes:

  • Encode large floats as exponent syntax so that round-tripping things like 5e+22 is correct.

  • Using duplicate array keys would not give an error:

    arr = [1]
arr = [2]

    This will now correctly give a "Key 'arr' has already been defined" error.

Commits
  • 5253492 Enable TOML 1.1 by default (#457)
  • e954445 Reject duplicate arrays (#455)
  • 6b16cbd Update toml-test test cases from upstream (#456)
  • 011fa2b Ensure constant format strings in wf calls
  • 4b439bf Remove itemNil
  • a473c12 Add test for out of range float64
  • b535ff8 Add some boring tests for lex.go
  • 6011ef0 Remove unreachable condition in lexTableNameStart
  • c8ca9e6 Remove unreachable condition
  • 1121f81 Make tomlv read from stdin
  • Additional commits viewable in compare view

Updates github.com/GoogleCloudPlatform/docker-credential-gcr/v2 from 2.1.30 to 2.1.31

Release notes

Sourced from github.com/GoogleCloudPlatform/docker-credential-gcr/v2's releases.

v2.1.31

What's Changed

Full Changelog: GoogleCloudPlatform/docker-credential-gcr@v2.1.30...v2.1.31

Commits

Updates github.com/bmatcuk/doublestar/v4 from 4.9.1 to 4.9.2

Release notes

Sourced from github.com/bmatcuk/doublestar/v4's releases.

Fixed Handling of Paths With Meta Chars Using Alts

@​toga4 submitted a PR that fixed a small bug with the way paths were handled when the pattern used {alts}: if some part of the on-disk path that came before the {alt} included meta characters (say, a directory name that included the character ?), these meta characters were not escaped when they were passed back through the globbing routines. This caused doublestar to interpret them as actual meta characters, rather than a fixed-string path as it should have. Nice find, @​toga4 !

What's Changed

New Contributors

Full Changelog: bmatcuk/doublestar@v4.9.1...v4.9.2

Commits
  • 3dc8306 Merge branch 'toga4-fix-brace-exp-with-meta'
  • 4db19e2 fix tests
  • 4ef2b00 fix: escape meta characters in paths during brace expansion
  • b191bb9 test: add failing tests for brace expansion with meta char directories
  • 9fded31 notes about globbing
  • See full diff in compare view

Updates github.com/containerd/containerd/v2 from 2.2.0 to 2.2.1

Release notes

Sourced from github.com/containerd/containerd/v2's releases.

containerd 2.2.1

Welcome to the v2.2.1 release of containerd!

The first patch release for containerd 2.2 contains various fixes and improvements.

Highlights

Container Runtime Interface (CRI)

  • Redact all query parameters in CRI error logs (#12546)

Image Distribution

  • Fix image defaults on Darwin to usable configuration (#12544)
  • Fix possible panic from WithMediaTypeKeyPrefix (#12516)

Runtime

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

  • Krisztian Litkey
  • Markus Lehtonen
  • Akihiro Suda
  • Mike Brown
  • Sebastiaan van Stijn
  • Derek McGowan
  • Heran Yang
  • Wei Fu
  • Phil Estes
  • Samuel Karp
  • Austin Vazquez
  • Sascha Grunert
  • Akhil Mohan
  • Andrey Noskov
  • Brian Goff
  • CrazyMax
  • Davanum Srinivas
  • Gaurav Ghildiyal
  • Neeraj Krishna Gopalakrishna
  • Paweł Gronowski
  • Tariq Ibrahim
  • TomerLev
  • Tõnis Tiigi
  • bo.jiang

... (truncated)

Commits
  • dea7da5 Merge pull request #12677 from dmcgowan/prepare-2.2.1
  • f6bae1f Prepare release notes for v2.2.1
  • b77253f Merge pull request #12701 from k8s-infra-cherrypick-robot/cherry-pick-12699-t...
  • c22cf5d cri,nri: pass any linux security profile to plugins.
  • d7532de cri,nri: pass any linux RDT constraints to plugins.
  • ef36e61 cri,nri: pass any linux net devices to plugins.
  • d56faf4 cri,nri: pass any linux scheduler attributes to plugins.
  • e1824d2 cri,nri: pass any linux I/O priority to plugins.
  • 01d5490 go.{mod,sum}: bump NRI deps to v0.11.0, re-vendor.
  • 815932a Merge pull request #12697 from thaJeztah/release_2.2_backport_bump_semconv
  • Additional commits viewable in compare view

Updates github.com/gocsaf/csaf/v3 from 3.5.0 to 3.5.1

Release notes

Sourced from github.com/gocsaf/csaf/v3's releases.

v3.5.1

This is minor fix correcting a wrong validation test around the name and version of the engine.

What's Changed

New Contributors

Full Changelog: gocsaf/csaf@v3.5.0...v3.5.1

Commits

Updates github.com/hashicorp/go-getter from 1.8.3 to 1.8.4

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.8.4

What's Changed

New Contributors

Full Changelog: hashicorp/go-getter@v1.8.3...v1.8.4

Commits
  • 576ab86 [chore] : Bump the go group across 1 directory with 12 updates (#575)
  • efec2db Merge pull request #574 from hashicorp/dependabot/github_actions/actions-36c6...
  • 7ccb947 [chore] : Bump the actions group across 1 directory with 6 updates
  • 228ad65 fix: allow downloading S3 files from MinIO over http (#570)
  • 5cb8b18 Merge pull request #567 from hashicorp/dependabot/github_actions/actions-92ca...
  • f358fa6 Merge pull request #571 from hashicorp/compliance/update-headers
  • 376d40c [COMPLIANCE] Update Copyright and License Headers
  • 9d34fba [chore] : Bump the actions group across 1 directory with 3 updates
  • fd63a33 Merge pull request #566 from hashicorp/compliance/update-headers
  • ac8218d [COMPLIANCE] Update Copyright and License Headers
  • Additional commits viewable in compare view

Updates github.com/open-policy-agent/opa from 1.11.0 to 1.12.2

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.12.2

This bug fix release address issues found in the new string interpolation feature

v1.12.1

This bug fix release reverts a change to regex.replace that unintentionally changed its behaviour for anchored regular expressions.

  • Revert "topdown: make regex.replace respect cancellation" (authored by @​srenatus)

v1.12.0

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Support for String Interpolation in the Rego language
  • Faster compilation and runtime
  • Fixes published in the v1.11.1 release

String Interpolation (#4733)

The Rego language has been extended to support String Interpolation, which provides a readable means to compose strings containing dynamic values determined at evaluation time.

An interpolated string is composed of a template-string containing zero or more template-expressions that evaluates to a value at evaluation time. The $ character prefix identifies a template-string, and template-expressions are declared by being enclosed in curly-braces ({, }).

Additionally, undefined template-expression values don't halt evaluation; instead, <undefined> will be injected into the generated string.

package interpolation
allowed_roles := ["admin", "employee"]
default role := "guest"
role := input.role
deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
not role in allowed_roles
}

{
</tr></table>

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.12.2

This bug fix release address issues found in the new string interpolation feature

1.12.1

This bug fix release reverts a change to regex.replace that unintentionally changed its behaviour for anchored regular expressions.

  • Revert "topdown: make regex.replace respect cancellation" (authored by @​srenatus)

1.12.0

This release contains a mix of new features, performance improvements, and bugfixes. Notably:

  • Support for string interpolation in the Rego language
  • Faster compilation and runtime
  • Fixes published in the v1.11.1 release

String Interpolation (#4733)

The Rego language has been extended to support String Interpolation, which provides a readable means to compose strings containing dynamic values determined at evaluation time.

An interpolated string is composed of a template-string containing zero or more template-expressions that evaluates to a value at evaluation time. The $ character prefix identifies a template-string, and template-expressions are declared by being enclosed in curly-braces ({, }).

Additionally, undefined template-expression values don't halt evaluation; instead, <undefined> will be injected into the generated string.

package interpolation
allowed_roles := ["admin", "employee"]
default role := "guest"
role := input.role
deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
not role in allowed_roles
}

{
  "deny": [
    "User <undefined>'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
</tr></table>

... (truncated)

Commits

Updates github.com/secure-systems-lab/go-securesystemslib from 0.9.1 to 0.10.0

Commits
  • 93d7e1c Merge pull request #139 from secure-systems-lab/dependabot/github_actions/gol...
  • b2fe7df Merge pull request #138 from secure-systems-lab/dependabot/github_actions/act...
  • 7e9f79e chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.2.0
  • 1552d12 chore(deps): bump actions/setup-go from 5.5.0 to 6.1.0
  • d1d5111 Merge pull request #137 from secure-systems-lab/dependabot/go_modules/golang....
  • 04d651e Merge pull request #136 from secure-systems-lab/dependabot/github_actions/act...
  • 145f8c2 chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0
  • e8de185 Merge pull request #127 from secure-systems-lab/dependabot/go_modules/github....
  • a50b13e chore(deps): bump actions/checkout from 6.0.0 to 6.0.1
  • c24bdce chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1
  • Additional commits viewable in compare view

Updates github.com/spdx/tools-golang from 0.5.5 to 0.5.7

Release notes

Sourced from github.com/spdx/tools-golang's releases.

v0.5.7

What's Changed

New Contributors

Full Changelog: spdx/tools-golang@v0.5.6...v0.5.7

v0.5.6

What's Changed

New Contributors

Full Changelog: spdx/tools-golang@v0.5.5...v0.5.6

Commits
  • 28116d2 fix: fail parsing if the required prefix isn't present for IDs (#275)
  • 3d64f16 build(deps): Bump actions/checkout from 5 to 6 (#271)
  • 254d7a7 fix: Fix prefixDocumentId() to use correct prefix (#272)
  • e6786a8 fix: ExternalDocumentRef in JSON serialization (#269)
  • 49501ad build(deps): Bump github.com/anchore/go-struct-converter from 0.0.0-202211181...
  • e95cf7f build(deps): Bump sigs.k8s.io/yaml from 1.5.0 to 1.6.0 (#259)
  • eabe60c build(deps): Bump actions/checkout from 4 to 5 (#260)
  • 72d8e33 build(deps): Bump github.com/stretchr/testify from 1.10.0 to 1.11.1 (#264)
  • d6b5d35 build(deps): Bump actions/setup-go from 5 to 6 (#265)
  • 916d962 build(deps): Bump sigs.k8s.io/yaml from 1.4.0 to 1.5.0 (#258)
  • Additional commits viewable in compare view

Updates github.com/tetratelabs/wazero from 1.10.1 to 1.11.0

Release notes

Sourced from github.com/tetratelabs/wazero's releases.

v1.11.0

Hi wazero friends! The new release of wazero v1.11.0 has arrived.

This release is a small "break with the past" it the sense that we added one go.mod dependency to wazero: golang.org/x/sys; read the rational for why.

Behavioral changes

Bug fixes

New Contributors

Full Changelog: wazero/wazero@v1.10.1...v1.11.0

Commits

Updates github.com/zclconf/go-cty-yaml from 1.1.0 to 1.2.0

Changelog

Sourced from github.com/zclconf/go-cty-yaml's changelog.

1.2.0 (December 17, 2025)

  • The YAML decoder now has more complete support for tag:yaml.org,2002:merge, including support for merging a sequence of mappings rather than just a single mapping.

    Unfortunately the specification for this tag is terse and incomplete, and other existing implementations disagree even with the few behaviors that are described in the specification, so this library implements behavior that matches existing implementations while diverging slightly from the spec:

    • The untagged scalar value << is resolved as tag:yaml.org,2002:merge only in the mapping key position. In all other positions it's resolved as a normal string, "<<". Writing out the tag explicitly instead of using the shorthand is allowed in mapping key position and rejected as an error in all other positions.
    • Multiple merge keys can appear in the same mapping, and will each be handled separately as if they had all been written as a single merge.
    • Later mentions of a key override earlier mentions of a key in all cases. This is the main deviation from the spec text: the spec requires that the earliest mention of each key takes priority when merging, but that is the opposite of the normal behavior for duplicate keys in a mapping (without merging) and other implementations seem to ignore that exception.

    There are a few other implementations that disagree with what this library implements. That's unfortunate, but unavoidable because existing implementations are in conflict with one another already. The choices in this implementation were based on a survey of various other popular implementatins and will not be changed in a breaking way after this release.

Commits

Updates golang.org/x/mod from 0.31.0 to 0.32.0

Commits

Updates golang.org/x/term from 0.38.0 to 0.39.0

Commits

Updates golang.org/x/text from 0.32.0 to 0.33.0

Commits

Updates helm.sh/helm/v3 from 3.19.2 to 3.19.4

Release notes

Sourced from helm.sh/helm/v3's releases.

Helm v3.19.4 is a security fix for a Go CVE in the previous tag. This patch release rebuilds the Helm v3.19.3 release with the latest Go toolchain, to fix the Go CVE. Users are encouraged to upgrade.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v3.19.4. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 3.19.5 and 4.0.4 are the next patch releases and will be on January 14, 2026
  • 3.20.0 and 4.1.0 is the next minor releases and will be on January 21, 2026

Changelog

  • Use latest patch release of Go in releases 7cfb6e486dac026202556836bb910c37d847793e (Matt Farina)
  • chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0 59c951f309511dcb017900b6a19836e5bcbade04 (dependabot[bot])
  • chore(deps): bump github.com/cyphar/filepath-securejoin d45f3f15dfbc05320add596102ce3ae220825ff1 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 d4595449c7bd2a82f1ae23b11711f2b7b219ed32 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 becd3876eb126cb83d8571e6e3826645e941d400 (dependabot[bot])
  • chore(deps): bump the k8s-io group with 7 updates edb1579fd0d9ed81fb451ce03c68bd6365374173 (dependabot[bot])

Helm v3.19.3 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

... (truncated)

Commits
  • 7cfb6e4 Use latest patch release of Go in releases
  • 59c951f chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0
  • d45f3f1 chore(deps): bump github.com/cyphar/filepath-securejoin
  • d459544 chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
  • becd387 chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0
  • edb1579 chore(deps): bump the k8s-io group with 7 updates
  • See full diff in compare view

Updates k8s.io/utils from 0.0.0-20250820121507-0af2bda4dd1d to 0.0.0-20251002143259-bc988d571ff4

Commits

Updates modernc.org/sqlite from 1.40.1 to 1.43.0

Commits

Updates github.com/nikolalohinski/gonja/v2 from 2.4.2 to 2.5.1

Commits
  • 8cd324e fix: make sure int to float comparison behave correctly
  • c31cb4e feat(builtins): add missing builtin tests for python parity
  • e85c8b1 adding support to supress logging
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the common group across 1 directory with 19 updates
413c831 
Bumps the common group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml) | `1.5.0` | `1.6.0` |
| [github.com/GoogleCloudPlatform/docker-credential-gcr/v2](https://github.com/GoogleCloudPlatform/docker-credential-gcr) | `2.1.30` | `2.1.31` |
| [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar) | `4.9.1` | `4.9.2` |
| [github.com/containerd/containerd/v2](https://github.com/containerd/containerd) | `2.2.0` | `2.2.1` |
| [github.com/gocsaf/csaf/v3](https://github.com/gocsaf/csaf) | `3.5.0` | `3.5.1` |
| [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter) | `1.8.3` | `1.8.4` |
| [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.11.0` | `1.12.2` |
| [github.com/secure-systems-lab/go-securesystemslib](https://github.com/secure-systems-lab/go-securesystemslib) | `0.9.1` | `0.10.0` |
| [github.com/spdx/tools-golang](https://github.com/spdx/tools-golang) | `0.5.5` | `0.5.7` |
| [github.com/tetratelabs/wazero](https://github.com/tetratelabs/wazero) | `1.10.1` | `1.11.0` |
| [github.com/zclconf/go-cty-yaml](https://github.com/zclconf/go-cty-yaml) | `1.1.0` | `1.2.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.31.0` | `0.32.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.38.0` | `0.39.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.32.0` | `0.33.0` |
| [helm.sh/helm/v3](https://github.com/helm/helm) | `3.19.2` | `3.19.4` |
| [k8s.io/api](https://github.com/kubernetes/api) | `0.34.2` | `0.35.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.40.1` | `1.43.0` |
| [github.com/nikolalohinski/gonja/v2](https://github.com/nikolalohinski/gonja) | `2.4.2` | `2.5.1` |



Updates `github.com/BurntSushi/toml` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/BurntSushi/toml/releases)
- [Commits](BurntSushi/toml@v1.5.0...v1.6.0)

Updates `github.com/GoogleCloudPlatform/docker-credential-gcr/v2` from 2.1.30 to 2.1.31
- [Release notes](https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases)
- [Commits](GoogleCloudPlatform/docker-credential-gcr@v2.1.30...v2.1.31)

Updates `github.com/bmatcuk/doublestar/v4` from 4.9.1 to 4.9.2
- [Release notes](https://github.com/bmatcuk/doublestar/releases)
- [Commits](bmatcuk/doublestar@v4.9.1...v4.9.2)

Updates `github.com/containerd/containerd/v2` from 2.2.0 to 2.2.1
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](containerd/containerd@v2.2.0...v2.2.1)

Updates `github.com/gocsaf/csaf/v3` from 3.5.0 to 3.5.1
- [Release notes](https://github.com/gocsaf/csaf/releases)
- [Changelog](https://github.com/gocsaf/csaf/blob/main/docs/release-process-hints.md)
- [Commits](gocsaf/csaf@v3.5.0...v3.5.1)

Updates `github.com/hashicorp/go-getter` from 1.8.3 to 1.8.4
- [Release notes](https://github.com/hashicorp/go-getter/releases)
- [Commits](hashicorp/go-getter@v1.8.3...v1.8.4)

Updates `github.com/open-policy-agent/opa` from 1.11.0 to 1.12.2
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](open-policy-agent/opa@v1.11.0...v1.12.2)

Updates `github.com/secure-systems-lab/go-securesystemslib` from 0.9.1 to 0.10.0
- [Release notes](https://github.com/secure-systems-lab/go-securesystemslib/releases)
- [Commits](secure-systems-lab/go-securesystemslib@v0.9.1...v0.10.0)

Updates `github.com/spdx/tools-golang` from 0.5.5 to 0.5.7
- [Release notes](https://github.com/spdx/tools-golang/releases)
- [Changelog](https://github.com/spdx/tools-golang/blob/main/RELEASE-NOTES.md)
- [Commits](spdx/tools-golang@v0.5.5...v0.5.7)

Updates `github.com/tetratelabs/wazero` from 1.10.1 to 1.11.0
- [Release notes](https://github.com/tetratelabs/wazero/releases)
- [Commits](wazero/wazero@v1.10.1...v1.11.0)

Updates `github.com/zclconf/go-cty-yaml` from 1.1.0 to 1.2.0
- [Changelog](https://github.com/zclconf/go-cty-yaml/blob/master/CHANGELOG.md)
- [Commits](zclconf/go-cty-yaml@v1.1.0...v1.2.0)

Updates `golang.org/x/mod` from 0.31.0 to 0.32.0
- [Commits](golang/mod@v0.31.0...v0.32.0)

Updates `golang.org/x/term` from 0.38.0 to 0.39.0
- [Commits](golang/term@v0.38.0...v0.39.0)

Updates `golang.org/x/text` from 0.32.0 to 0.33.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.32.0...v0.33.0)

Updates `helm.sh/helm/v3` from 3.19.2 to 3.19.4
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](helm/helm@v3.19.2...v3.19.4)

Updates `k8s.io/api` from 0.34.2 to 0.35.0
- [Commits](kubernetes/api@v0.34.2...v0.35.0)

Updates `k8s.io/utils` from 0.0.0-20250820121507-0af2bda4dd1d to 0.0.0-20251002143259-bc988d571ff4
- [Commits](https://github.com/kubernetes/utils/commits)

Updates `modernc.org/sqlite` from 1.40.1 to 1.43.0
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.40.1...v1.43.0)

Updates `github.com/nikolalohinski/gonja/v2` from 2.4.2 to 2.5.1
- [Commits](NikolaLohinski/gonja@v2.4.2...v2.5.1)

---
updated-dependencies:
- dependency-name: github.com/BurntSushi/toml
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/GoogleCloudPlatform/docker-credential-gcr/v2
  dependency-version: 2.1.31
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: github.com/bmatcuk/doublestar/v4
  dependency-version: 4.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: github.com/containerd/containerd/v2
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: github.com/gocsaf/csaf/v3
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: github.com/hashicorp/go-getter
  dependency-version: 1.8.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: github.com/open-policy-agent/opa
  dependency-version: 1.12.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/secure-systems-lab/go-securesystemslib
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/spdx/tools-golang
  dependency-version: 0.5.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: github.com/tetratelabs/wazero
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/zclconf/go-cty-yaml
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: golang.org/x/mod
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: golang.org/x/term
  dependency-version: 0.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: golang.org/x/text
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.19.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: k8s.io/api
  dependency-version: 0.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: k8s.io/utils
  dependency-version: 0.0.0-20251002143259-bc988d571ff4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: common
- dependency-name: modernc.org/sqlite
  dependency-version: 1.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
- dependency-name: github.com/nikolalohinski/gonja/v2
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: common
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jan 14, 2026
@dependabot dependabot bot requested a review from knqyf263 as a code owner January 14, 2026 09:27
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jan 14, 2026
@DmitriyLewen
Copy link
Contributor

DmitriyLewen commented Jan 19, 2026

Kubernetes removed v1alpha1 in k8s.io/[email protected].

But helm.sh/helm/v3 (versions v3.19.4 and v3.19.5) still uses k8s.io/[email protected] and v1alpha1.
So we can't bump k8s.io/api to v0.35.0 without changes in helm.sh/helm/v3.

Removed updating k8s.io/api to v0.35.0 in fc6c5d5

@DmitriyLewen
Copy link
Contributor

DmitriyLewen commented Jan 19, 2026 •
edited
Loading

@nikpivkin, could you take a look at the update for github.com/open-policy-agent/opa?
Test_RegoScanning_WithSomeInvalidPolicies/allow_up_to_max_1_error fails after the update:
https://github.com/aquasecurity/trivy/actions/runs/21130691957/job/60766061144#step:9:7564

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 19, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Jan 19, 2026
@dependabot dependabot bot deleted the dependabot/go_modules/common-aa7a737a74 branch January 19, 2026 16:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@knqyf263 knqyf263 Awaiting requested review from knqyf263 knqyf263 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@DmitriyLewen