Skip to content

Bump the go_modules group across 2 directories with 12 updates #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: devel
Choose a base branch
from
Open

Bump the go_modules group across 2 directories with 12 updates #1

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Nov 3, 2025

Bumps the go_modules group with 10 updates in the / directory:

Package From To
github.com/btcsuite/btcd 0.22.3 0.24.2
github.com/consensys/gnark-crypto 0.12.1 0.18.1
github.com/docker/docker 24.0.5+incompatible 25.0.13+incompatible
github.com/ethereum/go-ethereum 1.13.5 1.13.15
github.com/go-chi/chi/v5 5.0.11 5.2.2
github.com/golang-jwt/jwt/v4 4.5.0 4.5.2
github.com/rs/cors 1.10.1 1.11.0
github.com/vektah/gqlparser/v2 2.5.10 2.5.15
google.golang.org/protobuf 1.32.0 1.33.0
github.com/quic-go/quic-go 0.42.0 0.49.1

Bumps the go_modules group with 2 updates in the /erigon-lib directory: github.com/consensys/gnark-crypto and google.golang.org/protobuf.

Updates github.com/btcsuite/btcd from 0.22.3 to 0.24.2

Release notes

Sourced from github.com/btcsuite/btcd's releases.

v0.24.2

This release includes important bug fixes related to subtle interactions related to re-orgs and the UTXO set cache. These fixed are considered security critical.

This release also includes implementations of invalidateblock and reconsiderblock which can be useful in helping nodes that were afflicted by the aforementioned bugs to recover without needing to resync the entire chain.

WIth this release, btcd now also implements the testmempoolaccept RPC which can be useful to check a transaction candidate for validity from a policy and conflict perspective before broadcasting. Along the way, we've added some additional policy checks that exist in other Bitcoin full node implementations.

This release also contains fixes to some parsing issues discovered via fuzz testing.

Finally, as mentioned above release includes important security fixes, with full details to be disclosed in 90 days.

What's Changed

... (truncated)

Commits

Updates github.com/consensys/gnark-crypto from 0.12.1 to 0.18.1

Release notes

Sourced from github.com/consensys/gnark-crypto's releases.

v0.18.1

Full Changelog: Consensys/gnark-crypto@v0.18.0...v0.18.1

v0.18.0

What's Changed

New Contributors

Full Changelog: Consensys/gnark-crypto@v0.17.0...v0.18.0

v0.17.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from github.com/consensys/gnark-crypto's changelog.

[v0.18.1] - 2025-10-23

Perf

  • limit memory allocation during Vector deserialization (#759)

[v0.18.0] - 2025-06-09

Build

  • deps: bump golang.org/x/crypto from 0.33.0 to 0.35.0 (#677)

Chore

  • remove unused benchmark script (#675)

Docs

  • replace outdated link to article (#690)

Experiment

  • vortex on koalabear (#645)

Feat

  • remove dependency on internal package in ecc.go (#693)
  • make <31 bit field generated using uint32 (#676)

Fix

  • remove unimplemented path from fft ext
  • Eisenstein Half-GCD convergence (#680)

Perf

  • adds avx512 poseidon2 for small fields (#665)
  • remove useless copies in e4 mul by elem (#667)
  • disable cobra bit reverse for small fields (#662)

Refactor

  • hash to curve (#674)

[v0.17.0] - 2025-03-11

Chore

  • remove useless github workflow
  • generify poseidon2 parameters for other curves/fr (#636)
  • add auto close PR workflow (#638)

Feat

  • baby-bear and koala-bear extensions of degree 4 (#643)
  • poseidon2 for koala-bear, baby-bear and goldilocks (#629)
  • add sis avx512 and fft avx512 for koalabear (#622)
  • add Grumpkin elliptic curve (2-cycle with BN254) (#625)
  • Poseidon2 Hash Instantiation for BLS12-377 (#623)

... (truncated)

Commits

Updates github.com/docker/docker from 24.0.5+incompatible to 25.0.13+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

v25.0.13

25.0.13

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

Bug fixes and enhancements

  • Prevent restoration of iptables rules for deleted networks and containers on firewalld reload. moby/moby#50445
  • Fix Swarm services becoming unreachable from published ports after a firewalld reload. moby/moby#50445
  • Improve the reliability of the Swarm overlay network control plane by fixing longstanding issues with NetworkDB. moby/moby#50511
  • Improve the reliability of Swarm overlay container networks by fixing longstanding issues with the overlay network driver. moby/moby#50551

v25.0.12

25.0.12

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

Bug fixes and enhancements

  • Fix an issue where all new tasks in the Swarm could get stuck in the PENDING state forever after scaling up a service with placement preferences. moby/moby#50203
  • Fix an issue which made DNS service discovery for Swarm services unreliable. moby/moby#50230

Packaging updates

v25.0.11

25.0.11

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

Networking

Known Issues

Full Changelog: moby/moby@v25.0.10...v25.0.11

v25.0.10

25.0.10

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

... (truncated)

Commits
  • 165516e Merge pull request #50551 from corhere/backport-25.0/libn/all-the-overlay-fixes
  • f099e91 libnetwork: handle coalesced endpoint events
  • bace1b8 libnetwork/d/overlay: handle coalesced peer updates
  • f9e5429 libn/d/win/overlay: dedupe NetworkDB definitions
  • fc3df55 libn/d/overlay: extract hashable address types
  • b22872a libnetwork/driverapi: make EventNotify optional
  • c7e17ae libn/networkdb: report prev value in update events
  • d60c71a libnetwork/d/overlay: fix logical race conditions
  • ad54b8f libn/d/overlay: fix encryption race conditions
  • 8075689 libn/d/overlay: inline secMapWalk into only caller
  • Additional commits viewable in compare view

Updates github.com/ethereum/go-ethereum from 1.13.5 to 1.13.15

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Ontamalca (v1.13.15)

Geth v1.13.15 is a maintenance-release that contains some fixes mainly to avoid snapsync-related data-corruption.

We recommend all users to upgrade to v1.13.15 as soon as possible.

As with all our previous releases, you can find the:

Altaaya (v1.13.14)

Geth v1.13.14 is a small maintenance release with a handful of polishes to the blob pool:

  • Disallow blob transactions below the protocol minimum of 1 wei to enter the pool (#29081).
  • Reduce the blob pool's max capacity to 2.5GB for the rollout. (#29090).
  • Fix gas estimation for blob transactions (#29085).

This release is NOT critical for the Cancun fork, but recommended to make Geth lighter in anticipation to unknown blob load.

Other fixes:

  • Support overriding the basefee during tracing (#29051).
  • Fix call tracers missing top level logs in top-only mode (#29068).
  • Support unlimited gas for eth_createAccessList if --gascap=0 (#28846).

For a full rundown of the changes please consult the Geth 1.13.14 release milestone.

As with all our previous releases, you can find the:

Alsages (v1.13.13)

This is a minor release with fixes for several issues related to the upcoming Cancun mainnet fork. As such, it is recommended for all mainnet users.

Changes in this release:

  • Block-building performance with blob transactions has been improved a lot. (#29026, #29008, #29005)
  • A corner case in the EVM related to out-of-order fork scheduling has been fixed. (#29023)
  • eth_fillTransaction has seen some bug fixes related to blob transactions as well. (#28929, #29037)
  • A rare panic in the ethstats client related to chain reorgs is resolved. (#29020)
  • The blobpool database will now recover from disk corruption faults instead of crashing geth on startup. (#29001)

... (truncated)

Commits
  • c5ba367 params: release Geth v 1.13.15
  • 35e0525 core, eth/protocols/snap, trie: fix cause for snap-sync corruption, implement...
  • 7bcb553 eth/filters: enforce topic-limit early on filter criterias (#29535)
  • e343ddf core/rawdb: add sanity-limit to header accessor (#29534)
  • 5dcf503 eth/protocols/snap: skip retrieval for completed storages (#29378)
  • 2bd6bd0 Merge branch 'master' into release/1.13
  • 9038ba6 params: release Geth v1.13.14
  • 51b479e core/txpool: elevate the 'already reserved' error into a constant (#29095)
  • 5a0f468 eth/tracers: Fix callTracer logs on onlyTopCall == true (#29068)
  • 45a272c core/txpool: no need to log loud rotate if no local txs (#29083)
  • Additional commits viewable in compare view

Updates github.com/go-chi/chi/v5 from 5.0.11 to 5.2.2

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.2.2

What's Changed

Security fix

  • Fixes GHSA-vrw8-fxc6-2r93 - "Host Header Injection Leads to Open Redirect in RedirectSlashes" commit
    • a lower-severity Open Redirect that can't be exploited in browser or email client, as it requires manipulation of a Host header
    • reported by Anuraag Baishya, @​anuraagbaishya. Thank you!

New Contributors

Full Changelog: go-chi/chi@v5.2.1...v5.2.2

v5.2.1

⚠️ Chi supports Go 1.20+

Starting this release, we will now support the four most recent major versions of Go. See go-chi/chi#963 for related discussion.

What's Changed

Full Changelog: go-chi/chi@v5.2.0...v5.2.1

v5.2.0

What's Changed

... (truncated)

Changelog

Sourced from github.com/go-chi/chi/v5's changelog.

Changelog

v5.0.12 (2024-02-16)

Commits

Updates github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.2

Release notes

Sourced from github.com/golang-jwt/jwt/v4's releases.

v4.5.2

See GHSA-mh63-6h87-95cp

Full Changelog: golang-jwt/jwt@v4.5.1...v4.5.2

v4.5.1

Security

Unclear documentation of the error behavior in ParseWithClaims in <= 4.5.0 could lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

This issue was documented in GHSA-29wx-vh33-7x7r and fixed in this release.

Note: v5 was not affected by this issue. So upgrading to this release version is also recommended.

What's Changed

  • Back-ported error-handling logic in ParseWithClaims from v5 branch. This fixes GHSA-29wx-vh33-7x7r.

Full Changelog: golang-jwt/jwt@v4.5.0...v4.5.1

Commits

Updates github.com/rs/cors from 1.10.1 to 1.11.0

Commits
  • 4c32059 Normalize allowed request headers and store them in a sorted set (fixes #170)...
  • 8d33ca4 Complete documentation; deprecate AllowOriginRequestFunc in favour of AllowOr...
  • af821ae Merge branch 'jub0bs-master'
  • 0bcf73f Update benchmark
  • eacc8e8 Fix skewed middleware benchmarks (#165)
  • 9297f15 Respect the documented precedence of options (#163)
  • 73f81b4 Fix readme benchmark rendering (#161)
  • See full diff in compare view

Updates github.com/vektah/gqlparser/v2 from 2.5.10 to 2.5.15

Release notes

Sourced from github.com/vektah/gqlparser/v2's releases.

v2.5.15

What's Changed

Full Changelog: vektah/gqlparser@v2.5.14...v2.5.15

v2.5.14

What's Changed

Full Changelog: vektah/gqlparser@v2.5.13...v2.5.14

v2.5.13

What's Changed

New Contributors

Full Changelog: vektah/gqlparser@v2.5.12...v2.5.13

v2.5.12

What's Changed

New Contributors

Full Changelog: vektah/gqlparser@v2.5.11...v2.5.12

v2.5.11

What's Changed

New Contributors

... (truncated)

Commits
  • 55a3c47 Revert ParseSchema default token limit of 1500, add ParseSchemaWithLimit, Par...
  • 36a3658 Add ParseQueryWithLimit (#304)
  • d457fc0 Token limit fix CVE-2023-49559 (#291)
  • 6db1bd3 Bump braces from 3.0.2 to 3.0.3 in /validator/imported (#302)
  • 3900414 Bump the actions-deps group in /validator/imported with 7 updates (#301)
  • 7c770f6 Bump prettier in /validator/imported in the actions-deps group (#299)
  • 0ed4973 Bump the actions-deps group in /validator/imported with 6 updates (#298)
  • 00fd36f Bump the actions-deps group in /validator/imported with 8 updates (#297)
  • 9638a21 Bump github.com/stretchr/testify in the actions-deps group (#296)
  • 55ebe37 Add Dependabot.yml
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.19.0 to 0.35.0

Commits
  • 7292932 ssh: limit the size of the internal packet queue while waiting for KEX
  • f66f74b acme/autocert: check host policy before probing the cache
  • b0784b7 x509roots/fallback: drop obsolete build constraint
  • 911360c all: bump golang.org/x/crypto dependencies of asm generators
  • 89ff08d all: upgrade go directive to at least 1.23.0 [generated]
  • e47973b all: update certs for go1.24
  • 9290511 go.mod: update golang.org/x dependencies
  • fa5273e x509roots/fallback: update bundle
  • a8ea4be ssh: add ServerConfig.PreAuthConnCallback, ServerPreAuthConn (banner) interface
  • 71d3a4c acme: support challenges that require the ACME client to send a non-empty JSO...
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.21.0 to 0.25.0

Commits
  • d27919b go.mod: update golang.org/x dependencies

@dependabot
Bump the go_modules group across 2 directories with 12 updates
c26e397 
Bumps the go_modules group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/btcsuite/btcd](https://github.com/btcsuite/btcd) | `0.22.3` | `0.24.2` |
| [github.com/consensys/gnark-crypto](https://github.com/consensys/gnark-crypto) | `0.12.1` | `0.18.1` |
| [github.com/docker/docker](https://github.com/docker/docker) | `24.0.5+incompatible` | `25.0.13+incompatible` |
| [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum) | `1.13.5` | `1.13.15` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.0.11` | `5.2.2` |
| [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) | `4.5.0` | `4.5.2` |
| [github.com/rs/cors](https://github.com/rs/cors) | `1.10.1` | `1.11.0` |
| [github.com/vektah/gqlparser/v2](https://github.com/vektah/gqlparser) | `2.5.10` | `2.5.15` |
| google.golang.org/protobuf | `1.32.0` | `1.33.0` |
| [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) | `0.42.0` | `0.49.1` |

Bumps the go_modules group with 2 updates in the /erigon-lib directory: [github.com/consensys/gnark-crypto](https://github.com/consensys/gnark-crypto) and google.golang.org/protobuf.


Updates `github.com/btcsuite/btcd` from 0.22.3 to 0.24.2
- [Release notes](https://github.com/btcsuite/btcd/releases)
- [Changelog](https://github.com/btcsuite/btcd/blob/master/CHANGES)
- [Commits](btcsuite/btcd@v0.22.3...v0.24.2)

Updates `github.com/consensys/gnark-crypto` from 0.12.1 to 0.18.1
- [Release notes](https://github.com/consensys/gnark-crypto/releases)
- [Changelog](https://github.com/Consensys/gnark-crypto/blob/v0.18.1/CHANGELOG.md)
- [Commits](Consensys/gnark-crypto@v0.12.1...v0.18.1)

Updates `github.com/docker/docker` from 24.0.5+incompatible to 25.0.13+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](moby/moby@v24.0.5...v25.0.13)

Updates `github.com/ethereum/go-ethereum` from 1.13.5 to 1.13.15
- [Release notes](https://github.com/ethereum/go-ethereum/releases)
- [Commits](ethereum/go-ethereum@v1.13.5...v1.13.15)

Updates `github.com/go-chi/chi/v5` from 5.0.11 to 5.2.2
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.0.11...v5.2.2)

Updates `github.com/golang-jwt/jwt/v4` from 4.5.0 to 4.5.2
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md)
- [Commits](golang-jwt/jwt@v4.5.0...v4.5.2)

Updates `github.com/rs/cors` from 1.10.1 to 1.11.0
- [Commits](rs/cors@v1.10.1...v1.11.0)

Updates `github.com/vektah/gqlparser/v2` from 2.5.10 to 2.5.15
- [Release notes](https://github.com/vektah/gqlparser/releases)
- [Commits](vektah/gqlparser@v2.5.10...v2.5.15)

Updates `golang.org/x/crypto` from 0.19.0 to 0.35.0
- [Commits](golang/crypto@v0.19.0...v0.35.0)

Updates `golang.org/x/net` from 0.21.0 to 0.25.0
- [Commits](golang/net@v0.21.0...v0.25.0)

Updates `google.golang.org/protobuf` from 1.32.0 to 1.33.0

Updates `github.com/quic-go/quic-go` from 0.42.0 to 0.49.1
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.42.0...v0.49.1)

Updates `github.com/consensys/gnark-crypto` from 0.12.1 to 0.18.1
- [Release notes](https://github.com/consensys/gnark-crypto/releases)
- [Changelog](https://github.com/Consensys/gnark-crypto/blob/v0.18.1/CHANGELOG.md)
- [Commits](Consensys/gnark-crypto@v0.12.1...v0.18.1)

Updates `golang.org/x/crypto` from 0.18.0 to 0.35.0
- [Commits](golang/crypto@v0.19.0...v0.35.0)

Updates `golang.org/x/net` from 0.19.0 to 0.25.0
- [Commits](golang/net@v0.21.0...v0.25.0)

Updates `google.golang.org/protobuf` from 1.32.0 to 1.33.0

---
updated-dependencies:
- dependency-name: github.com/btcsuite/btcd
  dependency-version: 0.24.2
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/consensys/gnark-crypto
  dependency-version: 0.18.1
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/docker/docker
  dependency-version: 25.0.13+incompatible
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/ethereum/go-ethereum
  dependency-version: 1.13.15
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.2.2
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/golang-jwt/jwt/v4
  dependency-version: 4.5.2
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/rs/cors
  dependency-version: 1.11.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/vektah/gqlparser/v2
  dependency-version: 2.5.15
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.35.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/net
  dependency-version: 0.25.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.33.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.49.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/consensys/gnark-crypto
  dependency-version: 0.18.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.35.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/net
  dependency-version: 0.25.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.33.0
  dependency-type: direct:production
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant