8099e71934
build(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 ( #11419 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.56.0 to 0.57.0.
- [Commits](https://github.com/golang/crypto/compare/v0.56.0...v0.57.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.57.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-22 16:14:21 +09:00
63eb67c9da
build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts from 1.50.0 to 1.51.0 ( #11420 )
...
build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts
Bumps [github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2 ) from 1.50.0 to 1.51.0.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.50.0...service/s3/v1.51.0 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/sts
dependency-version: 1.51.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-22 15:57:37 +09:00
93efc64af6
build(deps): bump go.uber.org/atomic from 1.11.0 to 1.12.0 ( #11416 )
...
Bumps [go.uber.org/atomic](https://github.com/uber-go/atomic ) from 1.11.0 to 1.12.0.
- [Release notes](https://github.com/uber-go/atomic/releases )
- [Changelog](https://github.com/uber-go/atomic/blob/master/CHANGELOG.md )
- [Commits](https://github.com/uber-go/atomic/compare/v1.11.0...v1.12.0 )
---
updated-dependencies:
- dependency-name: go.uber.org/atomic
dependency-version: 1.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-22 15:57:29 +09:00
f2b08e47e5
build(deps): bump github.com/tarantool/go-tarantool/v3 from 3.0.1 to 3.0.2 ( #11417 )
...
build(deps): bump github.com/tarantool/go-tarantool/v3
Bumps [github.com/tarantool/go-tarantool/v3](https://github.com/tarantool/go-tarantool ) from 3.0.1 to 3.0.2.
- [Release notes](https://github.com/tarantool/go-tarantool/releases )
- [Changelog](https://github.com/tarantool/go-tarantool/blob/master/CHANGELOG.md )
- [Commits](https://github.com/tarantool/go-tarantool/compare/v3.0.1...v3.0.2 )
---
updated-dependencies:
- dependency-name: github.com/tarantool/go-tarantool/v3
dependency-version: 3.0.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-22 15:57:20 +09:00
5079d926e4
build(deps): bump cloud.google.com/go/kms from 1.33.0 to 1.34.0 ( #11418 )
...
Bumps [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go ) from 1.33.0 to 1.34.0.
- [Release notes](https://github.com/googleapis/google-cloud-go/releases )
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md )
- [Commits](https://github.com/googleapis/google-cloud-go/compare/kms/v1.33.0...dlp/v1.34.0 )
---
updated-dependencies:
- dependency-name: cloud.google.com/go/kms
dependency-version: 1.34.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-22 15:57:13 +09:00
08d5daf0c1
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.45.0 ( #11371 )
...
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
Bumps [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go ) from 1.44.0 to 1.45.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0 )
---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
dependency-version: 1.45.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Chris Lu <chrislusf@users.noreply.github.com >
2026-09-17 15:16:38 -07:00
8d34433308
build(deps): bump go.opentelemetry.io/otel/exporters/zipkin from 1.36.0 to 1.45.0 ( #11373 )
...
build(deps): bump go.opentelemetry.io/otel/exporters/zipkin
Bumps [go.opentelemetry.io/otel/exporters/zipkin](https://github.com/open-telemetry/opentelemetry-go ) from 1.36.0 to 1.45.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.36.0...v1.45.0 )
---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/exporters/zipkin
dependency-version: 1.45.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Chris Lu <chrislusf@users.noreply.github.com >
2026-09-17 15:10:51 -07:00
Chris Lu and GitHub
4fd67001d9
security: require go 1.26.6 and bump vulnerable deps ( #11374 )
...
* security: require go 1.26.6 and bump vulnerable deps
A dependency scan of the 4.47 release flagged the bundled toolchain
and modules:
- github.com/golang/go < 1.26.6 (CVE-2026-39821, CVE-2026-56853,
CVE-2026-56859, CVE-2026-56862, CVE-2026-56864, CVE-2026-56865,
CVE-2026-33818, CVE-2026-46600): raise the go directive to 1.26.6
so every built artifact requires the fixed toolchain.
- google.golang.org/grpc (CVE-2026-84445, CVE-2026-84304): move to
the fixed dev pseudo-version; released tags through v1.85.0-dev
remain in the affected range.
- github.com/pelletier/go-toml/v2 <= v2.4.2 (unbounded parser
recursion): v2.4.3.
- alpine libcrypto3/libssl3 < 3.5.8-r0 (CVE-2026-75803,
CVE-2026-63073, CVE-2026-63075, CVE-2026-63076, CVE-2026-63072,
CVE-2026-54874, CVE-2026-18798, CVE-2026-14456, CVE-2026-14457):
the release images already apk-upgrade the final stage; extend the
same to the telemetry and admin-integration images.
Same bumps applied to the test/kafka, test/sftp,
kafka-client-loadtest, and telemetry/server modules.
* telemetry: send integration test report above the 10 GiB floor
The collect endpoint keeps reports only when TotalDiskBytes >=
proto.MinDiskBytes, but the integration test still sent 1 GiB, so the
server counted the report and skipped storing it. No cluster_id series
was ever created and /metrics lacked seaweedfs_telemetry_volume_servers.
Send just above the floor (via proto.MinDiskBytes so it cannot silently
drift again) so the expected per-cluster metrics are exported.
2026-09-17 15:09:55 -07:00
c6a3280595
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.45.0 ( #11372 )
...
build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace
Bumps [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go ) from 1.44.0 to 1.45.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0 )
---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
dependency-version: 1.45.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-17 14:36:15 -07:00
01433e801d
build(deps): bump github.com/redis/go-redis/v9 from 9.21.0 to 9.22.0 ( #11306 )
...
* build(deps): bump github.com/redis/go-redis/v9 from 9.21.0 to 9.22.0
Bumps [github.com/redis/go-redis/v9](https://github.com/redis/go-redis ) from 9.21.0 to 9.22.0.
- [Release notes](https://github.com/redis/go-redis/releases )
- [Changelog](https://github.com/redis/go-redis/blob/master/RELEASE-NOTES.md )
- [Commits](https://github.com/redis/go-redis/compare/v9.21.0...v9.22.0 )
---
updated-dependencies:
- dependency-name: github.com/redis/go-redis/v9
dependency-version: 9.22.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
* test(redis_conf): track go-redis 9.22.0 default read timeout of 5s
go-redis 9.22.0 raised the default ReadTimeout from 3s to 5s (part of the
cross-SDK configuration alignment). Update TestUnsetKeepsGoRedisDefaults to
expect the new default so the bump in #11306 stops failing CI.
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Chris Lu <chris.lu@gmail.com >
2026-09-14 16:16:35 -07:00
0bd048b76f
build(deps): bump google.golang.org/api from 0.296.0 to 0.297.0 ( #11307 )
...
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client ) from 0.296.0 to 0.297.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases )
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md )
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.296.0...v0.297.0 )
---
updated-dependencies:
- dependency-name: google.golang.org/api
dependency-version: 0.297.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-14 15:09:14 -07:00
2aa6af033d
build(deps): bump github.com/go-sql-driver/mysql from 1.10.0 to 1.10.1 ( #11308 )
...
Bumps [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql ) from 1.10.0 to 1.10.1.
- [Release notes](https://github.com/go-sql-driver/mysql/releases )
- [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md )
- [Commits](https://github.com/go-sql-driver/mysql/compare/v1.10.0...v1.10.1 )
---
updated-dependencies:
- dependency-name: github.com/go-sql-driver/mysql
dependency-version: 1.10.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-14 14:04:10 -07:00
49f20489e4
build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.1 to 1.20.4 ( #11305 )
...
build(deps): bump github.com/aws/aws-sdk-go-v2/credentials
Bumps [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2 ) from 1.20.1 to 1.20.4.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.20.1...service/mq/v1.20.4 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
dependency-version: 1.20.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-14 10:13:14 -07:00
bdec508da9
build(deps): bump golang.org/x/image from 0.45.0 to 0.46.0 ( #11304 )
...
Bumps [golang.org/x/image](https://github.com/golang/image ) from 0.45.0 to 0.46.0.
- [Commits](https://github.com/golang/image/compare/v0.45.0...v0.46.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/image
dependency-version: 0.46.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-14 09:45:16 -07:00
Chris Lu and GitHub
c46f82d29a
fix(master): stop goraft server on shutdown and bump raft to v1.2.1 ( #11284 )
...
MasterServer.Shutdown only stopped the Hashicorp raft implementation;
when using the default goraft backend, the raft event-loop goroutine
(leaderLoop/followerLoop) kept running after the master shut down. In
the in-process test harness this leaked goroutines across sequential
test runs, and a stale event occasionally reached a leader at term 0
and tripped the goraft "leader.elected.at.same.term" assertion,
crashing the whole test binary (CI run 34670959967, PR 11279).
Stop the goraft server in Shutdown() so its goroutines exit cleanly,
and bump seaweedfs/raft to v1.2.1 which replaces that assertion with a
graceful step-down to Follower instead of a panic.
2026-09-11 22:25:05 -07:00
bc0efa4d10
build(deps): bump github.com/rclone/rclone from 1.75.0 to 1.75.1 ( #11274 )
...
Bumps [github.com/rclone/rclone](https://github.com/rclone/rclone ) from 1.75.0 to 1.75.1.
- [Release notes](https://github.com/rclone/rclone/releases )
- [Changelog](https://github.com/rclone/rclone/blob/master/RELEASE.md )
- [Commits](https://github.com/rclone/rclone/compare/v1.75.0...v1.75.1 )
---
updated-dependencies:
- dependency-name: github.com/rclone/rclone
dependency-version: 1.75.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-11 09:42:47 -07:00
2d4b730a2f
build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 ( #11210 )
...
* build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0
Bumps [github.com/twmb/avro](https://github.com/twmb/avro ) from 1.7.2 to 1.8.0.
- [Commits](https://github.com/twmb/avro/compare/v1.7.2...v1.8.0 )
---
updated-dependencies:
- dependency-name: github.com/twmb/avro
dependency-version: 1.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
* iceberg: adapt to twmb/avro v1.8.0 and iceberg-go defensive copies
avro v1.8.0 changes Schema.Root() to return *SchemaNode, which breaks
iceberg-go v0.6.0's internal avro_schemas.go. The fix (apache/iceberg-go#1843 )
is only on iceberg-go's main branch, unreleased, so bump iceberg-go to
that commit (c210509) alongside the avro bump.
That iceberg-go revision also changes two behaviors seaweedfs worked
around:
- It now infers a manifest list's format version from the embedded
writer schema, so a list missing the "format-version" header entry
(DuckDB's shape is read as v2, not v1. ReadManifestList's header
patching is now a redundant safety net; tests updated to expect v2.
- It returns defensive copies from DataFile.Partition(), so the
ReadManifest shim's in-place partition normalization was silently
discarded. Rebuild the entry through NewDataFileBuilder when any
partition value is normalized, copying every other DataFile field so
manifest round-trips are preserved.
- It converts day-transform partitions to iceberg.Date on read
(applyDayTransformDates), so the day-partition cases the shim and
tests guarded now convert without help; tests updated to expect
iceberg.Date from the raw read.
EOF
)
* iceberg: accept assert-ref-snapshot-id without snapshot-id
iceberg-go's new nullableInt64 parser rejects an assert-ref-snapshot-id
requirement whose "snapshot-id" field is absent from the JSON, even
though the Iceberg REST spec makes it optional (null means the ref must
not already exist). v0.6.0 used a plain *int64, so absent was nil and
accepted. ClickHouse sends the requirement without snapshot-id when
asserting a branch does not yet exist, so its writes fail with
"missing required field \"snapshot-id\"".
normalizeRequirements splices an explicit null into any
assert-ref-snapshot-id requirement missing the field before handing
the JSON to iceberg-go's parser, restoring the v0.6.0 behavior across
both iceberg-go versions.
* iceberg: fix v1 block_size_in_bytes default in rebuilt manifest entries
rebuildManifestEntry set block_size_in_bytes to 0, but the v1 manifest
schema requires the default of 64 MiB ("Always write default in v1").
The original value is not exposed on the DataFile interface, so use the
spec default. Also clarify the fallback comment to note that empty
(zero-record / zero-byte) files also trigger it, not just a nil spec.
Add a round-trip test that writes a rebuilt entry as v1 and verifies
block_size_in_bytes is 64 MiB via Avro decoding.
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Chris Lu <chris.lu@gmail.com >
2026-09-07 15:58:24 -07:00
e0f9e02761
build(deps): bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 ( #11208 )
...
Bumps [github.com/prometheus/client_model](https://github.com/prometheus/client_model ) from 0.6.2 to 0.6.3.
- [Release notes](https://github.com/prometheus/client_model/releases )
- [Commits](https://github.com/prometheus/client_model/compare/v0.6.2...v0.6.3 )
---
updated-dependencies:
- dependency-name: github.com/prometheus/client_model
dependency-version: 0.6.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-07 13:19:23 -07:00
3f8cc380fb
build(deps): bump cloud.google.com/go/storage from 1.64.0 to 1.67.0 ( #11206 )
...
Bumps [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go ) from 1.64.0 to 1.67.0.
- [Release notes](https://github.com/googleapis/google-cloud-go/releases )
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md )
- [Commits](https://github.com/googleapis/google-cloud-go/compare/compute/v1.64.0...compute/v1.67.0 )
---
updated-dependencies:
- dependency-name: cloud.google.com/go/storage
dependency-version: 1.67.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-07 13:19:12 -07:00
3eba8ebb9b
build(deps): bump github.com/go-ldap/ldap/v3 from 3.4.13 to 3.4.14 ( #11209 )
...
Bumps [github.com/go-ldap/ldap/v3](https://github.com/go-ldap/ldap ) from 3.4.13 to 3.4.14.
- [Release notes](https://github.com/go-ldap/ldap/releases )
- [Commits](https://github.com/go-ldap/ldap/compare/v3.4.13...v3.4.14 )
---
updated-dependencies:
- dependency-name: github.com/go-ldap/ldap/v3
dependency-version: 3.4.14
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-07 13:19:00 -07:00
99b84eeb88
build(deps): bump github.com/getsentry/sentry-go from 0.48.0 to 0.49.0 ( #11207 )
...
Bumps [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go ) from 0.48.0 to 0.49.0.
- [Release notes](https://github.com/getsentry/sentry-go/releases )
- [Changelog](https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md )
- [Commits](https://github.com/getsentry/sentry-go/compare/v0.48.0...v0.49.0 )
---
updated-dependencies:
- dependency-name: github.com/getsentry/sentry-go
dependency-version: 0.49.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-07 09:37:41 -07:00
98115ec2de
deps: update golang.org/x/image to v0.45.0 for CVE-2026-46603 ( #11164 )
...
golang.org/x/image v0.44.0 is affected by CVE-2026-46603 (GO-2026-6222):
a denial of service via excessive memory allocation when decoding
malformed VP8L (lossless WebP) data. It is fixed in v0.45.0, released
2026-08-11.
The decoder is reachable from SeaweedFS: weed/images/resizing.go
blank-imports golang.org/x/image/webp, which registers the VP8L decoder
with image.Decode, so the filer image resizing path decodes attacker
supplied WebP data with the affected version.
This is a go.mod/go.sum only change produced by
`go get golang.org/x/image@v0.45 .0 && go mod tidy`; no other dependency
moved. `go build ./weed/`, `go vet ./weed/images/...`,
`go test ./weed/images/...` and `go mod verify` all pass.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com >
2026-09-04 19:38:01 -07:00
830bd7ad24
build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.34 to 1.20.1 ( #11132 )
...
build(deps): bump github.com/aws/aws-sdk-go-v2/credentials
Bumps [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2 ) from 1.19.34 to 1.20.1.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/credentials/v1.19.34...v1.20.1 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
dependency-version: 1.20.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-03 13:52:58 -07:00
581dcf6b36
build(deps): bump github.com/pierrec/lz4/v4 from 4.1.28 to 4.1.29 ( #11133 )
...
Bumps [github.com/pierrec/lz4/v4](https://github.com/pierrec/lz4 ) from 4.1.28 to 4.1.29.
- [Release notes](https://github.com/pierrec/lz4/releases )
- [Commits](https://github.com/pierrec/lz4/compare/v4.1.28...v4.1.29 )
---
updated-dependencies:
- dependency-name: github.com/pierrec/lz4/v4
dependency-version: 4.1.29
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-03 13:52:47 -07:00
edbbf951f9
build(deps): bump github.com/prometheus/procfs from 0.21.1 to 0.22.0 ( #11134 )
...
Bumps [github.com/prometheus/procfs](https://github.com/prometheus/procfs ) from 0.21.1 to 0.22.0.
- [Release notes](https://github.com/prometheus/procfs/releases )
- [Commits](https://github.com/prometheus/procfs/compare/v0.21.1...v0.22.0 )
---
updated-dependencies:
- dependency-name: github.com/prometheus/procfs
dependency-version: 0.22.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-03 13:52:38 -07:00
f8a8571886
build(deps): bump github.com/klauspost/reedsolomon from 1.14.1 to 1.14.2 ( #11135 )
...
Bumps [github.com/klauspost/reedsolomon](https://github.com/klauspost/reedsolomon ) from 1.14.1 to 1.14.2.
- [Release notes](https://github.com/klauspost/reedsolomon/releases )
- [Commits](https://github.com/klauspost/reedsolomon/compare/v1.14.1...v1.14.2 )
---
updated-dependencies:
- dependency-name: github.com/klauspost/reedsolomon
dependency-version: 1.14.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-03 13:52:27 -07:00
0555d39c48
build(deps): bump google.golang.org/api from 0.294.0 to 0.296.0 ( #11136 )
...
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client ) from 0.294.0 to 0.296.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases )
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md )
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.294.0...v0.296.0 )
---
updated-dependencies:
- dependency-name: google.golang.org/api
dependency-version: 0.296.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-03 13:52:16 -07:00
Chris Lu and GitHub
68a175ef6f
deps: drop the apache/thrift replace, v0.24.0 carries the 32-bit fix ( #11077 )
...
The replace pinned thrift to a post-v0.23.0 master commit so 32-bit
GOARCHes would compile. That fix shipped in v0.24.0, so the replace was
only overriding the v0.24.0 require back to the pseudo-version and
holding the build below the CVE-2026-43871 fix.
Claude-Session: https://claude.ai/code/session_01C5BpSeYD3yULWmfVXwPRmB
2026-09-01 14:37:32 -07:00
49ee13635b
build(deps): bump google.golang.org/grpc from 1.84.0-dev.0.20260723093437-b6eac429d7b6 to 1.85.0-dev ( #11043 )
...
build(deps): bump google.golang.org/grpc
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.84.0-dev.0.20260723093437-b6eac429d7b6 to 1.85.0-dev.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/commits/v1.85.0-dev )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.85.0-dev
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Chris Lu <chrislusf@users.noreply.github.com >
2026-08-31 10:06:36 -07:00
8bd5ec37d1
build(deps): bump google.golang.org/api from 0.293.0 to 0.294.0 ( #11044 )
...
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client ) from 0.293.0 to 0.294.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases )
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md )
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.293.0...v0.294.0 )
---
updated-dependencies:
- dependency-name: google.golang.org/api
dependency-version: 0.294.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-31 09:50:08 -07:00
1971fb8cb0
build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.43.5 to 1.45.1 ( #11046 )
...
Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2 ) from 1.43.5 to 1.45.1.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.43.5...v1.45.1 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
dependency-version: 1.45.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-31 09:49:58 -07:00
86ee10a080
build(deps): bump modernc.org/sqlite from 1.56.0 to 1.57.0 ( #11042 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.56.0 to 1.57.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.56.0...v1.57.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.57.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-31 09:48:56 -07:00
909f5cabc7
build(deps): bump github.com/ydb-platform/ydb-go-sdk/v3 from 3.147.1 to 3.151.1 ( #11041 )
...
build(deps): bump github.com/ydb-platform/ydb-go-sdk/v3
Bumps [github.com/ydb-platform/ydb-go-sdk/v3](https://github.com/ydb-platform/ydb-go-sdk ) from 3.147.1 to 3.151.1.
- [Release notes](https://github.com/ydb-platform/ydb-go-sdk/releases )
- [Changelog](https://github.com/ydb-platform/ydb-go-sdk/blob/master/CHANGELOG.md )
- [Commits](https://github.com/ydb-platform/ydb-go-sdk/compare/v3.147.1...v3.151.1 )
---
updated-dependencies:
- dependency-name: github.com/ydb-platform/ydb-go-sdk/v3
dependency-version: 3.151.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-31 09:48:47 -07:00
c69bb10407
build(deps): bump github.com/getsentry/sentry-go from 0.44.1 to 0.48.0 ( #10921 )
...
* build(deps): bump github.com/getsentry/sentry-go from 0.44.1 to 0.48.0
Bumps [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go ) from 0.44.1 to 0.48.0.
- [Release notes](https://github.com/getsentry/sentry-go/releases )
- [Changelog](https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md )
- [Commits](https://github.com/getsentry/sentry-go/compare/v0.44.1...v0.48.0 )
---
updated-dependencies:
- dependency-name: github.com/getsentry/sentry-go
dependency-version: 0.48.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
* bump cockroachdb/errors to v1.14.0 for sentry-go 0.48.0
sentry-go 0.48.0 removed Event.Extra, which cockroachdb/errors v1.11.3
still references; v1.14.0 builds against the new API.
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Chris Lu <chris.lu@gmail.com >
2026-08-25 02:00:52 -07:00
d8545997c2
build(deps): bump github.com/seaweedfs/goexif from 1.0.3 to 2.0.0+incompatible ( #10917 )
...
build(deps): bump github.com/seaweedfs/goexif
Bumps [github.com/seaweedfs/goexif](https://github.com/seaweedfs/goexif ) from 1.0.3 to 2.0.0+incompatible.
- [Release notes](https://github.com/seaweedfs/goexif/releases )
- [Commits](https://github.com/seaweedfs/goexif/commits )
---
updated-dependencies:
- dependency-name: github.com/seaweedfs/goexif
dependency-version: 2.0.0+incompatible
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-24 15:24:08 -07:00
9121177f48
build(deps): bump github.com/shirou/gopsutil/v4 from 4.26.6 to 4.26.7 ( #10918 )
...
Bumps [github.com/shirou/gopsutil/v4](https://github.com/shirou/gopsutil ) from 4.26.6 to 4.26.7.
- [Release notes](https://github.com/shirou/gopsutil/releases )
- [Commits](https://github.com/shirou/gopsutil/compare/v4.26.6...v4.26.7 )
---
updated-dependencies:
- dependency-name: github.com/shirou/gopsutil/v4
dependency-version: 4.26.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-24 15:23:58 -07:00
9ba3d473d7
build(deps): bump cloud.google.com/go/pubsub from 1.51.0 to 1.51.1 ( #10919 )
...
Bumps [cloud.google.com/go/pubsub](https://github.com/googleapis/google-cloud-go ) from 1.51.0 to 1.51.1.
- [Release notes](https://github.com/googleapis/google-cloud-go/releases )
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md )
- [Commits](https://github.com/googleapis/google-cloud-go/compare/pubsub/v1.51.0...pubsub/v1.51.1 )
---
updated-dependencies:
- dependency-name: cloud.google.com/go/pubsub
dependency-version: 1.51.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-24 15:23:49 -07:00
e36b01c18f
build(deps): bump github.com/rabbitmq/amqp091-go from 1.13.0 to 1.14.0 ( #10920 )
...
Bumps [github.com/rabbitmq/amqp091-go](https://github.com/rabbitmq/amqp091-go ) from 1.13.0 to 1.14.0.
- [Release notes](https://github.com/rabbitmq/amqp091-go/releases )
- [Changelog](https://github.com/rabbitmq/amqp091-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/rabbitmq/amqp091-go/compare/v1.13.0...v1.14.0 )
---
updated-dependencies:
- dependency-name: github.com/rabbitmq/amqp091-go
dependency-version: 1.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-24 15:23:40 -07:00
a0ddf22f17
Bump Tarantool client library from 3.0.0 to 3.0.1 ( #10925 )
...
Co-authored-by: Marat Karimov <karimov_m@inbox.ru >
2026-08-24 15:10:48 -07:00
004fc32503
build(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.0 ( #10826 )
...
Bumps [github.com/moby/go-archive](https://github.com/moby/go-archive ) from 0.2.0 to 0.3.0.
- [Release notes](https://github.com/moby/go-archive/releases )
- [Changelog](https://github.com/moby/go-archive/blob/main/changes_test.go )
- [Commits](https://github.com/moby/go-archive/compare/v0.2.0...v0.3.0 )
---
updated-dependencies:
- dependency-name: github.com/moby/go-archive
dependency-version: 0.3.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Chris Lu <chrislusf@users.noreply.github.com >
2026-08-22 13:01:07 -07:00
Chris Lu and GitHub
6faa9d20e8
iceberg: stop compaction from corrupting dictionary-encoded columns ( #10857 )
...
* deps: upgrade parquet-go to v0.32.0
Iceberg compaction writes the merged file with the schema of its first
input, encodings included. parquet-go before v0.31.0 took the deprecated
PLAIN_DICTIONARY encoding that DuckDB writes at face value and encoded
those pages as plain int32 indices, but the spec gives PLAIN_DICTIONARY
the same bit-width-prefixed RLE layout as RLE_DICTIONARY. Every
dictionary-encoded column in a compacted file then decoded onto a single
dictionary entry, and anything past one page failed to decode at all.
* iceberg: cover compaction of dictionary-encoded input
The fixture is a DuckDB-written file, so it carries the PLAIN_DICTIONARY
encoding a Go writer will not produce.
* iceberg: tally whole rows in the dictionary merge test
Counting each column on its own passes a merge that remaps names while
leaving their cardinality intact.
2026-08-21 10:12:01 -07:00
93227c6dc3
build(deps): bump go.etcd.io/etcd/client/v3 from 3.6.12 to 3.7.1 ( #10789 )
...
Bumps [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd ) from 3.6.12 to 3.7.1.
- [Commits](https://github.com/etcd-io/etcd/compare/v3.6.12...v3.7.1 )
---
updated-dependencies:
- dependency-name: go.etcd.io/etcd/client/v3
dependency-version: 3.7.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Chris Lu <chrislusf@users.noreply.github.com >
2026-08-17 19:57:31 -07:00
518da712b5
build(deps): bump github.com/rabbitmq/amqp091-go from 1.11.0 to 1.13.0 ( #10791 )
...
Bumps [github.com/rabbitmq/amqp091-go](https://github.com/rabbitmq/amqp091-go ) from 1.11.0 to 1.13.0.
- [Changelog](https://github.com/rabbitmq/amqp091-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/rabbitmq/amqp091-go/compare/v1.11.0...v1.13.0 )
---
updated-dependencies:
- dependency-name: github.com/rabbitmq/amqp091-go
dependency-version: 1.13.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 14:44:06 -07:00
d36073f8d7
build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 ( #10790 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.57.0 to 0.58.0.
- [Commits](https://github.com/golang/net/compare/v0.57.0...v0.58.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.58.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 14:43:39 -07:00
42f2a48c90
build(deps): bump google.golang.org/api from 0.289.0 to 0.293.0 ( #10792 )
...
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client ) from 0.289.0 to 0.293.0.
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md )
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.289.0...v0.293.0 )
---
updated-dependencies:
- dependency-name: google.golang.org/api
dependency-version: 0.293.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 13:15:45 -07:00
42699b0f98
build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.43.4 to 1.43.5 ( #10787 )
...
Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2 ) from 1.43.4 to 1.43.5.
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.43.4...v1.43.5 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
dependency-version: 1.43.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 10:17:00 -07:00
52ebc9ea4e
build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 ( #10786 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.54.0 to 0.55.0.
- [Commits](https://github.com/golang/crypto/compare/v0.54.0...v0.55.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.55.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 10:16:46 -07:00
6d25ccc357
build(deps): bump github.com/ydb-platform/ydb-go-sdk/v3 from 3.146.3 to 3.147.1 ( #10694 )
...
build(deps): bump github.com/ydb-platform/ydb-go-sdk/v3
Bumps [github.com/ydb-platform/ydb-go-sdk/v3](https://github.com/ydb-platform/ydb-go-sdk ) from 3.146.3 to 3.147.1.
- [Release notes](https://github.com/ydb-platform/ydb-go-sdk/releases )
- [Changelog](https://github.com/ydb-platform/ydb-go-sdk/blob/master/CHANGELOG.md )
- [Commits](https://github.com/ydb-platform/ydb-go-sdk/compare/v3.146.3...v3.147.1 )
---
updated-dependencies:
- dependency-name: github.com/ydb-platform/ydb-go-sdk/v3
dependency-version: 3.147.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-10 11:07:51 -07:00
3ff6ce3c69
build(deps): bump github.com/pierrec/lz4/v4 from 4.1.27 to 4.1.28 ( #10695 )
...
Bumps [github.com/pierrec/lz4/v4](https://github.com/pierrec/lz4 ) from 4.1.27 to 4.1.28.
- [Release notes](https://github.com/pierrec/lz4/releases )
- [Commits](https://github.com/pierrec/lz4/compare/v4.1.27...v4.1.28 )
---
updated-dependencies:
- dependency-name: github.com/pierrec/lz4/v4
dependency-version: 4.1.28
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-10 11:07:43 -07:00
2e86dcf725
build(deps): bump modernc.org/sqlite from 1.53.0 to 1.56.0 ( #10696 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.53.0 to 1.56.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.53.0...v1.56.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.56.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-10 11:07:30 -07:00
