fix(deps): update osv-scanner minor#2566
Merged
G-Rath merged 1 commit intogoogle:mainfrom Mar 4, 2026
Merged
Conversation
forking-renovate
bot
added
the
dependencies
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2566 +/- ##
==========================================
- Coverage 68.00% 67.97% -0.03%
==========================================
Files 173 173
Lines 13394 13394
==========================================
- Hits 9109 9105 -4
- Misses 3574 3576 +2
- Partials 711 713 +2 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
renovate-bot
force-pushed
the
renovate/osv-scanner-minor
branch
6 times, most recently
from
2c2e82e to
bebde05
Compare
renovate-bot
force-pushed
the
renovate/osv-scanner-minor
branch
4 times, most recently
from
d2c1cf4 to
6435ac6
Compare
renovate-bot
force-pushed
the
renovate/osv-scanner-minor
branch
from
6435ac6 to
65b4f6a
Compare
G-Rath
approved these changes
Mar 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v3.0.0-20260112033243-1270359b191b→v3.0.0-20260225225317-765e10b45d5b1270359→765e10b1270359→765e10b1270359→765e10b1270359→765e10bv0.9.3→v0.10.0v0.21.0→v0.21.1v0.5.19→v0.5.20v5.16.5→v5.17.0v1.3.1→v1.4.009a17f8→ec3272cv0.1.3→v0.1.4v3.6.2→v3.7.0v4.0.0-rc.3→v4.0.0-rc.4v0.49.0→v0.51.0v0.39.0→v0.40.0v1.78.0→v1.79.19eebd24→4fcedbdRelease Notes
CycloneDX/cyclonedx-go (github.com/CycloneDX/cyclonedx-go)
v0.10.0Compare Source
Changelog
Fixes
f724c55: fix: add missing fields for v1.6 spec (#249) (@alistair-mclean)48a212c: fix: migrate golangci-lint config and address issues (@nscuro)7566298: fix: unset component tags for spec version less than 1.6 (#253) (@alistair-mclean)Building and Packaging
ff55798: build(deps): bump actions/checkout from 4.2.2 to 5.0.0 (@dependabot[bot])3781c74: build(deps): bump actions/checkout from 5.0.0 to 6.0.2 (@dependabot[bot])4a3ab35: build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (@dependabot[bot])49ee4a3: build(deps): bump actions/setup-go from 6.0.0 to 6.2.0 (@dependabot[bot])521976f: build(deps): bump apache/skywalking-eyes from 0.7.0 to 0.8.0 (@dependabot[bot])1149791: build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1 (@dependabot[bot])9fa7dc1: build(deps): bump gitpod/workspace-go from8985eb7to08a7c68(@dependabot[bot])af64af3: build(deps): bump golangci/golangci-lint-action from 6.2.0 to 9.2.0 (@dependabot[bot])8c642b2: build(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 (@dependabot[bot])Others
082681c: chore: bump minimum go version to 1.23 (@nscuro)charmbracelet/bubbles (github.com/charmbracelet/bubbles)
v0.21.1Compare Source
Changelog
New!
dff42dd: feat: update keybindings in list setSize method (@Broderick-Westrope)Fixed
c376ce3: fix(cursor): fix data race on blinkTag (#784) (@DryHumour)11d52ca: fix(table): preventing cursor from being out-of-bounds. (@s0ders)49ff5c0: fix(textinput): improve placeholder (#768) (@caarlos0)7c44f63: v1: fix(list): ensure correct cursor positions with page/cursor methods (#831) (@lrstanley)Docs
7fcf75d: docs(readme): update footer image and copyright date (@meowgorithm)d4feefe: docs: remove Charm Cloud reference (#785) (@ShalokShalom)Other stuff
daab808: ci: sync dependabot config (#786) (@charmcli)4b2d311: ci: sync dependabot config (#835) (@charmcli)8562e90: ci: sync golangci-lint config (#781) (@github-actions[bot])f54a125: test(table): improve table unit tests (#601) (@Broderick-Westrope)Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.
gkampitakis/go-snaps (github.com/gkampitakis/go-snaps)
v0.5.20Compare Source
What's Changed
Full Changelog: gkampitakis/go-snaps@v0.5.19...v0.5.20
go-git/go-git (github.com/go-git/go-git/v5)
v5.17.0Compare Source
What's Changed
Full Changelog: go-git/go-git@v5.16.5...v5.17.0
modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)
v1.4.0Compare Source
This release marks the completion of the full 2025-11-25 specification implementation, by introducing the support for Sampling with Tools and experimental client-side OAuth support. It also contains multiple bug fixes and improvements. Thanks to all contributors!
Client-side OAuth support
This release introduces experimental support for OAuth on the client side of the SDK. It aims to support the full scope of the current MCP specification for authorization. To use it, you need to compile the SDK with the
-tags mcp_go_client_oauthflag. Some changes may still be applied to this new API, based on developer feedback. The functionality is planned to become stable inv1.5.0release, expected by the end of March 2026. More details can be found at https://github.com/modelcontextprotocol/go-sdk/blob/main/docs/protocol.md#client.Sampling with Tools
Starting from this release, the server use the new
CreateMessageWithToolsmethod to create a sampling request to the client that contains tools that can be used by the client. On the client side,CreateMessageWithToolsHandlermay be used to handle such requests and issueToolUseresponses to the server.Behavior changes
We have two important behavior changes that were introduced to fix a bug or improve security posture. They can be temporarily turned off by specifying a special
MCPGODEBUGenvironment variable when running the SDK. Different options can be added together, separated by a comma.Introduced DNS rebinding protection
The requests arriving via a localhost address (
127.0.0.1,[::1]) that have a non-localhostHostheader will be rejected to protect against DNS rebinding attacks. The protection can be disabled by specifyingStreamableHTTPOptions.DisableLocalhostProtection, but it should be done only if security implications are understood (see documentation for the option).This protection is a behavior change, as the protection is now enabled by default. Because of that, we have introduced an
MCPGODEBUGoption to bring back the previous default behavior for users that need more time to adjust. However, if possible, we recommend specifyingDisableLocalhostProtectiondescribed above, as it is a more future-proof solution. TheMCPGODEBUGoption to remove this protection (disablelocalhostprotection=1) will be removed inv1.6.0.Removed JSON content escaping when marshaling
By default
encoding/jsonescapes the contents of the objects, which causes some servers to fail. We switched to no escaping by default, to be consistent with other SDKs. Since this is a behavior change, we introduced anMCPGODEBUGoption to bring back the previous behavior for users that need more time to adjust to it. That option (jsonescaping=1) will be removed inv1.6.0.Bug fixes
Security vulnerability caused by the case insensitive parsing behavior of
encoding/jsonhas been submitted (also release as a cherry pick inv1.3.1). Security advisory has been posted.Other fixes:
Enhancements
Notably, the SDK now supports the
extensionsfield in client and server capabilities, which should enable creation of MCP Apps.Other enhancements:
Repository organization
Some effort was put into better organization of the repository, as well as making sure it's up to date and secure. As a highlight, the repository is not integrated with OSSF Scorecard with a positive score of 8.7. Additionally, the full conformance test suite is now run on every PR and push to main.
dns-rebinding-protectionscenario as failing by @maciej-kisiel in #775New Contributors
Full Changelog: modelcontextprotocol/go-sdk@v1.3.0...v1.4.0
package-url/packageurl-go (github.com/package-url/packageurl-go)
v0.1.4Compare Source
What's Changed
New Contributors
Full Changelog: package-url/packageurl-go@v0.1.3...v0.1.4
urfave/cli (github.com/urfave/cli/v3)
v3.7.0Compare Source
What's Changed
New Contributors
Full Changelog: urfave/cli@v3.6.2...v3.7.0
yaml/go-yaml (go.yaml.in/yaml/v4)
v4.0.0-rc.4Compare Source
grpc/grpc-go (google.golang.org/grpc)
v1.79.1: Release 1.79.1Compare Source
Bug Fixes
-devsuffix from the User-Agent header. (#8902)v1.79.0: Release 1.79.0Compare Source
API Changes
SetDefaultBufferPoolto change the default buffer pool. (#8806)MetricsRecorderto require embedding the newUnimplementedMetricsRecorder(a no-op struct) in all implementations for forward compatibility. (#8780)Behavior Changes
Addressesand only handleEndpointsin resolver updates. (#8841)New Features
AsyncMetricReporterandRegisterAsyncReporterAPIs. (#8780)GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (#8864):authorityrewriting, as specified in gRFC A81. (#8779)random_subsettingLB policy, as specified in gRFC A68. (#8650)Bug Fixes
CONNECTINGstate. (#8813)WithDecompressororRPCDecompressor). (#8765)Performance Improvements
bufferobjects. (#8784)Configuration
📅 Schedule: Branch creation - "before 6am on monday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.