chore(deps): bump the go-modules group across 1 directory with 16 updates by dependabot[bot] · Pull Request #2008 · flanksource/duty

dependabot · 2026-06-16T09:49:08Z

Bumps the go-modules group with 15 updates in the / directory:

Package	From	To
cloud.google.com/go/cloudsqlconn	`1.21.2`	`1.22.0`
github.com/Azure/azure-sdk-for-go/sdk/azidentity	`1.13.1`	`1.14.0`
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys	`1.4.0`	`1.5.0`
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob	`1.7.0`	`1.8.0`
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs	`1.75.2`	`1.76.0`
github.com/aws/aws-sdk-go-v2/service/eks	`1.84.6`	`1.86.0`
github.com/flanksource/clicky	`1.21.18`	`1.21.23`
github.com/labstack/echo/v4	`4.15.2`	`4.15.4`
github.com/onsi/ginkgo/v2	`2.29.0`	`2.31.0`
github.com/onsi/gomega	`1.40.0`	`1.42.0`
google.golang.org/api	`0.283.0`	`0.284.0`
k8s.io/api	`0.36.1`	`0.36.2`
k8s.io/client-go	`0.36.1`	`0.36.2`
modernc.org/sqlite	`1.51.0`	`1.52.0`
github.com/aws/aws-sdk-go-v2/service/s3	`1.102.2`	`1.103.3`

Updates cloud.google.com/go/cloudsqlconn from 1.21.2 to 1.22.0

Release notes

Sourced from cloud.google.com/go/cloudsqlconn's releases.

v1.22.0

1.22.0 (2026-06-11)

Features

Support AI Developer Edition connections through the Cloud SQL Auth Proxy (#1108) (116b2e5)

Changelog

Sourced from cloud.google.com/go/cloudsqlconn's changelog.

1.22.0 (2026-06-11)

Features

Support AI Developer Edition connections through the Cloud SQL Auth Proxy (#1108) (116b2e5)

Commits

460c91b chore(main): release 1.22.0 (#1113)
116b2e5 feat: Support AI Developer Edition connections through the Cloud SQL Auth Pro...
See full diff in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/azidentity/v1.14.0

1.14.0 (2026-06-15)

Breaking Changes

These changes affect only code written against a beta version such as v1.14.0-beta.3

Removed WorkloadIdentityCredentialOptions.EnableAzureProxy. It will return in v1.15.0-beta.1

Bugs Fixed

AzureDeveloperCLICredential improved reporting of error messages returned from azd

Other Changes

Returned azidentity errors include links to the troubleshooting guide when appropriate

This module now requires a minimum Go version of 1.25

Upgraded dependencies

Commits

0495c20 Prep azcore 1.14.0 for release (#23293)
217edee fix(generator tool): filter tsp-client diagnostics log (#23292)
023c88f Increment package version after release of azidentity (#23290)
17f3361 Sync eng/common directory with azure-sdk-tools for PR 8760 (#23271)
f5f3234 bump proxy to one with an audit log and more correct locking (#23288)
d707091 Prepare azidentity v1.8.0-beta.2 for release (#23289)
84d213c NewManagedIdentityCredential returns an error for unsupported ID options (#23...
ea67e9c azcontainerregistry: move method to function (#23270)
40dad0a fix (#23287)
a368082 fix generator tool: ExecuteGoGenerate func (#23286)
Additional commits viewable in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys from 1.4.0 to 1.5.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys's releases.

sdk/security/keyvault/azadmin/v1.5.0

1.5.0 (2026-05-25)

Other Changes

Upgraded to API service version 2025-07-01

sdk/security/keyvault/azkeys/v1.5.0

1.5.0 (2026-05-25)

Other Changes

Upgraded to API service version 2025-07-01

sdk/security/keyvault/azcertificates/v1.5.0

1.5.0 (2026-05-26)

Features Added

Includes all changes from 1.5.0-beta.1.

sdk/security/keyvault/azsecrets/v1.5.0

1.5.0 (2026-05-26)

Features Added

Includes all changes from 1.5.0-beta.1.

sdk/data/azcosmos/v1.5.0-beta.7

1.5.0-beta.7 (2026-06-02)

Features Added

Added retry policy for transient 500, 502, and 504 server errors on read requests. The request is retried once in the current region and, if applicable, once against the next preferred region. Writes are not retried. This matches the behavior of the .NET, Java, and Python Cosmos SDKs. See PR 26821.

Bugs Fixed

Fixed missing OTel tracing spans for internal queries executed by ReadManyItems. Each per-partition query page now creates a query_items span, matching the tracing behavior of NewQueryItemsPager. See PR 26813.

403/WriteForbidden retries refresh the global endpoint manager fire-and-forget (CAS-gated) instead of blocking on a synchronous gem.Update. See PR 26889.

Connection-error retry policy now attempts up to 3 retries against the current region before failing over, and performs at most one cross-region failover per call. Cross-region failover for writes only occurs when the error proves the request never reached the service (DNS, dial, TLS handshake, ECONNREFUSED, etc.); writes on ambiguous transport failures (e.g. ECONNRESET, EOF, transport-level timeouts) no longer fail over to another region, avoiding potential duplicate writes. Reads still fail over for any transport error. Caller-set context deadlines or cancellations short-circuit the policy without consuming the caller's budget with retries. See PR 26858 and PR 26915.

HTTP 408 Request Timeout responses are now handled by the Cosmos client retry policy: reads are retried exactly once against another region, and writes are returned to the caller immediately to avoid potential duplicates. See PR 26858.

Fixed excessive GetDatabaseAccount HTTP calls when using preferred regions, and stopped data-plane retries from trailing into the customer-supplied (default) endpoint once account topology is populated. See PR 26815.

Partition key range cache now serves concurrent callers from a single in-flight refresh per container, and the cached routing map remains readable while a refresh is in progress. The refresh runs on a detached background context.Background() so a caller's cancellation no longer aborts the shared fetch for other waiters; each caller continues to honor its own context deadline. See PR 26855.

Partition key range cache change-feed pagination is now resilient to mid-drain throttling. 429 responses are retried indefinitely (with capped linear backoff + jitter) since the service is explicitly asking the client to slow down, and the pages already accumulated are preserved instead of restarting the drain from page 1 on the next refresh. See PR 26855.

Other Changes

Tightened the default HTTP client: 5s dial timeout (down from azcore's 30s), 65s http.Client.Timeout wall-clock cap per HTTP attempt (was unbounded), larger idle connection pool (1000 total / 100 per host, up from azcore's 100 / 10), and faster HTTP/2 health checks. Caller-supplied Transport and shorter context deadlines are unaffected. See PR 26856.

sdk/resourcemanager/networkcloud/armnetworkcloud/v1.5.0-beta.1

1.5.0-beta.1 (2026-05-06)

Features Added

New value CloudServicesNetworkStorageStatusStatusInitializing, CloudServicesNetworkStorageStatusStatusNone, CloudServicesNetworkStorageStatusStatusRepairing added to enum type CloudServicesNetworkStorageStatusStatus

... (truncated)

Commits

f4ab3aa Remove arm/ClientOptions.AuxiliaryTenants (#20573)
a554ef0 Remove azcore multitenant auth API (#20572)
0a42300 PutBlobFromURL/UploadBlobFromURL API (#20558)
be3f449 Fix azcore changelog entry (#20569)
380d05a Fix regression - base name overrides in CI (#20563)
4bdfb89 Modified challenge policy test (#20554)
5ab558f Added support for copy source authorization to append block from url (#20557)
d2534f7 [Azquery][Readme] Edit pass (#20382)
e9c77a5 Bump credscan to 2.3.12.23 (#20562)
dd74ea3 Transaction Validation - Blob Client (#20550)
Additional commits viewable in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/storage/azblob's releases.

sdk/storage/azblob/v1.8.0

1.8.0 (2026-06-15)

Features Added

Includes all features from 1.8.0-beta.1 and 1.8.0-beta.2

sdk/storage/azblob/v1.8.0-beta.2

1.8.0-beta.2 (2026-06-03)

Features Added

Added support for the Expect: 100-continue HTTP header on requests with a body. The new ExpectContinueBehavior field on ClientOptions configures the behavior via ExpectContinueOptions. By default (ExpectContinueModeApplyOnThrottle) the header is sent for one minute after a 429, 500, or 503 response is received; the interval can be overridden via ExpectContinueOptions.ThrottleInterval. Other modes are ExpectContinueModeOn (always send) and ExpectContinueModeOff (never send). Set the environment variable AZURE_STORAGE_DISABLE_EXPECT_CONTINUE_HEADER=true to disable the feature regardless of ClientOptions.

Commits

42def97 Add breaking changes to release notes (#21696)
112db83 Azcore v1.8.0 (#21694)
204a3c4 Prep azcore v1.7.2 for release (#21506)
89497f5 Add changelog entry for WASM fix (#21493)
0414a4b Transport dialer: setting nil for wasm build (#21451)
b1db0be Enable TLS renegotiation (#21182)
See full diff in compare view

Updates github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.75.2 to 1.76.0

Commits

061fd1b Release 2025-02-06
92f835c Regenerated Clients
56564d3 Update partitions file
54678cf Update endpoints model
1244c28 Update API model
d4c5594 Fix for #2383 (#3004)
78fa10a Release 2025-02-05
2d65d97 Regenerated Clients
64e842d Update endpoints model
f255e31 Update API model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/eks from 1.84.6 to 1.86.0

Commits

711cf64 Release 2025-08-04
699889e Regenerated Clients
5a94577 Update endpoints model
240e984 Update API model
2e08461 support configurable auth scheme preference (#3153)
5462033 Release 2025-08-01
a84b1c6 Regenerated Clients
3325d43 Update endpoints model
2ddc428 Update API model
eb0a91b Release 2025-07-31
Additional commits viewable in compare view

Updates github.com/flanksource/clicky from 1.21.18 to 1.21.23

Release notes

Sourced from github.com/flanksource/clicky's releases.

v1.21.23

1.21.23 (2026-06-15)

✨ Features

exec: add process supervision with resource limits and port detection (e8972b6), closes #123

webapp: Wire ChatWidget to operations client for tool parity (b542518)

v1.21.22

1.21.22 (2026-06-15)

🐛 Bug Fixes

Improve in-memory timeseries store write performance (#110) (bf79215)

v1.21.21

1.21.21 (2026-06-14)

🔧 Maintenance

add Apache 2.0 license (1ef624b)

v1.21.20

1.21.20 (2026-06-14)

⚠ BREAKING CHANGES

api: NewTableFrom now returns a table with headers for empty slices instead of an empty table. TryTypedValue now returns a TypedValue with a header-only table for empty TableProvider slices instead of nil.

✅ Tests

task: add testdata YAML files for task testing (990f51d)

task: isolate batch tests from global task manager (ba6a373)

✨ Features

aichat: Add AI chat backend with tool approval and conversation persistence (ebabb9b)

aichat: Add token usage tracking and cost calculation for chat turns (3cf6bee)

api: emit table schema for empty TableProvider slices (b3157fd)

v1.21.19

1.21.19 (2026-06-12)

✨ Features

... (truncated)

Changelog

Sourced from github.com/flanksource/clicky's changelog.

1.21.23 (2026-06-15)

✨ Features

exec: add process supervision with resource limits and port detection (e8972b6), closes #123

webapp: Wire ChatWidget to operations client for tool parity (b542518)

1.21.22 (2026-06-15)

🐛 Bug Fixes

Improve in-memory timeseries store write performance (#110) (bf79215)

1.21.21 (2026-06-14)

🔧 Maintenance

add Apache 2.0 license (1ef624b)

1.21.20 (2026-06-14)

⚠ BREAKING CHANGES

api: NewTableFrom now returns a table with headers for empty slices instead of an empty table. TryTypedValue now returns a TypedValue with a header-only table for empty TableProvider slices instead of nil.

✅ Tests

task: add testdata YAML files for task testing (990f51d)

task: isolate batch tests from global task manager (ba6a373)

✨ Features

aichat: Add AI chat backend with tool approval and conversation persistence (ebabb9b)

aichat: Add token usage tracking and cost calculation for chat turns (3cf6bee)

api: emit table schema for empty TableProvider slices (b3157fd)

1.21.19 (2026-06-12)

✨ Features

sse: add RunsSSEHandler for streaming run listings with deduplication (f4bb6ca)

Commits

3e7da2d chore(release): 1.21.23 [skip ci]
b542518 feat(webapp): Wire ChatWidget to operations client for tool parity
e8972b6 feat(exec): add process supervision with resource limits and port detection
cd29fc2 chore(release): 1.21.22 [skip ci]
bf79215 fix: Improve in-memory timeseries store write performance (#110)
9f02dca chore(release): 1.21.21 [skip ci]
1ef624b chore: add Apache 2.0 license
7d43f5f chore(release): 1.21.20 [skip ci]
990f51d test(task): add testdata YAML files for task testing
3cf6bee feat(aichat): Add token usage tracking and cost calculation for chat turns
Additional commits viewable in compare view

Updates github.com/labstack/echo/v4 from 4.15.2 to 4.15.4

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.15.4

Security

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#3016, released in v5.2.1). Thanks to @a-tt-om and @oran-gugu for reporting.

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:
// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})
Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:
	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")
for static middleware
	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.15.4 - 2026-06-15

Security

Fixes GHSA-vfp3-v2gw-7wfq

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:
// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})
Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:
	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")
for static middleware
	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))
v4.15.3 - 2026-06-14

... (truncated)

Commits

ec79b58 Merge pull request #3020 from aldas/v4_v4-15-4_changelog
2714c07 Changelog for v4.15.4 - security fix
13f0ed1 Merge pull request #3019 from aldas/v4_backport_3016
d16a4ec backport PR 3016 from v4
8f167b9 Merge pull request #3018 from aldas/v4_remove_v5_dep
9afa4ba remove dependency on labstack/echo v5 introduced in go.mod and go.sum
1e05f63 Merge pull request #3017 from aldas/v4_ci_updates
11a3cc4 Update dependencies and add ignore for linting
26bd016 Update CI action versions
aa52f6a ci: run workflows on the v4 branch, not just master (#3013)
Additional commits viewable in compare view

Updates github.com/onsi/ginkgo/v2 from 2.29.0 to 2.31.0

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.31.0

2.31.0

Add a bunch of Claude Skills via the marketplace:
/plugin marketplace add onsi/ginkgo
/plugin install ginkgo@ginkgo
v2.30.0

2.30.0

Features

Ginkgo now allows extentions/global.Reset to support running multiple suites from within a single process. This may take some massaging on your part (see 1672) but can dramatically speed up codebases with O(hundreds) of test suites.

Thanks @lawrencejones !

Fixes

Fix nested --github-output group for progress report nested inside timeline [4f62d7a]

Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.31.0

Add a bunch of Claude Skills via the marketplace:
/plugin marketplace add onsi/ginkgo
/plugin install ginkgo@ginkgo
2.30.0

Features

Ginkgo now allows extentions/global.Reset to support running multiple suites from within a single process. This may take some massaging on your part (see 1672) but can dramatically speed up codebases with O(hundreds) of test suites.

Thanks @lawrencejones !

Fixes

Fix nested --github-output group for progress report nested inside timeline [4f62d7a]

Commits

3c7bde4 v2.31.0
e479459 add claude skills
31e9912 v2.30.0
a79cdbb Document running multiple suites in a single test process
800291a Allow extensions/globals.Reset to support re-running RunSpecs
4f62d7a Fix nested --github-output group for progress report nested inside timeline
See full diff in compare view

Updates github.com/onsi/gomega from 1.40.0 to 1.42.0

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.42.0

1.42.0

Add a set of Claude skill as a marketplace plugin

v1.41.0

No release notes provided.

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.42.0

Add a set of Claude skill as a marketplace plugin

1.41.0

Features

Add BeASlice and BeAnArray matchers

Fixes

Object formatting now detects pointer cycles to avoid runaway formatting output.

Commits

35ca084 v1.42.0
d72697b v1.42.0 (full)
1f95d86 add a set of claude skills as a marketplace plugin
af2bccb v1.41.0
73e81f6 v1.41.0 (full)
e35a84f feat: devcontainer configuration with local pkgsite and GH pages
f12e5e1 fix(format): detect pointer cycles to avoid runaway formatting output
e14831f Add optionalDescription docs to AsyncAssertion and Assertion interfaces
344b94d Add BeASlice and BeAnArray matchers
See full diff in compare view

Updates google.golang.org/api from 0.283.0 to 0.284.0

Release notes

Sourced from google.golang.org/api's releases.

v0.284.0

0.284.0 (2026-06-09)

Features

all: Auto-regenerate discovery clients (#3613) (5f02153)

all: Auto-regenerate discovery clients (#3616) (25b429a)

all: Auto-regenerate discovery clients (#3617) (1ef3625)

Changelog

Sourced from google.golang.org/api's changelog.

0.284.0 (2026-06-09)

Features

all: Auto-regenerate discovery clients (#3613) (5f02153)

all: Auto-regenerate discovery clients (#3616) (25b429a)

all: Auto-regenerate discovery clients (#3617) (1ef3625)

Commits

5c6a0b0 chore(main): release 0.284.0 (#3614)
1ef3625 feat(all): auto-regenerate discovery clients (#3617)
4dd580d chore(all): update all (#3615)
25b429a feat(all): auto-regenerate discovery clients (#3616)
5f02153 feat(all): auto-regenerate discovery clients (#3613)
See full diff in compare view

Updates k8s.io/api from 0.36.1 to 0.36.2

Commits

2f4cefd Update dependencies to v0.36.2 tag
See full diff in compare view

Updates k8s.io/apimachinery from 0.36.1 to 0.36.2

Commits

ae3f98e Update dependencies to v0.36.2 tag
2ec982d Merge pull request #139508lalitc375/automated-cherry-pick-of-#139480
6a88102 Fix wrong marking of errors
See full diff in compare view

Updates k8s.io/client-go from 0.36.1 to 0.36.2

Commits

877f535 Update dependencies to v0.36.2 tag
See full diff in compare view

Updates modernc.org/sqlite from 1.51.0 to 1.52.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

2026-06-14 v1.53.0:

Add experimental netbsd/amd64 support, resolving the long-standing build break in [GitLab issue #246](https://gitlab.com/cznic/sqlite/-/issues/246). This target is intentionally not yet listed among the supported platforms in the package documentation: the port had been broken for years and is only now revived, and there is as yet no real-world experience running it under production workloads. Green CI is not the same as battle-tested — so while the full test suite (including the pcache and vec packages and the -race concurrency test) passes on NetBSD 10.1 / Go 1.26.3, and the entire upstream toolchain (libc, cc, ccgo, libz, libtcl8.6, libsqlite3, libsqlite_vec) is green on the NetBSD CI builder, the target is offered for evaluation only. If you run NetBSD, please exercise it with your own workloads and report back via #246; the intent is to promote it to a fully supported platform after a period of broader real-world testing (on the order of a month) elapses without surprises.

Implementation notes: the previously shipped lib/sqlite_netbsd_amd64.go was a stale old-generator transpile that no longer compiled (the mu.enter/mu.leave break in #246); it is replaced by a fresh new-generator transpile consistent with every other platform, and modernc.org/sqlite/vec (sqlite-vec) is vendored and auto-registers on netbsd. Correct operation requires the matching pinned modernc.org/libc, which carries two NetBSD-specific fixes found during this work: the mmap(2) PAD-argument ABI (without it, concurrent WAL access faults with SIGBUS in the WAL-index shared memory) and a working abort(3) (the prior stub left SQLite's crash-recovery writecrash test unable to terminate by signal). As usual, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins.

See [GitLab merge request #82](https://gitlab.com/cznic/sqlite/-/merge_requests/82), thanks Leonardo Taccari (@iamleot) and Thomas Klausner (@wiz)!

Add a Go-facing wrapper for SQLITE_CONFIG_PCACHE2. PageCache is the factory and Cache the per-database instance, both idiomatic Go interfaces; Page exposes the raw Buf and Extra pointers that SQLite reads through the C pcache contract. RegisterPageCache and MustRegisterPageCache install the module process-globally before the first sql.Open; subsequent Open calls are gated through a one-shot Xsqlite3_config(SQLITE_CONFIG_PCACHE2) so a too-late Register returns ErrPageCacheTooLate rather than silently falling through to the built-in pcache1. The binding owns the sqlite3_pcache_page stub and re-consults the implementation on every Fetch, reusing the stub only when the returned Page value is unchanged, which keeps a bounded/evicting purgeable cache safe by construction.

See [GitLab merge request #126](https://gitlab.com/cznic/sqlite/-/merge_requests/126), thanks Ian Chechin!

Add modernc.org/sqlite/pcache, the reference page-cache implementation that accompanies the #126 SQLITE_CONFIG_PCACHE2 wrapper. pcache.New returns a *Pool satisfying the PageCache interface; register it once with sqlite.MustRegisterPageCache(pcache.New()) and every connection opened afterwards draws its pages from it. Each Pool.Create mints a fresh per-database Cache: a bounded, LRU-evicting page store that honours the PRAGMA cache_size soft cap and releases the least-recently-unpinned page when it must make room. Page memory — the Buf and Extra buffers SQLite reads through — is allocated with libc.Xmalloc/libc.Xcalloc and therefore lives off the Go heap, which keeps SQLite's interior pointer arithmetic on the page extras from tripping the race detector's checkptr enforcement. Pool.Stats reports aggregate lifetime counters (hits, misses, allocs, evictions, rekeys, truncates, caches) across every cache a Pool has created, so hit/miss/eviction behaviour is observable without instrumenting individual caches. Cross-connection page sharing is out of scope for now; each Create returns an independent per-database cache.

Validated end-to-end against the #126 stress workload (cache_size=16, 4000 BLOB rows with DELETE and incremental_vacuum, integrity_check clean under -race) and benchmarked for the memory-utilization goal tracked in [GitLab issue #204](https://gitlab.com/cznic/sqlite/-/issues/204).

See [GitLab merge request #127](https://gitlab.com/cznic/sqlite/-/merge_requests/127), thanks Ian Chechin!

Tighten the modernc.org/sqlite/pcache reference implementation per cznic's !127 review follow-ups. Adds Stats.EasyRefusals, a per-Pool counter for the cases where FetchCreateEasy returns nil at cap; SQLite reacts to a refusal by spilling dirty pages and retrying with FetchCreateForce, so the new field is a direct proxy for the I/O pressure the strict Easy contract imposes vs pcache1's recycle-without-spill behavior. BenchmarkPoolEvictionChurn was reworked to drive a rotating-residue DELETE (k % 3 = i % 3) and re-insert a matching batch each cycle so the spill pressure recurs and easy-refusals/op scales with b.N instead of capping at the seed's one-time first-cycle cost; both existing benchmarks now report easy-refusals/op alongside the page-allocs/evictions metrics. Stats.Evictions documentation was tightened to match the actual behavior (counts LRU eviction, Unpin(discard=true), Shrink releases, and Unpin(discard=false) trimming back to target after a FetchCreateForce overcommit; bulk frees from Truncate, Rekey collisions, and Destroy are not counted). The TestPoolRoundTripIntegrity comment claiming the workload exercises xRekey ~15 times has been corrected; the SQL surface does not reliably emit xRekey here, and that codepath is covered by the unit tests instead.

See [GitLab merge request #130](https://gitlab.com/cznic/sqlite/-/merge_requests/130), thanks Ian Chechin!

Make modernc.org/sqlite/pcache -race-clean under SQLite's cache=shared mode. The pool already runs correctly under shared-cache because every callback into a given Cache is serialised internally by SQLite's sqlite3BtreeEnter on the BtShared mutex; verified empirically with a lock-free in-flight probe (max-in-flight = 1 on the canonical two-connection workload, 4 on a positive control with goroutines hitting the cache directly). However the Go race detector does not recognise SQLite's libc mutex as a happens-before edge and reports false-positive races on Fetch vs Unpin reads/writes of the per-cache state, which surfaces as DATA RACE failures for any user who registers the pool and runs their suite under -race. A sync.Mutex on the cache type is now taken on every public method (SetSize, PageCount, Fetch, Unpin, Rekey, Truncate, Destroy, Shrink), always. On the common non-shared-cache path the lock is uncontended (one atomic CAS per Lock/Unlock pair, negligible next to the SQLite work it bookends); on the shared-cache path it just rubber-stamps the order SQLite's BtShared mutex already established. A new e2e_test.go TestSharedCacheTwoConns_Integrity drives two sql.Conn against the same cache=shared URI with concurrent writers and asserts PRAGMA integrity_check = ok under -race; passes cleanly with the lock, would surface the false-positive without it. Design notes live in pcache/sharing.go.

See [GitLab merge request #131](https://gitlab.com/cznic/sqlite/-/merge_requests/131), thanks Ian Chechin!

Add an opt-in _dqs DSN query parameter that disables SQLite's double-quoted string literal compatibility quirk on a per-connection basis. When _dqs=0 (or any strconv.ParseBool false value) is supplied, the driver calls sqlite3_db_config with SQLITE_DBCONFIG_DQS_DDL and SQLITE_DBCONFIG_DQS_DML set to off before any statement is prepared, so a double-quoted identifier that fails to resolve raises a parse error instead of silently falling back to a string literal. Absence of the parameter, or _dqs=1, leaves SQLite's default behavior unchanged; existing DSNs continue to work byte-for-byte. Resolves [GitLab issue #61](https://gitlab.com/cznic/sqlite/-/issues/61).

See [GitLab merge request #128](https://gitlab.com/cznic/sqlite/-/merge_requests/128), thanks Ian Chechin!

Add an opt-in _error_rc DSN query parameter for clearer error reporting on open-time failures. When _error_rc=1 (or any strconv.ParseBool true value) is supplied, error strings synthesised from a (rc, db) pair only append sqlite3_errmsg(db) when sqlite3_extended_errcode(db) is consistent with the operation rc (full match first, primary code &0xff as fallback). On mismatch the canonical sqlite3_errstr(rc) is used alone, so an open-time SQLITE_CANTOPEN no longer carries the temporary handle's stale "out of memory" errmsg. Absence of the parameter, or _error_rc=0, preserves the legacy "errstr: errmsg" form byte-for-byte; existing callers that parse error strings are unaffected. The driver's *Error.Code() returns the same SQLite result code in both modes. Parsed before sqlite3_open_v2 so open-time errors are covered. Resolves [GitLab issue #230](https://gitlab.com/cznic/sqlite/-/issues/230).

See [GitLab merge request #129](https://gitlab.com/cznic/sqlite/-/merge_requests/129), thanks Ian Chechin!

2026-06-06 v1.52.0:

Upgrade to SQLite 3.53.2.

Add Backup.Remaining and Backup.PageCount, thin wrappers around the existing sqlite3_backup_remaining and sqlite3_backup_pagecount C symbols. Together they expose the per-Step progress counters that the underlying backup object already maintains, enabling progress reporting during online backups without dropping to modernc.org/sqlite/lib directly.

See [GitLab merge request #122](https://gitlab.com/cznic/sqlite/-/merge_requests/122), thanks Ian Chechin!

Drop the redundant second copy in (*conn).columnText, the path that backs every Rows.Scan into a Go string for a TEXT column. The value's bytes are still copied once out of SQLite-owned memory into a fresh Go buffer; that buffer is then reinterpreted as the result string with unsafe.String rather than copied a second time by the implicit string([]byte) conversion. This removes one allocation per TEXT value per row and roughly halves the bytes allocated on that path; on the new BenchmarkColumnTextScan cases it is ~13–20% faster for payloads of 256 B and larger, with no measurable change for very short strings. Purely internal: no API or behavioral change, and the returned string never aliases SQLite's buffer.

See...
Description has been truncated

…ates Bumps the go-modules group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [cloud.google.com/go/cloudsqlconn](https://github.com/googlecloudplatform/cloud-sql-go-connector) | `1.21.2` | `1.22.0` | | [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go) | `1.13.1` | `1.14.0` | | [github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys](https://github.com/Azure/azure-sdk-for-go) | `1.4.0` | `1.5.0` | | [github.com/Azure/azure-sdk-for-go/sdk/storage/azblob](https://github.com/Azure/azure-sdk-for-go) | `1.7.0` | `1.8.0` | | [github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs](https://github.com/aws/aws-sdk-go-v2) | `1.75.2` | `1.76.0` | | [github.com/aws/aws-sdk-go-v2/service/eks](https://github.com/aws/aws-sdk-go-v2) | `1.84.6` | `1.86.0` | | [github.com/flanksource/clicky](https://github.com/flanksource/clicky) | `1.21.18` | `1.21.23` | | [github.com/labstack/echo/v4](https://github.com/labstack/echo) | `4.15.2` | `4.15.4` | | [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) | `2.29.0` | `2.31.0` | | [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.40.0` | `1.42.0` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.283.0` | `0.284.0` | | [k8s.io/api](https://github.com/kubernetes/api) | `0.36.1` | `0.36.2` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.36.1` | `0.36.2` | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.51.0` | `1.52.0` | | [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.102.2` | `1.103.3` | Updates `cloud.google.com/go/cloudsqlconn` from 1.21.2 to 1.22.0 - [Release notes](https://github.com/googlecloudplatform/cloud-sql-go-connector/releases) - [Changelog](https://github.com/GoogleCloudPlatform/cloud-sql-go-connector/blob/main/CHANGELOG.md) - [Commits](GoogleCloudPlatform/cloud-sql-go-connector@v1.21.2...v1.22.0) Updates `github.com/Azure/azure-sdk-for-go/sdk/azidentity` from 1.13.1 to 1.14.0 - [Release notes](https://github.com/Azure/azure-sdk-for-go/releases) - [Commits](Azure/azure-sdk-for-go@sdk/azidentity/v1.13.1...sdk/azcore/v1.14.0) Updates `github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys` from 1.4.0 to 1.5.0 - [Release notes](https://github.com/Azure/azure-sdk-for-go/releases) - [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.4.0...sdk/azcore/v1.5.0) Updates `github.com/Azure/azure-sdk-for-go/sdk/storage/azblob` from 1.7.0 to 1.8.0 - [Release notes](https://github.com/Azure/azure-sdk-for-go/releases) - [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.7.0...sdk/azcore/v1.8.0) Updates `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs` from 1.75.2 to 1.76.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.75.2...service/s3/v1.76.0) Updates `github.com/aws/aws-sdk-go-v2/service/eks` from 1.84.6 to 1.86.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/eks/v1.84.6...service/s3/v1.86.0) Updates `github.com/flanksource/clicky` from 1.21.18 to 1.21.23 - [Release notes](https://github.com/flanksource/clicky/releases) - [Changelog](https://github.com/flanksource/clicky/blob/main/CHANGELOG.md) - [Commits](flanksource/clicky@v1.21.18...v1.21.23) Updates `github.com/labstack/echo/v4` from 4.15.2 to 4.15.4 - [Release notes](https://github.com/labstack/echo/releases) - [Changelog](https://github.com/labstack/echo/blob/v4.15.4/CHANGELOG.md) - [Commits](labstack/echo@v4.15.2...v4.15.4) Updates `github.com/onsi/ginkgo/v2` from 2.29.0 to 2.31.0 - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](onsi/ginkgo@v2.29.0...v2.31.0) Updates `github.com/onsi/gomega` from 1.40.0 to 1.42.0 - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](onsi/gomega@v1.40.0...v1.42.0) Updates `google.golang.org/api` from 0.283.0 to 0.284.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.283.0...v0.284.0) Updates `k8s.io/api` from 0.36.1 to 0.36.2 - [Commits](kubernetes/api@v0.36.1...v0.36.2) Updates `k8s.io/apimachinery` from 0.36.1 to 0.36.2 - [Commits](kubernetes/apimachinery@v0.36.1...v0.36.2) Updates `k8s.io/client-go` from 0.36.1 to 0.36.2 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.36.1...v0.36.2) Updates `modernc.org/sqlite` from 1.51.0 to 1.52.0 - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.51.0...v1.52.0) Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.102.2 to 1.103.3 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.102.2...service/s3/v1.103.3) --- updated-dependencies: - dependency-name: cloud.google.com/go/cloudsqlconn dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azidentity dependency-version: 1.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/Azure/azure-sdk-for-go/sdk/storage/azblob dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs dependency-version: 1.76.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/aws/aws-sdk-go-v2/service/eks dependency-version: 1.86.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/flanksource/clicky dependency-version: 1.21.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/labstack/echo/v4 dependency-version: 4.15.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/onsi/ginkgo/v2 dependency-version: 2.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/onsi/gomega dependency-version: 1.42.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: google.golang.org/api dependency-version: 0.284.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: k8s.io/api dependency-version: 0.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: k8s.io/apimachinery dependency-version: 0.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: k8s.io/client-go dependency-version: 0.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: modernc.org/sqlite dependency-version: 1.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.103.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-modules ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-06-16T09:49:32Z

Benchstat (RLS)

Base: 2b3d1cfe2cc560f56781be53cc893fc58f09a38e
Head: 2cb6f59f9f2427389636296abd093c1a42210b54

📊 6 minor regression(s) (all within 5% threshold)

Benchmark	Base	Head	Change	p-value
`RLS/Sample-15000/config_names/Without_RLS-4`	12.62m	13.18m	+4.40%	0.002
`RLS/Sample-15000/config_detail/Without_RLS-4`	4.346m	4.517m	+3.92%	0.041
`RLS/Sample-15000/change_types/With_RLS-4`	4.613m	4.707m	+2.04%	0.015
`RLS/Sample-15000/config_types/With_RLS-4`	119.3m	121.3m	+1.69%	0.002
`RLS/Sample-15000/analysis_types/With_RLS-4`	3.384m	3.426m	+1.24%	0.015
`RLS/Sample-15000/config_classes/With_RLS-4`	119.5m	120.1m	+0.57%	0.009

✅ 7 improvement(s)

Benchmark	Base	Head	Change	p-value
`RLS/Sample-15000/catalog_changes/Without_RLS-4`	5.207m	4.587m	-11.91%	0.004
`RLS/Sample-15000/config_changes/Without_RLS-4`	4.879m	4.492m	-7.93%	0.002
`RLS/Sample-15000/config_types/Without_RLS-4`	4.396m	4.234m	-3.68%	0.015
`RLS/Sample-15000/config_summary/Without_RLS-4`	96.39m	93.58m	-2.92%	0.004
`RLS/Sample-15000/config_names/With_RLS-4`	124.2m	120.7m	-2.84%	0.002
`RLS/Sample-15000/config_detail/With_RLS-4`	123.8m	120.3m	-2.80%	0.002
`RLS/Sample-15000/catalog_changes/With_RLS-4`	126.7m	125.9m	-0.63%	0.002

Full benchstat output

goos: linux
goarch: amd64
pkg: github.com/flanksource/duty/bench
cpu: AMD EPYC 9V74 80-Core Processor                
                                               │ bench-base.txt │           bench-head.txt           │
                                               │     sec/op     │   sec/op     vs base               │
RLS/Sample-15000/catalog_changes/Without_RLS-4     5.207m ± 18%   4.587m ± 3%  -11.91% (p=0.004 n=6)
RLS/Sample-15000/catalog_changes/With_RLS-4        126.7m ±  2%   125.9m ± 0%   -0.63% (p=0.002 n=6)
RLS/Sample-15000/config_changes/Without_RLS-4      4.879m ±  7%   4.492m ± 5%   -7.93% (p=0.002 n=6)
RLS/Sample-15000/config_changes/With_RLS-4         126.7m ±  1%   126.0m ± 1%        ~ (p=0.240 n=6)
RLS/Sample-15000/config_detail/Without_RLS-4       4.346m ±  6%   4.517m ± 7%   +3.92% (p=0.041 n=6)
RLS/Sample-15000/config_detail/With_RLS-4          123.8m ±  3%   120.3m ± 0%   -2.80% (p=0.002 n=6)
RLS/Sample-15000/config_names/Without_RLS-4        12.62m ±  1%   13.18m ± 1%   +4.40% (p=0.002 n=6)
RLS/Sample-15000/config_names/With_RLS-4           124.2m ±  1%   120.7m ± 0%   -2.84% (p=0.002 n=6)
RLS/Sample-15000/config_summary/Without_RLS-4      96.39m ±  2%   93.58m ± 2%   -2.92% (p=0.004 n=6)
RLS/Sample-15000/config_summary/With_RLS-4         605.1m ±  0%   606.2m ± 1%        ~ (p=0.310 n=6)
RLS/Sample-15000/configs/Without_RLS-4             7.672m ±  5%   7.407m ± 9%        ~ (p=0.485 n=6)
RLS/Sample-15000/configs/With_RLS-4                120.6m ±  0%   120.2m ± 1%        ~ (p=0.310 n=6)
RLS/Sample-15000/analysis_types/Without_RLS-4      3.392m ±  1%   3.422m ± 1%        ~ (p=0.132 n=6)
RLS/Sample-15000/analysis_types/With_RLS-4         3.384m ±  1%   3.426m ± 2%   +1.24% (p=0.015 n=6)
RLS/Sample-15000/analyzer_types/Without_RLS-4      3.248m ±  1%   3.225m ± 2%        ~ (p=0.240 n=6)
RLS/Sample-15000/analyzer_types/With_RLS-4         3.244m ±  1%   3.284m ± 2%        ~ (p=0.065 n=6)
RLS/Sample-15000/change_types/Without_RLS-4        4.466m ±  2%   4.473m ± 2%        ~ (p=0.937 n=6)
RLS/Sample-15000/change_types/With_RLS-4           4.613m ±  2%   4.707m ± 2%   +2.04% (p=0.015 n=6)
RLS/Sample-15000/config_classes/Without_RLS-4      3.524m ±  3%   3.561m ± 1%        ~ (p=0.394 n=6)
RLS/Sample-15000/config_classes/With_RLS-4         119.5m ±  0%   120.1m ± 1%   +0.57% (p=0.009 n=6)
RLS/Sample-15000/config_types/Without_RLS-4        4.396m ±  3%   4.234m ± 3%   -3.68% (p=0.015 n=6)
RLS/Sample-15000/config_types/With_RLS-4           119.3m ±  1%   121.3m ± 2%   +1.69% (p=0.002 n=6)
geomean                                            18.76m         18.57m        -1.00%

github-actions · 2026-06-16T09:49:34Z

Benchstat (Other)

Base: 2b3d1cfe2cc560f56781be53cc893fc58f09a38e
Head: 2cb6f59f9f2427389636296abd093c1a42210b54

📊 1 minor regression(s) (all within 5% threshold)

Benchmark	Base	Head	Change	p-value
`InsertionOfConfigsWithProperties-4`	3.472m	3.543m	+2.05%	0.009

Full benchstat output

goos: linux
goarch: amd64
pkg: github.com/flanksource/duty/bench
cpu: AMD EPYC 9V74 80-Core Processor                
                                                       │ bench-base.txt │           bench-head.txt            │
                                                       │     sec/op     │    sec/op      vs base              │
InsertionForRowsWithAliases/external_users.aliases-4      528.3µ ±  10%   534.1µ ±   6%       ~ (p=0.589 n=6)
InsertionForRowsWithAliases/config_items.external_id-4    1.042m ±  11%   1.043m ±  12%       ~ (p=0.937 n=6)
InsertionOfConfigsWithProperties-4                        3.472m ±   2%   3.543m ±   2%  +2.05% (p=0.009 n=6)
UpdateOfConfigsWithProperties-4                           7.277m ±   6%   7.474m ±   1%       ~ (p=0.065 n=6)
ResourceSelectorConfigs/name-4                            200.8µ ±   2%   195.8µ ±   6%       ~ (p=0.180 n=6)
ResourceSelectorConfigs/name_and_type-4                   218.1µ ±   4%   221.1µ ±   7%       ~ (p=0.818 n=6)
ResourceSelectorConfigs/tags-4                            33.22m ± 172%   33.70m ± 167%       ~ (p=0.485 n=6)
ResourceSelectorQueryBuild/name-4                         41.75µ ±   2%   41.64µ ±   1%       ~ (p=0.132 n=6)
ResourceSelectorQueryBuild/name_and_type-4                60.83µ ±   1%   60.75µ ±   0%       ~ (p=0.240 n=6)
ResourceSelectorQueryBuild/tags-4                         16.84µ ±   1%   16.75µ ±   2%       ~ (p=0.937 n=6)
geomean                                                   494.0µ          496.6µ         +0.53%

socket-security · 2026-06-16T09:49:35Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/onsi/gomega@v1.40.0 ⏵ v1.42.0	^-1
	github.com/labstack/echo/v4@v4.15.2 ⏵ v4.15.4	⁺¹
	github.com/flanksource/clicky@v1.21.18 ⏵ v1.21.23	⁺¹
	k8s.io/apimachinery@v0.36.1 ⏵ v0.36.2
	modernc.org/sqlite@v1.51.0 ⏵ v1.52.0	⁺¹
	k8s.io/client-go@v0.36.1 ⏵ v0.36.2
	k8s.io/api@v0.36.1 ⏵ v0.36.2
	google.golang.org/api@v0.283.0 ⏵ v0.284.0	⁺¹
	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob@v1.7.0 ⏵ v1.8.0	^-2
	github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.13.1 ⏵ v1.14.0	^-3
	github.com/onsi/ginkgo/v2@v2.29.0 ⏵ v2.31.0	⁺¹
	github.com/aws/aws-sdk-go-v2/service/s3@v1.102.2 ⏵ v1.103.3
	cloud.google.com/go/cloudsqlconn@v1.21.2 ⏵ v1.22.0
	github.com/aws/aws-sdk-go-v2/service/eks@v1.84.6 ⏵ v1.86.0	⁺¹
	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.75.2 ⏵ v1.76.0	⁺¹
	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.4.0 ⏵ v1.5.0

View full report

socket-security · 2026-06-16T09:49:37Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: golang `k8s.io/client-go` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → `golang/k8s.io/client-go@v0.36.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/k8s.io/client-go@v0.36.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2026-06-16T10:39:38Z

Gavel results

Gavel exited with code .

View full results

dependabot · 2026-06-17T09:44:11Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 16, 2026

dependabot Bot closed this Jun 17, 2026

dependabot Bot deleted the dependabot/go_modules/go-modules-e16478fd97 branch June 17, 2026 09:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the go-modules group across 1 directory with 16 updates - #2008

chore(deps): bump the go-modules group across 1 directory with 16 updates#2008
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-modules-e16478fd97

dependabot Bot commented on behalf of github Jun 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 16, 2026

Uh oh!

socket-security Bot commented Jun 16, 2026

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.22.0

1.22.0 (2026-06-11)

Features

1.22.0 (2026-06-11)

Features

sdk/azidentity/v1.14.0

1.14.0 (2026-06-15)

Breaking Changes

Bugs Fixed

Other Changes

sdk/security/keyvault/azadmin/v1.5.0

1.5.0 (2026-05-25)

Other Changes

sdk/security/keyvault/azkeys/v1.5.0

1.5.0 (2026-05-25)

Other Changes

sdk/security/keyvault/azcertificates/v1.5.0

1.5.0 (2026-05-26)

Features Added

sdk/security/keyvault/azsecrets/v1.5.0

1.5.0 (2026-05-26)

Features Added

sdk/data/azcosmos/v1.5.0-beta.7

1.5.0-beta.7 (2026-06-02)

Features Added

Bugs Fixed

Other Changes

sdk/resourcemanager/networkcloud/armnetworkcloud/v1.5.0-beta.1

1.5.0-beta.1 (2026-05-06)

Features Added

sdk/storage/azblob/v1.8.0

1.8.0 (2026-06-15)

Features Added

sdk/storage/azblob/v1.8.0-beta.2

1.8.0-beta.2 (2026-06-03)

Features Added

v1.21.23

1.21.23 (2026-06-15)

✨ Features

v1.21.22

1.21.22 (2026-06-15)

🐛 Bug Fixes

v1.21.21

1.21.21 (2026-06-14)

🔧 Maintenance

v1.21.20

1.21.20 (2026-06-14)

⚠ BREAKING CHANGES

✅ Tests

✨ Features

v1.21.19

1.21.19 (2026-06-12)

✨ Features

1.21.23 (2026-06-15)

✨ Features

1.21.22 (2026-06-15)

🐛 Bug Fixes

1.21.21 (2026-06-14)

🔧 Maintenance

1.21.20 (2026-06-14)

⚠ BREAKING CHANGES

✅ Tests

✨ Features

1.21.19 (2026-06-12)

✨ Features

v4.15.4

v4.15.4 - 2026-06-15

v4.15.3 - 2026-06-14

v2.31.0

2.31.0

v2.30.0

2.30.0

Features

Fixes

2.31.0

2.30.0

dependabot Bot commented on behalf of github Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading