build(deps): Bump the golang-x group with 2 updates#337
Conversation
Bumps the golang-x group with 2 updates: [golang.org/x/oauth2](https://github.com/golang/oauth2) and [golang.org/x/term](https://github.com/golang/term). Updates `golang.org/x/oauth2` from 0.24.0 to 0.30.0 - [Commits](golang/oauth2@v0.24.0...v0.30.0) Updates `golang.org/x/term` from 0.26.0 to 0.33.0 - [Commits](golang/term@v0.26.0...v0.33.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-version: 0.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang-x - dependency-name: golang.org/x/term dependency-version: 0.33.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang-x ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Kusari Analysis ResultsAnalysis for commit: ff8405c, performed at: 2025-07-29T00:52:28Z • • Recommendation✅ PROCEED with this Pull Request Summary✅ No Flagged Issues Detected All values appear to be within acceptable risk parameters. This PR safely updates four Go modules to their latest versions, including golang.org/x/oauth2 which fixes a HIGH severity vulnerability (CVE-2025-22868) present in the old version. All dependencies use permissive BSD-3-Clause licenses, and no new vulnerabilities are introduced. The security code analysis confirms there are no code issues, secrets, or workflow problems in the changes. This update improves the security posture of the application by patching a known vulnerability. Found this helpful? Give it a 👍 or 👎 reaction! Click to expand for details and specific link to issuesDependency Changes
Risk DetailsSafe Dependency Changes
|
|
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting |
Bumps the golang-x group with 2 updates: golang.org/x/oauth2 and golang.org/x/term.
Updates
golang.org/x/oauth2from 0.24.0 to 0.30.0Commits
cf14319oauth2: fix expiration time window check32d34efinternal: include clientID in auth style cache key2d34e30oauth2: replace a magic number with AuthStyleUnknown696f7b3all: modernize with doc links and any471209boauth2: drop dependency on go-cmp6968da2oauth2: sync Token.ExpiresIn from internal Tokend2c4e0aoauth2: context instead of golang.org/x/net/context in doc883dc3cendpoints: add various endpoints from stale CLs1c06e87all: make use of oauth.Token.ExpiresIn65c15a3oauth2: remove extra periodUpdates
golang.org/x/termfrom 0.26.0 to 0.33.0Commits
30da5ddgo.mod: update golang.org/x dependencies2ec7864go.mod: update golang.org/x dependenciesa809085term: support pluggable history5d2308bgo.mod: update golang.org/x dependenciese770dddx/term: disabling auto-completion around GetPassword()04218fdgo.mod: update golang.org/x dependencies208db03all: upgrade go directive to at least 1.23.0 [generated]743b270go.mod: update golang.org/x dependencies40b02d6go.mod: update golang.org/x dependencies442846ago.mod: update golang.org/x dependenciesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions