Skip to content

🌱 Bump the gomod group across 2 directories with 17 updates#4976

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/gomod-77918b1dfc
Closed

🌱 Bump the gomod group across 2 directories with 17 updates#4976
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/gomod-77918b1dfc

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 23, 2026 •
edited
Loading

Bumps the gomod group with 11 updates in the / directory:

Package From To
cloud.google.com/go/bigquery 1.73.1 1.74.0
github.com/bradleyfalzon/ghinstallation/v2 2.17.0 2.18.0
github.com/go-git/go-git/v5 5.16.5 5.17.0
github.com/google/go-containerregistry 0.21.0 0.21.3
github.com/moby/buildkit 0.26.3 0.28.0
go.yaml.in/yaml/v2 2.4.3 2.4.4
gocloud.dev 0.44.0 0.45.0
mvdan.cc/sh/v3 3.12.0 3.13.0
github.com/in-toto/attestation 1.1.2 1.2.0
github.com/onsi/ginkgo/v2 2.28.0 2.28.1
gitlab.com/gitlab-org/api/client-go 1.41.0 1.46.0

Bumps the gomod group with 2 updates in the /tools directory: github.com/golangci/golangci-lint/v2 and github.com/goreleaser/goreleaser/v2.

Updates cloud.google.com/go/bigquery from 1.73.1 to 1.74.0

Release notes

Sourced from cloud.google.com/go/bigquery's releases.

bigquery: v1.74.0

v1.74.0 (2026-02-25)

Features

  • add TotalServicesSkuSlotMillis to QueryStatistics (#13808) (d716a472)
Commits
  • 8500e9e chore(main): release spanner 1.74.0 (#11142)
  • 2dc0184 chore(spanner): Update CODEOWNERS to use TeamSync Managed Team (#11524)
  • afbe132 fix(maps/places): add oauth scopes to Places proto (#11518)
  • de5ca9d docs(analytics/admin): replace "GA4" with "Google Analytics" or "GA" in all c...
  • 1438255 fix(firestore): Convert key before seeting map entry (#11506)
  • 0682bfa fix(bigtable): Allow GC updates on emulated aggregate column family (#11499)
  • b89dd8e doc(bigtable): Fix misspelled words (#11489)
  • 9b9e87a chore(main): release auth 0.14.1 (#11492)
  • 7fb5f95 chore(all): update deps (#11508)
  • 9ad9d76 fix(storage): propagate ctx from invoke to grpc upload reqs (#11475)
  • Additional commits viewable in compare view

Updates github.com/bradleyfalzon/ghinstallation/v2 from 2.17.0 to 2.18.0

Release notes

Sourced from github.com/bradleyfalzon/ghinstallation/v2's releases.

v2.18.0

What's Changed

Full Changelog: bradleyfalzon/ghinstallation@v2.17.0...v2.18.0

Commits
  • 1237274 Bump golangci/golangci-lint-action from 8.0.0 to 9.2.0
  • c9c5e67 Bump actions/checkout from 5.0.0 to 6.0.2
  • f5640e5 Update google/go-github to v84
  • 6e26acb drop deprecated go versions
  • 0e0f2d4 fix lints
  • bc61e9f apply best practices to ci
  • ee71ad0 bump golangci-lint to v2.10
  • 4ec07cc add go 1.25 and 1.26 to tests
  • 8f035f2 bump github.com/google/go-github to v83
  • a2705da Bump actions/checkout from 4.2.2 to 5.0.0
  • See full diff in compare view

Updates github.com/go-git/go-git/v5 from 5.16.5 to 5.17.0

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.17.0

What's Changed

Full Changelog: go-git/go-git@v5.16.5...v5.17.0

Commits
  • bdf0688 Merge pull request #1864 from pjbgf/v5-issue-55
  • 5290e52 storage: filesystem, Avoid overwriting loose obj files. Fixes #55
  • 5d20a62 storage: filesystem, Fix permissions for loose and packed objs
  • 8ed442c backport, git: Improve Status() speed with new index.ModTime check (#1862)
  • c7b5960 build: Align test workflow with main
  • 8e71edf git: Add strict checks for supported extensions
  • 438a37f git: worktree, optimize infiles function for very large repos (#1853)
  • 67c7006 Merge pull request #1839 from go-git/renovate/releases/v5.x-go-github.com-go-...
  • 4ca3f02 build: Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY]
  • See full diff in compare view

Updates github.com/google/go-containerregistry from 0.21.0 to 0.21.3

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.3

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.2...v0.21.3

v0.21.2

What's Changed

Full Changelog: google/go-containerregistry@v0.21.1...v0.21.2

v0.21.1

This release fixes a regression in crane introduced in the previous release.

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.0...v0.21.1

Commits
  • 3888fb8 bump golang to 1.25.7 (#2236)
  • f439624 tarball: detect symlink cycles in extractFileFromTar (#2232)
  • 400c263 mutate: reject path traversal and symlink escape in Extract (#2227)
  • 47eedc9 Bump goreleaser/goreleaser-action in the actions group (#2220)
  • be0a845 Bump the go-deps group across 4 directories with 7 updates (#2233)
  • e916301 migrate to github.com/moby/moby modules (#2228)
  • 8b2478e Adds local file support to the crane index subcommand (#2223)
  • 9e0ccb0 Better handle redirects to https in ping (#2225)
  • 85f2bf5 crane: fix case in auth response json (#2218)
  • e971d63 Add WithFileBufferedOpener for file-backed daemon image buffering (#2214)
  • See full diff in compare view

Updates github.com/moby/buildkit from 0.26.3 to 0.28.0

Release notes

Sourced from github.com/moby/buildkit's releases.

v0.28.0

buildkit 0.28.0

Welcome to the v0.28.0 release of buildkit!

Please try out the release binaries and report any issues at https://github.com/moby/buildkit/issues.

Contributors

  • Tõnis Tiigi
  • CrazyMax
  • Sebastiaan van Stijn
  • Jonathan A. Sternberg
  • Akihiro Suda
  • Amr Mahdi
  • Dan Duvall
  • David Karlsson
  • Jonas Geiler
  • Kevin L.
  • rsteube

Notable Changes

  • Builtin Dockerfile frontend has been updated to v1.22.0 changelog
  • The default provenance format has been switched to SLSA v1.0 from the previous v0.2. The old format can still be generated by setting the version attribute. #6526
  • Provenance attestation for an image can now be directly pulled via Source metadata request. #6516 #6514 #6537
  • Pushing result images and exporting build cache now happens in parallel, for better performance. #6451
  • LLB definition now supports two new Source types for accessing raw blobs from image registries and from OCI layouts. New sources use identifier protocols docker-image+blob:// and oci-layout+blob://. #4286
  • LLB API now supports custom checksum requests for HTTP sources, allowing fetching checksums for different algorithms than the default SHA256 and with optional suffixes. #6527 #6537
  • LLB API now supports validating HTTP sources with PGP signatures, similarly to previous support for Git sources. #6527
  • With the update to a newer version of the in-toto library, the provenance attestation key InvocationID has changed to InvocationId to strictly follow the SLSA spec. This change doesn't affect BuildKit/Buildx Golang tooling, but could affect 3rd party tools if they are using case-sensitive JSON parsing. #6533
  • Embedded Qemu emulator support has been updated to v10.1.3 #6524
  • Update BuildKit Cgroups implementation to work in (Kubernetes) environments that don't have their own Cgroup namespace. #6368
  • Buildctl binary now supports bash completion. #6474
  • PGP signature verification now supports combined public keys as input for defining the required signer. #6519
  • Fix possible "failed to read expected number of bytes" error when reading attestation chains #6520
  • Fix possible error from race condition when creating images in parallel #6477

Dependency Changes

  • github.com/aws/aws-sdk-go-v2 v1.39.6 -> v1.41.1
  • github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.2 -> v1.7.4
  • github.com/aws/aws-sdk-go-v2/config v1.31.20 -> v1.32.7
  • github.com/aws/aws-sdk-go-v2/credentials v1.18.24 -> v1.19.7
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.13 -> v1.18.17
  • github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 -> v1.4.17

... (truncated)

Commits
  • 5245d86 Merge pull request #6551 from tonistiigi/v0.28-cherry-picks
  • 90ee5de vendor: update x/net to v0.51.0
  • 3eab156 vendor: update cloudflare/circl v1.6.3
  • ecde336 Merge pull request #6537 from tonistiigi/add-v0.28-sourcemeta-caps
  • 8d58a58 gateway: add caps for source metadata extensions
  • 373d0ad Merge pull request #6534 from jsternberg/copy-ignored-file-linter-negated-mat...
  • 9a083f4 Merge pull request #6532 from crazy-max/update-aec
  • 809fe38 Merge pull request #4286 from tonistiigi/imageblob
  • d4e025a linter: do not attempt to check for copying ignored file when negated pattern...
  • c5cee9e Merge pull request #6533 from crazy-max/update-intoto-golang
  • Additional commits viewable in compare view

Updates go.yaml.in/yaml/v2 from 2.4.3 to 2.4.4

Commits
  • 43b627a Replace gopkg.in/check.v1 with the standard testing library
  • See full diff in compare view

Updates gocloud.dev from 0.44.0 to 0.45.0

Release notes

Sourced from gocloud.dev's releases.

v0.45.0

What's Changed

New Contributors

Full Changelog: google/go-cloud@v0.44.0...v0.45.0

Commits
  • 7cc909b all: prerelease (#3664)
  • 31e3651 blob/s3blob: map S3 403 errors to PermissionDenied code (#3663)
  • c8f1226 all: update NATS dependency (#3662)
  • ac4bb89 all: Upgrade GitHub Actions for Node 24 compatibility (#3660)
  • 1497536 secrets/gcpkms: Add support for Additional Authenticated Data (AAD) (#3659)
  • 113974a all: Upgrade go.opentelemetry.io/otel/sdk to v1.40.0 (#3657)
  • 0b41d48 build(deps): bump the go_modules group across 2 directories with 1 update (#3...
  • 4c421d0 all: Update to go 1.26 (#3653)
  • b84d07f all: run go 1.26's go fix (#3654)
  • ae3c665 blob/gcsblob: derive universe domain from credentials (#3652)
  • Additional commits viewable in compare view

Updates golang.org/x/text from 0.34.0 to 0.35.0

Commits
  • 7ca2c6d go.mod: update golang.org/x dependencies
  • 73d1ba9 all: upgrade go directive to at least 1.25.0 [generated]
  • See full diff in compare view

Updates mvdan.cc/sh/v3 from 3.12.0 to 3.13.0

Release notes

Sourced from mvdan.cc/sh/v3's releases.

v3.13.0

This release introduces support for Zsh in the parser and formatter, which was tracked in issue #120 alongside the label https://github.com/mvdan/sh/labels/zsh. While support is not complete, it should be far enough for many use cases.

This release also drops support for Go 1.24 and includes many other enhancements:

  • cmd/shfmt
    • Exit with a non-zero status when -l prints any filenames
    • shfmt -version is now derived from the git current tag, dropping the -ldflags workaround
  • syntax
    • New nodes types and node fields are introduced alongside LangZsh
    • LangVariant is now a bitset, allowing the use of sets like "Bash-like"
    • Add InteractiveSeq and StmtsSeq iterator methods for Parser
    • Stop exposing the internal buffer in Printer via struct embedding
    • Support the use of brace expansions like declare {a,b}_c=value
    • Fix a bug where POSIX and Bash incorrectly allowed empty command lists
  • interp
    • Add support for shopt -s dotglob and shopt -s extglob
    • Add support for simple uses of !(expr) extended glob patterns
    • Support more builtin flags for declare, type, read
    • Fix various bugs relating to nulls, errors, and arrays
  • expand
    • Add Config.DotGlob and Config.ExtGlob for the interpreter
    • Add Variable.Flags to get the one-character declare flags
    • Do not force env vars on Windows to be uppercase
    • Fix various bugs relating to glob pattern matching
  • pattern
    • Add GlobLeadingDot and ExtendedOperators for the interpreter
    • Add NegExtGlobError to mark the use of !(expr) negation patterns

Consider becoming a sponsor if you benefit from the work that went into this release!

Binaries built on go version go1.26.1 linux/amd64 with:

CGO_ENABLED=0 go build -trimpath -ldflags="-w -s"

Note that this release no longer includes a sha256sums.txt asset; GitHub now provide digests natively.

Changelog

Sourced from mvdan.cc/sh/v3's changelog.

Changelog

Commits
  • 5c4d285 cmd/shfmt: bump Go and Alpine in the Dockerfile
  • 1ae455b update golang.org/x/sys
  • cb484d3 syntax: apply gopls warning suggestion
  • 64d9126 syntax: gofmt -w
  • 55d279f syntax: simplify zsh logic on left parentheses
  • 1cf3c19 syntax: support alternations in zsh test expressions
  • 0f0636e syntax: support parsing extended globs in zsh
  • a173247 syntax: parse and format zsh >! redirects as >|
  • d6bf6c9 syntax: rename ParamExp.Plus to IsSet
  • b612daa cmd/shfmt: simplify flag value code
  • Additional commits viewable in compare view

Updates github.com/in-toto/attestation from 1.1.2 to 1.2.0

Release notes

Sourced from github.com/in-toto/attestation's releases.

v1.2.0

Core Attestation Framework Spec Changes

New / Updated Predicates

Language Bindings Changes

Other Changes

New Contributors

Full Changelog: in-toto/attestation@v1.1.2...v1.2.0

Commits
  • df02077 Add SVR to the list of predicates and fix some issues in the list (#537)
  • cd3e5c7 Merge pull request #536 from marcelamelara/msm-update-maintainers
  • b31d198 Apply suggestions from code review
  • 4527976 Add Aditya as maintainer, move Mikhail and Tom to emeritus
  • 7bfb269 Ensure the Envelope spec meets ITE-5 (#431)
  • ad76f68 Clarify that non-cryptographic digests may use custom value encoding (#517)
  • 071e175 Bump actions/setup-node from 6.2.0 to 6.3.0 (#535)
  • cad7a33 Bump markdownlint-cli from 0.47.0 to 0.48.0 (#533)
  • 913a235 Bump actions/setup-go from 6.2.0 to 6.3.0 (#531)
  • 36c27c1 Merge pull request #530 from in-toto/dependabot/npm_and_yarn/markdown-it-14.1.1
  • Additional commits viewable in compare view

Updates github.com/onsi/ginkgo/v2 from 2.28.0 to 2.28.1

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.28.1

2.28.1

Update all dependencies. This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.

Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.28.1

Update all dependencies. This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.

Commits

Updates gitlab.com/gitlab-org/api/client-go from 1.41.0 to 1.46.0

Release notes

Sourced from gitlab.com/gitlab-org/api/client-go's releases.

v1.46.0

1.46.0

🚀 Features

1.46.0 (2026-03-01)

v1.45.0

1.45.0

🚀 Features

🔄 Other Changes

1.45.0 (2026-02-27)

Bug Fixes

  • test: Use epic IID instead of ID in DeleteEpic cleanup. (49dea05)

v1.44.0

1.44.0

🚀 Features

  • Implement runner controller instance-level runner scope support (!2765) by Timo Furrer

🔄 Other Changes

1.44.0 (2026-02-26)

v1.43.0

1.43.0

🚀 Features

... (truncated)

Changelog

Sourced from gitlab.com/gitlab-org/api/client-go's changelog.

1.46.0

🚀 Features

1.46.0 (2026-03-01)

1.45.0

🚀 Features

🔄 Other Changes

1.45.0 (2026-02-27)

Bug Fixes

  • test: Use epic IID instead of ID in DeleteEpic cleanup. (49dea05)

1.44.0

🚀 Features

  • Implement runner controller instance-level runner scope support (!2765) by Timo Furrer

🔄 Other Changes

1.44.0 (2026-02-26)

1.43.0

🚀 Features

... (truncated)

Commits
  • da7b8a7 chore(release): 1.46.0 [skip ci]
  • 072590b Merge branch 'Update_Urls_and_add-missing' into 'main'
  • 8b63461 Update urls and add missing
  • 0abd5ce chore(release): 1.45.0 [skip ci]
  • 6f5a6da Merge branch 'issue_#2237' into 'main'
  • 06094f9 Add LockMembershipsToSAML support to Application Settings
  • 37ff76b Merge branch 'fforster/epic-cleanup' into 'main'
  • 49dea05 fix(test): Use epic IID instead of ID in DeleteEpic cleanup.
  • 1e294d4 chore(release): 1.44.0 [skip ci]
  • 69b78fe Merge branch 'rc-runner-scopes' into 'main'
  • Additional commits viewable in compare view

Updates cloud.google.com/go/storage from 1.59.0 to 1.59.2

Release notes

Sourced from cloud.google.com/go/storage's releases.

storage 1.59.2

1.59.2 (2026-01-28)

Bug Fixes

  • deadlock in event loop while coordinating channels (#13652) (ff6c8e78)

storage 1.59.1

1.59.1 (2026-01-14)

Bug Fixes

Commits
  • cf3fbcb chore: librarian release pull request: 20260128T111026Z (#13737)
  • ff6c8e7 fix(storage): deadlock in event loop while coordinating channels (#13652)
  • 5cd8007 chore: librarian release pull request: 20260114T061057Z (#13597)
  • 585cd82 feat(firestore): [PQ] add pipeline queries
  • 6752a49 fix: remove mandatory attrs response in MRD (#13585)
  • 1347004 chore: skip failing TestIntegration_WriterAppendEdgeCases (#13586)
  • e7723a0 test(storage): add test for MRD with read handle (#13591)
  • 7e730f1 test(datastore): fix flaky tests (#13587)
  • d23326b chore(spanner): add gorm data type names for PG types (#13584)
  • bc92500 fix: don't update global object's readhandle in MRD (#13575)
  • Additional commits viewable in compare view

Updates github.com/go-git/go-billy/v5 from 5.7.0 to 5.8.0

Release notes

Sourced from github.com/go-git/go-billy/v5's releases.

v5.8.0

What's Changed

Full Changelog: go-git/go-billy@v5.7.0...v5.8.0

Commits
  • 8662784 Merge pull request #187 from pjbgf/windows-rename
  • f387d62 build: Update test workflow to rely on oldstable/stable
  • 915dae9 polyfill: Add support for Chmod
  • f3d5600 osfs: Create dir for BoundOS Tempfiles
  • 247a741 Merge pull request #183 from go-git/renovate/releases/v5.x-go-golang.org-x-ne...
  • 1c0c9d5 build: Update module golang.org/x/net to v0.45.0 [SECURITY]
  • See full diff in compare view

Updates golang.org/x/oauth2 from 0.35.0 to 0.36.0

Commits
  • 4d954e6 all: upgrade go directive to at least 1.25.0 [generated]
  • See full diff in compare view

Updates github.com/golangci/golangci-lint/v2 from 2.10.1 to 2.11.4

Release notes

Sourced from github.com/golangci/golangci-lint/v2's releases.

v2.11.4

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

  • 4bbfc35c455da805b505a4470bc612cdfd63a719 build(deps): bump github.com/fatih/color from 1.18.0 to 1.19.0 (#6451)
  • b65068d974533da59e816f4d6f3c6fccbb81afb6 build(deps): bump github.com/ryanrolds/sqlclosecheck from 0.5.1 to 0.6.0 (#6452)
  • b7ca3baed01bd0e4f14da5e67ef684a5b8ca8f9c build(deps): bump github.com/ryanrolds/sqlclosecheck from v0.5.1 to a fork (#6441)
  • c795a7543e81d6ea549fe3b6e6750cac5f57982a build(deps): bump github.com/sonatard/noctx from 0.5.0 to 0.5.1 (#6436)
  • 92706b69ec54f4542985dfcba16a27a666a0fed5 build(deps): bump golang.org/x/mod from 0.33.0 to 0.34.0 (#6433)
  • 41ee6f6ec7d95e260e5646432d4816c5e96b972c build(deps): bump golang.org/x/sys from 0.41.0 to 0.42.0 (#6435)
  • b345eab149baac70a9613e6c7b893c5fde7c3e54 build(deps): bump golang.org/x/tools from 0.42.0 to 0.43.0 (#6434)

v2.11.3

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

  • 697a1899cc458a617306273776854c4a4fd3c09d build(deps): bump github.com/securego/gosec...

    Description has been truncated

@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Mar 23, 2026
@dependabot dependabot bot requested a review from a team as a code owner March 23, 2026 17:48
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Mar 23, 2026
@dependabot dependabot bot requested review from jeffmendoza and justaugustus and removed request for a team March 23, 2026 17:48
@dependabot dependabot bot had a problem deploying to integration-test March 23, 2026 17:48 Failure
@dosubot dosubot bot added the size:L This PR changes 100-499 lines, ignoring generated files. label Mar 23, 2026
@justaugustus
Copy link
Copy Markdown
Member

justaugustus commented Mar 24, 2026

@dependabot recreate

@dependabot
🌱 Bump the gomod group across 2 directories with 17 updates
31b3cef 
Bumps the gomod group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/bigquery](https://github.com/googleapis/google-cloud-go) | `1.73.1` | `1.74.0` |
| [github.com/bradleyfalzon/ghinstallation/v2](https://github.com/bradleyfalzon/ghinstallation) | `2.17.0` | `2.18.0` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.16.5` | `5.17.0` |
| [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.21.0` | `0.21.3` |
| [github.com/moby/buildkit](https://github.com/moby/buildkit) | `0.26.3` | `0.28.0` |
| [go.yaml.in/yaml/v2](https://github.com/yaml/go-yaml) | `2.4.3` | `2.4.4` |
| [gocloud.dev](https://github.com/google/go-cloud) | `0.44.0` | `0.45.0` |
| [mvdan.cc/sh/v3](https://github.com/mvdan/sh) | `3.12.0` | `3.13.0` |
| [github.com/in-toto/attestation](https://github.com/in-toto/attestation) | `1.1.2` | `1.2.0` |
| [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) | `2.28.0` | `2.28.1` |
| [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) | `1.41.0` | `1.46.0` |

Bumps the gomod group with 2 updates in the /tools directory: [github.com/golangci/golangci-lint/v2](https://github.com/golangci/golangci-lint) and [github.com/goreleaser/goreleaser/v2](https://github.com/goreleaser/goreleaser).


Updates `cloud.google.com/go/bigquery` from 1.73.1 to 1.74.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](googleapis/google-cloud-go@bigquery/v1.73.1...spanner/v1.74.0)

Updates `github.com/bradleyfalzon/ghinstallation/v2` from 2.17.0 to 2.18.0
- [Release notes](https://github.com/bradleyfalzon/ghinstallation/releases)
- [Commits](bradleyfalzon/ghinstallation@v2.17.0...v2.18.0)

Updates `github.com/go-git/go-git/v5` from 5.16.5 to 5.17.0
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](go-git/go-git@v5.16.5...v5.17.0)

Updates `github.com/google/go-containerregistry` from 0.21.0 to 0.21.3
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.21.0...v0.21.3)

Updates `github.com/moby/buildkit` from 0.26.3 to 0.28.0
- [Release notes](https://github.com/moby/buildkit/releases)
- [Commits](moby/buildkit@v0.26.3...v0.28.0)

Updates `go.yaml.in/yaml/v2` from 2.4.3 to 2.4.4
- [Commits](yaml/go-yaml@v2.4.3...v2.4.4)

Updates `gocloud.dev` from 0.44.0 to 0.45.0
- [Release notes](https://github.com/google/go-cloud/releases)
- [Commits](google/go-cloud@v0.44.0...v0.45.0)

Updates `golang.org/x/text` from 0.34.0 to 0.35.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.34.0...v0.35.0)

Updates `mvdan.cc/sh/v3` from 3.12.0 to 3.13.0
- [Release notes](https://github.com/mvdan/sh/releases)
- [Changelog](https://github.com/mvdan/sh/blob/master/CHANGELOG.md)
- [Commits](mvdan/sh@v3.12.0...v3.13.0)

Updates `github.com/in-toto/attestation` from 1.1.2 to 1.2.0
- [Release notes](https://github.com/in-toto/attestation/releases)
- [Commits](in-toto/attestation@v1.1.2...v1.2.0)

Updates `github.com/onsi/ginkgo/v2` from 2.28.0 to 2.28.1
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](onsi/ginkgo@v2.28.0...v2.28.1)

Updates `gitlab.com/gitlab-org/api/client-go` from 1.41.0 to 1.46.0
- [Release notes](https://gitlab.com/gitlab-org/api/client-go/tags)
- [Changelog](https://gitlab.com/gitlab-org/api/client-go/blob/main/CHANGELOG.md)
- [Commits](https://gitlab.com/gitlab-org/api/client-go/compare/v1.41.0...v1.46.0)

Updates `cloud.google.com/go/storage` from 1.59.0 to 1.59.2
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](googleapis/google-cloud-go@spanner/v1.59.0...storage/v1.59.2)

Updates `github.com/go-git/go-billy/v5` from 5.7.0 to 5.8.0
- [Release notes](https://github.com/go-git/go-billy/releases)
- [Commits](go-git/go-billy@v5.7.0...v5.8.0)

Updates `golang.org/x/oauth2` from 0.35.0 to 0.36.0
- [Commits](golang/oauth2@v0.35.0...v0.36.0)

Updates `github.com/golangci/golangci-lint/v2` from 2.10.1 to 2.11.4
- [Release notes](https://github.com/golangci/golangci-lint/releases)
- [Changelog](https://github.com/golangci/golangci-lint/blob/main/CHANGELOG.md)
- [Commits](golangci/golangci-lint@v2.10.1...v2.11.4)

Updates `github.com/goreleaser/goreleaser/v2` from 2.12.2 to 2.14.3
- [Release notes](https://github.com/goreleaser/goreleaser/releases)
- [Commits](goreleaser/goreleaser@v2.12.2...v2.14.3)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/bigquery
  dependency-version: 1.74.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/bradleyfalzon/ghinstallation/v2
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/moby/buildkit
  dependency-version: 0.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: go.yaml.in/yaml/v2
  dependency-version: 2.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: gocloud.dev
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: golang.org/x/text
  dependency-version: 0.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: mvdan.cc/sh/v3
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/in-toto/attestation
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.28.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: gitlab.com/gitlab-org/api/client-go
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: cloud.google.com/go/storage
  dependency-version: 1.59.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/go-git/go-billy/v5
  dependency-version: 5.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/golangci/golangci-lint/v2
  dependency-version: 2.11.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/goreleaser/goreleaser/v2
  dependency-version: 2.14.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/go_modules/gomod-77918b1dfc branch from 635db31 to 31b3cef Compare March 24, 2026 00:45
@dependabot dependabot bot had a problem deploying to integration-test March 24, 2026 00:45 Failure
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Mar 30, 2026

Superseded by #4989.

@dependabot dependabot bot closed this Mar 30, 2026
@dependabot dependabot bot deleted the dependabot/go_modules/gomod-77918b1dfc branch March 30, 2026 08:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@justaugustus justaugustus Awaiting requested review from justaugustus justaugustus is a code owner automatically assigned from ossf/scorecard-maintainers

@jeffmendoza jeffmendoza Awaiting requested review from jeffmendoza jeffmendoza is a code owner automatically assigned from ossf/scorecard-maintainers

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code size:L This PR changes 100-499 lines, ignoring generated files.

Projects

OpenSSF Scorecard
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@justaugustus