Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 22 updates#471

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/minor-and-patch-e6b9aceac9
Open

build(deps): bump the minor-and-patch group across 1 directory with 22 updates#471
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/minor-and-patch-e6b9aceac9

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 28, 2026 •
edited
Loading

Bumps the minor-and-patch group with 19 updates in the / directory:

Package From To
github.com/99designs/gqlgen 0.17.76 0.17.86
github.com/alitto/pond/v2 2.5.0 2.6.0
github.com/avast/retry-go/v4 4.6.1 4.7.0
github.com/aws/aws-sdk-go 1.55.7 1.55.8
github.com/docker/go-connections 0.5.0 0.6.0
github.com/getsentry/sentry-go 0.34.1 0.42.0
github.com/go-playground/validator/v10 10.27.0 10.30.1
github.com/golang-jwt/jwt/v5 5.2.3 5.3.1
github.com/jackc/pgx/v5 5.7.6 5.8.0
github.com/lib/pq 1.10.9 1.11.0
github.com/mattn/go-sqlite3 1.14.28 1.14.33
github.com/prometheus/client_golang 1.22.0 1.23.2
github.com/rubenv/sql-migrate 1.8.0 1.8.1
github.com/sirupsen/logrus 1.9.3 1.9.4
github.com/spf13/cobra 1.9.1 1.10.2
github.com/spf13/viper 1.20.1 1.21.0
github.com/testcontainers/testcontainers-go 0.37.0 0.40.0
github.com/tetratelabs/wazero 1.10.1 1.11.0
github.com/vikstrous/dataloadgen 0.0.9 0.0.10

Updates github.com/99designs/gqlgen from 0.17.76 to 0.17.86

Release notes

Sourced from github.com/99designs/gqlgen's releases.

v0.17.86

What's Changed

New Contributors

Full Changelog: 99designs/gqlgen@v0.17.85...v0.17.86

v0.17.85

What's Changed

New Contributors

... (truncated)

Commits

Updates github.com/alitto/pond/v2 from 2.5.0 to 2.6.0

Release notes

Sourced from github.com/alitto/pond/v2's releases.

Release v2.6.0

What's Changed

Breaking Changes

  • Setting the queue size option to zero (0) via WithQueueSize(0) now disables the task queue altogether (all task submissions block until a worker becomes available unless the pool is set to non-blocking mode). Before this change, setting queue size to 0 would cause the queue to be unbounded. Pools are still unbounded by default, but now there's a constant that can be used to set queue size to unbounded explicitly. E.g. pond.NewPool(10, pond.WithQueueSize(pond.Unbounded)).

Full Changelog: alitto/pond@v2.5.0...v2.6.0

Commits
  • 505910b feat(optional-panic-recovery): Add option to disable panic recovery
  • e8bb01e feat(disable-queue): Allow disabling task queue by setting it to 0
  • 4503e79 Merge pull request #131 from alitto/dependabot/github_actions/actions/checkout-6
  • d53df42 chore(deps): bump actions/checkout from 5 to 6
  • de8edd9 Merge pull request #126 from alitto/dependabot/github_actions/actions/checkout-5
  • 52572db chore(deps): bump actions/checkout from 4 to 5
  • See full diff in compare view

Updates github.com/avast/retry-go/v4 from 4.6.1 to 4.7.0

Release notes

Sourced from github.com/avast/retry-go/v4's releases.

v4.7.0

What's Changed

New Contributors

Full Changelog: avast/retry-go@4.6.1...v4.7.0

Commits
  • 375037b bump version
  • 306fcee Merge pull request #142 from avast/go_1_25_test_environment
  • 0bdef9c ci(workflow): add Go version 1.25 to test matrix for expanded compatibility t...
  • 66013da Merge pull request #130 from StounhandJ/back_off_delay
  • 9e5d0d6 Merge pull request #129 from StounhandJ/master
  • 5068e50 Merge pull request #128 from amirrezafahimi/master
  • 22920c3 Merge pull request #136 from avast/dependabot/go_modules/github.com/stretchr/...
  • 459fade Bump github.com/stretchr/testify from 1.10.0 to 1.11.1
  • 6c62c20 BackOffDelay multiplies attempts from zero
  • e330bce no delay after final retry on max attempts
  • Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go from 1.55.7 to 1.55.8

Release notes

Sourced from github.com/aws/aws-sdk-go's releases.

Release v1.55.8 (2025-07-31)

SDK Features

  • Mark the module and all packages as deprecated.
    • This SDK has entered end-of-support.
Commits

Updates github.com/docker/go-connections from 0.5.0 to 0.6.0

Commits
  • 42faf79 Merge pull request #138 from thaJeztah/sockets_move_unix_options
  • 9ffab7e sockets: make NewUnixSocket, WithChown, WithChmod unix-only
  • 6bb1d15 Merge pull request #135 from thaJeztah/rename_test_files
  • b6c843d sockets: rename files to be considered test files
  • 80898b6 Merge pull request #133 from thaJeztah/deprecate_socket_dialpipe
  • a4399e5 socket: deprecate DialPipe
  • b071e04 Merge pull request #128 from thaJeztah/remove_old_cyphers
  • 578bfde Merge pull request #132 from thaJeztah/optimize_ParsePortSpec
  • deccd71 tlsconfig: align client and server defaults, remove weak CBC ciphers
  • 30b91c8 nat: ParsePortSpec: combine some conditions
  • Additional commits viewable in compare view

Updates github.com/getsentry/sentry-go from 0.34.1 to 0.42.0

Release notes

Sourced from github.com/getsentry/sentry-go's releases.

0.42.0

Breaking Changes 🛠

  • refactor Telemetry Processor to use TelemetryItem instead of ItemConvertible by @​giortzisg in #1180
    • remove ToEnvelopeItem from single log items
    • rename TelemetryBuffer to Telemetry Processor to adhere to spec
    • remove unsed ToEnvelopeItem(dsn) from Event.

New Features ✨

  • Add metric support by @​aldy505 in #1151
    • support for three metric methods (counter, gauge, distribution)
    • custom metric units
    • unexport batchlogger

Internal Changes 🔧

Release

Other

0.41.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.41.0.

Features

  • Add HTTP client integration for distributed tracing via sentryhttpclient package (#876)
    • Provides an http.RoundTripper implementation that automatically creates spans for outgoing HTTP requests
    • Supports trace propagation targets configuration via WithTracePropagationTargets option
    • Example usage: 
      import sentryhttpclient "github.com/getsentry/sentry-go/httpclient"
roundTripper := sentryhttpclient.NewSentryRoundTripper(nil)
client := &http.Client{
Transport: roundTripper,
}

  • Add ClientOptions.PropagateTraceparent option to control W3C traceparent header propagation in outgoing HTTP requests (#1161)
  • Add SpanID field to structured logs (#1169)

0.40.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.40.0.

... (truncated)

Changelog

Sourced from github.com/getsentry/sentry-go's changelog.

0.42.0

Breaking Changes 🛠

  • refactor Telemetry Processor to use TelemetryItem instead of ItemConvertible by @​giortzisg in #1180
    • remove ToEnvelopeItem from single log items
    • rename TelemetryBuffer to Telemetry Processor to adhere to spec
    • remove unsed ToEnvelopeItem(dsn) from Event.

New Features ✨

  • Add metric support by @​aldy505 in #1151
    • support for three metric methods (counter, gauge, distribution)
    • custom metric units
    • unexport batchlogger

Internal Changes 🔧

Release

Other

0.41.0

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.41.0.

Features

  • Add HTTP client integration for distributed tracing via sentryhttpclient package (#876)
    • Provides an http.RoundTripper implementation that automatically creates spans for outgoing HTTP requests
    • Supports trace propagation targets configuration via WithTracePropagationTargets option
    • Example usage: 
      import sentryhttpclient "github.com/getsentry/sentry-go/httpclient"
roundTripper := sentryhttpclient.NewSentryRoundTripper(nil)
client := &http.Client{
Transport: roundTripper,
}

  • Add ClientOptions.PropagateTraceparent option to control W3C traceparent header propagation in outgoing HTTP requests (#1161)
  • Add SpanID field to structured logs (#1169)

... (truncated)

Commits

Updates github.com/go-playground/validator/v10 from 10.27.0 to 10.30.1

Release notes

Sourced from github.com/go-playground/validator/v10's releases.

Release 10.30.1

What's Changed

New Contributors

Full Changelog: go-playground/validator@v10.30.0...v10.30.1

Release 10.30.0

What's Changed

New Contributors

Full Changelog: go-playground/validator@v10.29.0...v10.30.0

v10.29.0

What's Changed

New Contributors

... (truncated)

Commits

Updates github.com/golang-jwt/jwt/v5 from 5.2.3 to 5.3.1

Release notes

Sourced from github.com/golang-jwt/jwt/v5's releases.

v5.3.1

What's Changed

🔐 Features

👒 Dependencies

New Contributors

Full Changelog: golang-jwt/jwt@v5.3.0...v5.3.1

v5.3.0

This release is almost identical to to v5.2.3 but now correctly indicates Go 1.21 as minimum requirement.

What's Changed

Full Changelog: golang-jwt/jwt@v5.2.3...v5.3.0

Commits
  • 7ceae61 Add release.yml for changelog configuration
  • dce8e4d Set token.Signature in ParseUnverified (#414)
  • 8889e20 Save signature to Token struct after successful signing (#417)
  • d237f82 ci: update github-actions schedule interval to monthly
  • d8dce95 Bump crate-ci/typos from 1.41.0 to 1.42.1 (#492)
  • e931803 Bump crate-ci/typos from 1.40.0 to 1.41.0 (#490)
  • e6a0afa Bump actions/checkout from 5 to 6 (#487)
  • 9f85c9e Bump crate-ci/typos from 1.39.0 to 1.40.0 (#488)
  • 60a8669 Bump actions/setup-go from 5 to 6 (#469)
  • 76f5828 Remove misleading ParserOptions documentation (#484)
  • Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.8.0 (December 26, 2025)

  • Require Go 1.24+
  • Remove golang.org/x/crypto dependency
  • Add OptionShouldPing to control ResetSession ping behavior (ilyam8)
  • Fix: Avoid overflow when MaxConns is set to MaxInt32
  • Fix: Close batch pipeline after a query error (Anthonin Bonnefoy)
  • Faster shutdown of pgxpool.Pool background goroutines (Blake Gentry)
  • Add pgxpool ping timeout (Amirsalar Safaei)
  • Fix: Rows.FieldDescriptions for empty query
  • Scan unknown types into *any as string or []byte based on format code
  • Optimize pgtype.Numeric (Philip Dubé)
  • Add AfterNetConnect hook to pgconn.Config
  • Fix: Handle for preparing statements that fail during the Describe phase
  • Fix overflow in numeric scanning (Ilia Demianenko)
  • Fix: json/jsonb sql.Scanner source type is []byte
  • Migrate from math/rand to math/rand/v2 (Mathias Bogaert)
  • Optimize internal iobufpool (Mathias Bogaert)
  • Optimize stmtcache invalidation (Mathias Bogaert)
  • Fix: missing error case in interval parsing (Maxime Soulé)
  • Fix: invalidate statement/description cache in Exec (James Hartig)
  • ColumnTypeLength method return the type length for varbit type (DengChan)
  • Array and Composite codecs handle typed nils
Commits
  • fe8740a Release v5.8.0
  • e5dde5a Skip test on CockroachDB
  • 06f2d82 Remove trailing space
  • 2cf78dd Merge pull request #2448 from DengChan/column_type_lenth_varbit
  • 2d1c4ef Skip tests on CockroachDB
  • 1a5fa7f Array and Composite codecs handle typed nils
  • 5736d09 ColumnTypeLength method return the type length for varbit type.
  • 4c1308c Revert "stdlib matches native pgx scanning support"
  • 14ce2b7 Skip test on CockroachDB
  • 65b2724 Merge pull request #2443 from jameshartig/x-invalidate-cache-in-exec
  • Additional commits viewable in compare view

Updates github.com/lib/pq from 1.10.9 to 1.11.0

Release notes

Sourced from github.com/lib/pq's releases.

v1.11.0

This version of pq requires Go 1.21 or newer.

pq now supports only maintained PostgreSQL releases, which is PostgreSQL 14 and newer. Previously PostgreSQL 8.4 and newer were supported.

Features

  • The pq.Error.Error() text includes the position of the error (if reported by PostgreSQL) and SQLSTATE code (#1219, #1224):

    pq: column "columndoesntexist" does not exist at column 8 (42703)
pq: syntax error at or near ")" at position 2:71 (42601)

  • The pq.Error.ErrorWithDetail() method prints a more detailed multiline message, with the Detail, Hint, and error position (if any) (#1219):

    ERROR:   syntax error at or near ")" (42601)
CONTEXT: line 12, column 1:

     10 |     name           varchar,
 11 |     version        varchar,
 12 | );
      ^

  • Add Config, NewConfig(), and NewConnectorConfig() to supply connection details in a more structured way (#1240).

  • Support hostaddr and $PGHOSTADDR (#1243).

  • Support multiple values in host, port, and hostaddr, which are each tried in order, or randomly if load_balance_hosts=random is set (#1246).

  • Support target_session_attrs connection parameter (#1246).

  • Support [sslnegotiation] to use SSL without negotiation (#1180).

  • Allow using a custom tls.Config, for example for encrypted keys (#1228).

  • Add PQGO_DEBUG=1 print the communication with PostgreSQL to stderr, to aid in debugging, testing, and bug reports (#1223).

  • Add support for NamedValueChecker interface (#1125, #1238).

Fixes

  • Match HOME directory lookup logic with libpq: prefer $HOME over /etc/passwd, ignore ENOTDIR errors, and use APPDATA on Windows (#1214).

  • Fix sslmode=verify-ca verifying the hostname anyway when connecting to a DNS name (rather than IP) (#1226).

  • Correctly detect pre-protocol errors such as the server not being able to fork or running out of memory (#1248).

  • Fix build with wasm (#1184), appengine (#745), and Plan 9 (#1133).

  • Deprecate and type alias pq.NullTime to sql.NullTime (#1211).

... (truncated)

Changelog

Sourced from github.com/lib/pq's changelog.

v1.11.0 (2025-01-28)

This version of pq requires Go 1.21 or newer.

pq now supports only maintained PostgreSQL releases, which is PostgreSQL 14 and newer. Previously PostgreSQL 8.4 and newer were supported.

Features

  • The pq.Error.Error() text includes the position of the error (if reported by PostgreSQL) and SQLSTATE code (#1219, #1224):

    pq: column "columndoesntexist" does not exist at column 8 (42703)
pq: syntax error at or near ")" at position 2:71 (42601)

  • The pq.Error.ErrorWithDetail() method prints a more detailed multiline message, with the Detail, Hint, and error position (if any) (#1219):

    ERROR:   syntax error at or near ")" (42601)
CONTEXT: line 12, column 1:

     10 |     name          ...

    Description has been truncated

@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jan 28, 2026
Copilot AI review requested due to automatic review settings January 28, 2026 23:01
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jan 28, 2026
Copilot AI reviewed Jan 28, 2026
View reviewed changes
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@socket-security
Copy link

socket-security bot commented Jan 28, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedgithub.com/​aws/​aws-sdk-go@​v1.55.7 ⏵ v1.55.876 +110010050100
Updatedgithub.com/​prometheus/​client_golang@​v1.22.0 ⏵ v1.23.272 +1100100100100
Updatedgithub.com/​getsentry/​sentry-go@​v0.34.1 ⏵ v0.42.073 -9100100100100
Updatedgithub.com/​jackc/​pgx/​v5@​v5.7.6 ⏵ v5.8.074 -2100100100100
Updatedgithub.com/​99designs/​gqlgen@​v0.17.76 ⏵ v0.17.8675100100100100
Updatedgithub.com/​mattn/​go-sqlite3@​v1.14.28 ⏵ v1.14.3496 -110010075100
Updatedgolang.org/​x/​text@​v0.27.0 ⏵ v0.33.078 +1100100100100
Updatedgithub.com/​go-playground/​validator/​v10@​v10.27.0 ⏵ v10.30.185100100100100
Updatedgithub.com/​tetratelabs/​wazero@​v1.10.1 ⏵ v1.11.086100100100100
Updatedgithub.com/​testcontainers/​testcontainers-go@​v0.37.0 ⏵ v0.40.089 +1100100100100
Updatedgithub.com/​lib/​pq@​v1.10.9 ⏵ v1.11.294 +1100100100100
Updatedgithub.com/​docker/​go-connections@​v0.5.0 ⏵ v0.6.095 -1100100100100
Updatedgithub.com/​spf13/​cobra@​v1.9.1 ⏵ v1.10.295 +1100100100100
Updatedgithub.com/​golang-jwt/​jwt/​v5@​v5.2.3 ⏵ v5.3.198 +1100100100100
Updatedgithub.com/​sirupsen/​logrus@​v1.9.3 ⏵ v1.9.498 +1100100100100
Updatedgithub.com/​avast/​retry-go/​v4@​v4.6.1 ⏵ v4.7.099 +1100100100100
Updatedgithub.com/​spf13/​viper@​v1.20.1 ⏵ v1.21.099 +1100100100100
Updatedgithub.com/​vektah/​gqlparser/​v2@​v2.5.30 ⏵ v2.5.3199100100100100
Updatedgithub.com/​rubenv/​sql-migrate@​v1.8.0 ⏵ v1.8.1100100100100100
Updatedgolang.org/​x/​term@​v0.33.0 ⏵ v0.38.0100 +1100100100100
Updatedgithub.com/​vikstrous/​dataloadgen@​v0.0.9 ⏵ v0.0.10100100100100100
Updatedgithub.com/​alitto/​pond/​v2@​v2.5.0 ⏵ v2.6.0100100100100100

View full report

@socket-security
Copy link

socket-security bot commented Jan 28, 2026 •
edited
Loading

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
License policy violation: golang dario.cat/mergo under BSD-3-Clause

Location: Package overview

From: ? → golang/github.com/testcontainers/testcontainers-go@v0.40.0 → golang/dario.cat/mergo@v1.0.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/dario.cat/mergo@v1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang github.com/aws/aws-sdk-go under Apache-2.0 AND BSD-3-Clause

Location: Package overview

From: go.mod → golang/github.com/aws/aws-sdk-go@v1.55.8

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/aws/aws-sdk-go@v1.55.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang github.com/docker/docker

Location: Package overview

From: ? → golang/github.com/stellar/stellar-rpc@v0.9.6-0.20250618231249-2d3e8ff69365 → golang/github.com/testcontainers/testcontainers-go@v0.40.0 → golang/github.com/docker/docker@v28.5.1+incompatible

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/docker/docker@v28.5.1+incompatible. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang github.com/ebitengine/purego under Apache-2.0 AND BSD-3-Clause

Location: Package overview

From: ? → golang/github.com/testcontainers/testcontainers-go@v0.40.0 → golang/github.com/ebitengine/purego@v0.8.4

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/ebitengine/purego@v0.8.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang github.com/fsnotify/fsnotify under BSD-3-Clause

Location: Package overview

From: ? → golang/github.com/spf13/viper@v1.21.0 → golang/github.com/fsnotify/fsnotify@v1.9.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/fsnotify/fsnotify@v1.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang github.com/mattn/go-sqlite3 under BSD-3-Clause AND MIT

Location: Package overview

From: go.mod → golang/github.com/mattn/go-sqlite3@v1.14.34

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/mattn/go-sqlite3@v1.14.34. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang github.com/prometheus/client_golang under Apache-2.0 AND BSD-3-Clause

Location: Package overview

From: go.mod → golang/github.com/prometheus/client_golang@v1.23.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/prometheus/client_golang@v1.23.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang github.com/shirou/gopsutil/v4

Location: Package overview

From: ? → golang/github.com/testcontainers/testcontainers-go@v0.40.0 → golang/github.com/shirou/gopsutil/v4@v4.25.6

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/shirou/gopsutil/v4@v4.25.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang github.com/spf13/pflag under BSD-3-Clause

Location: Package overview

From: ? → golang/github.com/stellar/go-stellar-sdk@v0.1.0 → golang/github.com/spf13/viper@v1.21.0 → golang/github.com/stellar/stellar-rpc@v0.9.6-0.20250618231249-2d3e8ff69365 → golang/github.com/spf13/cobra@v1.10.2 → golang/github.com/spf13/pflag@v1.0.10

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/spf13/pflag@v1.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang github.com/vektah/gqlparser/v2 under BSD-3-Clause AND MIT

Location: Package overview

From: go.mod → golang/github.com/vektah/gqlparser/v2@v2.5.31

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/vektah/gqlparser/v2@v2.5.31. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang golang.org/x/crypto under BSD-3-Clause

Location: Package overview

From: ? → golang/github.com/stellar/go-stellar-sdk@v0.1.0 → golang/github.com/go-playground/validator/v10@v10.30.1 → golang/github.com/prometheus/client_golang@v1.23.2 → golang/github.com/stellar/stellar-rpc@v0.9.6-0.20250618231249-2d3e8ff69365 → golang/github.com/testcontainers/testcontainers-go@v0.40.0 → golang/golang.org/x/crypto@v0.46.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.46.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang golang.org/x/net under BSD-3-Clause

Location: Package overview

From: ? → golang/github.com/stellar/go-stellar-sdk@v0.1.0 → golang/github.com/go-playground/validator/v10@v10.30.1 → golang/github.com/prometheus/client_golang@v1.23.2 → golang/github.com/stellar/stellar-rpc@v0.9.6-0.20250618231249-2d3e8ff69365 → golang/github.com/testcontainers/testcontainers-go@v0.40.0 → golang/golang.org/x/net@v0.48.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/net@v0.48.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang golang.org/x/sync under BSD-3-Clause

Location: Package overview

From: ? → golang/github.com/stellar/go-stellar-sdk@v0.1.0 → golang/github.com/jackc/pgx/v5@v5.8.0 → golang/github.com/prometheus/client_golang@v1.23.2 → golang/github.com/stellar/stellar-rpc@v0.9.6-0.20250618231249-2d3e8ff69365 → golang/golang.org/x/sync@v0.19.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/sync@v0.19.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang golang.org/x/sys under BSD-3-Clause

Location: Package overview

From: ? → golang/golang.org/x/term@v0.38.0 → golang/github.com/stellar/go-stellar-sdk@v0.1.0 → golang/github.com/tetratelabs/wazero@v1.11.0 → golang/github.com/go-playground/validator/v10@v10.30.1 → golang/github.com/sirupsen/logrus@v1.9.4 → golang/github.com/getsentry/sentry-go@v0.42.0 → golang/github.com/docker/go-connections@v0.6.0 → golang/github.com/prometheus/client_golang@v1.23.2 → golang/github.com/spf13/viper@v1.21.0 → golang/github.com/stellar/stellar-rpc@v0.9.6-0.20250618231249-2d3e8ff69365 → golang/github.com/testcontainers/testcontainers-go@v0.40.0 → golang/golang.org/x/sys@v0.39.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/sys@v0.39.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang golang.org/x/term under BSD-3-Clause

Location: Package overview

From: go.mod → golang/golang.org/x/term@v0.38.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/term@v0.38.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang golang.org/x/text under BSD-3-Clause

Location: Package overview

From: go.mod → golang/golang.org/x/text@v0.33.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/text@v0.33.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: golang google.golang.org/protobuf under BSD-3-Clause

Location: Package overview

From: ? → golang/github.com/stellar/go-stellar-sdk@v0.1.0 → golang/github.com/99designs/gqlgen@v0.17.86 → golang/github.com/prometheus/client_golang@v1.23.2 → golang/github.com/stellar/stellar-rpc@v0.9.6-0.20250618231249-2d3e8ff69365 → golang/google.golang.org/protobuf@v1.36.11

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/google.golang.org/protobuf@v1.36.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot dependabot bot force-pushed the dependabot/go_modules/minor-and-patch-e6b9aceac9 branch 2 times, most recently from a1ea15f to c92300e Compare February 8, 2026 02:10
@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 2…
6d7d874 
…2 updates

Bumps the minor-and-patch group with 19 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/99designs/gqlgen](https://github.com/99designs/gqlgen) | `0.17.76` | `0.17.86` |
| [github.com/alitto/pond/v2](https://github.com/alitto/pond) | `2.5.0` | `2.6.0` |
| [github.com/avast/retry-go/v4](https://github.com/avast/retry-go) | `4.6.1` | `4.7.0` |
| [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) | `1.55.7` | `1.55.8` |
| [github.com/docker/go-connections](https://github.com/docker/go-connections) | `0.5.0` | `0.6.0` |
| [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go) | `0.34.1` | `0.42.0` |
| [github.com/go-playground/validator/v10](https://github.com/go-playground/validator) | `10.27.0` | `10.30.1` |
| [github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt) | `5.2.3` | `5.3.1` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.7.6` | `5.8.0` |
| [github.com/lib/pq](https://github.com/lib/pq) | `1.10.9` | `1.11.0` |
| [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) | `1.14.28` | `1.14.33` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.22.0` | `1.23.2` |
| [github.com/rubenv/sql-migrate](https://github.com/rubenv/sql-migrate) | `1.8.0` | `1.8.1` |
| [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) | `1.9.3` | `1.9.4` |
| [github.com/spf13/cobra](https://github.com/spf13/cobra) | `1.9.1` | `1.10.2` |
| [github.com/spf13/viper](https://github.com/spf13/viper) | `1.20.1` | `1.21.0` |
| [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go) | `0.37.0` | `0.40.0` |
| [github.com/tetratelabs/wazero](https://github.com/tetratelabs/wazero) | `1.10.1` | `1.11.0` |
| [github.com/vikstrous/dataloadgen](https://github.com/vikstrous/dataloadgen) | `0.0.9` | `0.0.10` |



Updates `github.com/99designs/gqlgen` from 0.17.76 to 0.17.86
- [Release notes](https://github.com/99designs/gqlgen/releases)
- [Changelog](https://github.com/99designs/gqlgen/blob/master/CHANGELOG.md)
- [Commits](99designs/gqlgen@v0.17.76...v0.17.86)

Updates `github.com/alitto/pond/v2` from 2.5.0 to 2.6.0
- [Release notes](https://github.com/alitto/pond/releases)
- [Commits](alitto/pond@v2.5.0...v2.6.0)

Updates `github.com/avast/retry-go/v4` from 4.6.1 to 4.7.0
- [Release notes](https://github.com/avast/retry-go/releases)
- [Commits](avast/retry-go@4.6.1...4.7.0)

Updates `github.com/aws/aws-sdk-go` from 1.55.7 to 1.55.8
- [Release notes](https://github.com/aws/aws-sdk-go/releases)
- [Changelog](https://github.com/aws/aws-sdk-go/blob/main/CHANGELOG_PENDING.md)
- [Commits](aws/aws-sdk-go@v1.55.7...v1.55.8)

Updates `github.com/docker/go-connections` from 0.5.0 to 0.6.0
- [Commits](docker/go-connections@v0.5.0...v0.6.0)

Updates `github.com/getsentry/sentry-go` from 0.34.1 to 0.42.0
- [Release notes](https://github.com/getsentry/sentry-go/releases)
- [Changelog](https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-go@v0.34.1...v0.42.0)

Updates `github.com/go-playground/validator/v10` from 10.27.0 to 10.30.1
- [Release notes](https://github.com/go-playground/validator/releases)
- [Commits](go-playground/validator@v10.27.0...v10.30.1)

Updates `github.com/golang-jwt/jwt/v5` from 5.2.3 to 5.3.1
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Commits](golang-jwt/jwt@v5.2.3...v5.3.1)

Updates `github.com/jackc/pgx/v5` from 5.7.6 to 5.8.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.7.6...v5.8.0)

Updates `github.com/lib/pq` from 1.10.9 to 1.11.0
- [Release notes](https://github.com/lib/pq/releases)
- [Changelog](https://github.com/lib/pq/blob/master/CHANGELOG.md)
- [Commits](lib/pq@v1.10.9...v1.11.0)

Updates `github.com/mattn/go-sqlite3` from 1.14.28 to 1.14.33
- [Release notes](https://github.com/mattn/go-sqlite3/releases)
- [Commits](mattn/go-sqlite3@v1.14.28...v1.14.33)

Updates `github.com/prometheus/client_golang` from 1.22.0 to 1.23.2
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.22.0...v1.23.2)

Updates `github.com/rubenv/sql-migrate` from 1.8.0 to 1.8.1
- [Commits](rubenv/sql-migrate@v1.8.0...v1.8.1)

Updates `github.com/sirupsen/logrus` from 1.9.3 to 1.9.4
- [Release notes](https://github.com/sirupsen/logrus/releases)
- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)
- [Commits](sirupsen/logrus@v1.9.3...v1.9.4)

Updates `github.com/spf13/cobra` from 1.9.1 to 1.10.2
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](spf13/cobra@v1.9.1...v1.10.2)

Updates `github.com/spf13/viper` from 1.20.1 to 1.21.0
- [Release notes](https://github.com/spf13/viper/releases)
- [Commits](spf13/viper@v1.20.1...v1.21.0)

Updates `github.com/testcontainers/testcontainers-go` from 0.37.0 to 0.40.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.37.0...v0.40.0)

Updates `github.com/tetratelabs/wazero` from 1.10.1 to 1.11.0
- [Release notes](https://github.com/tetratelabs/wazero/releases)
- [Commits](wazero/wazero@v1.10.1...v1.11.0)

Updates `github.com/vektah/gqlparser/v2` from 2.5.30 to 2.5.31
- [Release notes](https://github.com/vektah/gqlparser/releases)
- [Commits](vektah/gqlparser@v2.5.30...v2.5.31)

Updates `github.com/vikstrous/dataloadgen` from 0.0.9 to 0.0.10
- [Commits](vikstrous/dataloadgen@v0.0.9...v0.0.10)

Updates `golang.org/x/term` from 0.33.0 to 0.38.0
- [Commits](golang/term@v0.33.0...v0.38.0)

Updates `golang.org/x/text` from 0.27.0 to 0.33.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.27.0...v0.33.0)

---
updated-dependencies:
- dependency-name: github.com/99designs/gqlgen
  dependency-version: 0.17.86
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/alitto/pond/v2
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/avast/retry-go/v4
  dependency-version: 4.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/aws/aws-sdk-go
  dependency-version: 1.55.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/docker/go-connections
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/getsentry/sentry-go
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/go-playground/validator/v10
  dependency-version: 10.30.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/golang-jwt/jwt/v5
  dependency-version: 5.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/lib/pq
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/mattn/go-sqlite3
  dependency-version: 1.14.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.23.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/rubenv/sql-migrate
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/sirupsen/logrus
  dependency-version: 1.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/spf13/viper
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/testcontainers/testcontainers-go
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/tetratelabs/wazero
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/vektah/gqlparser/v2
  dependency-version: 2.5.31
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/vikstrous/dataloadgen
  dependency-version: 0.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/term
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: golang.org/x/text
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/go_modules/minor-and-patch-e6b9aceac9 branch from c92300e to 6d7d874 Compare February 15, 2026 02:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants