Bump the go-deps group across 1 directory with 9 updates by dependabot[bot] · Pull Request #1079 · fluxcd/image-automation-controller

dependabot · 2026-07-28T15:52:50Z

Bumps the go-deps group with 7 updates in the / directory:

Package	From	To
github.com/cyphar/filepath-securejoin	`0.6.1`	`0.7.0`
github.com/fluxcd/pkg/apis/event	`0.27.0`	`0.28.0`
github.com/fluxcd/pkg/apis/meta	`1.30.1`	`1.31.0`
github.com/fluxcd/pkg/auth	`0.54.0`	`0.56.0`
github.com/fluxcd/pkg/runtime	`0.110.0`	`0.111.0`
github.com/go-git/go-billy/v5	`5.9.0`	`5.9.1`
github.com/google/go-containerregistry	`0.21.6`	`0.21.7`

Updates github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0

Changelog

Sourced from github.com/cyphar/filepath-securejoin's changelog.

[0.7.0] - 2025-06-17

You talk of times of peace for all, and then prepare for war.

Changed

Update to cyphar.com/go-pathrs@0.2.5, which included a build-time API breakage that we needed to work around. The API of this library is unchanged by this, but users should make sure to update to v0.7.0 of filepath-securejoin if they use the libpathrs built tag and have update to libpathrs v0.2.5.

Commits

8096a95 VERSION: release v0.7.0
1324ccb merge #101 into cyphar/filepath-securejoin:main
dd8f0bb deps: bump to cyphar.com/go-pathrs@v0.2.5
c9a7725 gha: bump golangci-lint to v2.12
2e968bd Merge pull request #91 from cyphar/dependabot/github_actions/actions/download...
2879148 Merge pull request #90 from cyphar/dependabot/github_actions/actions/upload-a...
07b805b build(deps): bump actions/download-artifact from 6 to 7
8507844 build(deps): bump actions/upload-artifact from 5 to 6
daef0cf Merge pull request #89 from cyphar/dependabot/github_actions/actions/checkout-6
95f8ea4 build(deps): bump actions/checkout from 5 to 6
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/apis/event from 0.27.0 to 0.28.0

Commits

00782ed Merge pull request #917 from fluxcd/test-auth-providers
3976c50 [RFC-0010] Add tests for auth providers
182841a Merge pull request #916 from fluxcd/cache-op-label
1e41450 Introduce operation label for cache event metric
aa3cde9 Merge pull request #909 from fluxcd/auth-azure
9e0e8bc [RFC-0010] Add azure auth library
7eae091 Merge pull request #908 from fluxcd/auth-gcp
9f68942 Merge pull request #907 from fluxcd/auth-aws
bb7cb58 Merge pull request #906 from fluxcd/auth-core
45fbfee [RFC-0010] Add gcp auth library
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/apis/meta from 1.30.1 to 1.31.0

Commits

b98e2b0 Merge pull request #1251 from fluxcd/release-main
2dfcb7c Prepare for release
dd6b016 Merge pull request #1253 from fluxcd/upgrade-k8s-36.2
2d00796 Upgrade kubernetes to 1.36.2
827f6c3 Merge pull request #1249 from fluxcd/upgrade-go-git-providers
be6d462 Upgrade go-git-providers and go-github
023a357 Merge pull request #1248 from fluxcd/label-2.9
7e8856d Add backport label for Flux 2.9
See full diff in compare view

Updates github.com/fluxcd/pkg/auth from 0.54.0 to 0.56.0

Commits

bf02f0a Merge pull request #1026 from fluxcd/storage-refactoring
e2dd3d1 artifact: Refactor storage package structure
ee36d78 Merge pull request #1025 from fluxcd/controller-runtime-v0.22.1
b5ab5b9 Prepare release
6ce90c6 Add the Artifact Management SDK to readme
e4f3937 Update controller-runtime to v0.22.1
9e2ac7d Merge pull request #1024 from fluxcd/dependabot/github_actions/ci-43e6514044
93ac531 build(deps): bump the ci group across 1 directory with 5 updates
24724be Merge pull request #1023 from fluxcd/runtime-env-vars
85cb1e2 runtime: Add environment variables
Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.110.0 to 0.111.0

Commits

b98e2b0 Merge pull request #1251 from fluxcd/release-main
2dfcb7c Prepare for release
dd6b016 Merge pull request #1253 from fluxcd/upgrade-k8s-36.2
2d00796 Upgrade kubernetes to 1.36.2
827f6c3 Merge pull request #1249 from fluxcd/upgrade-go-git-providers
be6d462 Upgrade go-git-providers and go-github
023a357 Merge pull request #1248 from fluxcd/label-2.9
7e8856d Add backport label for Flux 2.9
ae10469 Merge pull request #1246 from fluxcd/ks-always-subst
2cd36cb kustomize: add tests for empty vars with strict sub and omitted without
Additional commits viewable in compare view

Updates github.com/go-git/go-billy/v5 from 5.9.0 to 5.9.1

Release notes

Sourced from github.com/go-git/go-billy/v5's releases.

v5.9.1

What's Changed

build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-billy#216

build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-billy#230

build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-billy#229

Full Changelog: go-git/go-billy@v5.9.0...v5.9.1

Commits

19ea4dd Merge pull request #229 from go-git/renovate/releases/v5.x-go-golang.org-x-ne...
8923518 build: Update module golang.org/x/net to v0.56.0 [SECURITY]
306e011 Merge pull request #230 from go-git/renovate/releases/v5.x-go-golang.org-x-te...
6108d3a build: Update module golang.org/x/text to v0.39.0 [SECURITY]
f135070 Merge pull request #216 from go-git/renovate/releases/v5.x-go-golang.org-x-ne...
473e72c build: Update module golang.org/x/net to v0.55.0 [SECURITY]
See full diff in compare view

Updates github.com/google/go-containerregistry from 0.21.6 to 0.21.7

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.7

What's Changed

tarball: return error instead of panicking on missing rootfs.diff_ids by @iahsanGill in google/go-containerregistry#2304

gcrane: honor --platform flag in copy by @iahsanGill in google/go-containerregistry#2307

mutate: verify layer digests in Extract and Time by @momenashrafff in google/go-containerregistry#2303

tarball: close layer readers during Write by @nandbhat in google/go-containerregistry#2308

build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in google/go-containerregistry#2311

build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory by @dependabot[bot] in google/go-containerregistry#2312

BUGFIX: Fail with error when read exceeds maximum by @inteon in google/go-containerregistry#2328

build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in google/go-containerregistry#2327

fix(name): anchor loopback registry detection by @rohan-patnaik in google/go-containerregistry#2314

Reject symlinks in OCI layout blobs by @mosskappa in google/go-containerregistry#2306

fix(crane): avoid creating export tar on pull failure by @Haihan-Jiang in google/go-containerregistry#2318

feat(kubernetes): allow ignoring pull secrets by @rohan-patnaik in google/go-containerregistry#2315

fix(name): preserve localhost registry references by @rohan-patnaik in google/go-containerregistry#2316

pkg/registry: export ErrNotFound by @malt3 in google/go-containerregistry#2176

pkg/registry: export RedirectError by @malt3 in google/go-containerregistry#2177

build(deps): bump the go-deps group across 1 directory with 2 updates by @dependabot[bot] in google/go-containerregistry#2343

build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in google/go-containerregistry#2344

fix: prevent SSRF in google.List() pagination by @tufstraka in google/go-containerregistry#2332

internal/gzip: fix goroutine leak in ReadCloserLevel by @amarkdotdev in google/go-containerregistry#2347

fix(transport): apply refreshed bearer token after cross-host redirect by @64johnlee in google/go-containerregistry#2337

build(deps): bump the go-deps group across 3 directories with 4 updates by @dependabot[bot] in google/go-containerregistry#2348

fix(tarball): normalize paths when matching files by @bstoll in google/go-containerregistry#2334

transport: do not re-attach bearer token after cross-host redirect by @evilgensec in google/go-containerregistry#2349

Bump CI go version to 1.26.4 by @Subserial in google/go-containerregistry#2350

New Contributors

@momenashrafff made their first contribution in google/go-containerregistry#2303

@nandbhat made their first contribution in google/go-containerregistry#2308

@inteon made their first contribution in google/go-containerregistry#2328

@rohan-patnaik made their first contribution in google/go-containerregistry#2314

@mosskappa made their first contribution in google/go-containerregistry#2306

@Haihan-Jiang made their first contribution in google/go-containerregistry#2318

@tufstraka made their first contribution in google/go-containerregistry#2332

@amarkdotdev made their first contribution in google/go-containerregistry#2347

@64johnlee made their first contribution in google/go-containerregistry#2337

@bstoll made their first contribution in google/go-containerregistry#2334

Full Changelog: google/go-containerregistry@v0.21.6...v0.21.7

Commits

c68d899 Bump go version to 1.26.4 (#2350)
da61d86 transport: do not re-attach bearer token after cross-host redirect (#2349)
09fe1e5 fix(tarball): normalize paths when matching files (#2334)
5baa399 build(deps): bump the go-deps group across 3 directories with 4 updates (#2348)
97a8a17 fix(transport): apply refreshed bearer token after cross-host redirect (#2337)
e963497 internal/gzip: fix goroutine leak in ReadCloserLevel (#2347)
02649ea fix: prevent SSRF in google.List() pagination (#2332)
7204b40 build(deps): bump the actions group across 1 directory with 2 updates (#2344)
4cfaa93 build(deps): bump the go-deps group across 1 directory with 2 updates (#2343)
6849394 pkg/registry: export RedirectError (#2177)
Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.41.0 to 1.42.1

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.42.1

1.42.1

Bump Dependencies

v1.42.0

1.42.0

Add a set of Claude skill as a marketplace plugin

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.42.1

Bump Dependencies

1.42.0

Add a set of Claude skill as a marketplace plugin

Commits

ced6c1c v1.42.1
2beb9fb v1.42.1 (full)
006cd2c bump al lthe things
35ca084 v1.42.0
d72697b v1.42.0 (full)
1f95d86 add a set of claude skills as a marketplace plugin
See full diff in compare view

Updates golang.org/x/crypto from 0.52.0 to 0.53.0

Commits

45460e0 go.mod: update golang.org/x dependencies
d37c95e pkcs12: limit PBKDF iteration count to prevent CPU exhaustion
e2ffffe ssh: reject incomplete gssapi-with-mic configurations
60e158a ssh/test: isolate CLI tests from user SSH config and agent
1b77d23 ssh/knownhosts: reject lines with multiple or unknown markers
3872a2b ssh/knownhosts: verify declared key type matches decoded key
9f72ecc ssh/knownhosts: treat only ASCII space and tab as whitespace
8f405a4 ssh: validate ECDSA curve matches expected algorithm
bb41b3d ssh: improve DH GEX group selection using PreferredBits
e04e721 ssh/agent: validate ed25519 private key length in Add
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-deps group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.6.1` | `0.7.0` | | [github.com/fluxcd/pkg/apis/event](https://github.com/fluxcd/pkg) | `0.27.0` | `0.28.0` | | [github.com/fluxcd/pkg/apis/meta](https://github.com/fluxcd/pkg) | `1.30.1` | `1.31.0` | | [github.com/fluxcd/pkg/auth](https://github.com/fluxcd/pkg) | `0.54.0` | `0.56.0` | | [github.com/fluxcd/pkg/runtime](https://github.com/fluxcd/pkg) | `0.110.0` | `0.111.0` | | [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy) | `5.9.0` | `5.9.1` | | [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.21.6` | `0.21.7` | Updates `github.com/cyphar/filepath-securejoin` from 0.6.1 to 0.7.0 - [Release notes](https://github.com/cyphar/filepath-securejoin/releases) - [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md) - [Commits](cyphar/filepath-securejoin@v0.6.1...v0.7.0) Updates `github.com/fluxcd/pkg/apis/event` from 0.27.0 to 0.28.0 - [Commits](fluxcd/pkg@git/v0.27.0...git/v0.28.0) Updates `github.com/fluxcd/pkg/apis/meta` from 1.30.1 to 1.31.0 - [Commits](fluxcd/pkg@apis/meta/v1.30.1...apis/meta/v1.31.0) Updates `github.com/fluxcd/pkg/auth` from 0.54.0 to 0.56.0 - [Commits](fluxcd/pkg@oci/v0.54.0...oci/v0.56.0) Updates `github.com/fluxcd/pkg/runtime` from 0.110.0 to 0.111.0 - [Commits](fluxcd/pkg@runtime/v0.110.0...runtime/v0.111.0) Updates `github.com/go-git/go-billy/v5` from 5.9.0 to 5.9.1 - [Release notes](https://github.com/go-git/go-billy/releases) - [Commits](go-git/go-billy@v5.9.0...v5.9.1) Updates `github.com/google/go-containerregistry` from 0.21.6 to 0.21.7 - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](google/go-containerregistry@v0.21.6...v0.21.7) Updates `github.com/onsi/gomega` from 1.41.0 to 1.42.1 - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](onsi/gomega@v1.41.0...v1.42.1) Updates `golang.org/x/crypto` from 0.52.0 to 0.53.0 - [Commits](golang/crypto@v0.52.0...v0.53.0) --- updated-dependencies: - dependency-name: github.com/cyphar/filepath-securejoin dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/apis/event dependency-version: 0.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/apis/meta dependency-version: 1.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/auth dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fluxcd/pkg/runtime dependency-version: 0.111.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/go-git/go-billy/v5 dependency-version: 5.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/google/go-containerregistry dependency-version: 0.21.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/onsi/gomega dependency-version: 1.42.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/crypto dependency-version: 0.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-01T19:13:10Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency label Jul 28, 2026

dependabot Bot closed this Aug 1, 2026

dependabot Bot deleted the dependabot/go_modules/go-deps-a06b9988f2 branch August 1, 2026 19:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the go-deps group across 1 directory with 9 updates - #1079

Bump the go-deps group across 1 directory with 9 updates#1079
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-a06b9988f2

dependabot Bot commented on behalf of github Jul 28, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

[0.7.0] - 2025-06-17

Changed

v5.9.1

What's Changed

v0.21.7

What's Changed

New Contributors

v1.42.1

1.42.1

v1.42.0

1.42.0

1.42.1

1.42.0

Uh oh!

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 28, 2026 •

edited

Loading