chore(deps)(deps): bump the go-deps group across 1 directory with 9 updates by dependabot[bot] · Pull Request #71 · PickHD/basekarya

dependabot · 2026-07-13T09:22:35Z

Bumps the go-deps group with 8 updates in the /backend directory:

Package	From	To
github.com/minio/minio-go/v7	`7.1.0`	`7.2.1`
gorm.io/gorm	`1.31.1`	`1.31.2`
github.com/redis/go-redis/v9	`9.19.0`	`9.21.0`
github.com/signintech/gopdf	`0.36.1`	`0.37.0`
github.com/go-playground/validator/v10	`10.30.2`	`10.30.3`
github.com/xuri/excelize/v2	`2.10.1`	`2.11.0`
github.com/labstack/echo/v4	`4.15.2`	`4.15.4`
golang.org/x/crypto	`0.53.0`	`0.54.0`

Updates github.com/minio/minio-go/v7 from 7.1.0 to 7.2.1

Release notes

Sourced from github.com/minio/minio-go/v7's releases.

v7.2.0

What's Changed

Use go tool for ci-lint check by @klauspost in minio/minio-go#2229

Rename github.com/go-ini/ini to gopkg.in/ini.v1 by @ramondeklein in minio/minio-go#2232

Add RDMA / NVIDIA GPU Direct Storage support by @harshavardhana in minio/minio-go#2233

Full Changelog: minio/minio-go@v7.1.0...v7.2.0

Commits

7e34713 feat: support in mc inventory for custom run schedule (#2244)
016d0fd feat: stream GetObjectAnnotation payload via io.ReadCloser (#2243)
6c51637 feat: stream PutObjectAnnotation payload via io.ReadSeeker (#2242)
07c682a feat: add object annotation client APIs (#2241)
53b504a fix: caching defer bug (#2237)
291e83f add new aws region ap-southeast-6 (#2234)
33792ec Add RDMA / NVIDIA GPU Direct Storage support (#2233)
6bb13f7 Rename github.com/go-ini/ini to gopkg.in/ini.v1 (#2232)
d6341dc Use go tool for ci-lint check (#2229)
See full diff in compare view

Updates gorm.io/gorm from 1.31.1 to 1.31.2

Release notes

Sourced from gorm.io/gorm's releases.

Release v1.31.2

Changes

Fix potential rows leak on panic by deferring rows.Close() @omer-cengel (#7798)

perf: replace fmt.Sprintf with strconv in ExplainSQL numeric formatting @alpardfm (#7796)

Document NowFunc timezone behavior @morning-verlu (#7799)

correct typo and rename fileType to fieldType in AlterColumn @cragone (#7748)

fix: panic when using clause.Returning with CreateInBatches @Truongquangkhang (#7768)

fix(migrator): add nil guards to ColumnType methods to prevent panic @lihan3238 (#7767)

ci: switch tests Go matrix to stable/oldstable and update setup-go @smf-h (#7726)

chore(ci): bump actions/stale to v9 @Olexandr88 (#7696)

fix(migrator): don't clear alterColumn when defaults match @qqxhb (#7728)

Add package comments to fix ST1000 warnings @twocs (#7708)

generics: populate WithResult error @qqxhb (#7723)

fix(utils): restore FileWithLineNum caller depth and add regression test @smf-h (#7717)

tests: skip customized foreign key many2many on MySQL 8.4+ @smf-h (#7727)

fix tiny typo in error message @snelg (#7738)

Add unit test verifying chainable query methods mutate statement @miladev95 (#7684)

fix: Close connection after ping failure to prevent goroutine leak @liang09255 (#7689)

fix: Row() and Rows() functions should automaticaly apply the generic type as model @hakanakyurek (#7664)

internal/lru: improve concurrency with RWMutex @miladev95 (#7668)

Fix nil pointer panic in serializer for nil any-type fields @doraemonkeys (#7634)

staticcheck QF1001 @miladev95 (#7648)

Support array/slice expansion for named SQL parameters in parentheses @bafflingbug (#7614)

Commits

1d6ce99 Fix potential rows leak on panic by deferring rows.Close() (#7798)
f648834 perf: replace fmt.Sprintf with strconv in ExplainSQL numeric formatting (#7796)
49cd6b8 Document NowFunc timezone behavior (#7799)
d0ee5e2 correct typo and rename fileType to fieldType in AlterColumn (#7748)
2a22022 fix: panic when using clause.Returning with CreateInBatches (#7768)
3322929 fix(migrator): add nil guards to ColumnType methods to prevent panic (#7767)
40cd2af ci: switch tests Go matrix to stable/oldstable and update setup-go (#7726)
ba38501 chore(ci): bump actions/stale to v9 (#7696)
c1f742d fix: don't override alterColumn when defaults match (#7728)
c14d3ac update github ci golang version
Additional commits viewable in compare view

Updates github.com/redis/go-redis/v9 from 9.19.0 to 9.21.0

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.21.0

This is a minor release adding new features and bug fixes. There are no breaking changes; upgrading from 9.20.x is a drop-in replacement.

🚀 Highlights

Zero-copy GetToBuffer / SetFromBuffer

Two new StringCmdable methods let callers read and write Redis string values directly into and from pre-allocated byte buffers, eliminating the per-call payload allocation that Get/Set incur:
GetToBuffer(ctx, key, buf) *ZeroCopyStringCmd   // reads into buf; ZeroCopyStringCmd { Val() int; Bytes() []byte; Result() (int, error) }
SetFromBuffer(ctx, key, buf) *StatusCmd
GetToBuffer decodes the bulk reply straight into the caller-owned buf (no intermediate allocation); a buffer that is too small returns an error after draining the payload, so the connection stays aligned for the next reply. SetFromBuffer is provided for API symmetry — it dispatches to the same []byte writer path as Set(ctx, key, buf, 0) and produces byte-identical output on the wire. Available on *Client, *ClusterClient, *Ring, *Conn and Pipeliner.

(#3834) by @ndyakov

Explicit LIMIT 0 for stream trimming

Redis treats XTRIM/XADD approximate-trim (~) LIMIT 0 as "disable the trimming effort cap entirely", which differs from omitting LIMIT (the implicit 100 * stream-node-max-entries default). The command builders previously only emitted LIMIT when limit > 0, so callers could never send an explicit LIMIT 0. Following the KeepTTL = -1 precedent, the new XTrimLimitDisabled = -1 sentinel now emits an explicit LIMIT 0; limit == 0 keeps the historical no-LIMIT behavior, so existing callers produce byte-identical commands.

(#3848) by @TheRealMal

✨ New Features

Zero-copy buffer string commands: new GetToBuffer / SetFromBuffer on StringCmdable and the ZeroCopyStringCmd result type, reading/writing string values into caller-owned buffers without per-call payload allocation (#3834) by @ndyakov

XTrimLimitDisabled sentinel: XTRIM/XADD approximate trimming can now send an explicit LIMIT 0 to disable the trim effort cap, via the new XTrimLimitDisabled = -1 sentinel (#3848) by @TheRealMal

PubSub health-check timeouts: channel.initHealthCheck now bounds the Ping it issues with a fresh per-check timeout context (the exported pingTimeout / reconnectTimeout) instead of context.TODO(), so a stuck health-check Ping can no longer block indefinitely (#3819) by @abdellani

Skip redundant UNWATCH in Tx.Close: a transaction now tracks whether a WATCH is still active (watchArmed) and only issues UNWATCH on Close when it is, removing an extra round trip on the common WATCH/.../EXEC and no-key Watch paths while never returning a connection to the pool with an active watch (#3854) by @fcostaoliveira

🐛 Bug Fixes

maintnotifications ModeAuto fail-open: ModeAuto now stays fail-open when the server does not support maintenance notifications — connections are retired and tracking is guarded during downgrade so the client keeps working instead of erroring (#3853) by @terrorobe

👥 Contributors

We'd like to thank all the contributors who worked on this release!

@abdellani, @fcostaoliveira, @ndyakov, @terrorobe, @TheRealMal

9.20.1

This is a patch release containing bug fixes only. There are no new features or breaking changes; upgrading from 9.20.0 is a drop-in replacement.

🚀 Highlights

RESP3 pub/sub message loss fixed

PeekPushNotificationName previously inspected only the bytes already buffered by bufio, so when a push frame header straddled a buffer fill boundary it could return a truncated notification name (e.g. "messa" instead of "message"). The push processor then mis-routed the frame and ReadReply silently dropped it, causing intermittent RESP3 pub/sub message loss. The peek now grows its window (36 bytes → up to 4 KiB) and reads more from the connection until the header is complete, cleanly separating incomplete prefixes from corrupt frames (including overflow-safe bulk-length handling). Fixes #3839.

... (truncated)

Changelog

Sourced from github.com/redis/go-redis/v9's changelog.

9.21.0 (2026-06-18)

This is a minor release adding new features and bug fixes. There are no breaking changes; upgrading from 9.20.x is a drop-in replacement.

🚀 Highlights

Zero-copy GetToBuffer / SetFromBuffer

Two new StringCmdable methods let callers read and write Redis string values directly into and from pre-allocated byte buffers, eliminating the per-call payload allocation that Get/Set incur:
GetToBuffer(ctx, key, buf) *ZeroCopyStringCmd   // reads into buf; ZeroCopyStringCmd { Val() int; Bytes() []byte; Result() (int, error) }
SetFromBuffer(ctx, key, buf) *StatusCmd
GetToBuffer decodes the bulk reply straight into the caller-owned buf (no intermediate allocation); a buffer that is too small returns an error after draining the payload, so the connection stays aligned for the next reply. SetFromBuffer is provided for API symmetry — it dispatches to the same []byte writer path as Set(ctx, key, buf, 0) and produces byte-identical output on the wire. Available on *Client, *ClusterClient, *Ring, *Conn and Pipeliner.

(#3834) by @ndyakov

Explicit LIMIT 0 for stream trimming

Redis treats XTRIM/XADD approximate-trim (~) LIMIT 0 as "disable the trimming effort cap entirely", which differs from omitting LIMIT (the implicit 100 * stream-node-max-entries default). The command builders previously only emitted LIMIT when limit > 0, so callers could never send an explicit LIMIT 0. Following the KeepTTL = -1 precedent, the new XTrimLimitDisabled = -1 sentinel now emits an explicit LIMIT 0; limit == 0 keeps the historical no-LIMIT behavior, so existing callers produce byte-identical commands.

(#3848) by @TheRealMal

✨ New Features

Zero-copy buffer string commands: new GetToBuffer / SetFromBuffer on StringCmdable and the ZeroCopyStringCmd result type, reading/writing string values into caller-owned buffers without per-call payload allocation (#3834) by @ndyakov

XTrimLimitDisabled sentinel: XTRIM/XADD approximate trimming can now send an explicit LIMIT 0 to disable the trim effort cap, via the new XTrimLimitDisabled = -1 sentinel (#3848) by @TheRealMal

PubSub health-check timeouts: channel.initHealthCheck now bounds the Ping it issues with a fresh per-check timeout context (the exported pingTimeout / reconnectTimeout) instead of context.TODO(), so a stuck health-check Ping can no longer block indefinitely (#3819) by @abdellani

Skip redundant UNWATCH in Tx.Close: a transaction now tracks whether a WATCH is still active (watchArmed) and only issues UNWATCH on Close when it is, removing an extra round trip on the common WATCH/.../EXEC and no-key Watch paths while never returning a connection to the pool with an active watch (#3854) by @fcostaoliveira

🐛 Bug Fixes

maintnotifications ModeAuto fail-open: ModeAuto now stays fail-open when the server does not support maintenance notifications — connections are retired and tracking is guarded during downgrade so the client keeps working instead of erroring (#3853) by @terrorobe

👥 Contributors

We'd like to thank all the contributors who worked on this release!

@abdellani, @fcostaoliveira, @ndyakov, @terrorobe, @TheRealMal

Full Changelog: redis/go-redis@v9.20.1...v9.21.0

9.20.1 (2026-06-11)

This is a patch release containing bug fixes only. There are no new features or breaking changes; upgrading from 9.20.0 is a drop-in replacement.

... (truncated)

Commits

1551837 chore(release): 9.21.0 (#3857)
1cfa927 fix(maintnotifications): keep ModeAuto fail-open (#3853)
1f0ea0e feat(pubsub): introduce timeouts for Ping on channel.initHealthCheck (#3819)
5484b0b feat(tx): skip redundant UNWATCH in Tx.Close when no WATCH is active (#3854)
bf57a51 chore(deps): bump rojopolis/spellcheck-github-actions (#3852)
641294c feat(streams): support explicit LIMIT 0 in XTRIM/XADD trimming via XTrimLimit...
74d9bb0 feat(command): add zero-copy GetToBuffer and SetFromBuffer (#3834)
a13416b chore(release): 9.20.1 (#3847)
10dc44f fix(push): fix peeking when push name is truncated (#3842)
e1a2d68 fix(ft.hybrid): Always generate vector param names if they are not provided b...
Additional commits viewable in compare view

Updates github.com/signintech/gopdf from 0.36.1 to 0.37.0

Commits

8153e8b Merge branch 's-johri-feat/justify-align'
44a7c47 test: verify justify coexists with kerning
9dbeae6 test: add visual demo for justify alignment
36c33ba docs: document Justify text alignment
e845a10 feat: justify wrapped paragraphs, last line left-aligned
06e3959 feat: justify single-line cell text via TJ adjustments
48bfcec feat: add lineAlign last-line policy helper
b190d30 feat: add interior-space gap detection helpers
6010911 feat: add justifyAdjustment TJ distribution helper
ab82456 feat: add Justify alignment constant
Additional commits viewable in compare view

Updates github.com/go-playground/validator/v10 from 10.30.2 to 10.30.3

Release notes

Sourced from github.com/go-playground/validator/v10's releases.

v10.30.3

What's Changed

Fix/issue 1550 UUID case insensitive by @leo-jp-edwards in go-playground/validator#1551

Feat: Add NoneOf Validation by @Carmen-Shannon in go-playground/validator#1554

Add bcp47_strict_language_tag validator by @bfabio in go-playground/validator#1489

chore(deps): bump golang.org/x/text from 0.35.0 to 0.36.0 by @dependabot[bot] in go-playground/validator#1558

chore(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0 by @dependabot[bot] in go-playground/validator#1559

Add CLAUDE.md with repo guidance for Claude Code by @deankarn in go-playground/validator#1564

Reduce build size with dead code elimination by @zemzale in go-playground/validator#1542

Refactored out detectFileMIMEType, matchesMIMEType logic for reuse. Added standalone isMIMEType validator for flexibility by @dapzthelegend in go-playground/validator#1544

feat(translations): add timezone support for en and ja locales by @dedyf5 in go-playground/validator#1566

docs: use errors.As in README and translations example by @eyupcanakman in go-playground/validator#1563

docs: fix typos by @rymiyamoto in go-playground/validator#1568

feat: add origin validator for web origin URLs by @ahmedkamalio in go-playground/validator#1565

fix: reject hostnames with trailing hyphen in RFC 952 validator by @ahmedkamalio in go-playground/validator#1569

fix(lint): correctly disable govet inline analyzer & deprecated gomodguard by @nodivbyzero in go-playground/validator#1574

chore(deps): bump golang.org/x/text from 0.36.0 to 0.37.0 by @dependabot[bot] in go-playground/validator#1572

chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in go-playground/validator#1571

fix(cron): anchor regex and accept full cron syntax by @ahmedkamalio in go-playground/validator#1577

chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in go-playground/validator#1580

feat: omit blank tag names from namespace by @abemedia in go-playground/validator#1567

fix(docs): correct ripemd160 tag name in README validation table by @napoleonbot in go-playground/validator#1582

New Contributors

@leo-jp-edwards made their first contribution in go-playground/validator#1551

@Carmen-Shannon made their first contribution in go-playground/validator#1554

@dapzthelegend made their first contribution in go-playground/validator#1544

@dedyf5 made their first contribution in go-playground/validator#1566

@eyupcanakman made their first contribution in go-playground/validator#1563

@rymiyamoto made their first contribution in go-playground/validator#1568

@abemedia made their first contribution in go-playground/validator#1567

@napoleonbot made their first contribution in go-playground/validator#1582

Full Changelog: go-playground/validator@v10.30.2...v10.30.3

Commits

ac4c1ba fix(docs): correct ripemd160 tag name in README validation table (#1582)
feacb34 feat: omit blank tag names from namespace (#1567)
5ed0a7e chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#1580)
0364541 fix(cron): anchor regex and accept full cron syntax (#1577)
8eb2659 chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 (#1571)
f7e1721 chore(deps): bump golang.org/x/text from 0.36.0 to 0.37.0 (#1572)
cf37fce fix(lint): correctly disable govet inline analyzer & deprecated gomodguard (#...
7c334e5 fix: reject hostnames with trailing hyphen in RFC 952 validator (#1569)
6bcb7bc feat: add origin validator for web origin URLs (#1565)
6fd2fa8 docs: fix typos (#1568)
Additional commits viewable in compare view

Updates github.com/xuri/excelize/v2 from 2.10.1 to 2.11.0

Release notes

Sourced from github.com/xuri/excelize/v2's releases.

v2.11.0

We are pleased to announce the release of version 2.11.0. Featured are a handful of new areas of functionality and numerous bug fixes.

A summary of changes is available in the Release Notes. A full list of changes is available in the changelog.

Release Notes

The most notable changes in this release are:

Breaking Change

Upgraded requirement: Go language version is 1.25.0 or later, due to upgrading dependency package golang.org/x/net

Breaking changes for the AddChart, AddChartSheet and AddShape functions

Change Title field data type of Chart from []RichTextRun to ChartTitle

Change Line field data type of Shape from ShapeLine to LineOptions

Renamed data type ChartDashType to LineDashType

Renamed data type ChartLineType to LineType

Renamed data type ChartLine to LineOptions

Security

Check row number when reading worksheet to prevent unbounded memory allocation (CVE-2026-54063), related security advisories GHSA-h69g-9hx6-f3v4

Prevent attacker-controlled allocations by validating against worksheet row number overflow maximum limitation (CVE-2026-59161), related security advisories GHSA-q5j5-6p94-4gwc

Prevent panic on getting cell value with invalid shared string table index (CVE-2026-59162), related security advisories GHSA-fx5j-qcqg-grpf

Notable Features

Added new ChartTitle data type

Added new PivotTableShowValuesAs data type

Added new PivotTableShowValuesAsType enumeration

Added 3 new exported error variables: ErrPivotTableShowValuesAsBaseField, ErrPivotTableShowValuesAsBaseItem and ErrUnsupportedPivotTableShowValuesAsType

Added new field ShowValuesAs in PivotTableField data type

Added new field SelectedItems in PivotTableOptions and SlicerOptions data types

Added new function AutoFitColWidth to support auto fit columns width, related issue #92

The SetSheetName function allow sheet rename for invalid source names, related issue #548

The CalcCellValue function supports tilde wildcard criteria

The CalcCellValue function supports implicit intersection and fixes regex criteria anchoring

The CalcCellValue function supports 3D references across sheet ranges, related issue #2303

The CalcCellValue function supports returning formula calculation result with raw cell value, related issue #2316

The AddPivotTable function supports checking whether the same data field appears in pivot table column, rows and filter fields, to prevent generating a corrupted workbook

The AddPivotTable and GetPivotTables functions support setting and getting show values as of pivot table data fields, related issue #2340

The AddPivotTable, AddSlicer, GetPivotTables and GetSlicers functions support setting and getting selected items for pivot table and pivot table slicer, related issue #2154

The AddChart and AddChartSheet functions support setting chart title with formula

The AddChart and AddChartSheet functions support setting chart title and chart axis title's layout

The AddChart and AddChartSheet functions support setting line format for chart title and chart axis title

The AddShape function supports setting line format of shapes

The NewStyle function supports auto foreground and background color when creating solid fill style when no custom color value is specified

Compatibility Improvements

... (truncated)

Commits

90ff348 This closes #2344, fixes CalcCellValue function returning incorrect calculati...
09f0656 This fixes #548, allow sheet rename for invalid source names (#2345)
93f0b3c This fixes GHSA-q5j5-6p94-4gwc and GHSA-fx5j-qcqg-grpf (#2331)
1213a8b This related with #2340, implement unsupported pivot table show values as types
b7e098e This related with #2340, fix invalid pivot table show values as base field index
4ae56a6 This closes #2340, initialized support set and get show value as of pivot tab...
2e6a05b Update dependencies module to fix vulnerabilities
c88ce10 This closes #2337, clear shared formula when overwriting with a normal formul...
eb84319 This compact sparse worksheet rows in linear time, Go 1.21 and later required...
875b959 Check row number when reading worksheet for improve security
Additional commits viewable in compare view

Updates github.com/labstack/echo/v4 from 4.15.2 to 4.15.4

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.15.4

Security

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#3016, released in v5.2.1). Thanks to @a-tt-om and @oran-gugu for reporting.

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:
// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})
Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:
	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")
for static middleware
	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.15.4 - 2026-06-15

Security

Fixes GHSA-vfp3-v2gw-7wfq

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:
// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})
Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:
	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")
for static middleware
	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))
v4.15.3 - 2026-06-14

... (truncated)

Commits

ec79b58 Merge pull request #3020 from aldas/v4_v4-15-4_changelog
2714c07 Changelog for v4.15.4 - security fix
13f0ed1 Merge pull request #3019 from aldas/v4_backport_3016
d16a4ec backport PR 3016 from v4
8f167b9 Merge pull request #3018 from aldas/v4_remove_v5_dep
9afa4ba remove dependency on labstack/echo v5 introduced in go.mod and go.sum
1e05f63 Merge pull request #3017 from aldas/v4_ci_updates
11a3cc4 Update dependencies and add ignore for linting
26bd016 Update CI action versions
aa52f6a ci: run workflows on the v4 branch, not just master (#3013)
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.53.0 to 0.54.0

Commits

cdce021 go.mod: update golang.org/x dependencies
d9474cc openpgp: make the deprecation message more explicit
7626c50 ssh: verify declared key type matches decoded key in authorized_keys
0471e79 ssh/agent: enforce strict limits on DSA key parameters
6435c37 ssh: sanitize client disconnect messages
7d695da ssh/agent: drain channel stderr in agent forwarders
5b7f841 acme/autocert: fix data race in Manager.createCert
0b316e7 argon2: update RFC 9106 parameter recommendations
55aec0a x509roots/fallback: update bundle
5f2de1a internal: remove wycheproof tests
See full diff in compare view

Updates golang.org/x/text from 0.38.0 to 0.40.0

Commits

724af9c go.mod: update golang.org/x dependencies
bf5b9d6 internal/export/idna: always treat Punycode encoding pure ASCII as an error
b326f3d go.mod: update golang.org/x dependencies
5ae8e57 unicode/norm: avoid infinite loop on invalid input
0dc94a2 all: fix some comments
See full diff in compare view

dependabot · 2026-07-13T09:22:36Z

Labels

The following labels could not be found: backend, dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

…pdates Bumps the go-deps group with 8 updates in the /backend directory: | Package | From | To | | --- | --- | --- | | [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.1.0` | `7.2.1` | | [gorm.io/gorm](https://github.com/go-gorm/gorm) | `1.31.1` | `1.31.2` | | [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) | `9.19.0` | `9.21.0` | | [github.com/signintech/gopdf](https://github.com/signintech/gopdf) | `0.36.1` | `0.37.0` | | [github.com/go-playground/validator/v10](https://github.com/go-playground/validator) | `10.30.2` | `10.30.3` | | [github.com/xuri/excelize/v2](https://github.com/xuri/excelize) | `2.10.1` | `2.11.0` | | [github.com/labstack/echo/v4](https://github.com/labstack/echo) | `4.15.2` | `4.15.4` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.53.0` | `0.54.0` | Updates `github.com/minio/minio-go/v7` from 7.1.0 to 7.2.1 - [Release notes](https://github.com/minio/minio-go/releases) - [Commits](minio/minio-go@v7.1.0...v7.2.1) Updates `gorm.io/gorm` from 1.31.1 to 1.31.2 - [Release notes](https://github.com/go-gorm/gorm/releases) - [Commits](go-gorm/gorm@v1.31.1...v1.31.2) Updates `github.com/redis/go-redis/v9` from 9.19.0 to 9.21.0 - [Release notes](https://github.com/redis/go-redis/releases) - [Changelog](https://github.com/redis/go-redis/blob/master/RELEASE-NOTES.md) - [Commits](redis/go-redis@v9.19.0...v9.21.0) Updates `github.com/signintech/gopdf` from 0.36.1 to 0.37.0 - [Changelog](https://github.com/signintech/gopdf/blob/master/Changelog.md) - [Commits](signintech/gopdf@v0.36.1...v0.37.0) Updates `github.com/go-playground/validator/v10` from 10.30.2 to 10.30.3 - [Release notes](https://github.com/go-playground/validator/releases) - [Commits](go-playground/validator@v10.30.2...v10.30.3) Updates `github.com/xuri/excelize/v2` from 2.10.1 to 2.11.0 - [Release notes](https://github.com/xuri/excelize/releases) - [Commits](qax-os/excelize@v2.10.1...v2.11.0) Updates `github.com/labstack/echo/v4` from 4.15.2 to 4.15.4 - [Release notes](https://github.com/labstack/echo/releases) - [Changelog](https://github.com/labstack/echo/blob/v4.15.4/CHANGELOG.md) - [Commits](labstack/echo@v4.15.2...v4.15.4) Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0 - [Commits](golang/crypto@v0.53.0...v0.54.0) Updates `golang.org/x/text` from 0.38.0 to 0.40.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.38.0...v0.40.0) --- updated-dependencies: - dependency-name: github.com/go-playground/validator/v10 dependency-version: 10.30.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/labstack/echo/v4 dependency-version: 4.15.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/minio/minio-go/v7 dependency-version: 7.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/redis/go-redis/v9 dependency-version: 9.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/signintech/gopdf dependency-version: 0.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/xuri/excelize/v2 dependency-version: 2.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/text dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: gorm.io/gorm dependency-version: 1.31.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot force-pushed the dependabot/go_modules/backend/go-deps-113958a4a2 branch from 10fae53 to 432fc36 Compare July 20, 2026 09:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps)(deps): bump the go-deps group across 1 directory with 9 updates - #71

chore(deps)(deps): bump the go-deps group across 1 directory with 9 updates#71
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/backend/go-deps-113958a4a2

dependabot Bot commented on behalf of github Jul 13, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.2.0

What's Changed

Release v1.31.2

Changes

9.21.0

🚀 Highlights

Zero-copy GetToBuffer / SetFromBuffer

Explicit LIMIT 0 for stream trimming

✨ New Features

🐛 Bug Fixes

👥 Contributors

9.20.1

🚀 Highlights

RESP3 pub/sub message loss fixed

9.21.0 (2026-06-18)

🚀 Highlights

Zero-copy GetToBuffer / SetFromBuffer

Explicit LIMIT 0 for stream trimming

✨ New Features

🐛 Bug Fixes

👥 Contributors

9.20.1 (2026-06-11)

v10.30.3

What's Changed

New Contributors

v2.11.0

Release Notes

Breaking Change

Security

Notable Features

Compatibility Improvements

v4.15.4

v4.15.4 - 2026-06-15

v4.15.3 - 2026-06-14

Uh oh!

dependabot Bot commented on behalf of github Jul 13, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 13, 2026 •

edited

Loading

Zero-copy `GetToBuffer` / `SetFromBuffer`

Explicit `LIMIT 0` for stream trimming

Zero-copy `GetToBuffer` / `SetFromBuffer`

Explicit `LIMIT 0` for stream trimming