Skip to content

deps(deps): bump the go-dependencies group across 1 directory with 7 updates - #337

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-621b3cf4d7
Open

deps(deps): bump the go-dependencies group across 1 directory with 7 updates#337
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-621b3cf4d7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-dependencies group with 7 updates in the / directory:

Package From To
github.com/google/go-containerregistry 0.21.7 0.22.0
github.com/lestrrat-go/jwx/v3 3.1.1 3.2.0
github.com/modelcontextprotocol/go-sdk 1.6.1 1.7.0
github.com/onsi/ginkgo/v2 2.32.0 2.32.1
github.com/onsi/gomega 1.42.1 1.43.0
github.com/sigstore/sigstore-go 1.2.2 1.3.0
github.com/stretchr/testify 1.11.1 1.12.1

Updates github.com/google/go-containerregistry from 0.21.7 to 0.22.0

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.22.0

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.21.9...v0.21.10

v0.21.9

What's Changed

Full Changelog: google/go-containerregistry@v0.21.8...v0.21.9

v0.21.8

The artifacts attached to this release are missing SLSA provenance, see #2390.

What's Changed

... (truncated)

Commits
  • 3f4ff3c fix(build): unify new build flow into cloudbuild_v2.yaml (#2419)
  • c6b5acd fix(build): correct Cloud Build schema options and source provenance hash (#2...
  • 8f4a85d go.mod: bump Go version + add toolchain directive to replace .go-version file...
  • 5481560 build(deps): bump the go-deps group across 1 directory with 3 updates (#2415)
  • 5b5c272 build(deps): bump the actions group across 1 directory with 8 updates (#2405)
  • 66dd454 remote: retry failed Puller and Pusher initialization (#2406)
  • 3f47f91 fix: add missing substitutions and workspace cleanup to new build files (#2413)
  • 4cb3583 Allow single-character repository paths (#2407)
  • 82cc428 remote: resolve push-check credentials against the repository (#2411)
  • 97815aa build: add multi-architecture Cloud Build configurations for crane, gcrane, a...
  • Additional commits viewable in compare view

Updates github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.2.0

Release notes

Sourced from github.com/lestrrat-go/jwx/v3's releases.

v3.2.0

For more detailed release notes, see Changes.

What's Changed

Full Changelog: lestrrat-go/jwx@v3.1.1...v3.2.0

Changelog

Sourced from github.com/lestrrat-go/jwx/v3's changelog.

v3.2.0 27 Jul 2026

  • [jwe] Correct the JSON "aad" member so it contains only BASE64URL of the external Additional Authenticated Data, rather than the combined value used as the content-encryption AAD. Add jwe.WithAuthenticateData for encrypting JSON JWEs with external AAD; the value is included in the shared AEAD input for all recipients, and compact serialization rejects non-empty external AAD. (#2276, #2278)

  • [jwk] Added opt-in retention of unparseable JWK Set entries. Passing jwk.WithStrictKeySetParsing(false) to jwk.Parse (or setting it globally via jwk.Configure) keeps an entry whose key type is not understood — for example a post-quantum key published alongside classical keys — as a jwk.UnsupportedKey placeholder instead of failing the whole set (RFC 7517 §5). The placeholder preserves the entry's original JSON (marshaling round-trips losslessly) and the parse error via Reason(); use jwk.IsUnsupportedKey to detect one. The default is unchanged: v3 still fails the whole set on the first unparseable entry, so existing callers see no difference. The same option exists in v4 with the opposite default (v4 retains by default, v3 stays strict by default); call sites that pass the option explicitly keep the same meaning across the v3→v4 migration. Placeholders are rejected by jws/jwe key selection, jwk.Export, jwk.AssignKeyID, and jwk.PublicSetOf (which accepts a new jwk.WithOmitUnsupportedKeys(true) to drop them). (#2263)

Commits
  • 94006b6 release v3.2.0
  • 04612cd Merge pull request #2278 from lestrrat-go/feat-v3-jwe-authenticated-data
  • cd553be Merge pull request #2276 from lestrrat-go/fix-v3-jwe-json-aad
  • f414ccf add JWE Changes entry
  • 73e36fb add JWE authenticated data option
  • c937f0b fix jwe lint issue
  • 5137768 fix jwe JSON AAD serialization
  • f55fa6a recommend opting into retain for third-party JWK sets with PQC keys (#2274)
  • 701554e [v3] test jwe rejects UnsupportedKey placeholder (#2272)
  • 79ce4db fix per-call reject-dup-kid override of global (#2270)
  • Additional commits viewable in compare view

Updates github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.7.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.7.0

This release brings full support for protocol version 2026-07-28. The wire protocol is largely rewritten: a stateless model with per-request _meta, a new server/discover RPC replacing the initialize handshake, multi-round-trip requests (MRTR) replacing server-initiated calls, a unified subscriptions/listen stream replacing free-floating change notifications, standardised HTTP headers, and the formal deprecation of the roots, sampling, and logging features.

The streamable HTTP transport accepts requests at protocol version 2026-07-28 only when StreamableHTTPOptions.Stateless = true. If you want to expose the new protocol over HTTP, set Stateless = true; if you want to keep stateful sessions, your clients will negotiate down to 2025-11-25.

Backward compatibility with 2025-11-25 and earlier is preserved on every endpoint. The SDK negotiates the highest mutually-supported version at connect time. The new protocol is enabled by default for new clients; existing legacy clients and servers continue to work unchanged.

This release consolidates everything shipped in v1.7.0-pre.1, v1.7.0-pre.2, and v1.7.0-pre.3. Thank you to everyone who exercised the pre-releases and filed feedback.

v1.7.0-pre.3 is already successfully used by GitHub, serving more than half a million users.

Make MCP Stateless (SEP-2575) & Sessionless (SEP-2567)

The initialize/notifications/initialized handshake is removed in 2026-07-28. Each request now carries _meta.io.modelcontextprotocol/{protocolVersion,clientInfo,clientCapabilities} so the server can validate the peer without state. A new server/discover RPC lets clients learn the server's supported versions and capabilities up front; the SDK falls back to legacy initialize if discover fails. Resumability (Last-Event-ID, standalone GET) is removed; ping, logging/setLevel, resources/subscribe, and resources/unsubscribe are also removed on this revision and rejected with MethodNotFound.

Subscriptions listen (SEP-2575)

The legacy tools/list_changed, prompts/list_changed, resources/list_changed, and resources/updated notifications are replaced by a single long-lived subscriptions/listen request whose response stream multiplexes every change notification the client opted into, each tagged with io.modelcontextprotocol/subscriptionId. The SDK opens this stream automatically on Client.Connect when the corresponding list-changed handler is set; servers route notifications only to subscribed sessions.

Multi Round-Trip Requests (SEP-2322)

Server-to-client requests for elicitation, sampling, and roots are no longer issued as fresh JSON-RPC requests. Instead a tool/prompt/resource handler returns an InputRequiredResult whose inputRequests field carries the requests; the client fulfils each and retries the original call with inputResponses populated. The SDK ships client- and server-side middleware that handles this transparently in both directions, including a server-side compatibility shim that lets MRTR handlers also work against legacy clients.

Cacheable list results (SEP-2549)

tools/list, prompts/list, resources/list, resources/templates/list, resources/read, and server/discover results now carry ttlMs and cacheScope fields. Clients honour them as freshness hints to reduce polling; shared intermediaries use cacheScope to decide whether responses may be cached.

HTTP standardization (SEP-2243)

The streamable HTTP transport now mirrors selected fields from the JSON-RPC body into HTTP headers (Mcp-Method, Mcp-Name, Mcp-Protocol-Version, Mcp-Param-*) so network intermediaries can route and observe MCP traffic without deep packet inspection. Tools can declare per-parameter passthrough via x-mcp-header annotations on their input schema. Body↔header mismatches return -32020 HeaderMismatch.

... (truncated)

Commits

Updates github.com/onsi/ginkgo/v2 from 2.32.0 to 2.32.1

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.32.1

2.32.1

Fixes

  • Defer AfterAll until repeated spec completes [e647b3b]
Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.32.1

Fixes

  • Defer AfterAll until repeated spec completes [e647b3b]
Commits

Updates github.com/onsi/gomega from 1.42.1 to 1.43.0

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.43.0

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

Commits

Updates github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0

Release notes

Sourced from github.com/sigstore/sigstore-go's releases.

v1.3.0

What's Changed

New Contributors

Full Changelog: sigstore/sigstore-go@v1.2.2...v1.3.0

Commits
  • 22d3691 Bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#667)
  • 41fe108 Bump linter, disable goconst, run go fix (#664)
  • ba85fa8 verify: stop materializing in-toto predicates the verifier never reads (#666)
  • 96c07cb Handle 409s from Rekor v1 by fetching the entry (#647)
  • 85e559c Bump the minor-patch group across 1 directory with 2 updates (#662)
  • fe6a5a5 Bump actions/checkout from 7.0.0 to 7.0.1 (#663)
  • fc71b2a fix(verify): prevent nil-pointer panic in TLogEntries (#658)
  • 444ecf7 Bump the minor-patch group across 1 directory with 6 updates (#660)
  • 96894f5 Bump actions/setup-go from 6.5.0 to 7.0.0 (#659)
  • See full diff in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(deps): bump the go-dependencies group across 1 directory with 7 …
2bcd88b 
…updates

Bumps the go-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.21.7` | `0.22.0` |
| [github.com/lestrrat-go/jwx/v3](https://github.com/lestrrat-go/jwx) | `3.1.1` | `3.2.0` |
| [github.com/modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) | `1.6.1` | `1.7.0` |
| [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) | `2.32.0` | `2.32.1` |
| [github.com/onsi/gomega](https://github.com/onsi/gomega) | `1.42.1` | `1.43.0` |
| [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) | `1.2.2` | `1.3.0` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.1` |



Updates `github.com/google/go-containerregistry` from 0.21.7 to 0.22.0
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Commits](google/go-containerregistry@v0.21.7...v0.22.0)

Updates `github.com/lestrrat-go/jwx/v3` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/lestrrat-go/jwx/releases)
- [Changelog](https://github.com/lestrrat-go/jwx/blob/v3.2.0/Changes)
- [Commits](lestrrat-go/jwx@v3.1.1...v3.2.0)

Updates `github.com/modelcontextprotocol/go-sdk` from 1.6.1 to 1.7.0
- [Release notes](https://github.com/modelcontextprotocol/go-sdk/releases)
- [Commits](modelcontextprotocol/go-sdk@v1.6.1...v1.7.0)

Updates `github.com/onsi/ginkgo/v2` from 2.32.0 to 2.32.1
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](onsi/ginkgo@v2.32.0...v2.32.1)

Updates `github.com/onsi/gomega` from 1.42.1 to 1.43.0
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.42.1...v1.43.0)

Updates `github.com/sigstore/sigstore-go` from 1.2.2 to 1.3.0
- [Release notes](https://github.com/sigstore/sigstore-go/releases)
- [Commits](sigstore/sigstore-go@v1.2.2...v1.3.0)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/lestrrat-go/jwx/v3
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/modelcontextprotocol/go-sdk
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-version: 2.32.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/onsi/gomega
  dependency-version: 1.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/sigstore/sigstore-go
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner September 1, 2026 10:11
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 1, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: @genmcp/maintainers. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants