Skip to content

fix(deps): bump the external group across 1 directory with 5 updates #2917

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
jakedoublev merged 1 commit into from
Dec 19, 2025
Merged

fix(deps): bump the external group across 1 directory with 5 updates #2917

jakedoublev merged 1 commit into from
Dec 19, 2025

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 18, 2025 •
edited
Loading

Bumps the external group with 4 updates in the /examples directory: connectrpc.com/connect, github.com/spf13/cobra, github.com/stretchr/testify and google.golang.org/grpc.

Updates connectrpc.com/connect from 1.18.1 to 1.19.1

Release notes

Sourced from connectrpc.com/connect's releases.

v1.19.1

What's Changed

Bugfixes

Full Changelog: connectrpc/connect-go@v1.19.0...v1.19.1

v1.19.0

This release introduces the highly requested "simple" flag for code generation, making Connect significantly more ergonomic for everyday RPC development.

The new simple flag in protoc-gen-connect-go generates cleaner, more intuitive client and handler interfaces that eliminate request/response wrappers for most use cases. This addresses community feedback about verbosity and provides a more straightforward API. When enabled, metadata (headers/trailers) can be passed through context instead of explicit wrapper objects, optimizing for the common case where developers don't need direct access to HTTP headers.

What's Changed

Enhancements

Bugfixes

Other changes

New Contributors

Full Changelog: connectrpc/connect-go@v1.18.1...v1.19.0

Commits

Updates github.com/spf13/cobra from 1.9.1 to 1.10.1

Release notes

Sourced from github.com/spf13/cobra's releases.

v1.10.1

🐛 Fix

v1.0.9 of pflags brought back ParseErrorsWhitelist and marked it as deprecated

Full Changelog: spf13/cobra@v1.10.0...v1.10.1

v1.10.0

What's Changed

🚨 Attention!

This version of pflag carried a breaking change: it renamed ParseErrorsWhitelist to ParseErrorsAllowlist which can break builds if both pflag and cobra are dependencies in your project.

  • If you use both pflag and cobra, upgrade pflagto 1.0.8 andcobrato1.10.0`
  • or use the newer, fixed version of pflag v1.0.9 which keeps the deprecated ParseErrorsWhitelist

More details can be found here: spf13/cobra#2303

✨ Features

🐛 Fix

🪠 Testing

📝 Docs

New Contributors

... (truncated)

Commits
  • 7da941c chore: Bump pflag to v1.0.9 (#2305)
  • 51d6751 Bump pflag to 1.0.8 (#2303)
  • 3f3b818 Update README.md with new logo
  • dcaf42e Add Periscope to the list of projects using Cobra (#2299)
  • 6dec1ae The default ShellCompDirective can be customized for a command and its subcom...
  • c8289c1 chore(golangci-lint): add some exclusion presets
  • 4af7b64 refactor: apply golangci-lint autofixes, work around false positives
  • 75790e4 chore(golangci-lint): upgrade to v2
  • db3ddb5 Adding sponsorship to README.md
  • 67171d6 putting sponsorship below header
  • Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.10.0 to 1.11.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.11.1

This release fixes #1785 introduced in v1.11.0 where expected argument values implementing the stringer interface (String() string) with a method which mutates their value, when passed to mock.Mock.On (m.On("Method", <expected>).Return()) or actual argument values passed to mock.Mock.Called may no longer match one another where they previously did match. The behaviour prior to v1.11.0 where the stringer is always called is restored. Future testify releases may not call the stringer method at all in this case.

What's Changed

Full Changelog: stretchr/testify@v1.11.0...v1.11.1

v1.11.0

What's Changed

Functional Changes

v1.11.0 Includes a number of performance improvements.

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 2a57335 Merge pull request #1788 from brackendawson/1785-backport-1.11
  • af8c912 Backport #1786 to release/1.11
  • b7801fb Merge pull request #1778 from stretchr/dependabot/github_actions/actions/chec...
  • 69831f3 build(deps): bump actions/checkout from 4 to 5
  • a53be35 Improve captureTestingT helper
  • aafb604 mock: improve formatting of error message
  • 7218e03 improve error msg
  • 929a212 Merge pull request #1758 from stretchr/dolmen/suite-faster-method-filtering
  • bc7459e suite: faster filtering of methods (-testify.m)
  • 7d37b5c suite: refactor methodFilter
  • Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.73.0 to 1.77.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.77.0

API Changes

  • mem: Replace the Reader interface with a struct for better performance and maintainability. (#8669)

Behavior Changes

  • balancer/pickfirst: Remove support for the old pick_first LB policy via the environment variable GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=false. The new pick_first has been the default since v1.71.0. (#8672)

Bug Fixes

  • xdsclient: Fix a race condition in the ADS stream implementation that could result in resource-not-found errors, causing the gRPC client channel to move to TransientFailure. (#8605)
  • client: Ignore HTTP status header for gRPC streams. (#8548)
  • client: Set a read deadline when closing a transport to prevent it from blocking indefinitely on a broken connection. (#8534)
  • client: Fix a bug where default port 443 was not automatically added to addresses without a specified port when sent to a proxy.
    • Setting environment variable GRPC_EXPERIMENTAL_ENABLE_DEFAULT_PORT_FOR_PROXY_TARGET=false disables this change; please file a bug if any problems are encountered as we will remove this option soon. (#8613)
  • balancer/pickfirst: Fix a bug where duplicate addresses were not being ignored as intended. (#8611)
  • server: Fix a bug that caused overcounting of channelz metrics for successful and failed streams. (#8573)
  • balancer/pickfirst: When configured, shuffle addresses in resolver updates that lack endpoints. Since gRPC automatically adds endpoints to resolver updates, this bug only affects custom LB policies that delegate to pick_first but don't set endpoints. (#8610)
  • mem: Clear large buffers before re-using. (#8670)

Performance Improvements

  • transport: Reduce heap allocations to reduce time spent in garbage collection. (#8624, #8630, #8639, #8668)
  • transport: Avoid copies when reading and writing Data frames. (#8657, #8667)
  • mem: Avoid clearing newly allocated buffers. (#8670)

New Features

  • outlierdetection: Add metrics specified in gRFC A91. (#8644)
  • stats/opentelemetry: Add support for optional label grpc.lb.backend_service in per-call metrics (#8637)
  • xds: Add support for JWT Call Credentials as specified in gRFC A97. Set environment variable GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS=true to enable this feature. (#8536)
  • experimental/stats: Add support for up/down counters. (#8581)

Release 1.76.0

Dependencies

Bug Fixes

  • client: Return status INTERNAL when a server sends zero response messages for a unary or client-streaming RPC. (#8523)
  • client: Fail RPCs with status INTERNAL instead of UNKNOWN upon receiving http headers with status 1xx and END_STREAM flag set. (#8518)
  • pick_first: Fix race condition that could cause pick_first to get stuck in IDLE state on backend address change. (#8615)

... (truncated)

Commits

Updates google.golang.org/protobuf from 1.36.6 to 1.36.10

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Nov 18, 2025
@dependabot dependabot bot requested review from a team as code owners November 18, 2025 17:09
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Nov 18, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Nov 18, 2025

X-Test Results

opentdfplatform9WZA44.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from 8ef76b6 to e4205bd Compare November 19, 2025 17:10
@github-actions
Copy link
Contributor

github-actions bot commented Nov 19, 2025

X-Test Results

opentdfplatformLI3UVG.dockerbuild
✅ js-v0.4.34
cukes-report
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from e4205bd to f2ed7a8 Compare November 20, 2025 17:09
@github-actions
Copy link
Contributor

github-actions bot commented Nov 20, 2025

Dependency Review

The following issues were found:
  • ❌ 1 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 6 package(s) with unknown licenses.
See the Details below.

Vulnerabilities

examples/go.mod

NameVersionVulnerabilitySeverity
golang.org/x/crypto0.43.0golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumptionmoderate
golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds readmoderate

License Issues

examples/go.mod

PackageVersionLicenseIssue Type
golang.org/x/crypto0.43.0NullUnknown License
golang.org/x/net0.46.1-0.20251013234738-63d1a5100f82NullUnknown License
golang.org/x/oauth20.32.0NullUnknown License
golang.org/x/sys0.37.0NullUnknown License
golang.org/x/text0.30.0NullUnknown License
google.golang.org/protobuf1.36.10NullUnknown License
Denied Licenses: GPL-2.0, AGPL-1.0, AGPL-1.0-or-later, AGPL-1.0-only, AGPL-3.0, AGPL-3.0-only, AGPL-3.0-or-later, GPL-1.0, GPL-1.0+, GPL-1.0-only, GPL-1.0-or-later, CNRI-Python-GPL-Compatible, GPL-2.0+, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0-with-GCC-exception, GPL-2.0-with-autoconf-exception, GPL-2.0-with-bison-exception, GPL-2.0-with-classpath-exception, GPL-2.0-with-font-exception, GPL-3.0, GPL-3.0+, GPL-3.0-only, GPL-3.0-or-later, GPL-3.0-with-GCC-exception, GPL-3.0-with-autoconf-exception, LGPL-2.0, LGPL-2.0+, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1, LGPL-2.1+, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0, LGPL-3.0+, LGPL-3.0-only, LGPL-3.0-or-later, LGPLLR, NGPL
Excluded from license check: pkg:githubactions/SonarSource/sonarqube-scan-action

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
gomod/golang.org/x/crypto 0.43.0 UnknownUnknown
gomod/connectrpc.com/connect 1.19.1 🟢 6.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 9security policy file detected
Maintained🟢 1016 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 2badge detected: InProgress
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/spf13/cobra 1.10.1 🟢 6.9
Details
CheckScoreReason
Maintained🟢 52 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 21/25 approved changesets -- score normalized to 8
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/spf13/pflag 1.0.9 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 7Found 11/14 approved changesets -- score normalized to 7
Maintained🟢 1021 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/stretchr/testify 1.11.1 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/golang.org/x/net 0.46.1-0.20251013234738-63d1a5100f82 UnknownUnknown
gomod/golang.org/x/oauth2 0.32.0 UnknownUnknown
gomod/golang.org/x/sys 0.37.0 UnknownUnknown
gomod/golang.org/x/text 0.30.0 UnknownUnknown
gomod/google.golang.org/genproto/googleapis/api 0.0.0-20251022142026-3a174f9686a8 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1015 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 2SAST tool is not run on all commits -- score normalized to 2
Vulnerabilities🟢 100 existing vulnerabilities detected
gomod/google.golang.org/genproto/googleapis/rpc 0.0.0-20251022142026-3a174f9686a8 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1015 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 2SAST tool is not run on all commits -- score normalized to 2
Vulnerabilities🟢 100 existing vulnerabilities detected
gomod/google.golang.org/grpc 1.77.0 🟢 8.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 9security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST🟢 7SAST tool detected but not run on all commits
Vulnerabilities🟢 100 existing vulnerabilities detected
gomod/google.golang.org/protobuf 1.36.10 UnknownUnknown

Scanned Files

  • examples/go.mod

1 similar comment
@github-actions
Copy link
Contributor

github-actions bot commented Nov 20, 2025

Dependency Review

The following issues were found:
  • ❌ 1 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 6 package(s) with unknown licenses.
See the Details below.

Vulnerabilities

examples/go.mod

NameVersionVulnerabilitySeverity
golang.org/x/crypto0.43.0golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumptionmoderate
golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds readmoderate

License Issues

examples/go.mod

PackageVersionLicenseIssue Type
golang.org/x/crypto0.43.0NullUnknown License
golang.org/x/net0.46.1-0.20251013234738-63d1a5100f82NullUnknown License
golang.org/x/oauth20.32.0NullUnknown License
golang.org/x/sys0.37.0NullUnknown License
golang.org/x/text0.30.0NullUnknown License
google.golang.org/protobuf1.36.10NullUnknown License
Denied Licenses: GPL-2.0, AGPL-1.0, AGPL-1.0-or-later, AGPL-1.0-only, AGPL-3.0, AGPL-3.0-only, AGPL-3.0-or-later, GPL-1.0, GPL-1.0+, GPL-1.0-only, GPL-1.0-or-later, CNRI-Python-GPL-Compatible, GPL-2.0+, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0-with-GCC-exception, GPL-2.0-with-autoconf-exception, GPL-2.0-with-bison-exception, GPL-2.0-with-classpath-exception, GPL-2.0-with-font-exception, GPL-3.0, GPL-3.0+, GPL-3.0-only, GPL-3.0-or-later, GPL-3.0-with-GCC-exception, GPL-3.0-with-autoconf-exception, LGPL-2.0, LGPL-2.0+, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1, LGPL-2.1+, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0, LGPL-3.0+, LGPL-3.0-only, LGPL-3.0-or-later, LGPLLR, NGPL
Excluded from license check: pkg:githubactions/SonarSource/sonarqube-scan-action

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
gomod/golang.org/x/crypto 0.43.0 UnknownUnknown
gomod/connectrpc.com/connect 1.19.1 🟢 6.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 9security policy file detected
Maintained🟢 1016 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 2badge detected: InProgress
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/spf13/cobra 1.10.1 🟢 6.9
Details
CheckScoreReason
Maintained🟢 52 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 8Found 21/25 approved changesets -- score normalized to 8
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/spf13/pflag 1.0.9 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 7Found 11/14 approved changesets -- score normalized to 7
Maintained🟢 1021 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/stretchr/testify 1.11.1 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
gomod/golang.org/x/net 0.46.1-0.20251013234738-63d1a5100f82 UnknownUnknown
gomod/golang.org/x/oauth2 0.32.0 UnknownUnknown
gomod/golang.org/x/sys 0.37.0 UnknownUnknown
gomod/golang.org/x/text 0.30.0 UnknownUnknown
gomod/google.golang.org/genproto/googleapis/api 0.0.0-20251022142026-3a174f9686a8 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1015 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 2SAST tool is not run on all commits -- score normalized to 2
Vulnerabilities🟢 100 existing vulnerabilities detected
gomod/google.golang.org/genproto/googleapis/rpc 0.0.0-20251022142026-3a174f9686a8 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1015 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 2SAST tool is not run on all commits -- score normalized to 2
Vulnerabilities🟢 100 existing vulnerabilities detected
gomod/google.golang.org/grpc 1.77.0 🟢 8.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 9security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST🟢 7SAST tool detected but not run on all commits
Vulnerabilities🟢 100 existing vulnerabilities detected
gomod/google.golang.org/protobuf 1.36.10 UnknownUnknown

Scanned Files

  • examples/go.mod

@github-actions
Copy link
Contributor

github-actions bot commented Nov 20, 2025

X-Test Results

opentdfplatformN6AJYP.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from f2ed7a8 to 5b725fe Compare November 21, 2025 21:42
@github-actions
Copy link
Contributor

github-actions bot commented Nov 21, 2025

X-Test Results

opentdfplatformNEE8BJ.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from 5b725fe to 105c81c Compare November 27, 2025 17:08
@github-actions
Copy link
Contributor

github-actions bot commented Nov 27, 2025

X-Test Results

opentdfplatformUWDBU3.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from 105c81c to b4a30e3 Compare December 3, 2025 16:11
@github-actions
Copy link
Contributor

github-actions bot commented Dec 3, 2025

X-Test Results

opentdfplatformK0M6S6.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from b4a30e3 to 320baee Compare December 4, 2025 17:11
@github-actions
Copy link
Contributor

github-actions bot commented Dec 4, 2025

X-Test Results

opentdfplatform0560OO.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from 320baee to 38569d7 Compare December 5, 2025 17:10
@github-actions
Copy link
Contributor

github-actions bot commented Dec 5, 2025

X-Test Results

opentdfplatformIN4LET.dockerbuild
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
cukes-report
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from 38569d7 to fb96480 Compare December 9, 2025 17:10
@github-actions
Copy link
Contributor

github-actions bot commented Dec 9, 2025

X-Test Results

opentdfplatform2F8A6O.dockerbuild
cukes-report
✅ js-v0.4.34
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from fb96480 to d7764ce Compare December 16, 2025 17:10
@github-actions
Copy link
Contributor

github-actions bot commented Dec 16, 2025

X-Test Results

opentdfplatformXSLV0Y.dockerbuild
✅ js-v0.4.34
cukes-report
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from d7764ce to bb658b0 Compare December 17, 2025 17:11
@github-actions
Copy link
Contributor

github-actions bot commented Dec 17, 2025

X-Test Results

opentdfplatformPVO7BU.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from bb658b0 to 996e94b Compare December 19, 2025 17:08
@github-actions
Copy link
Contributor

github-actions bot commented Dec 19, 2025

X-Test Results

opentdfplatformWJQOSL.dockerbuild
✅ js-v0.4.34
✅ java-v0.4.34
cukes-report
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from 996e94b to 385f4c0 Compare December 19, 2025 17:39
@github-actions
Copy link
Contributor

github-actions bot commented Dec 19, 2025

X-Test Results

opentdfplatformMZ2OG4.dockerbuild
✅ java-v0.4.34
cukes-report
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@jakedoublev
Copy link
Contributor

jakedoublev commented Dec 19, 2025

@dependabot recreate

@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from 385f4c0 to 9c366fd Compare December 19, 2025 18:36
@github-actions
Copy link
Contributor

github-actions bot commented Dec 19, 2025

X-Test Results

opentdfplatformJSO91X.dockerbuild
✅ js-v0.4.34
cukes-report
✅ java-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@jakedoublev
Copy link
Contributor

jakedoublev commented Dec 19, 2025

@dependabot rebase

1 similar comment
@jakedoublev
Copy link
Contributor

jakedoublev commented Dec 19, 2025

@dependabot rebase

@dependabot
fix(deps): bump the external group across 1 directory with 5 updates
7126bc5 
Bumps the external group with 4 updates in the /examples directory: [connectrpc.com/connect](https://github.com/connectrpc/connect-go), [github.com/spf13/cobra](https://github.com/spf13/cobra), [github.com/stretchr/testify](https://github.com/stretchr/testify) and [google.golang.org/grpc](https://github.com/grpc/grpc-go).


Updates `connectrpc.com/connect` from 1.18.1 to 1.19.1
- [Release notes](https://github.com/connectrpc/connect-go/releases)
- [Changelog](https://github.com/connectrpc/connect-go/blob/main/RELEASE.md)
- [Commits](connectrpc/connect-go@v1.18.1...v1.19.1)

Updates `github.com/spf13/cobra` from 1.9.1 to 1.10.1
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](spf13/cobra@v1.9.1...v1.10.1)

Updates `github.com/stretchr/testify` from 1.10.0 to 1.11.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.10.0...v1.11.1)

Updates `google.golang.org/grpc` from 1.73.0 to 1.77.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.73.0...v1.77.0)

Updates `google.golang.org/protobuf` from 1.36.6 to 1.36.10

---
updated-dependencies:
- dependency-name: connectrpc.com/connect
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: external
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: external
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: external
- dependency-name: google.golang.org/grpc
  dependency-version: 1.77.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: external
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: external
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/go_modules/examples/external-4132398a03 branch from 9c366fd to 7126bc5 Compare December 19, 2025 23:22
@github-actions
Copy link
Contributor

github-actions bot commented Dec 19, 2025

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 200.52428ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 1000
Denied Decision Requests 0
Total Time 112.89155ms

Benchmark Statistics

Name № Requests Avg Duration Min Duration Max Duration

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 392.864698ms
Throughput 254.54 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 43.014964986s
Average Latency 428.248176ms
Throughput 116.24 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 29.614541707s
Average Latency 295.099208ms
Throughput 168.84 requests/second

@github-actions
Copy link
Contributor

github-actions bot commented Dec 19, 2025

X-Test Results

opentdfplatform2H1F0J.dockerbuild
cukes-report
✅ java-v0.4.34
✅ js-v0.4.34
✅ go-v0.4.34
bats-test-results
✅ js-pull-2917
✅ java-pull-2917
✅ go-pull-2917

@jakedoublev jakedoublev added this pull request to the merge queue Dec 19, 2025
Merged via the queue into main with commit fce65f8 Dec 19, 2025
41 checks passed
@jakedoublev jakedoublev deleted the dependabot/go_modules/examples/external-4132398a03 branch December 19, 2025 23:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jakedoublev jakedoublev jakedoublev approved these changes

Assignees

No one assigned

Labels

comp:examples dependencies Pull requests that update a dependency file go Pull requests that update Go code size/m

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jakedoublev