Skip to content

build(deps): bump the gomod-minor-patch group across 1 directory with 17 updates - #50

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-minor-patch-4c6ca04ada
Open

build(deps): bump the gomod-minor-patch group across 1 directory with 17 updates#50
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-minor-patch-4c6ca04ada

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the gomod-minor-patch group with 13 updates in the / directory:

Package From To
github.com/danielgtaylor/huma/v2 2.37.3 2.39.0
github.com/exaring/otelpgx 0.10.0 0.11.1
github.com/go-chi/httprate 0.15.0 0.16.0
github.com/go-webauthn/webauthn 0.17.3 0.17.4
github.com/jackc/pgx/v5 5.9.2 5.10.0
github.com/pressly/goose/v3 3.27.1 3.27.2
github.com/prometheus/client_golang 1.23.2 1.24.0
github.com/shirou/gopsutil/v4 4.26.4 4.26.6
github.com/testcontainers/testcontainers-go 0.42.0 0.43.0
github.com/testcontainers/testcontainers-go/modules/postgres 0.42.0 0.43.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp 0.68.0 0.69.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc 1.43.0 1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc 1.43.0 1.44.0

Updates github.com/danielgtaylor/huma/v2 from 2.37.3 to 2.39.0

Release notes

Sourced from github.com/danielgtaylor/huma/v2's releases.

v2.39.0

Overview

This release adds a new framework adapter, a handful of developer-facing features, and a large batch of correctness fixes spanning SSE, the Fiber adapter, schema generation, and validation.

Echo v5 Support

The humaecho adapter now supports Echo v5 alongside the existing versions. (#959)

No More Faulty Duplicate-Schema Panics

Registering operations that use inline structs with differing field names (and an empty operation ID) previously panicked at startup on a false-positive duplicate-schema collision. Conflicting names are now auto-incremented deterministically (Request, Request1, Request2, ...), so the app starts and the generated spec stays readable. (#893)

Context Propagation to Adapters

WithContext now propagates the context directly into the underlying adapter's own context wrapper (bun, chi, echo, fiber, gin, go, httprouter) instead of relying on a generic sub-context, so cancellation and context values flow correctly through the request lifecycle. (#867)

SSE Streaming on Fiber / fasthttp

Server-Sent Events (and other streaming responses) previously failed on the Fiber adapters with unable to flush, since fasthttp doesn't implement http.Flusher. SSE now streams correctly on Fiber v2 and v3 via an internal streaming hook, with no new public API and fasthttp remaining an indirect dependency. (#1059)

More SSE Improvements

  • Response headers are now flushed before the user handler runs, so EventSource.onopen fires immediately rather than waiting for the first event (#1038)
  • Comments can now be sent over SSE streams, a common way to keep connections alive (#1054)

New Features

  • Schema.Const for pinning a schema to a single allowed value (#1004)
  • Customizable docs renderer config for finer control over the documentation UI (#1024)
  • encoding.TextUnmarshaler support for slice query parameters, matching the existing behavior for scalar params (#1021)
  • Non-file JSON form-data fields: multipart form fields tagged contentType:"application/json" are now unmarshalled and validated (#1060)

Validation & Schema Fixes

  • Integer enums no longer always fail validation on query/path parameters; numeric enum values are now compared numerically rather than by strict Go type (#1050)
  • Content-Type validation is now case-insensitive per RFC 9110, so e.g. Application/Json no longer returns 415 (#1052)
  • Path parameters are always marked required: true in the generated spec, per the OpenAPI specification (#1011)
  • Prevented a panic (and dropped response) in uniqueItems validation when array items are unhashable types, now returning 422 correctly (#1045)
  • The json:",inline" tag is now honored for embedding anonymous fields in schemas (#1006)
  • Hidden route schemas are no longer leaked into the generated spec (#1032)

Adapter & Robustness Fixes

  • humafiber (v2): corrected EachHeader iteration (it previously invoked the callback once per byte, breaking cookie reads) and switched BodyReader to Body() for automatic request-body decompression (#1058)
  • autopatch: prevented chi route-context reuse from recursing internal GET sub-requests back into the generated PATCH handler and panicking (#1049)
  • Fixed a URL parsing panic in getAPIPrefix when server URLs contain template variables like {port} or {version} (#1027)
  • The read deadline is now cleared after the request body is read, so a slow handler can't cause a background read to time out and cancel the connection context (#1028)

Docs UI & Documentation

  • Forms are now permitted in the docs UI CSP (#1036)
  • Added allow-downloads to the Stoplight CSP so the Export button works (#1048)
  • Updated Restish references to v2 (#1041)

What's Changed

... (truncated)

Commits
  • d6f2a37 feat(form-data): handle unmarshalling and validation of non-file JSON form da...
  • 214a18c fix: avoid faulty duplicate detection (#893)
  • 4e53fef fix: prevent panic in uniqueItems validation for unhashable types (#1042) (#1...
  • a8a668c fix(sse): support streaming responses on Fiber/fasthttp adapters (#1059)
  • 6cc787b Support sending comments with SSE (#1054)
  • da460b9 feat: propagate context to adapters on WithContext (#867)
  • fcd9058 fix(humafiber): correct Fiber v2 EachHeader iteration and body decompression ...
  • 770e618 fix: content type validation should be case insensitive (#1052)
  • fd8148e fix: compare numeric enum values numerically (#1050)
  • 93b5a32 fix: support json inline tag for embedding anonymous fields in schema (#1006)
  • Additional commits viewable in compare view

Updates github.com/exaring/otelpgx from 0.10.0 to 0.11.1

Release notes

Sourced from github.com/exaring/otelpgx's releases.

v0.11.1

What's Changed

New Contributors

Full Changelog: exaring/otelpgx@v0.11.0...v0.11.1

v0.11.0

What's Changed

New Contributors

Full Changelog: exaring/otelpgx@v0.10.0...v0.11.0

Commits
  • 626246c Fix lints
  • 168b105 Refactor tests to use testify
  • 795d56d fix logConnectionDetails
  • 76cf7a5 Add tests for asserting trace attributes
  • 25501de fix(ci): test from go1.25+
  • ca37215 fix: Update .github/workflows/test.yaml
  • b0d28b5 refactor(test): use typed context key in span name test
  • 45dc290 chore(lint): switch from golint to golangci-lint
  • ad455b0 refactor: switch to testify
  • e630def chore: update pgx
  • Additional commits viewable in compare view

Updates github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.0

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

@​VojtechVitek submitted PR #967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:

It also addresses issues outlined at:

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
</tr></table>

... (truncated)

Commits

Updates github.com/go-chi/httprate from 0.15.0 to 0.16.0

Release notes

Sourced from github.com/go-chi/httprate's releases.

v0.16.0

What's Changed

New Contributors

Full Changelog: go-chi/httprate@v0.15.0...v0.16.0

Commits
  • 741b4a5 Deprecate spoofable RealIP rate-limiting; add LimitBy + KeyFromContext and mo...
  • 81255de perf: use zero-alloc xxh3.HashString on the local counter hot path (#60)
  • 0c2093a test: replace golang.org/x/sync/errgroup with sync.WaitGroup (#59)
  • 89e5cca local counter: align windows to reset at sub-millisecond counter start (#58)
  • be2ba84 replace fmt with strconv to reduce allocations (#55)
  • See full diff in compare view

Updates github.com/go-webauthn/webauthn from 0.17.3 to 0.17.4

Release notes

Sourced from github.com/go-webauthn/webauthn's releases.

v0.17.4

v0.17.4 (2026-05-22)

Dependency Updates

This release just contains updates to dependencies.

Changelog

Sourced from github.com/go-webauthn/webauthn's changelog.

v0.17.4 (2026-05-22)

Dependency Updates

This release just contains updates to dependencies.

Commits
  • bc5e90d release: v0.17.4 (#695)
  • eaeedc6 build(deps): update module github.com/go-webauthn/x to v0.2.6 (#694)
  • d41c63d build(deps): update step-security/harden-runner action to v2.19.4 (#693)
  • 5eb52ec build(deps): update codecov/codecov-action action to v6.0.1 (#692)
  • b9202d1 build(deps): update step-security/harden-runner action to v2.19.3 (#690)
  • 6b95913 build(deps): update github/codeql-action action to v4.35.5 (#691)
  • 7aca952 build(deps): update step-security/harden-runner action to v2.19.2 (#689)
  • a0459c6 ci: apply zizmor recommendations (#688)
  • See full diff in compare view

Updates github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.10.0 (June 3, 2026)

This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers, contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are sent over TLS when the original connection used TLS.

Features

  • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
  • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
  • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
  • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
  • pgxpool: check if connection is expired before acquire (arthurdotwork)

Security Hardening

  • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
  • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
  • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
  • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
  • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
  • Fix panic on malformed geometric text; return an error instead (MaIII)

Fixes

  • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
  • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
  • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
  • Fix data race when context is cancelled during connect
  • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
  • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
  • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
  • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
  • Add missing error check of rows.Err to load types (Jen Altavilla)
Commits
  • 7293fb1 Update changelog for v5.10.0
  • 1ade285 pgconn: document secure connection configuration
  • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
  • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
  • b28e65b pgtype: bound array element count against remaining message bytes
  • cd1f389 pgtype: bound array binary decode element length against remaining bytes
  • ff27b5b pgtype: bound hstore binary decode against malicious server input
  • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
  • 44f6173 pgconn: cap server-supplied SCRAM iteration count
  • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
  • Additional commits viewable in compare view

Updates github.com/pressly/goose/v3 from 3.27.1 to 3.27.2

Release notes

Sourced from github.com/pressly/goose/v3's releases.

v3.27.2

Changed

  • Upgrade golang.org/x/crypto and golang.org/x/net to address security advisories (CVE fixes)
  • Various dependency upgrades
Changelog

Sourced from github.com/pressly/goose/v3's changelog.

[v3.27.2] - 2026-06-30

Changed

  • Upgrade golang.org/x/crypto and golang.org/x/net to address security advisories (CVE fixes)
  • Various dependency upgrades
Commits
  • b0f7076 release: v3.27.2
  • 6669df2 build(deps): bump github.com/opencontainers/runc from 1.3.3 to 1.3.6 in /inte...
  • f61f5b9 build(deps): bump the gomod group across 1 directory with 4 updates (#1086)
  • 90d5b3a build(deps): bump actions/checkout from 6 to 7 (#1081)
  • cef6bb7 build(deps): bump golang crypto and net to FIX CVEs (#1083)
  • f2c327a build(deps): bump the gomod group across 1 directory with 7 updates (#1079)
  • d0bee40 Docs: mention MariaDB support (#1071)
  • See full diff in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.0 - 2026-07-20

Changes

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.0 / 2026-07-20

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927
Commits
  • 48dd383 Cut v1.24.0 (#2061)
  • a725305 Cut v1.24.0-rc.0 (#2058)
  • 77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
  • 78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
  • 34e9a7f Merge pull request #2055 from prombot/repo_sync
  • 43749bc Update common Prometheus files
  • de19217 examples: improve simple main.go example (#1999)
  • 20355eb fix: correct typos in comments and test error messages (#2049)
  • 4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
  • b0d896b Replace deprecated model.NameValidationScheme with explicit UTF8Validation (#...
  • Additional commits viewable in compare view

Updates github.com/shirou/gopsutil/v4 from 4.26.4 to 4.26.6

Release notes

Sourced from github.com/shirou/gopsutil/v4's releases.

v4.26.6

What's Changed

cpu

disk

mem

sensor

New Contributors

Full Changelog: shirou/gopsutil@v4.26.5...v4.26.6

v4.26.5

What's Changed

disk

net

process

New Contributors

Full Changelog: shirou/gopsutil@v4.26.4...v4.26.5

Commits
  • 50a6b05 Merge pull request #2104 from atanas-vladimirov/openbsd
  • c0390a2 Merge pull request #2103 from guillemj/pu/lscpu-clusters
  • 62c57ea Merge pull request #2101 from shirou/fix/2100-disk-zfs-btrfs-partitions
  • e093580 Merge pull request

@dependabot
build(deps): bump the gomod-minor-patch group across 1 directory with…
9f8642c 
… 17 updates

Bumps the gomod-minor-patch group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma) | `2.37.3` | `2.39.0` |
| [github.com/exaring/otelpgx](https://github.com/exaring/otelpgx) | `0.10.0` | `0.11.1` |
| [github.com/go-chi/httprate](https://github.com/go-chi/httprate) | `0.15.0` | `0.16.0` |
| [github.com/go-webauthn/webauthn](https://github.com/go-webauthn/webauthn) | `0.17.3` | `0.17.4` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.2` | `5.10.0` |
| [github.com/pressly/goose/v3](https://github.com/pressly/goose) | `3.27.1` | `3.27.2` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.0` |
| [github.com/shirou/gopsutil/v4](https://github.com/shirou/gopsutil) | `4.26.4` | `4.26.6` |
| [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go) | `0.42.0` | `0.43.0` |
| [github.com/testcontainers/testcontainers-go/modules/postgres](https://github.com/testcontainers/testcontainers-go) | `0.42.0` | `0.43.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.68.0` | `0.69.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.43.0` | `1.44.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.43.0` | `1.44.0` |



Updates `github.com/danielgtaylor/huma/v2` from 2.37.3 to 2.39.0
- [Release notes](https://github.com/danielgtaylor/huma/releases)
- [Commits](danielgtaylor/huma@v2.37.3...v2.39.0)

Updates `github.com/exaring/otelpgx` from 0.10.0 to 0.11.1
- [Release notes](https://github.com/exaring/otelpgx/releases)
- [Commits](exaring/otelpgx@v0.10.0...v0.11.1)

Updates `github.com/go-chi/chi/v5` from 5.2.5 to 5.3.0
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.2.5...v5.3.0)

Updates `github.com/go-chi/httprate` from 0.15.0 to 0.16.0
- [Release notes](https://github.com/go-chi/httprate/releases)
- [Commits](go-chi/httprate@v0.15.0...v0.16.0)

Updates `github.com/go-webauthn/webauthn` from 0.17.3 to 0.17.4
- [Release notes](https://github.com/go-webauthn/webauthn/releases)
- [Changelog](https://github.com/go-webauthn/webauthn/blob/master/CHANGELOG.md)
- [Commits](go-webauthn/webauthn@v0.17.3...v0.17.4)

Updates `github.com/jackc/pgx/v5` from 5.9.2 to 5.10.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.9.2...v5.10.0)

Updates `github.com/pressly/goose/v3` from 3.27.1 to 3.27.2
- [Release notes](https://github.com/pressly/goose/releases)
- [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md)
- [Commits](pressly/goose@v3.27.1...v3.27.2)

Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.23.2...v1.24.0)

Updates `github.com/shirou/gopsutil/v4` from 4.26.4 to 4.26.6
- [Release notes](https://github.com/shirou/gopsutil/releases)
- [Commits](shirou/gopsutil@v4.26.4...v4.26.6)

Updates `github.com/testcontainers/testcontainers-go` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.42.0...v0.43.0)

Updates `github.com/testcontainers/testcontainers-go/modules/postgres` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.42.0...v0.43.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.68.0 to 0.69.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.68.0...zpages/v0.69.0)

Updates `go.opentelemetry.io/otel` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0)

Updates `go.opentelemetry.io/otel/sdk/metric` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.43.0...v1.44.0)

---
updated-dependencies:
- dependency-name: github.com/danielgtaylor/huma/v2
  dependency-version: 2.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: github.com/exaring/otelpgx
  dependency-version: 0.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: github.com/go-chi/httprate
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: github.com/go-webauthn/webauthn
  dependency-version: 0.17.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-minor-patch
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: github.com/pressly/goose/v3
  dependency-version: 3.27.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-minor-patch
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: github.com/shirou/gopsutil/v4
  dependency-version: 4.26.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-minor-patch
- dependency-name: github.com/testcontainers/testcontainers-go
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: github.com/testcontainers/testcontainers-go/modules/postgres
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-version: 0.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
- dependency-name: go.opentelemetry.io/otel/sdk/metric
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 20, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants