Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 4 updates - #305

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/go_modules/minor-and-patch-e488a13e39
Closed

chore(deps): bump the minor-and-patch group across 1 directory with 4 updates#305
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/go_modules/minor-and-patch-e488a13e39

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 4 updates in the / directory: github.com/gopacket/gopacket, github.com/gophercloud/gophercloud/v2, github.com/prometheus/client_model and github.com/prometheus/common.

Updates github.com/gopacket/gopacket from 1.7.0 to 1.7.1

Release notes

Sourced from github.com/gopacket/gopacket's releases.

v1.7.1

Security release. All versions up to and including v1.7.0 are affected — upgrade is recommended for anyone decoding untrusted packets or capture files.

Security fixes

Crafted input caused runtime panics (out-of-bounds slice/index, or unsigned underflow producing an inverted range) in a number of layers/ decoders. Each is now bounded against the buffer, returning a decode error and setting SetTruncated() instead of crashing.

Advisory Area
CVE-2026-65819 TLS, DHCPv4, sFlow, IPSecAH, VRRPv2, Diameter, GTPv1U, ERSPAN, LCM, RadioTap, Dot11IE — the fix for this shipped in no prior release
GHSA-6h9g-cjv3-pg2c TCP MPTCP options — on the ordinary Ethernet→IP→TCP path, so any consumer decoding untrusted TCP was exposed
GHSA-25xj-ggj7-jqgf SIP header folding (port-auto-selected, single UDP datagram)
GHSA-cxrr-2gv2-m94w EtherIP, AGUEVar0, UDPLite, MPLS, EthernetCTP, PFLog, LinuxSLL, LinuxSLL2, PktapV1, Prism, PPP, FDDI

Note on exposure: gopacket.NewPacket with default options and DecodingLayerParser with IgnorePanic: false both recover, so those callers previously saw a decode error rather than a crash. A process crash landed on a direct DecodeFromBytes call, IgnorePanic: true, or SkipDecodeRecovery: true.

The GHSA-cxrr decoders split by trust model: the first five carry remote-attacker-controlled bytes, while PFLog, LinuxSLL/SLL2, PktapV1, Prism, PPP and FDDI are written by the host's own capture stack, making a crafted pcap from an untrusted source the realistic input rather than a packet off the wire.

Other fixes

  • Protocol decoder length checks across arp, ipsec, pppoe, rudp, sctp and vrrp (#163)
  • MDNS name serialization fix (#157)
  • Regression tests for DNS decodeSVCB truncated SvcParams, and for every advisory above

Credits

CVE-2026-65819 reported by @​mosajjal (Fenko). The three GHSAs above reported by zx (Jace) (@​manus-use) and validated by @​FoxhoundAI.

Commits
  • 2220269 test(layers): add regression tests for the decoder panic advisories
  • de853ae layers:various: add length checks to twelve link and tunnel decoders
  • 888f295 layers/sip: reject a header continuation line before any header
  • 7cfad9e layers/tcp: bound MPTCP option length before subtype dispatch
  • f87e843 build(deps): bump actions/setup-go from 6 to 7 (#164)
  • 1c51bb8 test(dns): add regression test for decodeSVCB truncated-SvcParams panic
  • f8b2b11 fix MDNS name serialization (#157)
  • b772f56 layers:various: add protocol decoder length checks (#163)
  • 210f25f Merge commit from fork
  • See full diff in compare view

Updates github.com/gophercloud/gophercloud/v2 from 2.13.0 to 2.14.0

Release notes

Sourced from github.com/gophercloud/gophercloud/v2's releases.

v2.14.0

What's Changed

Full Changelog: gophercloud/gophercloud@v2.13.0...v2.14.0

Changelog

Sourced from github.com/gophercloud/gophercloud/v2's changelog.

v2.14.0 (2026-08-20)

  • GH-3797 build(deps): bump github/codeql-action from 4.36.1 to 4.36.2
  • GH-3799 build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0
  • GH-3816 build(deps): bump actions/checkout from 6.0.2 to 7.0.0
  • GH-3820 [v2] Add deprecation warning for V2EndpointURL, V3EndpointURL
  • GH-3826 build(deps): bump actions/setup-go from 6.4.0 to 6.5.0
  • GH-3841 [v2] Create an external router when testing L3RouterScheduling
  • GH-3844 [V2] dns: add X-Auth-All-Projects and X-Auth-Sudo-Tenant-ID header support to recordsets
  • GH-3862 build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0
  • GH-3864 build(deps): bump actions/setup-go from 6.5.0 to 7.0.0
  • GH-3871 build(deps): bump actions/labeler from 6.1.0 to 7.0.0
  • GH-3880 build(deps): bump actions/checkout from 7.0.0 to 7.0.1
  • GH-3902 Manila sharetype getset backport
  • GH-3904 build(deps): bump coverallsapp/github-action from 2.3.7 to 2.3.8
  • GH-3916 [v2] core: validation for missing response keys in extractIntoPtr
  • GH-3917 [v2] auth: don't send scope with application credentials
  • GH-3919 [v2] Add Ironic vendor passthru helpers
  • GH-3920 [v2] Add Identity v3 system-scoped role assignment support for users and groups
  • GH-3930 [v2] CI: improve test assertions
  • GH-3950 [v2] core: honor context while waiting for reauthentication
  • GH-3952 [v2] pagination: Fix AllPages returning wrong key for empty linked pages
  • GH-3953 [v2] containerinfra: Fix wrong HTTP method and path in certificate create test
  • GH-3954 v2: ci(magnum): deprecate heat and use magnum-cluster-api driver
  • GH-3959 build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0
  • GH-3960 [v2] subnetpool: Support for add and remove prefixes operations
  • GH-3961 [v2] Add migrations list support in compute service
  • GH-3970 [v2] baremetal: add vendor/model/serial_number to FirmwareComponent
  • GH-3971 [v2] pagination: Add KeyedPage interface
  • GH-3972 build(deps): bump the all-github-actions group with 3 updates
  • GH-3974 [v2] baremetal(ci): change RAM disk type from tinyipa to dib
  • GH-3976 [v2] pagination: Return error on missing resource key
Commits
  • b098ed7 Merge pull request #3969 from shiftstack/prepare-v2.14.0
  • 1e689a1 Prepare v2.14.0
  • ab2b182 Merge pull request #3976 from gophercloud/bp-v2-00acdae-e0ba184
  • 4c643b5 pagination: Return error on missing key
  • bc34337 Add deprecation warning for unused error
  • 3100215 Merge pull request #3970 from gophercloud/bp-v2-72cdeba
  • a881d88 Merge pull request #3971 from gophercloud/bp-v2-cd90e85-50e5c69
  • 704b4e2 baremetal: add vendor/model/serial_number to FirmwareComponent
  • abfc85e Merge pull request #3974 from winiciusallan/change-tinyipa-v2
  • b53975b Merge pull request #3972 from gophercloud/dependabot/github_actions/v2/all-gi...
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_model from 0.6.2 to 0.6.3

Release notes

Sourced from github.com/prometheus/client_model's releases.

v0.6.3

What's Changed

New Contributors

Full Changelog: prometheus/client_model@v0.6.2...v0.6.3

What's Changed

... (truncated)

Commits

Updates github.com/prometheus/common from 0.70.1 to 0.71.0

Release notes

Sourced from github.com/prometheus/common's releases.

v0.71.0

What's Changed

New Contributors

Full Changelog: prometheus/common@v0.70.1...v0.71.0

Commits
  • 9a4aff0 build(deps): bump github.com/stretchr/testify in /assets (#979)
  • 483bb89 Update dependabot config (#978)
  • d29e1ea build(deps): bump golang.org/x/net (#975)
  • e531bd2 build(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#976)
  • bc3fc3a build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 (#977)
  • 15e9f45 expfmt: fix OpenMetrics 2.0 decoder error, format docs, and encoder version d...
  • 0acfdb3 expfmt: prevent st@ leaking to Gauge and Untyped samples in OpenMetrics 2.0 (...
  • eb72e27 model: add Duration unit constants and conversion methods (#952)
  • 67b7d90 fix: drop invalid OpenMetrics 2.0 exemplars instead of failing exposition (#970)
  • 715ac36 expfmt: format OpenMetrics 2.0 float values and validate units (#969)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 4…
b8bbd26 
… updates

Bumps the minor-and-patch group with 4 updates in the / directory: [github.com/gopacket/gopacket](https://github.com/gopacket/gopacket), [github.com/gophercloud/gophercloud/v2](https://github.com/gophercloud/gophercloud), [github.com/prometheus/client_model](https://github.com/prometheus/client_model) and [github.com/prometheus/common](https://github.com/prometheus/common).


Updates `github.com/gopacket/gopacket` from 1.7.0 to 1.7.1
- [Release notes](https://github.com/gopacket/gopacket/releases)
- [Commits](gopacket/gopacket@v1.7.0...v1.7.1)

Updates `github.com/gophercloud/gophercloud/v2` from 2.13.0 to 2.14.0
- [Release notes](https://github.com/gophercloud/gophercloud/releases)
- [Changelog](https://github.com/gophercloud/gophercloud/blob/v2.14.0/CHANGELOG.md)
- [Commits](gophercloud/gophercloud@v2.13.0...v2.14.0)

Updates `github.com/prometheus/client_model` from 0.6.2 to 0.6.3
- [Release notes](https://github.com/prometheus/client_model/releases)
- [Commits](prometheus/client_model@v0.6.2...v0.6.3)

Updates `github.com/prometheus/common` from 0.70.1 to 0.71.0
- [Release notes](https://github.com/prometheus/common/releases)
- [Changelog](https://github.com/prometheus/common/blob/main/CHANGELOG.md)
- [Commits](prometheus/common@v0.70.1...v0.71.0)

---
updated-dependencies:
- dependency-name: github.com/gopacket/gopacket
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/gophercloud/gophercloud/v2
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/prometheus/client_model
  dependency-version: 0.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/prometheus/common
  dependency-version: 0.71.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 14, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/minor-and-patch-e488a13e39 branch September 14, 2026 01:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants