Skip to content

chore(deps): group dependency bumps - #5325

Merged
dangra merged 3 commits into
masterfrom
flyctl-deps-roundup
Oct 26, 2026
Merged

dangra merged 3 commits into
masterfrom
flyctl-deps-roundup

Conversation

@dangra

@dangra dangra commented Oct 26, 2026

Copy link
Copy Markdown
Member

Rolls every open Dependabot update into one PR, plus every other dependency that has a newer release.

Supersedes #5313
Supersedes #5278
Supersedes #5242
Supersedes #5237
Supersedes #5234
Supersedes #5233

The commits are split so a CI failure can be bisected:

  1. The six Dependabot updates above.
  2. Every other direct Go module with a newer minor or patch release, bumped with go get <mod>@latest and then go mod tidy.
  3. GitHub Actions with newer releases. Each keeps its current pinning style.

The go directive stays at 1.26.10; no bump raised the minimum Go version. github.com/containerd/containerd/v2 lands at v2.4.1 instead of the v2.3.6 in #5237, because the newer buildkit requires it.

GitHub Actions

Action Old New
goreleaser/goreleaser-action v7.2.3 v7.3.0
docker/login-action v4.6.0 v4.7.0
j178/prek-action v3.0.2 v3.1.0

The other Actions are already current. That includes the actions pinned to a major tag, which pick up new minor releases on their own, and the two pinned by SHA (slackapi/slack-github-action is v4.0.0; the jnwng/github-app-installation-token-action commit is newer than its latest tag).

Direct Go modules

Module Old → New
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c → v0.0.0-20261013165250-51075c6ea6bc
github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 → v0.6.4
github.com/aws/aws-sdk-go-v2/config v1.33.5 → v1.33.10
github.com/aws/aws-sdk-go-v2/credentials v1.20.5 → v1.20.10
github.com/aws/aws-sdk-go-v2/service/s3 v1.113.1 → v1.114.5
github.com/azazeal/pause v1.3.0 → v1.3.1
github.com/buildpacks/pack v0.40.9 → v0.40.10
github.com/containerd/containerd/api v1.11.1 → v1.12.0
github.com/docker/go-connections v0.8.1 → v0.8.2
github.com/getsentry/sentry-go v0.49.0 → v0.50.0
github.com/jpillora/backoff v1.0.0 → v1.1.0
github.com/launchdarkly/go-sdk-common/v3 v3.5.1 → v3.6.0
github.com/mark3labs/mcp-go v1.1.1 → v1.4.0
github.com/mattn/go-colorable v0.1.15 → v0.1.16
github.com/mattn/go-zglob v0.0.6 → v0.0.8
github.com/moby/buildkit v0.33.0 → v0.34.1
github.com/moby/moby/client v0.6.0 → v0.6.2
github.com/nats-io/nats.go v1.53.1 → v1.55.0
github.com/pkg/sftp v1.13.11 → v1.13.12
github.com/prometheus/blackbox_exporter v0.28.0 → v0.29.1
github.com/prometheus/client_golang v1.24.1 → v1.25.0
github.com/superfly/client-signals/go v0.4.4 → v0.5.0
github.com/superfly/fly-go v0.11.5 → v0.11.6
github.com/tailscale/hujson v0.0.0-20260302212456-ecc657c15afd → v0.0.0-20260727124030-b80ff77dac4f
github.com/tonistiigi/fsutil v0.0.0-20260819142231-83cac42c1c52 → v0.0.0-20261009124904-c1c5bffae3b5
github.com/vektah/gqlparser/v2 v2.5.37 → v2.5.64
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 → v0.72.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0 → v1.47.0
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.46.0 → v1.47.0
go.opentelemetry.io/otel/sdk v1.46.0 → v1.47.0
go.opentelemetry.io/otel/trace v1.46.0 → v1.47.0
go.opentelemetry.io/otel v1.46.0 → v1.47.0
golang.org/x/crypto v0.57.0 → v0.58.0
golang.org/x/mod v0.41.0 → v0.42.0
golang.org/x/net v0.59.0 → v0.61.0
golang.org/x/sync v0.23.0 → v0.24.0
golang.org/x/sys v0.48.0 → v0.49.0
golang.org/x/term v0.46.0 → v0.47.0
golang.org/x/text v0.42.0 → v0.43.0
golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 → v0.0.0-20261024220952-b3bc704ef0ee
Indirect Go modules (moved by go mod tidy / MVS)
Module Old → New
cel.dev/cel-go (new) v0.32.0
github.com/agnivade/levenshtein v1.2.1 → v1.2.2
github.com/andybalholm/brotli v1.2.0 → v1.2.6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 → v1.7.24
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0 → v1.20.4
github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3 → v1.5.7
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3 → v2.8.7
github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 → v1.5.7
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 → v1.13.22
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.3 → v1.11.8
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 → v1.14.7
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.3 → v1.20.7
github.com/aws/aws-sdk-go-v2/service/signin v1.10.0 → v1.10.5
github.com/aws/aws-sdk-go-v2/service/sso v1.38.0 → v1.38.5
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0 → v1.43.5
github.com/aws/aws-sdk-go-v2/service/sts v1.51.0 → v1.51.5
github.com/aws/aws-sdk-go-v2 v1.47.0 → v1.47.4
github.com/aws/smithy-go v1.28.1 → v1.28.6
github.com/containerd/containerd/v2 v2.3.5 → v2.4.1
github.com/containerd/log/otel (new) v0.1.0
github.com/containerd/log v0.1.0 → v0.2.0
github.com/containerd/ttrpc v1.2.9 → v1.2.10
github.com/cyphar/filepath-securejoin v0.6.1 → v0.7.0
github.com/docker/cli v29.7.2+incompatible → v29.8.2+incompatible
github.com/docker/docker-credential-helpers v0.9.8 → v0.9.9
github.com/docker/go-metrics v0.0.1 → v0.1.0
github.com/google/btree v1.0.1 → v1.1.2
github.com/gorilla/websocket (new) v1.5.4-0.20250319132907-e064f32e3674
github.com/klauspost/compress v1.19.2 → v1.20.1
github.com/moby/moby/api v1.56.0 → v1.56.1
github.com/moby/sys/userns v0.2.0 → v0.2.1
github.com/nats-io/nkeys v0.4.15 → v0.4.16
github.com/prometheus/common v0.70.1 → v0.72.1
github.com/prometheus/procfs v0.21.1 → v0.22.0
github.com/quic-go/quic-go v0.59.1 → v0.63.0
github.com/sirupsen/logrus v1.10.1 → v1.10.2
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0 → v0.71.0
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.70.0 → v0.71.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 → v1.47.0
go.opentelemetry.io/otel/log (new) v1.47.0
go.opentelemetry.io/otel/metric v1.46.0 → v1.47.0
golang.org/x/oauth2 v0.36.0 → v0.37.0
golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5 → v0.0.0-20260924152758-ed294f943157
golang.org/x/tools v0.49.0 → v0.51.0
google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 → v0.0.0-20260928230214-8a89bd6388cc
google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 → v0.0.0-20260928230214-8a89bd6388cc
gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259 → v0.0.0-20250503011706-39ed1f5ac29c

Skipped

  • Major-version upgrades (a new /vN import path) were not attempted.

Testing

  • go build ./... passes for linux, windows and darwin.
  • go vet ./... passes.
  • go test ./... passes, apart from three scanner Rails tests that need rake installed. They fail the same way on master on a machine without Ruby.

Roll up the open Dependabot updates into one change:

- goreleaser/goreleaser-action 7.2.3 -> 7.3.0 (#5313)
- aws-sdk group: config v1.33.9, credentials v1.20.9, service/s3 v1.114.3 (#5278)
- github.com/nats-io/nats.go 1.53.1 -> 1.54.0 (#5242)
- github.com/containerd/containerd/v2 2.3.5 -> 2.3.6 (#5237)
- github.com/mattn/go-zglob 0.0.6 -> 0.0.8 (#5234)
- github.com/containerd/containerd/api 1.11.1 -> 1.12.0 (#5233)
Bump every direct dependency with a newer minor or patch release to its
latest version, letting go mod tidy settle the indirect ones.
@dangra dangra added the dependencies Pull requests that update a dependency file label Oct 26, 2026
@dangra
dangra merged commit c6de331 into master Oct 26, 2026
23 checks passed
@dangra
dangra deleted the flyctl-deps-roundup branch October 26, 2026 16:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant