Skip to content

Update all non-major dependencies#229

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch
Open

Update all non-major dependencies#229
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link

@renovate renovate bot commented Nov 17, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
ginkgo minor 2.23.4 → 2.28.1 age confidence
github.com/modelcontextprotocol/go-sdk require minor v1.3.1 → v1.4.0 age confidence
go (source) toolchain minor 1.24.1 → 1.26.0 age confidence
golang minor 1.24.1 → 1.26.0 age confidence
golangci-lint patch 1.64.6 → 1.64.8 age confidence
node (source) minor 22.19.0 → 22.22.0 age confidence

Release Notes

onsi/ginkgo (ginkgo)

v2.28.1

Compare Source

Update all dependencies. This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.

v2.28.0

Compare Source

Ginkgo's SemVer filter now supports filtering multiple components by SemVer version:

It("should work in a specific version range (1.0.0, 2.0.0) and third-party dependency redis in [8.0.0, ~)", SemVerConstraint(">= 3.2.0"), ComponentSemVerConstraint("redis", ">= 8.0.0") func() {
    // This test will only run when version is between 1.0.0 (exclusive) and 2.0.0 (exclusive) and redis version is >= 8.0.0
})

can be filtered in or out with an invocation like:

ginkgo --sem-ver-filter="2.1.1, redis=8.2.0"

Huge thanks to @​Icarus9913 for working on this!

v2.27.5

Compare Source

Fixes

Don't make a new formatter for each GinkgoT(); that's just silly and uses precious memory

v2.27.4

Compare Source

Fixes
  • CurrentTreeConstructionNodeReport: fix for nested container nodes [59bc751]

v2.27.3

Compare Source

Fixes

report exit result in case of failure [1c9f356]
fix data race [ece19c8]

v2.27.2

Compare Source

Fixes
  • inline automaxprocs to simplify dependencies; this will be removed when Go 1.26 comes out [a69113a]
Maintenance
  • Fix syntax errors and typo [a99c6e0]
  • Fix paragraph position error [f993df5]

v2.27.1

Compare Source

Fixes
  • Fix Ginkgo Reporter slice-bounds panic [606c1cb]
  • Bug Fix: Add GinkoTBWrapper.Attr() and GinkoTBWrapper.Output() [a6463b3]

v2.27.0

Compare Source

Features
Transforming Nodes during Tree Construction

This release adds support for NodeArgsTransformers that can be registered with AddTreeConstructionNodeArgsTransformer.

These are called during the tree construction phase as nodes are constructed and can modify the node strings and decorators. This enables frameworks built on top of Ginkgo to modify Ginkgo nodes and enforce conventions.

Learn more here.

Spec Prioritization

A new SpecPriority(int) decorator has been added. Ginkgo will honor priority when ordering specs, ensuring that higher priority specs start running before lower priority specs

Learn more here.

Maintenance

v2.26.0

Compare Source

Features

Ginkgo can now generate json-formatted reports that are compatible with the go test json format. Use ginkgo --gojson-report=report.go.json. This is not intended to be a replacement for Ginkgo's native json format which is more information rich and better models Ginkgo's test structure semantics.

v2.25.3

Compare Source

Fixes
  • emit --github-output group only for progress report itself [f01aed1]

v2.25.2

Compare Source

Fixes

Add github output group for progress report content

Maintenance

Bump Gomega

v2.25.1

Compare Source

Fixes
  • fix(types): ignore nameless nodes on FullText() [10866d3]
  • chore: fix some CodeQL warnings [2e42cff]

v2.25.0

Compare Source

AroundNode

This release introduces a new decorator to support more complex spec setup usecases.

AroundNode registers a function that runs before each individual node. This is considered a more advanced decorator.

Please read the docs for more information and some examples.

Allowed signatures:

  • AroundNode(func()) - func will be called before the node is run.
  • AroundNode(func(ctx context.Context) context.Context) - func can wrap the passed in context and return a new one which will be passed on to the node.
  • AroundNode(func(ctx context.Context, body func(ctx context.Context))) - ctx is the context for the node and body is a function that must be called to run the node. This gives you complete control over what runs before and after the node.

Multiple AroundNode decorators can be applied to a single node and they will run in the order they are applied.

Unlike setup nodes like BeforeEach and DeferCleanup, AroundNode is guaranteed to run in the same goroutine as the decorated node. This is necessary when working with lower-level libraries that must run on a single thread (you can call runtime.LockOSThread() in the AroundNode to ensure that the node runs on a single thread).

Since AroundNode allows you to modify the context you can also use AroundNode to implement shared setup that attaches values to the context.

If applied to a container, AroundNode will run before every node in the container. Including setup nodes like BeforeEach and DeferCleanup.

AroundNode can also be applied to RunSpecs to run before every node in the suite. This opens up new mechanisms for instrumenting individual nodes across an entire suite.

v2.24.0

Compare Source

Features

Specs can now be decorated with (e.g.) SemVerConstraint("2.1.0") and ginkgo --sem-ver-filter="2.1.1" will only run constrained specs that match the requested version. Learn more in the docs here! Thanks to @​Icarus9913 for the PR.

Fixes
Maintenance

Numerous dependency bumps and documentation fixes

modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)

v1.4.0

Compare Source

This release marks the completion of the full 2025-11-25 specification implementation, by introducing the support for Sampling with Tools and experimental client-side OAuth support. It also contains multiple bug fixes and improvements. Thanks to all contributors!

Client-side OAuth support

This release introduces experimental support for OAuth on the client side of the SDK. It aims to support the full scope of the current MCP specification for authorization. To use it, you need to compile the SDK with the -tags mcp_go_client_oauth flag. Some changes may still be applied to this new API, based on developer feedback. The functionality is planned to become stable in v1.5.0 release, expected by the end of March 2026. More details can be found at https://github.com/modelcontextprotocol/go-sdk/blob/main/docs/protocol.md#client.

Sampling with Tools

Starting from this release, the server use the new CreateMessageWithTools method to create a sampling request to the client that contains tools that can be used by the client. On the client side, CreateMessageWithToolsHandler may be used to handle such requests and issue ToolUse responses to the server.

Behavior changes

We have two important behavior changes that were introduced to fix a bug or improve security posture. They can be temporarily turned off by specifying a special MCPGODEBUG environment variable when running the SDK. Different options can be added together, separated by a comma.

Introduced DNS rebinding protection (MCPGODEBUG=disablelocalhostprotection=1)

The requests arriving via a localhost address (127.0.0.1, [::1]) that have a non-localhost Host header will be rejected to protect against DNS rebinding attacks. The option to remove this protection will be removed in v1.6.0.

Removed JSON content escaping when marshaling (MCPGODEBUG=jsonescaping=1):

By default encoding/json escapes the contents of the objects, which causes some servers to fail. We switched to no escaping by default. The option to bring back the escaping will be removed in v1.6.0.

Bug fixes

Security vulnerability caused by the case insensitive parsing behavior of encoding/json has been submitted (also release as a cherry pick in v1.3.1). Security advisory has been posted.

Other fixes:

Enhancements

Notably, the SDK now supports the extensions field in client and server capabilities, which should enable creation of MCP Apps.

Other enhancements:

Repository organization

Some effort was put into better organization of the repository, as well as making sure it's up to date and secure. As a highlight, the repository is not integrated with OSSF Scorecard with a positive score of 8.7. Additionally, the full conformance test suite is now run on every PR and push to main.

New Contributors

Full Changelog: modelcontextprotocol/go-sdk@v1.3.0...v1.4.0

golang/go (go)

v1.26.0

v1.25.7

v1.25.6

v1.25.5

v1.25.4

v1.25.3

v1.25.2

v1.25.1

v1.25.0

v1.24.13

v1.24.12

v1.24.11

v1.24.10

v1.24.9

v1.24.8

v1.24.7

v1.24.6

v1.24.5

v1.24.4

v1.24.3

v1.24.2

golangci/golangci-lint (golangci-lint)

v1.64.8

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

v1.64.7

Compare Source

golangci-lint is a free and open-source project built by volunteers.

If you value it, consider supporting us, the maintainers and linter authors.

We appreciate it! ❤️

For key updates, see the changelog.

Changelog

  • 94946f3 build(deps): bump github.com/OpenPeeDeeP/depguard/v2 from 2.2.0 to 2.2.1 (#​5509)
  • 132365e build(deps): bump github.com/golangci/dupl from 3e9179a to f665c8d (#​5512)
  • bddd1bc build(deps): bump github.com/securego/gosec/v2 from 2.22.1 to 2.22.2 (#​5515)
  • 624fb4e build(deps): bump golang.org/x/mod from 0.23.0 to 0.24.0 (#​5507)
  • 8cffdb7 build(deps): bump golang.org/x/oauth2 from 0.27.0 to 0.28.0 in /scripts/gen_github_action_config in the scripts group (#​5521)
  • 7a3f3d7 build(deps): bump golang.org/x/tools from 0.30.0 to 0.31.0 (#​5508)
  • c13fd5b build(deps): bump honnef.co/go/tools from 0.6.0 to 0.6.1 (#​5510)
nodejs/node (node)

v22.22.0: 2026-01-13, Version 22.22.0 'Jod' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes

lib:

  • (CVE-2025-59465) add TLSSocket default error handler
  • (CVE-2025-55132) disable futimes when permission model is enabled
    lib,permission:
  • (CVE-2025-55130) require full read and write to symlink APIs
    src:
  • (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks
    src,lib:
  • (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle
    tls:
  • (CVE-2026-21637) route callback exceptions through error handlers
Commits

v22.21.1: 2025-10-28, Version 22.21.1 'Jod' (LTS), @​aduh95

Compare Source

Commits

v22.21.0: 2025-10-20, Version 22.21.0 'Jod' (LTS), @​aduh95

Compare Source

Notable Changes
  • [1486fedea1] - (SEMVER-MINOR) cli: add --use-env-proxy (Joyee Cheung) #​59151
  • [bedaaa11fc] - (SEMVER-MINOR) http: support http proxy for fetch under NODE_USE_ENV_PROXY (Joyee Cheung) #​57165
  • [af8b5fa29d] - (SEMVER-MINOR) http: add shouldUpgradeCallback to let servers control HTTP upgrades (Tim Perry) #​59824
  • [42102594b1] - (SEMVER-MINOR) http,https: add built-in proxy support in http/https.request and Agent (Joyee Cheung) #​58980
  • [686ac49b82] - (SEMVER-MINOR) src: add percentage support to --max-old-space-size (Asaf Federman) #​59082
Commits

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Author

renovate bot commented Nov 17, 2025 •
edited
Loading

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
github.com/google/jsonschema-go v0.2.3 -> v0.3.0
golang.org/x/text v0.31.0 -> v0.32.0
golang.org/x/sys v0.38.0 -> v0.39.0

@renovate renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from f6f7a26 to 20f6b3a Compare November 24, 2025 02:32
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 3109c88 to f409e4a Compare December 5, 2025 07:59
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 708fbf4 to ab72ecb Compare December 15, 2025 16:13
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 493c092 to 8a6635a Compare December 22, 2025 20:34
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 0f932de to d1896ec Compare January 13, 2026 02:26
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from d1896ec to f4ac612 Compare January 15, 2026 19:12
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 3eea4f4 to 1af12fd Compare February 4, 2026 18:15
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 14ddd51 to 56f7fbf Compare February 12, 2026 15:06
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 56f7fbf to 17fee4a Compare February 18, 2026 20:07
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from b1d66cb to 80ab3e4 Compare February 27, 2026 21:59
@renovate
Copy link
Author

renovate bot commented Feb 27, 2026

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated

Details:

Package Change
golang.org/x/oauth2 v0.30.0 -> v0.34.0

@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 80ab3e4 to 7eb4720 Compare March 1, 2026 21:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants