Skip to content

build(deps): bump the all-dependencies group with 13 updates - #96

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-dependencies-4fa97403d7
Open

build(deps): bump the all-dependencies group with 13 updates#96
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/all-dependencies-4fa97403d7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 13 updates:

Package From To
github.com/ipfs/boxo 0.38.0 0.42.2
github.com/ipfs/go-block-format 0.2.3 0.2.4
github.com/ipfs/go-cid 0.6.1 0.6.2
github.com/ipfs/go-datastore 0.9.1 0.9.2
github.com/ipfs/go-ds-leveldb 0.5.2 0.5.3
github.com/ipfs/go-ipld-format 0.6.3 0.6.4
github.com/ipld/go-car/v2 2.16.0 2.17.0
github.com/libp2p/go-libp2p 0.48.0 0.49.0
github.com/libp2p/go-libp2p-kad-dht 0.38.0 0.42.1
github.com/mattn/go-sqlite3 1.14.42 1.14.52
go.sia.tech/jape 0.14.1 0.14.3
go.sia.tech/renterd/v2 2.9.0 2.9.4
go.uber.org/zap 1.27.1 1.28.0

Updates github.com/ipfs/boxo from 0.38.0 to 0.42.2

Release notes

Sourced from github.com/ipfs/boxo's releases.

v0.42.2

[!NOTE] This release was brought to you by the Shipyard team.

[!IMPORTANT] This is the last Kubo release with new features from the Shipyard team. Our IPFS work ends on September 30, 2026. Until then we will ship security and bug fix releases if any are needed. After that date, no one at Shipyard maintains Boxo. If you depend on Boxo, read the announcement and send us your transition questions before the end of September.

What's Changed

Added

  • bitswap/network/httpnet: DefaultConnectFailureBackoff constant, the wait before Connect re-probes an endpoint after a failed probe.
  • bitswap/network/httpnet: CooldownTracker type with NewCooldownTracker, SharedCooldownTracker and the WithCooldownTracker option, for controlling where per-host backoff state lives.

Changed

  • ✨ bitswap/network/httpnet: removed the background ping loop that probed every connected HTTP peer with GET/HEAD /ipfs/bafkqaaa every 5 seconds for the lifetime of the process (old: fixed 5s cadence per peer, results discarded; new: no periodic probes). Idle HTTP peers generate no background traffic.
  • bitswap/network/httpnet: latency to HTTP peers is measured from the Connect probe and from real retrieval responses instead of periodic pings.
  • bitswap/network/httpnet: Connect and Ping honor per-host cooldowns; after a failed endpoint probe, Connect does not re-probe the host until Retry-After (when provided) or DefaultConnectFailureBackoff elapses (old: no backoff, re-probe on every call).
  • bitswap/network/httpnet: per-host cooldowns live in a process-wide registry (SharedCooldownTracker) so backoff deadlines survive short-lived Network instances (old: per-instance state, forgotten on every restart); Network.Stop no longer stops the registry, and WithCooldownTracker gives a Network a private one.

Removed

  • bitswap/network/httpnet: HTTP 410 is no longer accepted as a successful answer to the connection probe; it was a workaround for a provider that has since shut down. 410 on real block requests still counts as a valid "content unavailable" reply.

Fixed

  • bitswap/network/httpnet: message senders created while a host was in cooldown no longer treat that cooldown as permanent; the request path resumes once the cooldown expires.
  • bitswap/network/bsnet: peers already connected when Bitswap starts are now recognised. libp2p only reports connections opened after a notifier is registered, so a peer connected during node startup stayed invisible to Bitswap for the life of that connection, and no want was ever sent to it. Nodes with another way to find content usually masked this; nodes relying on an already-connected peer could wait forever.

Full Changelog: ipfs/boxo@v0.42.1...v0.42.2

v0.42.1

[!NOTE] This release was brought to you by the Shipyard team.

What's Changed

Added

  • gateway: added WithMaxTraversalDepth. It limits how deep BlocksBackend descends into a DAG while it serves a CAR response. Traversal keeps per-level state, so its cost grows with depth. The limit is on by default at DefaultMaxTraversalDepth (1024), well above anything UnixFS produces. A file reaches terabytes by depth 4, and a HAMT adds about 4 levels per million directory entries. Pass a positive value to set your own limit, or WithMaxTraversalDepth(0) to remove the limit. #1197

Changed

  • gateway: a CAR response that fails partway through now ends with [Gateway Error: CAR stream truncated, response is incomplete]. withRetrievalTimeout already uses the same marker when it cuts a response short. The gateway sets X-Stream-Error only once the body is streaming, so that header rarely reaches the client. A truncated CAR was otherwise indistinguishable from a complete one. The marker makes the trailing bytes invalid CAR, so a reader stops with an error instead of accepting a short DAG. This mostly helps operators. Gateways usually sit behind reverse proxies and third-party CDNs, so a short response leaves you guessing which hop cut it. Now the response says so itself. #1197
  • routing/http/server: /routing/v1 responses no longer let a cache serve a two-day-old answer while the origin is healthy. Peer addresses in routing results come from short-lived sources such as relay reservations. A stale window measured in days handed clients addresses that had stopped working long ago. stale-while-revalidate is now 10 minutes for responses with results, and 1 minute for empty ones. That covers a background refresh. stale-if-error applies only when the origin is failing, so responses with results keep the 48h Amino DHT expiration window. For empty responses it is 1 hour. max-age is unchanged. #1195

... (truncated)

Changelog

Sourced from github.com/ipfs/boxo's changelog.

[v0.42.2]

Added

  • bitswap/network/httpnet: DefaultConnectFailureBackoff constant, the wait before Connect re-probes an endpoint after a failed probe.
  • bitswap/network/httpnet: CooldownTracker type with NewCooldownTracker, SharedCooldownTracker and the WithCooldownTracker option, for controlling where per-host backoff state lives.

Changed

  • ✨ bitswap/network/httpnet: removed the background ping loop that probed every connected HTTP peer with GET/HEAD /ipfs/bafkqaaa every 5 seconds for the lifetime of the process (old: fixed 5s cadence per peer, results discarded; new: no periodic probes). Idle HTTP peers generate no background traffic.
  • bitswap/network/httpnet: latency to HTTP peers is measured from the Connect probe and from real retrieval responses instead of periodic pings.
  • bitswap/network/httpnet: Connect and Ping honor per-host cooldowns; after a failed endpoint probe, Connect does not re-probe the host until Retry-After (when provided) or DefaultConnectFailureBackoff elapses (old: no backoff, re-probe on every call).
  • bitswap/network/httpnet: per-host cooldowns live in a process-wide registry (SharedCooldownTracker) so backoff deadlines survive short-lived Network instances (old: per-instance state, forgotten on every restart); Network.Stop no longer stops the registry, and WithCooldownTracker gives a Network a private one.

Removed

  • bitswap/network/httpnet: HTTP 410 is no longer accepted as a successful answer to the connection probe; it was a workaround for a provider that has since shut down. 410 on real block requests still counts as a valid "content unavailable" reply.

Fixed

  • bitswap/network/httpnet: message senders created while a host was in cooldown no longer treat that cooldown as permanent; the request path resumes once the cooldown expires.
  • bitswap/network/bsnet: peers already connected when Bitswap starts are now recognised. libp2p only reports connections opened after a notifier is registered, so a peer connected during node startup stayed invisible to Bitswap for the life of that connection, and no want was ever sent to it. Nodes with another way to find content usually masked this; nodes relying on an already-connected peer could wait forever.

[v0.42.1]

Added

  • gateway: added WithMaxTraversalDepth. It limits how deep BlocksBackend descends into a DAG while it serves a CAR response. Traversal keeps per-level state, so its cost grows with depth. The limit is on by default at DefaultMaxTraversalDepth (1024), well above anything UnixFS produces. A file reaches terabytes by depth 4, and a HAMT adds about 4 levels per million directory entries. Pass a positive value to set your own limit, or WithMaxTraversalDepth(0) to remove the limit. #1197

Changed

  • gateway: a CAR response that fails partway through now ends with [Gateway Error: CAR stream truncated, response is incomplete]. withRetrievalTimeout already uses the same marker when it cuts a response short. The gateway sets X-Stream-Error only once the body is streaming, so that header rarely reaches the client. A truncated CAR was otherwise indistinguishable from a complete one. The marker makes the trailing bytes invalid CAR, so a reader stops with an error instead of accepting a short DAG. This mostly helps operators. Gateways usually sit behind reverse proxies and third-party CDNs, so a short response leaves you guessing which hop cut it. Now the response says so itself. #1197
  • routing/http/server: /routing/v1 responses no longer let a cache serve a two-day-old answer while the origin is healthy. Peer addresses in routing results come from short-lived sources such as relay reservations. A stale window measured in days handed clients addresses that had stopped working long ago. stale-while-revalidate is now 10 minutes for responses with results, and 1 minute for empty ones. That covers a background refresh. stale-if-error applies only when the origin is failing, so responses with results keep the 48h Amino DHT expiration window. For empty responses it is 1 hour. max-age is unchanged. #1195
  • upgrade to go-libp2p v0.49.0

Fixed

  • bitswap/network: ExtractHTTPAddress now brackets an IPv6 literal when it builds the provider URL. A peer that announces /ip6/<addr>/tcp/443/tls/http is now usable as an HTTP provider. Without brackets, url.Parse rejected the address under Go 1.26 and later, and the peer was skipped. On earlier versions it parsed, but the authority split at the last colon, so the client dialed a host and port that do not exist. #1196

Security

[v0.42.0]

Added

  • namesys: DNSLink lookups now return the DNS TXT record's TTL, and the gateway uses it as Cache-Control: max-age for /ipns/<dnslink-host> responses. Clients cache a DNSLink website for exactly as long as its DNS record allows and fetch updates once it expires, instead of relying on a static default. #329
    • Requires a resolver that reports TTLs, such as DNS-over-HTTPS via go-doh-resolver v0.6.0. The OS resolver cannot report TTLs: Go's standard library net.Resolver returns only record values, and libp2p's default DNS wiring (madns.DefaultResolver) wraps it, so domains it serves keep the old behavior. In Kubo, a DNS.Resolvers entry for . covers all domains.
    • WithDNSResolver detects TTL support automatically. NewDNSResolverWithTTL, WithDNSResolverWithTTL, and LookupTXTWithTTLFunc take a TTL-aware lookup directly. NewDNSResolver and LookupTXTFunc are unchanged and report an unknown TTL (0).

... (truncated)

Commits
  • 25b1db8 Merge pull request #1207 from ipfs/release-v0.42.2
  • ce5e75c bump version
  • d343c5f Release v0.42.2
  • d8b6157 fix(bitswap/httpnet): bound probe traffic (#1205)
  • f75e524 Merge pull request #1203 from ipfs/doc-broadcast-control
  • b85c249 Merge branch 'main' into doc-broadcast-control
  • 2492105 fix(bitswap): see peers connected before startup (#1201)
  • ddf4b1e docs: spec guardrails (#1204)
  • b824151 docs: fix broadcast reduction docs, add example
  • 9557533 docs: describe bitswap broacast control for reducing bitswap broadcasts
  • Additional commits viewable in compare view

Updates github.com/ipfs/go-block-format from 0.2.3 to 0.2.4

Release notes

Sourced from github.com/ipfs/go-block-format's releases.

v0.2.4

What's Changed

Full Changelog: ipfs/go-block-format@v0.2.3...v0.2.4

Commits

Updates github.com/ipfs/go-cid from 0.6.1 to 0.6.2

Release notes

Sourced from github.com/ipfs/go-cid's releases.

v0.6.2

What's Changed

  • chore: modernize code and update dependencies in ipfs/go-cid#184
    • update golang.org/x/crypto to v0.53.0
    • update golang.org/x/sys to v0.46.0
    • to marshal json, use fmt.Appendf instead of converting formatted string to []byte
  • update README in ipfs/go-cid#185
  • use errors.New for error strings without formatting in ipfs/go-cid#187
  • remove unneeded Makefile in ipfs/go-cid#187

Full Changelog: ipfs/go-cid@v0.6.1...v0.6.2

Commits

Updates github.com/ipfs/go-datastore from 0.9.1 to 0.9.2

Release notes

Sourced from github.com/ipfs/go-datastore's releases.

v0.9.2

What's Changed

Full Changelog: ipfs/go-datastore@v0.9.1...v0.9.2

Commits

Updates github.com/ipfs/go-ds-leveldb from 0.5.2 to 0.5.3

Release notes

Sourced from github.com/ipfs/go-ds-leveldb's releases.

v0.5.3

What's Changed

Full Changelog: ipfs/go-ds-leveldb@v0.5.2...v0.5.3

Commits

Updates github.com/ipfs/go-ipld-format from 0.6.3 to 0.6.4

Release notes

Sourced from github.com/ipfs/go-ipld-format's releases.

v0.6.4

What's Changed

Full Changelog: ipfs/go-ipld-format@v0.6.3...v0.6.4

Commits

Updates github.com/ipld/go-car/v2 from 2.16.0 to 2.17.0

Release notes

Sourced from github.com/ipld/go-car/v2's releases.

v2.17.0

What's Changed

New Contributors

Full Changelog: ipld/go-car@v0.6.3...v2.17.0

Commits
  • a95c3df chore: v2.17.0 bump (#672)
  • eb7b6f2 chore(deps): bump github.com/polydawn/refmt in /cmd (#671)
  • c4b9f36 chore(deps): bump github.com/ipld/go-ipld-prime in /v2 (#665)
  • 7c707db chore(deps): bump github.com/ipld/go-ipld-prime from 0.22.0 to 0.23.0 (#666)
  • 69dc246 chore(deps): bump github.com/ipfs/boxo from 0.38.0 to 0.39.0 (#667)
  • fd5616e chore(deps): bump github.com/ipfs/go-unixfsnode in /v2 (#668)
  • 738cbcd chore(deps): bump github.com/ipld/go-ipld-prime in /cmd (#669)
  • 24b1b65 chore(deps): bump github.com/ipfs/go-unixfsnode in /cmd (#670)
  • 2dd6aca chore(deps): bump github.com/ipfs/go-cid from 0.6.0 to 0.6.1 (#660)
  • 90a1311 chore(deps): bump github.com/ipfs/go-cid from 0.6.0 to 0.6.1 in /v2 (#661)
  • Additional commits viewable in compare view

Updates github.com/libp2p/go-libp2p from 0.48.0 to 0.49.0

Release notes

Sourced from github.com/libp2p/go-libp2p's releases.

v0.49.0

What's Changed

New Contributors

Full Changelog: libp2p/go-libp2p@v0.48.0...v0.49.0

Commits
  • 5c7e6ec Release v0.49.0
  • 42c3811 chore: update deps
  • 07d71d8 chore(webtransport): update webtransport-go to v0.11.1
  • bb0dc7d test(basichost): cancel in-flight refresh probes
  • a07d7ff refactor(autonatv2): unlock pickServer via defer
  • 10e3837 docs(basichost): fix stale const name in comments
  • 8745f50 fix(basichost): probe secondary addrs on the same 1h cadence as primaries
  • f23601b fix(autonatv2): don't panic in GetReachability after Close
  • 617deba test(basichost): actually spawn workers in refreshReachability cancellation test
  • 18e98a9 fix(basichost): score webrtc-direct addrs with P_WEBRTC_DIRECT
  • Additional commits viewable in compare view

Updates github.com/libp2p/go-libp2p-kad-dht from 0.38.0 to 0.42.1

Release notes

Sourced from github.com/libp2p/go-libp2p-kad-dht's releases.

v0.42.1

[!NOTE] This release was brought to you by the Shipyard team.

What's Changed

Full Changelog: libp2p/go-libp2p-kad-dht@v0.42.0...v0.42.1

v0.42.0

[!NOTE] This release was brought to you by the Shipyard team.

Highlights

⚠️ Breaking changes

Constructors no longer take a context.Context (#1282)

The lifecycle context was removed from all constructors. The DHT now runs until Close() is called; cancelling a context no longer tears it down.

Before After
dht.New(ctx, h, opts...) dht.New(h, opts...)
dht.NewDHT(ctx, h, dstore) dht.NewDHT(h, dstore)
dht.NewDHTClient(ctx, h, dstore) dht.NewDHTClient(h, dstore)
dual.New(ctx, h, opts...) dual.New(h, opts...)
records.NewProviderManager(ctx, ...) records.NewProviderManager(...)
rtrefresh.NewRtRefreshManager(ctx, ...) rtrefresh.NewRtRefreshManager(...)

Migration: drop the context argument. If you relied on cancelling the constructor context to shut the DHT down, call Close() instead. Close() blocks until all long-lived components have stopped. Note that in-flight RPC handlers are owned by the libp2p host, so close the host before closing any datastore handed to the DHT.

ProviderStore option removed (#1277 by @​guillaumemichel)

Custom ProviderStore implementations can no longer be injected; the DHT always runs the built-in provider manager. The dht.ProviderStore(...) option is replaced by datastore-level configuration:

// Before: inject a custom provider store
d, err := dht.New(ctx, h, dht.ProviderStore(customStore))
// After: configure the built-in provider manager
d, err := dht.New(h,
dht.ProviderDatastore(dstore),          // dedicated datastore for provider records
dht.ProviderManagerOpts(                // tune the built-in manager
records.ProvideValidity(48*time.Hour),
</tr></table>

... (truncated)

Commits

Updates github.com/mattn/go-sqlite3 from 1.14.42 to 1.14.52

Release notes

Sourced from github.com/mattn/go-sqlite3's releases.

1.14.52

What's Changed

Full Changelog: mattn/go-sqlite3@v1.14.51...v1.14.52

1.14.51

What's Changed

New Contributors

Full Changelog: mattn/go-sqlite3@v1.14.50...v1.14.51

1.14.50

What's Changed

New Contributors

Full Changelog: mattn/go-sqlite3@v1.14.49...v1.14.50

1.14.49

What's Changed

... (truncated)

Commits

@dependabot
build(deps): bump the all-dependencies group with 13 updates
75d9a35 
Bumps the all-dependencies group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/ipfs/boxo](https://github.com/ipfs/boxo) | `0.38.0` | `0.42.2` |
| [github.com/ipfs/go-block-format](https://github.com/ipfs/go-block-format) | `0.2.3` | `0.2.4` |
| [github.com/ipfs/go-cid](https://github.com/ipfs/go-cid) | `0.6.1` | `0.6.2` |
| [github.com/ipfs/go-datastore](https://github.com/ipfs/go-datastore) | `0.9.1` | `0.9.2` |
| [github.com/ipfs/go-ds-leveldb](https://github.com/ipfs/go-ds-leveldb) | `0.5.2` | `0.5.3` |
| [github.com/ipfs/go-ipld-format](https://github.com/ipfs/go-ipld-format) | `0.6.3` | `0.6.4` |
| [github.com/ipld/go-car/v2](https://github.com/ipld/go-car) | `2.16.0` | `2.17.0` |
| [github.com/libp2p/go-libp2p](https://github.com/libp2p/go-libp2p) | `0.48.0` | `0.49.0` |
| [github.com/libp2p/go-libp2p-kad-dht](https://github.com/libp2p/go-libp2p-kad-dht) | `0.38.0` | `0.42.1` |
| [github.com/mattn/go-sqlite3](https://github.com/mattn/go-sqlite3) | `1.14.42` | `1.14.52` |
| [go.sia.tech/jape](https://github.com/SiaFoundation/jape) | `0.14.1` | `0.14.3` |
| [go.sia.tech/renterd/v2](https://github.com/SiaFoundation/renterd) | `2.9.0` | `2.9.4` |
| [go.uber.org/zap](https://github.com/uber-go/zap) | `1.27.1` | `1.28.0` |


Updates `github.com/ipfs/boxo` from 0.38.0 to 0.42.2
- [Release notes](https://github.com/ipfs/boxo/releases)
- [Changelog](https://github.com/ipfs/boxo/blob/main/CHANGELOG.md)
- [Commits](ipfs/boxo@v0.38.0...v0.42.2)

Updates `github.com/ipfs/go-block-format` from 0.2.3 to 0.2.4
- [Release notes](https://github.com/ipfs/go-block-format/releases)
- [Commits](ipfs/go-block-format@v0.2.3...v0.2.4)

Updates `github.com/ipfs/go-cid` from 0.6.1 to 0.6.2
- [Release notes](https://github.com/ipfs/go-cid/releases)
- [Commits](ipfs/go-cid@v0.6.1...v0.6.2)

Updates `github.com/ipfs/go-datastore` from 0.9.1 to 0.9.2
- [Release notes](https://github.com/ipfs/go-datastore/releases)
- [Commits](ipfs/go-datastore@v0.9.1...v0.9.2)

Updates `github.com/ipfs/go-ds-leveldb` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/ipfs/go-ds-leveldb/releases)
- [Commits](ipfs/go-ds-leveldb@v0.5.2...v0.5.3)

Updates `github.com/ipfs/go-ipld-format` from 0.6.3 to 0.6.4
- [Release notes](https://github.com/ipfs/go-ipld-format/releases)
- [Commits](ipfs/go-ipld-format@v0.6.3...v0.6.4)

Updates `github.com/ipld/go-car/v2` from 2.16.0 to 2.17.0
- [Release notes](https://github.com/ipld/go-car/releases)
- [Commits](ipld/go-car@v2.16.0...v2.17.0)

Updates `github.com/libp2p/go-libp2p` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/libp2p/go-libp2p/releases)
- [Changelog](https://github.com/libp2p/go-libp2p/blob/master/CHANGELOG.md)
- [Commits](libp2p/go-libp2p@v0.48.0...v0.49.0)

Updates `github.com/libp2p/go-libp2p-kad-dht` from 0.38.0 to 0.42.1
- [Release notes](https://github.com/libp2p/go-libp2p-kad-dht/releases)
- [Commits](libp2p/go-libp2p-kad-dht@v0.38.0...v0.42.1)

Updates `github.com/mattn/go-sqlite3` from 1.14.42 to 1.14.52
- [Release notes](https://github.com/mattn/go-sqlite3/releases)
- [Commits](mattn/go-sqlite3@v1.14.42...v1.14.52)

Updates `go.sia.tech/jape` from 0.14.1 to 0.14.3
- [Release notes](https://github.com/SiaFoundation/jape/releases)
- [Changelog](https://github.com/SiaFoundation/jape/blob/master/CHANGELOG.md)
- [Commits](SiaFoundation/jape@v0.14.1...v0.14.3)

Updates `go.sia.tech/renterd/v2` from 2.9.0 to 2.9.4
- [Release notes](https://github.com/SiaFoundation/renterd/releases)
- [Changelog](https://github.com/SiaFoundation/renterd/blob/master/CHANGELOG.md)
- [Commits](SiaFoundation/renterd@v2.9.0...v2.9.4)

Updates `go.uber.org/zap` from 1.27.1 to 1.28.0
- [Release notes](https://github.com/uber-go/zap/releases)
- [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md)
- [Commits](uber-go/zap@v1.27.1...v1.28.0)

---
updated-dependencies:
- dependency-name: github.com/ipfs/boxo
  dependency-version: 0.42.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: github.com/ipfs/go-block-format
  dependency-version: 0.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: github.com/ipfs/go-cid
  dependency-version: 0.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: github.com/ipfs/go-datastore
  dependency-version: 0.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: github.com/ipfs/go-ds-leveldb
  dependency-version: 0.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: github.com/ipfs/go-ipld-format
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: github.com/ipld/go-car/v2
  dependency-version: 2.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: github.com/libp2p/go-libp2p
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: github.com/libp2p/go-libp2p-kad-dht
  dependency-version: 0.42.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: github.com/mattn/go-sqlite3
  dependency-version: 1.14.52
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: go.sia.tech/jape
  dependency-version: 0.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: go.sia.tech/renterd/v2
  dependency-version: 2.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: go.uber.org/zap
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 14, 2026
@socket-security

socket-security Bot commented Sep 14, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedgo.sia.tech/​renterd/​v2@​v2.9.0 ⏵ v2.9.473 +1100100100100
Updatedgithub.com/​ipfs/​boxo@​v0.38.0 ⏵ v0.42.274 +1100100100100
Updatedgithub.com/​libp2p/​go-libp2p@​v0.48.0 ⏵ v0.49.074 +110010075100
Updatedgithub.com/​mattn/​go-sqlite3@​v1.14.42 ⏵ v1.14.5297 +110010075100
Updatedgithub.com/​ipld/​go-car/​v2@​v2.16.0 ⏵ v2.17.090100100100100
Updatedgo.uber.org/​zap@​v1.27.1 ⏵ v1.28.098 +1100100100100
Updatedgithub.com/​ipfs/​go-datastore@​v0.9.1 ⏵ v0.9.299100100100100
Updatedgo.sia.tech/​jape@​v0.14.1 ⏵ v0.14.3100 +1100100100100
Updatedgithub.com/​libp2p/​go-libp2p-kad-dht@​v0.38.0 ⏵ v0.42.1100 +1100100100100
Updatedgithub.com/​ipfs/​go-cid@​v0.6.1 ⏵ v0.6.2100100100100100
Updatedgithub.com/​ipfs/​go-block-format@​v0.2.3 ⏵ v0.2.4100100100100100
Updatedgithub.com/​ipfs/​go-ds-leveldb@​v0.5.2 ⏵ v0.5.3100100100100100
Updatedgithub.com/​ipfs/​go-ipld-format@​v0.6.3 ⏵ v0.6.4100100100100100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants