Skip to content

build(deps): bump the go-mod group across 1 directory with 10 updates#695

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-mod-4567f67029
Open

build(deps): bump the go-mod group across 1 directory with 10 updates#695
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-mod-4567f67029

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-mod group with 9 updates in the / directory:

Package From To
github.com/authzed/authzed-go 1.9.0 1.10.0
github.com/authzed/spicedb 1.51.2-0.20260429171948-76fc1537501e 1.53.0
github.com/ccoveille/go-safecast/v2 2.0.0 2.0.1
github.com/gookit/color 1.6.0 1.6.1
github.com/mark3labs/mcp-go 0.46.0 0.54.1
github.com/rs/zerolog 1.34.0 1.35.1
golang.org/x/mod 0.35.0 0.36.0
golang.org/x/net 0.53.0 0.55.0
google.golang.org/grpc 1.80.0 1.81.1

Updates github.com/authzed/authzed-go from 1.9.0 to 1.10.0

Release notes

Sourced from github.com/authzed/authzed-go's releases.

v1.10.0

What's Changed

Full Changelog: authzed/authzed-go@v1.9.0...v1.10.0

Commits
  • 9f795e9 Merge pull request #418 from authzed/add-zedtoken-to-download-api
  • 2d81536 chore: vendor at_revision zedtoken on DownloadPermissionSetsResponse
  • See full diff in compare view

Updates github.com/authzed/spicedb from 1.51.2-0.20260429171948-76fc1537501e to 1.53.0

Release notes

Sourced from github.com/authzed/spicedb's releases.

v1.53.0

Added

  • Add DispatchExecutor, a query plan executor that is Dispatch-aware and sends subproblems on Alias boundaries (authzed/spicedb#3074)

  • Implement Dispatch caching for query plan execution (authzed/spicedb#3079)

  • Add new optimizer to query planner based on set theory laws for simplifications (authzed/spicedb#3051)

  • Experimental: Add unified schema storage with ReadStoredSchema/WriteStoredSchema APIs for improved schema read performance (authzed/spicedb#2924)

    This feature stores the entire schema as a single serialized proto rather than reading individual namespace and caveat definitions separately, significantly improving schema read performance.

    Migration to unified schema storage is controlled by the --experimental-schema-mode flag, which supports a 4-phase rolling migration:

    1. read-legacy-write-legacy (default) - No change; reads and writes use legacy per-definition storage.
    2. read-legacy-write-both - Reads from legacy storage, writes to both legacy and unified storage. This is the first migration step and backfills the unified schema table.
    3. read-new-write-both - Reads from unified storage, writes to both. Validates the new read path while maintaining backward compatibility.
    4. read-new-write-new - Reads and writes only unified storage. This is the final migration target.

    Deployment:

    • With the SpiceDB Operator:* Configure the operator to roll through stages 1 through 4 in sequence. The operator handles the rolling update of SpiceDB instances at each stage.
    • Without the operator:* Progress through the stages manually by updating the --experimental-schema-mode flag and performing a rolling restart at each stage. You can also take the system down briefly and move directly from stage 1 to stage 4, which runs the full migration in one step.

Changed

Fixed

  • Query plan contexts are written to during recursive calls -- for now, disable dispatch inside recursive calls (authzed/spicedb#3078)

What's Changed

Full Changelog: authzed/spicedb@v1.52.0...v1.53.0

Docker Images

This release is available at authzed/spicedb:v1.53.0, quay.io/authzed/spicedb:v1.53.0, ghcr.io/authzed/spicedb:v1.53.0

... (truncated)

Changelog

Sourced from github.com/authzed/spicedb's changelog.

[1.53.0] - 2026-05-13

Added

  • Add DispatchExecutor, a query plan executor that is Dispatch-aware and sends subproblems on Alias boundaries (authzed/spicedb#3074)

  • Implement Dispatch caching for query plan execution (authzed/spicedb#3079)

  • Add new optimizer to query planner based on set theory laws for simplifications (authzed/spicedb#3051)

  • Experimental: Add unified schema storage with ReadStoredSchema/WriteStoredSchema APIs for improved schema read performance (authzed/spicedb#2924)

    This feature stores the entire schema as a single serialized proto rather than reading individual namespace and caveat definitions separately, significantly improving schema read performance.

    Migration to unified schema storage is controlled by the --experimental-schema-mode flag, which supports a 4-phase rolling migration:

    1. read-legacy-write-legacy (default) - No change; reads and writes use legacy per-definition storage.
    2. read-legacy-write-both - Reads from legacy storage, writes to both legacy and unified storage. This is the first migration step and backfills the unified schema table.
    3. read-new-write-both - Reads from unified storage, writes to both. Validates the new read path while maintaining backward compatibility.
    4. read-new-write-new - Reads and writes only unified storage. This is the final migration target.

    Deployment:

    • With the SpiceDB Operator:* Configure the operator to roll through stages 1 through 4 in sequence. The operator handles the rolling update of SpiceDB instances at each stage.
    • Without the operator:* Progress through the stages manually by updating the --experimental-schema-mode flag and performing a rolling restart at each stage. You can also take the system down briefly and move directly from stage 1 to stage 4, which runs the full migration in one step.

Changed

Fixed

  • Query plan contexts are written to during recursive calls -- for now, disble dispatch inside recursive calls (authzed/spicedb#3078)

[1.52.0] - 2026-04-30

Added

  • Added support for YAML-based validation files in DevContext (authzed/spicedb#3024)
  • Added support for YAML-based validation files in the Language Server (authzed/spicedb#3024)
  • Enable statistics-based optimizations when --experimental-query-plan is enabled. (authzed/spicedb#3052)
  • Added missing implementations of cursoring for LookupResource, LookupSubjects and ReadRelationships calls in FDW (authzed/spicedb#3016)
  • Add new gRPC Dispatch API and messages for dispatching query plans (authzed/spicedb#3072)
  • Support new withDebug flag in LookupResources calls to identify cycles (authzed/spicedb#3070)

Changed

Fixed

  • Improved error message when expiration is written before caveat in a relationship (authzed/spicedb#3071)
  • On a Postgres setup with read replicas, some requests may silently swallow errors of sort "revision not found in replica" (authzed/spicedb#2979)
  • Use cgroup-aware memory detection for cache and watch buffer sizing in containerized environments (authzed/spicedb#3000)
  • Upgraded the spanner client, which changed the internal implementation to not use a session pool. This means that the --datastore-spanner-max-sessions and --datastore-spanner-min-sessions flags are now deprecated and no-op. We also strongly recommend using Application Default Credentials in favor of a credentials file. (authzed/spicedb#3038)
  • Query Planner: error "ERROR: index \"pk_relation_tuple\" cannot be used for this query (SQLSTATE 42809)" returned when using wildcards (authzed/spicedb#3039)
  • Providing one of (--grpc-tls-cert-path, --grpc-tls-key-path) but not the other is now considered an error state, as both are necessary if you want to use TLS.
  • In a caveat context that uses nested lists of lists, the hashes generated for cache keys could collide because of an issue with the serialization logic. The serialization now uses deterministic protobuf serialization which avoids this issue (authzed/spicedb#3065)

... (truncated)

Commits

Updates github.com/ccoveille/go-safecast/v2 from 2.0.0 to 2.0.1

Release notes

Sourced from github.com/ccoveille/go-safecast/v2's releases.

v2.0.1

What's Changed

Fixes

Minor

New Contributors

Full Changelog: ccoVeille/go-safecast@v2.0.0...v2.0.1

Commits
  • edf6347 chore: add tests for floats rounding to zero
  • bc04d2b chore: move tiny floats test to the right place
  • f57f503 chore: simplify sign check for small negative floats
  • 51825a0 fix type in test
  • 36013fd Fix issue #144: Small floats are incorrectly rejected
  • a401ef5 build(deps): bump crate-ci/typos from 1.46.2 to 1.46.3 in the all group
  • ce6b413 build(deps): bump the all group with 2 updates
  • e591b21 docs: Fix typo in comment
  • 38b4891 build(deps): bump the all group with 2 updates
  • 7569636 build(deps): bump crate-ci/typos from 1.45.0 to 1.45.1 in the all group
  • Additional commits viewable in compare view

Updates github.com/gookit/color from 1.6.0 to 1.6.1

Release notes

Sourced from github.com/gookit/color's releases.

v1.6.1

Change Log

Fixed

Other

Commits
  • d232e11 ci(release): remove Go version matrix and simplify build steps in release action
  • 1245572 fix(convert): incorrect conversion between integer types
  • 2bb27a5 fix(detect): should enable VTP on windows CMD,PWSH
  • e58a899 fix: re-apply color after nested reset in RenderString (#119)
  • de1e243 Add 'stable' to Go version matrix and update action
  • ed1b9cc build(deps): bump actions/checkout from 5 to 6 (#115)
  • 2e18426 build(deps): bump github/codeql-action from 3 to 4 (#113)
  • See full diff in compare view

Updates github.com/mark3labs/mcp-go from 0.46.0 to 0.54.1

Release notes

Sourced from github.com/mark3labs/mcp-go's releases.

Release v0.54.1

No release notes provided.

Release v0.54.0

What's Changed

New Contributors

Full Changelog: mark3labs/mcp-go@v0.53.0...v0.54.0

Release v0.53.0

What's Changed

New Contributors

Full Changelog: mark3labs/mcp-go@v0.52.0...v0.53.0

Release v0.52.0

What's Changed

Full Changelog: mark3labs/mcp-go@v0.51.0...v0.52.0

Release v0.51.0

... (truncated)

Commits
  • 481f056 fix(tools): print errors to stderr for invalid jsonschema tags (#894)
  • 6e7859c perf(mcp): reduce content unmarshal allocations (#890)
  • 018f190 Add Title and Size to ResourceLink (match Resource / spec) (#887)
  • ca26738 cleanup
  • 76ea91b refactor(server): collapse client-info and writeJSONRPCError duplication (#886)
  • fac90b6 fmt
  • b817eff feat(mcp): add BaseMetadata.title, Icon.theme, Resource.size (#870) (#885)
  • 602478c fix: add panic recovery to session hook goroutines (#883)
  • 14ddeb3 feat: add OpenTelemetry tracing hooks to server and client (#856)
  • 3f8fc8e fix: add panic recovery to task goroutines, fix cleanup goroutine leak (#880)
  • Additional commits viewable in compare view

Updates github.com/rs/zerolog from 1.34.0 to 1.35.1

Commits
  • 116c806 event: restore Err() logging when ErrorStackMarshaler returns nil (#763)
  • 1396655 Bump CI Go matrix minimum from 1.21 to 1.23
  • 4b65a2f Bump actions/cache from 4 to 5 (#741)
  • b835796 Bump actions/setup-go from 5 to 6 (#742)
  • 134caf8 Added sanitization of journald keys (#751)
  • e133b6a Added variadic StrsV, ObjectsV, and StringersV (#752)
  • 82017d8 Bump github.com/coreos/go-systemd/v22 from 22.6.0 to 22.7.0 (#753)
  • 2f5b8a9 fix: UpdateContext skips Nop and zero-value loggers (#754)
  • d64c9a7 Add slog.Handler implementation for zerolog (#755)
  • a0d61dc fix: return dict to Event pool (#749)
  • Additional commits viewable in compare view

Updates golang.org/x/mod from 0.35.0 to 0.36.0

Commits
  • 643da9b go.mod: update golang.org/x dependencies
  • ccc3cdf zip: include 'but content has correct sum' note in TestVCS
  • ab30318 zip: update zip hashes for new flate compression
  • See full diff in compare view

Updates golang.org/x/net from 0.53.0 to 0.55.0

Commits
  • 7770ec4 go.mod: update golang.org/x dependencies
  • 4ece7b6 html: escape greater-than symbol in doctype identifiers
  • 08be507 html: improve Noah's Ark clause performance
  • a8fb2fe html: properly render fostered elements in foreign content
  • 0dc5b7a html: properly check namespace in "in body" any other end tag
  • a452f3c html: ignore duplicate attributes during tokenization
  • f865199 quic: fix appendMaxDataFrame erroneously accumulating sentLimit
  • 210ed3c quic: establish a "happened-before" relationship between stream write and read
  • ad8140e quic: fix buffer slicing when handling overlapping stream data
  • 23ee2ef http2: avoid API changes when built with go1.27
  • Additional commits viewable in compare view

Updates golang.org/x/term from 0.42.0 to 0.43.0

Commits

Updates google.golang.org/grpc from 1.80.0 to 1.81.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.81.1

Security

  • xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per gRFC A41. (#9111)

Bug Fixes

  • otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. (#9081)

Release 1.81.0

Behavior Changes

  • balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. (#8808)

Dependencies

  • Minimum supported Go version is now 1.25. (#8969)

Bug Fixes

  • xds: Use the leaf cluster's security config for the TLS handshake instead of the aggregate cluster's config. (#8956)
  • transport: Send a RST_STREAM when receiving an END_STREAM when the stream is not already half-closed. (#8832)
  • xds: Fix ADS resource name validation to prevent a panic. (#8970)

New Features

  • grpc/stats: Add support for custom labels in per-call metrics (gRFC A108). (#9008)
  • xds: Add support for Server Name Indication (SNI) and SAN validation (gRFC A101). Disabled by default. To enable, set GRPC_EXPERIMENTAL_XDS_SNI=true environment variable. (#9016)
  • xds: Add support to control which fields get propagated from ORCA backend metric reports to LRS load reports (gRFC A85). Disabled by default. To enable, set GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION=true. (#9005)
  • xds: Add metrics to track xDS client connectivity and cached resource state (gRFC A78). (#8807)
  • stats/otel: Enhance grpc.subchannel.disconnections metric by adding disconnection reason to the grpc.disconnect_error label (gRFC A94). This provides granular insights into why subchannels are closing. (#8973)
  • mem: Add mem.Buffer.Slice() API to slice the buffer like a slice. (#8977)

Performance Improvements

  • alts: Pool read buffers to lower memory utilization when sockets are unreadable. (#8964)
  • transport: Pool HTTP/2 framer read buffers to reduce idle memory consumption. Currently limited to Linux for ALTS and non-encrypted transports (TCP, Unix). To disable, set GRPC_GO_EXPERIMENTAL_HTTP_FRAMER_READ_BUFFER_POOLING=false and report any issues. (#9032)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the go-mod group across 1 directory with 10 updates
b417811 
Bumps the go-mod group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/authzed/authzed-go](https://github.com/authzed/authzed-go) | `1.9.0` | `1.10.0` |
| [github.com/authzed/spicedb](https://github.com/authzed/spicedb) | `1.51.2-0.20260429171948-76fc1537501e` | `1.53.0` |
| [github.com/ccoveille/go-safecast/v2](https://github.com/ccoveille/go-safecast) | `2.0.0` | `2.0.1` |
| [github.com/gookit/color](https://github.com/gookit/color) | `1.6.0` | `1.6.1` |
| [github.com/mark3labs/mcp-go](https://github.com/mark3labs/mcp-go) | `0.46.0` | `0.54.1` |
| [github.com/rs/zerolog](https://github.com/rs/zerolog) | `1.34.0` | `1.35.1` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.35.0` | `0.36.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.53.0` | `0.55.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.80.0` | `1.81.1` |



Updates `github.com/authzed/authzed-go` from 1.9.0 to 1.10.0
- [Release notes](https://github.com/authzed/authzed-go/releases)
- [Commits](authzed/authzed-go@v1.9.0...v1.10.0)

Updates `github.com/authzed/spicedb` from 1.51.2-0.20260429171948-76fc1537501e to 1.53.0
- [Release notes](https://github.com/authzed/spicedb/releases)
- [Changelog](https://github.com/authzed/spicedb/blob/main/CHANGELOG.md)
- [Commits](https://github.com/authzed/spicedb/commits/v1.53.0)

Updates `github.com/ccoveille/go-safecast/v2` from 2.0.0 to 2.0.1
- [Release notes](https://github.com/ccoveille/go-safecast/releases)
- [Commits](ccoVeille/go-safecast@v2.0.0...v2.0.1)

Updates `github.com/gookit/color` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/gookit/color/releases)
- [Commits](gookit/color@v1.6.0...v1.6.1)

Updates `github.com/mark3labs/mcp-go` from 0.46.0 to 0.54.1
- [Release notes](https://github.com/mark3labs/mcp-go/releases)
- [Commits](mark3labs/mcp-go@v0.46.0...v0.54.1)

Updates `github.com/rs/zerolog` from 1.34.0 to 1.35.1
- [Commits](rs/zerolog@v1.34.0...v1.35.1)

Updates `golang.org/x/mod` from 0.35.0 to 0.36.0
- [Commits](golang/mod@v0.35.0...v0.36.0)

Updates `golang.org/x/net` from 0.53.0 to 0.55.0
- [Commits](golang/net@v0.53.0...v0.55.0)

Updates `golang.org/x/term` from 0.42.0 to 0.43.0
- [Commits](golang/term@v0.42.0...v0.43.0)

Updates `google.golang.org/grpc` from 1.80.0 to 1.81.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.80.0...v1.81.1)

---
updated-dependencies:
- dependency-name: github.com/authzed/authzed-go
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: github.com/authzed/spicedb
  dependency-version: 1.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: github.com/ccoveille/go-safecast/v2
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-mod
- dependency-name: github.com/gookit/color
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-mod
- dependency-name: github.com/mark3labs/mcp-go
  dependency-version: 0.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: github.com/rs/zerolog
  dependency-version: 1.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: golang.org/x/mod
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: golang.org/x/net
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: golang.org/x/term
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: google.golang.org/grpc
  dependency-version: 1.81.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the area/dependencies Affects dependencies label Jun 2, 2026
@rudi-ch

rudi-ch commented Jun 4, 2026

Copy link
Copy Markdown

Not sure who looks at these, but x/crypto has a CVE that should be fixed with 0.52.0 as in https://github.com/authzed/spicedb/pull/3132/changes while this PR only updates to 0.51.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/dependencies Affects dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rudi-ch