Skip to content

Bump the gomod group across 1 directory with 3 updates - #202

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-b48af5579c
Open

Bump the gomod group across 1 directory with 3 updates#202
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-b48af5579c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the gomod group with 2 updates in the / directory: github.com/coder/websocket and github.com/quic-go/quic-go.

Updates github.com/coder/websocket from 1.8.12 to 1.8.15

Release notes

Sourced from github.com/coder/websocket's releases.

v1.8.15

Changes

New Contributors

Full Changelog: coder/websocket@v1.8.14...v1.8.15

v1.8.14

Changes

New Contributors

Full Changelog: coder/websocket@v1.8.13...v1.8.14

v1.8.13

Changes

... (truncated)

Commits
  • 9c8faad conn: skip timeout callbacks for background contexts (#566)
  • 7039364 avoid per-frame cleanup closures on read to remove 2 allocs per frame read (#...
  • d099e16 docs: fix roadmap links (#558)
  • c98e9dc docs: fix lint issue (#557)
  • 39b7b07 docs: remove mention of resolved issue in README (#556)
  • 9f473ad docs: add document for AI agents (AGENTS.md) (#547)
  • 8d3545a fix: transmit in single frame when compression enabled (#552)
  • 8bf6dd2 chore: fix typo in Accept function (#544)
  • 7d7c644 refactor: add ErrMessageTooBig sentinel error for limited reads (#535)
  • c7846ea refactor: use context.AfterFunc to track timeouts instead of goroutine (#532)
  • Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.57.1 to 0.60.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.60.0

Starting with v0.60.0, quic-go is ready for use in FIPS 140-3 environments when built with Go 1.26 or newer and used with the Go Cryptographic Module. See FIPS140.md for details.

This required a number of changes:

  • switch QUIC HKDF usage to the standard library crypto/hkdf: #5461
  • use the Go standard library's TLS 1.3 AES-GCM implementation for QUIC packet protection AEADs: #5624
  • use cipher.NewGCMWithRandomNonce for address validation token encryption: #5625
  • disable FIPS 140-3 enforcement for the Retry packet integrity tag, which is outside the FIPS 140-3 scope: #5630
  • disable FIPS 140-3 enforcement for Initial packet protection, whose secrets are derived from public RFC constants: #5640
  • guard the internal ChaCha20-Poly1305 code path so it is not used in FIPS 140-3 mode: #5633
  • add FIPS / non-FIPS data transfer integration tests, including Retry and key updates: #5646

Breaking Changes

  • quic-go now requires Go 1.25 or newer: #5561

Notable Fixes

  • path probe packets now correctly pass the OOB data (needed to select the correct network interface in some system configurations): #5544, thanks to @​on-keyday
  • cancel the Stream and SendStream context when the connection is closed: #5556, thanks to @​zvdy
  • http3: validate Extended CONNECT ``:protocol` pseudo-header values according to HTTP token syntax: #5639
  • http3: always set http.Request.Scheme and http.Request.Host: #5554, thanks to @​qiulaidongfeng
  • http3: fixed a nil pointer dereference when Server.Logger is unset: #5671
  • fix maximum datagram size estimation after MTU discovery: #5650, thanks to @​jinq0123
  • OpenStreamSync now reliably returns the context error when the context is cancelled: #5660

Behind the scenes

In the last couple of months, we have reworked our fuzz setup and the integration into OSS-Fuzz: First of all, all fuzzers were rewritten to Go native fuzzing (#5592, #5599, #5600, #5603, #5613). We also added new fuzzers for the HTTP/3 frame parser (#5595), HTTP/3 request, response and trailer decoding (#5602) and the STREAM / CRYPTO frame sorter (#5620).

Since native Go fuzzing uses a different seed corpus format, we now use the newly implemented go-ossfuzz-seeds library to generate OSS-Fuzz compatible seed corpus files from f.Add calls.

We also enable ClusterFuzzLite batch fuzzing (#5605), including. a seed corpus (#5607). Fuzz coverage for both ClusterFuzzLite batch fuzzing (#5641) and for OSS-Fuzz fuzzing (#5655) is now submitted to Codecov.

Changelog

... (truncated)

Commits
  • 7612ad1 fix maximum datagram size estimation after MTU discovery (#5650)
  • c29d679 log build date and revisions in OSS-Fuzz build script (#5674)
  • 2728695 ci: bump docker/setup-qemu-action from 4.0.0 to 4.1.0 (#5673)
  • 4e4845b http3: fix nil pointer dereference when Server.Logger is unset (#5671)
  • 25c8e61 make frame sorter fuzz corpus accessible to OSS-Fuzz (#5670)
  • e444e69 ci: bump docker/login-action from 4.1.0 to 4.2.0 (#5668)
  • 23256b5 ci: bump docker/setup-buildx-action from 4.0.0 to 4.1.0 (#5665)
  • a7a3ef9 ci: bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#5666)
  • 0b49963 ci: bump docker/build-push-action from 7.1.0 to 7.2.0 (#5667)
  • 4f3577c ci: bump codecov/codecov-action from 6.0.0 to 6.0.1 (#5664)
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.46.0 to 0.51.0

Commits
  • b8a14a8 go.mod: update golang.org/x dependencies
  • 9d9d507 x509roots/fallback/bundle: fix bundle test with Go 1.27+
  • fd0b90d acme: include Problem in OrderError.Error
  • b9e5359 pbkdf2: turn into a wrapper for crypto/pbkdf2
  • cc0e4fc hkdf: forward Extract to the standard library
  • a8e9237 x509roots/fallback: update bundle
  • 03ca0dc go.mod: update golang.org/x dependencies
  • 8400f4a ssh: respect signer's algorithm preference in pickSignatureAlgorithm
  • 81c6cb3 ssh: swap cbcMinPaddingSize to cbcMinPacketSize to get encLength
  • 982eaa6 go.mod: update golang.org/x dependencies
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Mar 20, 2026
@dependabot
dependabot Bot requested review from Copilot and removed request for Copilot March 20, 2026 21:08
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Mar 20, 2026
@dependabot
Bump the gomod group across 1 directory with 3 updates
cb0cc51 
Bumps the gomod group with 2 updates in the / directory: [github.com/coder/websocket](https://github.com/coder/websocket) and [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go).


Updates `github.com/coder/websocket` from 1.8.12 to 1.8.15
- [Release notes](https://github.com/coder/websocket/releases)
- [Commits](coder/websocket@v1.8.12...v1.8.15)

Updates `github.com/quic-go/quic-go` from 0.57.1 to 0.60.0
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.57.1...v0.60.0)

Updates `golang.org/x/crypto` from 0.46.0 to 0.51.0
- [Commits](golang/crypto@v0.46.0...v0.51.0)

---
updated-dependencies:
- dependency-name: github.com/coder/websocket
  dependency-version: 1.8.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: golang.org/x/crypto
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the gomod group with 3 updates Bump the gomod group across 1 directory with 3 updates Jun 18, 2026
Copilot AI review requested due to automatic review settings June 18, 2026 02:32
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/gomod-b48af5579c branch from 12b9adc to cb0cc51 Compare June 18, 2026 02:32
Copilot AI reviewed Jun 18, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant