build(deps): bump the go group across 1 directory with 4 updates by dependabot[bot] · Pull Request #730 · pomerium/cli

dependabot · 2026-08-18T17:20:28Z

Bumps the go group with 4 updates in the / directory: github.com/dunglas/httpsfv, github.com/elazarl/goproxy, github.com/getsentry/sentry-go and github.com/stretchr/testify.

Updates github.com/dunglas/httpsfv from 1.1.0 to 1.1.1

Release notes

Sourced from github.com/dunglas/httpsfv's releases.

Version 1.1.1

This release fixes two panics reachable when parsing malformed structured fields (denial of service). See the security advisory: GHSA-jj78-73gf-wr5j. Upgrading is strongly recommended for all users of v1.1.0.

What's Changed

fix: panics when parsing malformed display strings and dates by @dunglas (reported by @marten-seemann in GHSA-jj78-73gf-wr5j)

fix: decimal formatting issues by @leelynne in dunglas/httpsfv#14

New Contributors

@leelynne made their first contribution in dunglas/httpsfv#14

Full Changelog: dunglas/httpsfv@v1.1.0...v1.1.1

Commits

f2c11c2 fix: panics when parsing malformed display strings and dates
888fe5c fix: decimal formatting issues (#14)
See full diff in compare view

Updates github.com/elazarl/goproxy from 1.8.4 to 1.9.0

Release notes

Sourced from github.com/elazarl/goproxy's releases.

v1.9.0: HTTP/2 MITM Full Support

What's Changed

HTTP/2 MITM Full Support by @ErikPelli in elazarl/goproxy#785

Use Go standard library to check port by @ErikPelli in elazarl/goproxy#795

Full Changelog: elazarl/goproxy@v1.8.6...v1.9.0

Highlights & Acknowledgements

HTTP/2 MITM Support: This release introduces native support for inspecting and manipulating HTTP/2 traffic within GoProxy's MITM functionality. A special thanks to the team at @LumiaSecurity (including @omriza for the review) for supporting the development of these HTTP/2 MITM features and contributing to this major enhancement. Achieving full HTTP/2 MITM capability represents a huge milestone for GoProxy, taking our library to the next level for whoever needs it. To enable it, make sure that AllowHTTP2 is set to true in the proxy configuration.

⚠️ Possible Breaking Change

Previously there was an incomplete implementation of HTTP/2 inside the h2.go file, with an exported H2Transport struct. Probably no one was using it, but if you were, be careful that in this release it has been removed to create the full HTTP/2 MITM implementation.

v1.8.6

What's Changed

Fix unexpected scheme edge case in MITM by @ErikPelli in elazarl/goproxy#793

Stream MITM response bodies by @krissetto in elazarl/goproxy#794

New Contributors

@krissetto made their first contribution in elazarl/goproxy#794

Full Changelog: elazarl/goproxy@v1.8.5...v1.8.6

v1.8.5

What's Changed

fix(https): coalesce the MITM response head into a single write by @shaharfreiman in elazarl/goproxy#787

Remove redundant certificate Leaf set starting from Go 1.23 by @ErikPelli in elazarl/goproxy#789

Fix headers overwrite when there are no trailers by @ErikPelli in elazarl/goproxy#791

New Contributors

@shaharfreiman made their first contribution in elazarl/goproxy#787

Full Changelog: elazarl/goproxy@v1.8.4...v1.8.5

Commits

6225cd3 Use Go standard library to check port (#795)
5e44068 HTTP/2 MITM Full Support (#785)
a4bf432 Stream MITM response bodies (#794)
3f0ac0b Fix unexpected scheme edge case in MITM (#793)
d435b12 Fix headers overwrite when there are no trailers (#791)
5497631 Remove redundant certificate Leaf set starting from Go 1.23 (#789)
5ba11e8 fix(https): coalesce the MITM response head into a single write (#787)
See full diff in compare view

Updates github.com/getsentry/sentry-go from 0.47.0 to 0.48.0

Release notes

Sourced from github.com/getsentry/sentry-go's releases.

0.48.0

Breaking Changes 🛠

Remove issue creation from logging integrations by @giortzisg in #1340

New Features ✨
Add ClientOptions.DataCollection for granular control over data collected by automatic instrumentation, replacing the broad SendDefaultPII switch. DataCollection can independently configure automatic user.* population, cookies, request/response headers, HTTP bodies, and query parameters. When configured, it is the source of truth and SendDefaultPII is ignored. by @giortzisg in #1339

For backwards compatibility, clients that do not configure DataCollection keep a best-effort mapping of the previous SendDefaultPII behavior. To opt in to the new defaults, pass an empty DataCollection and then restrict individual categories as needed.
sentry.Init(sentry.ClientOptions{
    Dsn: "https://public@example.com/1",
// Opt in to the new data collection defaults. Omitted fields use their
// defaults: user info, cookies, headers, query params, and supported HTTP
// bodies are collected, with sensitive values filtered.
DataCollection: &amp;sentry.DataCollection{},

})
To opt in while disabling automatic user info and HTTP bodies, configure those fields explicitly:
sentry.Init(sentry.ClientOptions{
    Dsn: "https://public@example.com/1",
    DataCollection: &sentry.DataCollection{
        UserInfo:   sentry.Set(false),
        HTTPBodies: []sentry.BodyType{},
    },
})
PushScope shorthand now returns the new scope reference by @DoctorJohn in #1335
Bug Fixes 🐛

Fix fiber route name when using middlewares by @giortzisg in #1363

Omit empty event id for standalone client reports by @giortzisg in #1362

Preserve '%' literal in log messages by @giortzisg in #1358

Unaligned 64-bit atomic panic on 32-bit platforms in telemetry buffers by @Kirill-INQ in #1355

Isolate event processor across clones by @giortzisg in #1337

Internal Changes 🔧

Deps

Bump fiber/v2 to 2.52.14 by @giortzisg in #1359

Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot in #1349

Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot in #1346

Bump codecov/codecov-action from 6.0.0 to 7.0.0 by @dependabot in #1347

Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot in #1343

Bump golang.org/x/crypto to 0.52.0 and golang/x/net to 0.55.0 by @giortzisg in #1341

Bump getsentry/github-workflows/validate-pr from c802283cd9075b7a2b7a32655019c21c21676e34 to 4013fc6e1aeb1be1f9d3b4d232624f0ec1afa613 by @dependabot in #1344

... (truncated)

Changelog

Sourced from github.com/getsentry/sentry-go's changelog.

0.48.0

Breaking Changes 🛠

Remove issue creation from logging integrations by @giortzisg in #1340

New Features ✨
Add ClientOptions.DataCollection for granular control over data collected by automatic instrumentation, replacing the broad SendDefaultPII switch. DataCollection can independently configure automatic user.* population, cookies, request/response headers, HTTP bodies, and query parameters. When configured, it is the source of truth and SendDefaultPII is ignored. by @giortzisg in #1339

For backwards compatibility, clients that do not configure DataCollection keep a best-effort mapping of the previous SendDefaultPII behavior. To opt in to the new defaults, pass an empty DataCollection and then restrict individual categories as needed.
sentry.Init(sentry.ClientOptions{
    Dsn: "https://public@example.com/1",
// Opt in to the new data collection defaults. Omitted fields use their
// defaults: user info, cookies, headers, query params, and supported HTTP
// bodies are collected, with sensitive values filtered.
DataCollection: &amp;sentry.DataCollection{},

})
To opt in while disabling automatic user info and HTTP bodies, configure those fields explicitly:
sentry.Init(sentry.ClientOptions{
    Dsn: "https://public@example.com/1",
    DataCollection: &sentry.DataCollection{
        UserInfo:   sentry.Set(false),
        HTTPBodies: []sentry.BodyType{},
    },
})
PushScope shorthand now returns the new scope reference by @DoctorJohn in #1335
Bug Fixes 🐛

Fix fiber route name when using middlewares by @giortzisg in #1363

Omit empty event id for standalone client reports by @giortzisg in #1362

Preserve '%' literal in log messages by @giortzisg in #1358

Unaligned 64-bit atomic panic on 32-bit platforms in telemetry buffers by @Kirill-INQ in #1355

Isolate event processor across clones by @giortzisg in #1337

Internal Changes 🔧

Deps

Bump fiber/v2 to 2.52.14 by @giortzisg in #1359

Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot in #1349

Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot in #1346

Bump codecov/codecov-action from 6.0.0 to 7.0.0 by @dependabot in #1347

Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot in #1343

Bump golang.org/x/crypto to 0.52.0 and golang/x/net to 0.55.0 by @giortzisg in #1341

... (truncated)

Commits

d02f9ba release: 0.48.0
99c424f feat!: remove issue creation from logging integrations (#1340)
d1c1d3f feat: parse request body for outgoing http (#1339)
9b5cab2 fix: fix fiber route name when using middlewares (#1363)
07a7975 fix: omit empty event id for standalone client reports (#1362)
c255382 build(deps): bump fiber/v2 to 2.52.14 (#1359)
06c58dc ci: remove changelog-preview and codecov actions (#1357)
a99e044 fix: preserve '%' literal in log messages (#1358)
8aaf1d4 feat: apply sensitive data filters to grpc & sql (#1333)
4347773 feat: apply sensitive data filters to http (#1332)
Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.0

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.0

What's Changed

Functional Changes

assert: make *AssertionFunc types just aliases by @dolmen in stretchr/testify#1563

Fixes

mock: avoid panic when expected type is nil in Arguments.Diff by @mutaiib in stretchr/testify#1775

mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @brackendawson in stretchr/testify#1786

suite: validate method signatures and continue execution for valid tests by @vyas-git in stretchr/testify#1665

assert.PanicsWithError: report error message by @olivergondza in stretchr/testify#1400

assert: IsIncreasing et al can return false w/out failing by @brackendawson in stretchr/testify#1787

add type to error message of assert.Same by @egawata in stretchr/testify#1792

mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @brackendawson in stretchr/testify#1795

assert: truncate very long objects in test failure messages by @brackendawson in stretchr/testify#1646

assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @nghiack7 in stretchr/testify#1888

suite: prevent panic when SetupTest skips with HandleStats by @blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

CI: test also with Go 1.23 by @dolmen in stretchr/testify#1783

Vendor unmaintained github.com/pmezard/go-difflib by @brackendawson in stretchr/testify#1708

Promote ccoVeille to maintainer by @brackendawson in stretchr/testify#1784

build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in stretchr/testify#1790

assert.YAMLEq: Document mutlidoc behavior by @brackendawson in stretchr/testify#1791

_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @dolmen in stretchr/testify#1782

doc: remove ineffective inline code blocks by @brackendawson in stretchr/testify#1714

Tag generated assertions as non-generated in new .gitattributes by @ubunatic in stretchr/testify#1815

chore: vendor go-spew from https://github.com/davecgh/go-spew by @ccoVeille in stretchr/testify#1827

require: fix godoc generation for assertions returning a bool by @Baxromumarov in stretchr/testify#1850

docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by @a2not in stretchr/testify#1821

docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by @a2not in stretchr/testify#1842

EMERITUS.md: add @tylerb by @dolmen in stretchr/testify#1812

CI: test also with Go 1.24 by @alexandear in stretchr/testify#1856

deps: bump objx to v0.5.3 and remove dependency cycle issue by @ccoVeille in stretchr/testify#1823

CI: upgrade GitHub Actions and pin hashes by @SuperQ in stretchr/testify#1883

CI: add _readme-gofmt tool to reformat Go code in README by @dolmen in stretchr/testify#1889

CI: add check of GitHub Action pinned hashes against tag by @dolmen in stretchr/testify#1885

_codegen: modernize by @dolmen in stretchr/testify#1890

build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in stretchr/testify#1906

mock: Mock.Return does not exist anymore by @Kentzo in stretchr/testify#1905

New Contributors

@mutaiib made their first contribution in stretchr/testify#1775

@vyas-git made their first contribution in stretchr/testify#1665

@olivergondza made their first contribution in stretchr/testify#1400

@egawata made their first contribution in stretchr/testify#1792

@ubunatic made their first contribution in stretchr/testify#1815

@Baxromumarov made their first contribution in stretchr/testify#1850

@a2not made their first contribution in stretchr/testify#1821

... (truncated)

Commits

001eb79 Merge pull request #1905 from Kentzo/patch-1
ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
f8c01f3 mock: Mock.Return does not exist anymore
12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
a11649e assert: make *AssertionFunc type just aliases
dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
098f8d7 _codegen: use strings.Builder
d2699be _codegen: modernize
a463c8c Merge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashes
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go group with 4 updates in the / directory: [github.com/dunglas/httpsfv](https://github.com/dunglas/httpsfv), [github.com/elazarl/goproxy](https://github.com/elazarl/goproxy), [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go) and [github.com/stretchr/testify](https://github.com/stretchr/testify). Updates `github.com/dunglas/httpsfv` from 1.1.0 to 1.1.1 - [Release notes](https://github.com/dunglas/httpsfv/releases) - [Commits](dunglas/httpsfv@v1.1.0...v1.1.1) Updates `github.com/elazarl/goproxy` from 1.8.4 to 1.9.0 - [Release notes](https://github.com/elazarl/goproxy/releases) - [Commits](elazarl/goproxy@v1.8.4...v1.9.0) Updates `github.com/getsentry/sentry-go` from 0.47.0 to 0.48.0 - [Release notes](https://github.com/getsentry/sentry-go/releases) - [Changelog](https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md) - [Commits](getsentry/sentry-go@v0.47.0...v0.48.0) Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.0 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.0) --- updated-dependencies: - dependency-name: github.com/dunglas/httpsfv dependency-version: 1.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/elazarl/goproxy dependency-version: 1.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/getsentry/sentry-go dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/stretchr/testify dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 18, 2026

dependabot Bot requested a review from a team as a code owner August 18, 2026 17:20

dependabot Bot requested a review from kralicky August 18, 2026 17:20

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Aug 18, 2026

calebdoxsey approved these changes Aug 18, 2026

View reviewed changes

calebdoxsey merged commit b53b7d3 into main Aug 18, 2026
9 checks passed

calebdoxsey deleted the dependabot/go_modules/go-34f9f8989d branch August 18, 2026 21:55

Navigation Menu

Uh oh!

build(deps): bump the go group across 1 directory with 4 updates - #730

build(deps): bump the go group across 1 directory with 4 updates#730
calebdoxsey merged 1 commit into
mainfrom
dependabot/go_modules/go-34f9f8989d

dependabot Bot commented on behalf of github Aug 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 18, 2026

Version 1.1.1

What's Changed

New Contributors

v1.9.0: HTTP/2 MITM Full Support

What's Changed

Highlights & Acknowledgements

⚠️ Possible Breaking Change

v1.8.6

What's Changed

New Contributors

v1.8.5

What's Changed

New Contributors

0.48.0

Breaking Changes 🛠

New Features ✨

Bug Fixes 🐛

Internal Changes 🔧

Deps

0.48.0

Breaking Changes 🛠

New Features ✨

Bug Fixes 🐛

Internal Changes 🔧

Deps

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

New Contributors

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant