chore(deps): update go dependencies by red-hat-konflux[bot] · Pull Request #617 · securesign/trillian

red-hat-konflux · 2026-04-21T19:35:51Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
cel.dev/expr	indirect	patch	`v0.25.1` → `v0.25.2`
cloud.google.com/go/auth	indirect	minor	`v0.20.0` → `v0.21.0`	`v0.22.0`
cloud.google.com/go/iam	indirect	minor	`v1.9.0` → `v1.11.0`	`v1.12.0`
cloud.google.com/go/longrunning	indirect	major	`v0.11.0` → `v1.2.0`
cloud.google.com/go/monitoring	indirect	minor	`v1.27.0` → `v1.29.0`	`v1.30.0`
cloud.google.com/go/spanner	require	minor	`v1.90.0` → `v1.92.0`
cloud.google.com/go/storage	indirect	minor	`v1.62.0` → `v1.63.0`	`v1.63.1`
cloud.google.com/go/trace	indirect	minor	`v1.14.0` → `v1.16.0`
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp	indirect	minor	`v1.31.0` → `v1.34.0`
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric	indirect	minor	`v0.56.0` → `v0.58.0`
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping	indirect	minor	`v0.56.0` → `v0.58.0`
github.com/apache/beam/sdks/v2	require	minor	`v2.61.0` → `v2.75.0`
github.com/avast/retry-go/v4	indirect	major	`v4.6.0` → `v5.0.0`
github.com/aws/aws-sdk-go	indirect	patch	`v1.55.7` → `v1.55.8`
github.com/cenkalti/backoff/v5	indirect	major	`v5.0.3` → `v7.0.0`
github.com/cheggaaa/pb/v3	indirect	patch	`v3.1.6` → `v3.1.7`	`v3.2.0`
github.com/coreos/go-systemd/v22	indirect	minor	`v22.6.0` → `v22.7.0`
github.com/emicklei/go-restful/v3	indirect	minor	`v3.12.2` → `v3.13.0`
github.com/envoyproxy/go-control-plane/envoy	indirect	minor	`v1.36.0` → `v1.37.0`
github.com/fatih/color	indirect	minor	`v1.18.0` → `v1.19.0`
github.com/felixge/httpsnoop	indirect	minor	`v1.0.4` → `v1.1.0`
github.com/fxamacker/cbor/v2	indirect	patch	`v2.9.0` → `v2.9.2`
github.com/go-openapi/jsonpointer	indirect	major	`v0.23.1` → `v1.0.0`
github.com/go-openapi/jsonreference	indirect	major	`v0.21.5` → `v1.0.0`
github.com/go-openapi/swag	indirect	minor	`v0.26.0` → `v0.27.0`
github.com/go-openapi/swag/cmdutils	indirect	minor	`v0.26.0` → `v0.27.0`
github.com/go-openapi/swag/conv	indirect	minor	`v0.26.0` → `v0.27.0`
github.com/go-openapi/swag/fileutils	indirect	minor	`v0.26.0` → `v0.27.0`
github.com/go-openapi/swag/jsonname	indirect	minor	`v0.26.0` → `v0.27.0`
github.com/go-openapi/swag/jsonutils	indirect	minor	`v0.26.0` → `v0.27.0`
github.com/go-openapi/swag/loading	indirect	minor	`v0.26.0` → `v0.27.0`
github.com/go-openapi/swag/mangling	indirect	minor	`v0.26.0` → `v0.27.0`
github.com/go-openapi/swag/netutils	indirect	minor	`v0.26.0` → `v0.27.0`
github.com/go-openapi/swag/stringutils	indirect	minor	`v0.26.0` → `v0.27.0`
github.com/go-openapi/swag/typeutils	indirect	minor	`v0.26.0` → `v0.27.0`
github.com/go-openapi/swag/yamlutils	indirect	minor	`v0.26.0` → `v0.27.0`
github.com/go-sql-driver/mysql	require	minor	`v1.9.3` → `v1.10.0`
github.com/goccy/go-json	indirect	patch	`v0.10.5` → `v0.10.6`
github.com/google/go-licenses/v2	require	patch	`v2.0.0-alpha.1` → `v2.0.1`
github.com/google/pprof	indirect	digest	`545e8a4` → `b9395ee`
github.com/googleapis/enterprise-certificate-proxy	indirect	patch	`v0.3.15` → `v0.3.18`
github.com/googleapis/gax-go/v2	indirect	minor	`v2.21.0` → `v2.23.0`
github.com/grpc-ecosystem/go-grpc-middleware	require	major	`v1.4.0` → `v2.3.3`
github.com/grpc-ecosystem/grpc-gateway/v2	indirect	minor	`v2.28.0` → `v2.29.0`
github.com/imdario/mergo	indirect	major	`v0.3.16` → `v1.0.2`
github.com/jackc/pgx/v5	require	minor	`v5.9.1` → `v5.10.0`
github.com/jhump/protoreflect/v2	indirect	patch	`v2.0.0-beta.1` → `v2.0.0-beta.2`
github.com/letsencrypt/pkcs11key/v4	require	patch	`v4.0.0` → `v4.0.1`
github.com/mattn/go-colorable	indirect	patch	`v0.1.14` → `v0.1.15`
github.com/mattn/go-isatty	indirect	patch	`v0.0.21` → `v0.0.22`
github.com/mattn/go-runewidth	indirect	patch	`v0.0.23` → `v0.0.24`
github.com/onsi/ginkgo	indirect	major	`v1.16.5` → `v2.32.0`
github.com/planetscale/vtprotobuf	indirect	digest	`ba97887` → `8ae5a48`
github.com/prometheus/common	indirect	minor	`v0.67.5` → `v0.70.0`
github.com/prometheus/procfs	indirect	minor	`v0.20.1` → `v0.21.1`
github.com/prometheus/prometheus	indirect	minor	`v0.305.3` → `v0.313.1`
github.com/spiffe/go-spiffe/v2	indirect	minor	`v2.6.0` → `v2.8.1`
go.etcd.io/bbolt	indirect	minor	`v1.4.3` → `v1.5.0`
go.etcd.io/etcd/api/v3	indirect	minor	`v3.6.9` → `v3.7.0`
go.etcd.io/etcd/client/pkg/v3	indirect	minor	`v3.6.9` → `v3.7.0`
go.etcd.io/etcd/client/v3	require	minor	`v3.6.9` → `v3.7.0`
go.etcd.io/etcd/etcdctl/v3	require	minor	`v3.6.9` → `v3.7.0`
go.etcd.io/etcd/etcdutl/v3	indirect	minor	`v3.6.9` → `v3.7.0`
go.etcd.io/etcd/pkg/v3	indirect	minor	`v3.6.9` → `v3.7.0`
go.etcd.io/etcd/server/v3	require	minor	`v3.6.9` → `v3.7.0`
go.etcd.io/etcd/tests/v3	indirect	minor	`v3.6.9` → `v3.7.0`
go.etcd.io/etcd/v3	require	minor	`v3.6.9` → `v3.7.0`
go.etcd.io/raft/v3	indirect	minor	`v3.6.0` → `v3.7.0`
go.opentelemetry.io/contrib/detectors/gcp	indirect	minor	`v1.39.0` → `v1.44.0`
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	indirect	minor	`v0.68.0` → `v0.69.0`
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	indirect	minor	`v0.68.0` → `v0.69.0`
go.opentelemetry.io/otel	indirect	minor	`v1.43.0` → `v1.44.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace	indirect	minor	`v1.40.0` → `v1.44.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	indirect	minor	`v1.40.0` → `v1.44.0`
go.opentelemetry.io/otel/metric	indirect	minor	`v1.43.0` → `v1.44.0`
go.opentelemetry.io/otel/sdk	indirect	minor	`v1.43.0` → `v1.44.0`
go.opentelemetry.io/otel/sdk/metric	indirect	minor	`v1.43.0` → `v1.44.0`
go.opentelemetry.io/otel/trace	indirect	minor	`v1.43.0` → `v1.44.0`
go.uber.org/zap	indirect	minor	`v1.27.1` → `v1.28.0`
go.yaml.in/yaml/v2	indirect	major	`v2.4.3` → `v3.0.4`
golang.org/x/crypto	require	minor	`v0.50.0` → `v0.54.0`
golang.org/x/exp	indirect	digest	`746e56f` → `9ea1abe`
golang.org/x/mod	indirect	minor	`v0.35.0` → `v0.38.0`
golang.org/x/net	indirect	minor	`v0.53.0` → `v0.57.0`
golang.org/x/sync	require	minor	`v0.20.0` → `v0.22.0`
golang.org/x/sys	require	minor	`v0.43.0` → `v0.47.0`
golang.org/x/term	indirect	minor	`v0.42.0` → `v0.45.0`
golang.org/x/text	indirect	minor	`v0.36.0` → `v0.40.0`
golang.org/x/tools	require	minor	`v0.44.0` → `v0.48.0`
google.golang.org/api	require	minor	`v0.276.0` → `v0.288.0`
google.golang.org/grpc	require	minor	`v1.80.0` → `v1.82.0`
google.golang.org/grpc/cmd/protoc-gen-go-grpc	require	patch	`v1.6.1` → `v1.6.2`
gopkg.in/evanphx/json-patch.v4	indirect	major	`v4.13.0` → `v5.9.11`
gopkg.in/yaml.v2	require	major	`v2.4.0` → `v3.0.1`
k8s.io/api	require	minor	`v0.35.4` → `v0.36.2`
k8s.io/apimachinery	require	minor	`v0.35.4` → `v0.36.2`
k8s.io/client-go	require	minor	`v0.35.4` → `v0.36.2`
k8s.io/klog/v2	require	minor	`v2.130.1` → `v2.140.0`
k8s.io/kube-openapi	indirect	digest	`ec9c827` → `cdb1db5`
k8s.io/utils	require	digest	`28399d8` → `cf1189d`
sigs.k8s.io/structured-merge-diff/v6	indirect	minor	`v6.3.0` → `v6.4.2`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

google/cel-spec (cel.dev/expr)

`v0.25.2`

Compare Source

What's Changed

Add conformance tests for (string).reverse() by @jnthntatum in #491
Updates to the conformance tests for integer values in %e and %f format directives by @TristonianJones in #495
Add automated BCR publishing on release tags by @mmorel-35 in #498
Add clarification on scoping rules. by @jnthntatum in #506
Networking extension conformance tests by @TristonianJones in #507
Add conformance test cases for null assignability around repeated fields and maps by @l46kok in #510

New Contributors

@mmorel-35 made their first contribution in #498

Full Changelog: cel-expr/cel-spec@v0.25.1...v0.25.2

googleapis/google-cloud-go (cloud.google.com/go/auth)

`v0.21.0`

Compare Source

bigquery:
- Add OpenCensus tracing.
firestore:
- BREAKING CHANGE: If a document does not exist, return a DocumentSnapshot
  whose Exists method returns false. DocumentRef.Get and Transaction.Get
  return the non-nil DocumentSnapshot in addition to a NotFound error.
  DocumentRef.GetAll and Transaction.GetAll return a non-nil
  DocumentSnapshot instead of nil.
- Add DocumentIterator.Stop. Call Stop whenever you are done with a
  DocumentIterator.
- Added Query.Snapshots and DocumentRef.Snapshots, which provide realtime
  notification of updates. See https://cloud.google.com/firestore/docs/query-data/listen.
- Canceling an RPC now always returns a grpc.Status with codes.Canceled.
spanner:
- Add CommitTimestamp, which supports inserting the commit timestamp of a
  transaction into a column.

GoogleCloudPlatform/opentelemetry-operations-go (github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric)

`v0.58.0`

Compare Source

`v0.57.0`: v1.33.0/v0.57.0

Compare Source

What's Changed

Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to v1.43.0 [SECURITY] by @renovate-bot in #1146
Update module go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to v1.43.0 [SECURITY] by @renovate-bot in #1145
Update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [SECURITY] by @renovate-bot in #1144
[chore] retry_on_failure is removed from our exporter by @braydonk in #1151
downgrade davecgh/go-spew, pmezard/go-difflib to tagged releases by @thaJeztah in #1152
Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY] by @renovate-bot in #1149
Update e2e-testing image to fix presubmits by @dashpole in #1155
Update go.opentelemetry.io/collector by @renovate-bot in #1073
Auto comment /gcbrun for dependency updates by @dashpole in #1154
Revert "Auto comment /gcbrun for dependency updates" by @dashpole in #1157
Update module github.com/prometheus/common to v0.67.5 by @renovate-bot in #1156
Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.4.0 in /tools by @dependabot[bot] in #1118
Update golang.org/x by @renovate-bot in #1008
Combine dependency bumps by @dashpole in #1158
Update All Dependencies by @renovate-bot in #1161
Update all major dependencies by @dashpole in #1164
Update All Dependencies by @renovate-bot in #1163
Add AGENTS.md by @dashpole in #1165
Fix CodeQL permissions to allow uploading results by @dashpole in #1166
collector: bump golang.org/x/net to v0.55.0 to fix GO-2026-5026 by @dashpole in #1170
Migrate impersonate to use cloud.google.com/go/auth by @dashpole in #1169
fix: Support OTLP event_name field in logs exporter by @putcho01 in #1088
exporter/collector/logs: accept string-typed line in sourceLocation by @alliasgher in #1142
exporter/collector/logs: use parsed httpRequest.protocol instead of hardcoded HTTP/1.1 by @alliasgher in #1143
exporter/trace: sanitize invalid UTF-8 in span fields by @alliasgher in #1141
chore: update E2E tests to use centralized async cleanup 0.22.0 by @aabmass in #1171
Add support for cloud run worker pools by @dashpole in #1112
Prerelease 1.33.0/v0.57.0 by @avilevy18 in #1173

New Contributors

@thaJeztah made their first contribution in #1152
@putcho01 made their first contribution in #1088
@alliasgher made their first contribution in #1142

Full Changelog: GoogleCloudPlatform/opentelemetry-operations-go@v0.56.0...v0.57.0

apache/beam (github.com/apache/beam/sdks/v2)

`v2.75.0`: Beam 2.75.0 release

Compare Source

We are happy to present the new 2.75.0 release of Beam.
This release includes both improvements and new functionality.
See the download page for this release.

For more information on changes in 2.75.0, check out the detailed release notes.

Highlights

Python SDK now supports memory profiling with Memray (#38853).
(Python) Added Qdrant VectorDatabaseWriteConfig implementation (#38141).

I/Os

Support for reading from Delta Lake added (Java) (#38551).
ClickHouseIO: support writing DateTime64(precision[, 'timezone']) columns with sub-second precision (Java) (#38466).
Upgraded IO Expansion Service to Java 17 (#38974).

New Features / Improvements

Dataflow Runner v2 has been renamed to Dataflow Portable Runner. Please refer to Dataflow public documentation on when to enable Portable Runner.(#39000).
(Java) Enabled state tag encoding v2 by default for new Dataflow Streaming Engine jobs. It can be disabled by passing --experiments=disable_streaming_engine_state_tag_encoding_v2 or --updateCompatibilityVersion=2.74.0 pipeline option. Note that the tag encoding version cannot change during a job update. Jobs using tag encoding v2 (enabled by default for new jobs on 2.75.0+) cannot be downgraded to Beam versions prior to 2.73.0, as only versions 2.73.0 and later support tag encoding v2. (#38705).
(Python) Added instrumentation to support off-the-shelf profiling agents when launching Python SDK Harness (#38853).
(Java) Added support to the FnApi Data stream protocol allowing runners to isolate bundles slowly processing input from other bundles. (#39001).
(YAML) Switched js2py library to Quickjs (#38473).
(YAML) Added HuggingFaceModelHandler for YAML usage (#38696).
(YAML) Added WriteToMongoDB transform (#38376).
(YAML) Added WriteToDatadog transform (#38362).
(Java) Flink 2.1 and 2.2 support is added (#38947) (#38978); Flink 1.17 and 1.18 support is dropped.
(Python) MqttIO is now supported in Python via cross-language (#21060).

Breaking Changes

(Python) Typehints of dataclass fields are honored during type inferences. To restore the behavior of fallback-to-any,
use pipeline option --exclude_infer_dataclass_field_type (#38797).
However fixing forward is recommended.

Bugfixes

Fixed GCS filesystem glob matching to correctly handle / in object names and support ** for recursive matching (Go) (#38059).
Fixed BigQueryEnrichmentHandler batch mode dropping earlier requests when multiple requests share the same enrichment key (Python) (#38035).
Fixed IcebergIO writing manifest column bounds padded with trailing 0x00 bytes, which broke equality predicate pushdown in some query engines (Java) (#38580).

Known Issues

(Java) Projects using the Flink runner with Flink 2.1 or later alongside libraries requiring org.lz4:lz4-java (e.g., Kafka clients) may encounter a Gradle capability conflict, because Flink 2.1+ ships at.yawk.lz4:lz4-java which declares the same capability. To resolve, add a capabilitiesResolution rule to your build.gradle that selects at.yawk.lz4:lz4-java (#38947).

According to git shortlog, the following people contributed to the 2.75.0 release. Thank you to all contributors!

Abdelrahman Ibrahim, Ahmed Abualsaud, Akshat, Andrew Crites, Andrew Kabas, Anurag Pappula, Arpit Jain, Arun Pandian, Atharv, Chamikara Jayalath, Danny McCormick, Deji Ibrahim, Derrick Williams, Drew Stevens, Durgaprasad M L, Elia Liu, Enzo Maruffa Moreira, Ganesh Sivakumar, Goutam Adwant, HansMarcus01, Jack McCluskey, Joe Santos, Kenneth Knowles, Lalit Yadav, Liam Miller-Cushon, Maciej Szwaja, Manan Mangal, Michael Gruschke, Nikita Grover, Radek Stankiewicz, Radosław Stankiewicz, Reuven Lax, RuiLong J., Sachin Ranjalkar, Sagnik Ghosh, Sam Whittle, Shunping Huang, Subramanya V, Tarun Annapareddy, Tobias Kaymak, TongruiLi, Valentyn Tymofieiev, Vitaly Terentyev, XQ Hu, Yi Hu, aaaZayne, claudevdm, ddebowczyk92, innuendo, kellen, parveensania, tejasiyer-dev

`v2.74.0`: Beam 2.74.0 release

Compare Source

We are happy to present the new 2.74.0 release of Beam.
This release includes both improvements and new functionality.
See the download page for this release.

For more information on changes in 2.74.0, check out the detailed release notes.

Highlights

Spark 4 runner support for Java SDK (#38255).

I/Os

IcebergIO: support declaring a table's sort order on dynamic table creation via the new sort_fields config (#38269).
IcebergIO: support writing with hash distribution mode, and with autosharding (#38061).

New Features / Improvements

Capability introduces an indicator for aggregations and timers firing during a pipeline drain, allowing users and sinks to recognize and appropriately handle potentially incomplete or partial data (#36884).
Added support for setting disk provisioned IOPS and throughput in Dataflow runner via --diskProvisionedIops and --diskProvisionedThroughputMibps pipeline options (Java/Go/Python) (#38349).
TriggerStateMachineRunner changes from BitSetCoder to SentinelBitSetCoder to
encode finished bitset. SentinelBitSetCoder and BitSetCoder are state
compatible. Both coders can decode encoded bytes from the other coder
(#38139).
(Python) Added type alias for with_exception_handling to be used for typehints. (#38173).
(Java) BatchElements transform for Java SDK (#38369)
Added plugin mechanism to support different Lineage implementations (Java) (#36790).
(Python) Supported Python user type in Beam SQL. For example, SQL statements like SELECT some_field from PCOLLECTION can now operate a PCollection of Beam Row containing pickable Python user type (#20738).
(Python) Introduced beam.coders.registry.register_row as preferred API to register a named tuple or dataclass with a Beam Row. At pipelne runtime, the original type associated with the registered row are preserved across the serialization boundary (#38108).

Breaking Changes

(Python) Made Beartype the default fallback type checking tool. This can be disabled with the --disable_beartype pipeline option. (#38275)

Deprecations

Dropped Java 8 support (#31678).
Removed Samza Runner support (#35448).

Bugfixes

Fixed BigQueryEnrichmentHandler batch mode dropping earlier requests when multiple requests share the same enrichment key (Python) (#38035).
Added max_batch_duration_secs passthrough support in Python Enrichment BigQuery and CloudSQL handlers so batching duration can be forwarded to BatchElements (#38243).

According to git shortlog, the following people contributed to the 2.74.0 release. Thank you to all contributors!

Abdelrahman Ibrahim, Ahmed Abualsaud, Andrew Crites, Andrew Kabas, Arran Cudbard-Bell, Arun Pandian, Asish Kumar, Bentsi Leviav, Blake Jones, Bruno Volpato, Chris Jordan, Danny McCormick, Deji Ibrahim, Derrick Williams, Elia LIU, Ganesh Sivakumar, Jack McCluskey, Kenneth Knowles, Lalit Yadav, M Junaid Shaukat, Matej Aleksandrov, Prabhnoor Singh, Radek Stankiewicz, Radosław Stankiewicz, Reuven Lax, RuiLong J., Sam Whittle, Shunping Huang, Subramanya V, Tarun Annapareddy, Tobias Kaymak, TongruiLi, Valentyn Tymofieiev, Vitaly Terentyev, XQ Hu, Yi Hu, ZIHAN DAI, apanich, bambadiouf1, chenxuesdu, claudevdm, harshadkhetpal, johnjcasey, parveensania, tianz101

`v2.73.0`: Beam 2.73.0 release

Compare Source

We are happy to present the new 2.73.0 release of Beam.
This release includes both improvements and new functionality.
See the download page for this release.

For more information on changes in 2.73.0, check out the detailed release notes.

Highlights

I/Os

DebeziumIO (Java): added OffsetRetainer interface and FileSystemOffsetRetainer implementation to persist and restore CDC offsets across pipeline restarts, and exposed withStartOffset / withOffsetRetainer on DebeziumIO.Read and the cross-language ReadBuilder (#28248).

New Features / Improvements

(Python) Added BigQuery CDC streaming source (#37724)
Added ADKAgentModelHandler for running Google Agent Development Kit (ADK) agents (Python) (#37917).
(Python) Added exception chaining to preserve error context in CloudSQLEnrichmentHandler, processes utilities, and core transforms (#37422).
(Python) Added a pipeline option --experiments=pip_no_build_isolation to disable build isolation when installing dependencies in the runtime environment (#37331).
(Go) Added OrderedListState support to the Go SDK stateful DoFn API (#37629).
Added support for large pipeline options via a file (Python) (#37370).
Supported infer schema from dataclass (Python) (#22085). Default coder for typehint-ed (or set with_output_type) for non-frozen dataclasses changed to RowCoder. To preserve the old behavior (fast primitive coder), explicitly register the type with FastPrimitiveCoder.
Updates minimum Go version to 1.26.1 (#37897).
(Python) Added image embedding support in apache_beam.ml.rag package (#37628).
(Python) Added support for Python version 3.14 (#37247).

Breaking Changes

The Python SDK container's boot.go now passes pipeline options through a file instead of the PIPELINE_OPTIONS environment variable. If a user pairs a new Python SDK container with an older SDK version (which does not support the file-based approach), the pipeline options will not be recognized and the pipeline will fail. Users must ensure their SDK and container versions are synchronized (#37370).
Python DoFn.with_exception_handling now respects user DoFn typehints. This can break update compatibility if coders change. It can also break pipeline compilation if existing typehints are incorrect. To update safely sepcify the pipeline option --update_compatibility_version=2.72.0. To fix typehints replace any incorrect typehints that were previously ignored (#37590)

Bugfixes

Fixed ProcessManager not reaping child processes, causing zombie process accumulation on long-running Flink deployments (Java) (#37930).

Security Fixes

Fixed CVE-2023-46604 (CVSS 10.0) and CVE-2022-41678 by upgrading ActiveMQ from 5.14.5 to 5.19.2 (Java) (#37943).
Fixed CVE-2024-1597, CVE-2022-31197, and CVE-2022-21724 by upgrading PostgreSQL JDBC Driver from 42.2.16 to 42.6.2 (Java) (#37942).

List of Contributors

According to git shortlog, the following people contributed to the 2.73.0 release. Thank you to all contributors!

Abdelrahman Ibrahim, Ahmed Abualsaud, Alex Malao, Alexander Nieuwenhuijse, Andres Tiko, Andrew Crites, Arun Pandian, Bentsi Leviav, Bruno Volpato, Chamikara Jayalath, Chandra Kiran Bolla, Danny McCormick, Deji Ibrahim, Derrick Williams, Elia LIU, Esmelealem, Hannes Gustafsson, Jack McCluskey, Joey Tran, Kenneth Knowles, M Junaid Shaukat, Mansi Singh, Matej Aleksandrov, Mathijs Deelen, Mattie Fu, Praneet Nadella, Radek Stankiewicz, Radosław Stankiewicz, Reuven Lax, RuiLong J., S. Veyrié, Sakthivel Subramanian, Sam Whittle, Shubham Thakur, Shunping Huang, Subramanya V, Tarun Annapareddy, Tobias Kaymak, Valentyn Tymofieiev, Vitaly Terentyev, XQ Hu, Yi Hu, ZIHAN DAI, claudevdm, kishorepola, parveensania

`v2.72.0`: Beam 2.72.0 release

Compare Source

We are happy to present the new 2.72.0 release of Beam.
This release includes both improvements and new functionality.
See the download page for this release.

For more information on changes in 2.72.0, check out the detailed release notes.

Highlights

Flink 2.0 support (#36947).

I/Os

Add Datadog IO support (Java) (#37318).
Remove Pubsublite IO support, since service will be deprecated in March 2026. (#37375).
(Java) ClickHouse - migrating from the legacy JDBC driver (v0.6.3) to ClickHouse Java Client v2 (v0.9.6). See the class documentation for migration guide (#37610).
(Java) Upgraded GoogleAdsIO to use GoogleAdsIO API v23 (#37620).

New Features / Improvements

(Python) Added exception chaining to preserve error context in CloudSQLEnrichmentHandler, processes utilities, and core transforms (#37422).
(Python) Added a pipeline option --experiments=pip_no_build_isolation to disable build isolation when installing dependencies in the runtime environment (#37331).

Deprecations

(Python) Removed previously deprecated list_prefix method for filesystem interfaces (#37587).

Bugfixes

Fixed (Yaml) issue with validate compatible method (#37588).
Fixed (Yaml) issue with Create transform dealing with different type elements (#37585).

Security Fixes

Fixed CVE-2024-28397 by switching from js2py to pythonmonkey (Yaml) (#37560).

List of Contributors

According to git shortlog, the following people contributed to the 2.72.0 release. Thank you to all contributors!

Abdelrahman Ibrahim, Ahmed Abualsaud, Andrew Crites, Arun Pandian, Ben Feinstein, Bentsi Leviav, Celeste Zeng, Danny McCormick, Danny Mccormick, Derrick Williams, Elia LIU, Ganesh, Jack McCluskey, Kenneth Knowles, Labesse Kévin, M Junaid Shaukat, Mansi Singh, Mattie Fu, Nayan Mathur, Pablo Estrada, Pirzada Ahmad Faraz, Radek Stankiewicz, Radosław Stankiewicz, Robert Bradshaw, Rohan Sah, RuiLong J., Sakthivel Subramanian, Sam Whittle, Shaheer Amjad, Shunping Huang, Steven van Rossum, Tarun Annapareddy, Tobias Kaymak, Valentyn Tymofieiev, Vitaly Terentyev, Yi Hu, XQ Hu, ZIHAN DAI, apanich, chenxuesdu, claudevdm, franzonia137

`v2.71.0`: Beam 2.71.0 release

Compare Source

We are happy to present the new 2.71.0 release of Beam.
This release includes both improvements and new functionality.

For more information on changes in 2.71.0, check out the detailed release notes.

I/Os

(Java) Elasticsearch 9 Support (#36491).
(Java) Upgraded HCatalogIO to Hive 4.0.1 (#32189).

New Features / Improvements

Support configuring Firestore database on ReadFn transforms (Java) (#36904).
(Python) Inference args are now allowed in most model handlers, except where they are explicitly/intentionally disallowed (#37093).

Bugfixes

Fixed FirestoreV1 Beam connectors allow configuring inconsistent project/database IDs between RPC requests and routing headers #36895 (Java) (#36895).
Logical type and coder registry are saved for pipelines in the case of default pickler. This fixes a side effect of switching to cloudpickle as default pickler in Beam 2.65.0 (Python) (#35738).

Known Issues

For the most up to date list of known issues, see https://github.com/apache/beam/blob/master/CHANGES.md

List of Contributors

According to git shortlog, the following people contributed to the 2.71.0 release. Thank you to all contributors!

Abacn, Ahmed Abualsaud, Amar3tto, Andrew Crites, apanich, Arun, Arun Pandian, assaf127, Chamikara Jayalath, CherisPatelInfocusp, Cheskel Twersky, Claire McGinty, Claude, Danny Mccormick, dependabot[bot], Derrick Williams, Egbert van der Wal, Evan Galpin, Ganesh, github-actions[bot], hekk-kaori-maeda, Jack Dingilian, Jack McCluskey, JayajP, Jiang Zhu, Kenneth Knowles, liferoad, M Junaid Shaukat, Nayan Mathur, Noah Stapp, Paco Avila, Radek Stankiewicz, Radosław Stankiewicz, Robert Stupp, Sam Whittle, Shunping Huang, Steven van Rossum, Suvrat Acharya, Tarun Annapareddy, tvalentyn, Utkarsh Parekh, Vitaly Terentyev, Xiaochu Liu, Yala Huang Feng, Yi Hu, Yu Watanabe, zhan7236

`v2.70.0`: Beam 2.70.0 release

Compare Source

We are happy to present the new 2.70.0 release of Beam.
This release includes both improvements and new functionality.
See the download page for this release.

For more information on changes in 2.70.0, check out the detailed release notes.

Highlights

Flink 1.20 support added (#32647).

New Features / Improvements

Python examples added for Milvus search enrichment handler on Beam Website
including jupyter notebook example (Python) (#36176).
Milvus sink I/O connector added (Python) (#36702).
Now Beam has full support for Milvus integration including Milvus enrichment and sink operations.

Breaking Changes

(Python) Some Python dependencies have been split out into extras. To ensure all previously installed dependencies are installed, when installing Beam you can pip install apache-beam[gcp,interactive,yaml,redis,hadoop,tfrecord], though most users will not need all of these extras (#34554).

Deprecations

(Python) Python 3.9 reached EOL in October 2025 and support for the language version has been removed. (#36665).

List of Contributors

According to git shortlog, the following people contributed to the 2.70.0 release. Thank you to all contributors!

Abdelrahman Ibrahim, Ahmed Abualsaud, Alex Chermenin, Andrew Crites, Arun Pandian, Celeste Zeng, Chamikara Jayalath, Chenzo, Claire McGinty, Danny McCormick, Derrick Williams, Dustin Rhodes, Enrique Calderon, Ian Liao, Jack McCluskey, Jessica Hsiao, Joey Tran, Karthik Talluri, Kenneth Knowles, Maciej Szwaja, Mehdi.D, Mohamed Awnallah, Praneet Nadella, Radek Stankiewicz, Radosław Stankiewicz, Reuven Lax, RuiLong J., S. Veyrié, Sam Whittle, Shunping Huang, Stephan Hoyer, Steven van Rossum, Tanu Sharma, Tarun Annapareddy, Tom Stepp, Valentyn Tymofieiev, Vitaly Terentyev, XQ Hu, Yi Hu, changliiu, claudevdm, fozzie15, kristynsmith, wolfchris-google

`v2.69.0`: Beam 2.69.0 release

Compare Source

We are happy to present the new 2.69.0 release of Beam.
This release includes both improvements and new functionality.
See the download page for this release.

For more information on changes in 2.69.0, check out the detailed release notes.

Highlights

(Python) Add YAML Editor and Visualization Panel (#35772).
(Java) Java 25 Support (#35772).

I/Os

Upgraded Iceberg dependency to 1.10.0 (#36123).

New Features / Improvements

Enhance JAXBCoder with XMLInputFactory support (Java) (#36446).
Python examples added for CloudSQL enrichment handler on Beam website (Python) (#35473).
Support for batch mode execution in WriteToPubSub transform added (Python) (#35990).
Added official support for Python 3.13 (#34869).
Added an optional output_schema verification to all YAML transforms (#35952).
Support for encryption when using GroupByKey added, along with --gbek pipeline option to automatically replace all GroupByKey transforms (Java/Python) (#36214).

Breaking Changes

(Python) dill is no longer a required, default dependency for Apache Beam (#21298).
- This change only affects pipelines that explicitly use the pickle_library=dill pipeline option.
- While dill==0.3.1.1 is still pre-installed on the official Beam SDK base images, it is no longer a direct dependency of the apache-beam Python package. This means it can be overridden by other dependencies in your environment.
- If your pipeline uses pickle_library=dill, you must manually ensure dill==0.3.1.1 is installed in both your submission and runtime environments.
  - Submission environment: Install the dill extra in your local environment pip install apache-beam[gcpdill].
  - Runtime (worker) environment: Your action depends on how you manage your worker's environment.
    - If using default containers or custom containers with the official Beam base image e.g. FROM apache/beam_python3.10_sdk:2.69.0
      - Add dill==0.3.1.1 to your worker's requirements file (e.g., requirements.txt)
      - Pass this file to your pipeline using the --requirements_file requirements.txt pipeline option (For more details see managing Dataflow dependencies).
    - If custom containers with a non-Beam base image e.g. FROM python:3.9-slim
      - Install apache-beam with the dill extra in your docker file e.g. RUN pip install --no-cache-dir apache-beam[gcp,dill]
- If there is a dill version mismatch between submission and runtime environments you might encounter unpickling errors like Can't get attribute '_create_code' on <module 'dill._dill' from....
- If dill is not installed in the runtime environment you will see the error ImportError: Pipeline option pickle_library=dill is set, but dill is not installed...
- Report any issues you encounter when using pickle_library=dill to the GitHub issue (#21298)
(Python) Added a pickle_library=dill_unsafe pipeline option. This allows overriding dill==0.3.1.1 using dill as the pickle_library. Use with extreme caution. Other versions of dill has not been tested with Apache Beam (#21298).
(Python) The deterministic fallback coder for complex types like NamedTuple, Enum, and dataclasses now normalizes filepaths for better determinism guarantees. This affects streaming pipelines updating from 2.68 to 2.69 that utilize this fallback coder. If your pipeline is affected, you may see a warning like: "Using fallback deterministic coder for type X...". To update safely sepcify the pipeline option --update_compatibility_version=2.68.0 (#36345).
(Python) Fixed transform naming conflict when executing DataTransform on a dictionary of PColls (#30445).
This may break update compatibility if you don't provide a --transform_name_mapping.
Removed deprecated Hadoop versions (2.10.2 and 3.2.4) that are no longer supported for Iceberg from IcebergIO (#36282).
(Go) Coder construction on SDK side is more faithful to the specs from runners without stripping length-prefix. This may break streaming pipeline update as the underlying coder could be changed (#36387).
Minimum Go version for Beam Go updated to 1.25.2 (#36461).
(Java) DoFn OutputReceiver now requires implementing a builder method as part of extended metadata support for elements (#34902).
(Java) Removed ProcessContext outputWindowedValue introduced in 2.68 that allowed setting offset and record Id. Use OutputReceiver's builder to set those field ([#36523]#36523).

Bugfixes

Fixed passing of pipeline options to x-lang transforms when called from the Java SDK (Java) (#36443).
PulsarIO has now changed support status from incomplete to experimental. Both read and writes should now minimally
function (un-partitioned topics, without schema support, timestamp ordered messages for read) (Java)
(#36141).
Fixed Spanner Change Stream reading stuck issue due to watermark of partition moving backwards (#36470).

List of Contributors

According to git shortlog, the following people contributed to the 2.69.0 release. Thank you to all contributors!

Abdelrahman Ibrahim, Ahmed Abualsaud, Andrew Crites, Arun Pandian, Bryan Dang, Chamikara Jayalath, Charles Nguyen, Chenzo, Clay Johnson, Danny McCormick, David A, Derrick Williams, Enrique Calderon, Hai Joey Tran, Ian Liao, Ian Mburu, Jack McCluskey, Jiang Zhu, Joey Tran, Kenneth Knowles, Kyle Stanley, Maciej Szwaja, Minbo Bae, Mohamed Awnallah, Radek Stankiewicz, Radosław Stankiewicz, Razvan Culea, Reuven Lax, Sagnik Ghosh, Sam Whittle, Shunping Huang, Steven van Rossum, Talat UYARER, Tanu Sharma, Tarun Annapareddy, Tom Stepp, Valentyn Tymofieiev, Vitaly Terentyev, XQ Hu, Yi Hu, Yilei, claudevdm, flpablo, fozzie15, johnjcasey, lim1t, parveensania, yashu

`v2.68.0`: Beam 2.68.0 release

Compare Source

We are happy to present the new 2.68.0 release of Beam.
This release includes both improvements and new functionality.
See the download page for this release.

For more information on changes in 2.68.0, check out the detailed release notes.

Highlights

[Python] Prism runner now enabled by default for most Python pipelines using the direct runner (#34612). This may break some tests, see #34612 for details on how to handle issues.

I/Os

Upgraded Iceberg dependency to 1.9.2 ([#35981](https://redirect.github.com/apache/beam/p

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

red-hat-konflux · 2026-04-21T19:35:52Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

4 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.25.0` -> `1.26.4`
`google.golang.org/genproto`	`v0.0.0-20260420184626-e10c466a9529` -> `v0.0.0-20260519071638-aa98bba5eb94`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260420184626-e10c466a9529` -> `v0.0.0-20260615183401-62b3387ff324`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260420184626-e10c466a9529` -> `v0.0.0-20260622175928-b703f567277d`
`google.golang.org/protobuf`	`v1.36.11` -> `v1.36.12-0.20260120151049-f2248ac996af`

red-hat-konflux · 2026-07-08T15:38:40Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: github.com/imdario/mergo@v1.0.2: parsing go.mod:
	module declares its path as: dario.cat/mergo
	        but was required as: github.com/imdario/mergo

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot added the dependencies label Apr 21, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch 18 times, most recently from 0dfd4b2 to 441a764 Compare April 29, 2026 19:02

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch 10 times, most recently from 64ae2da to 467dc07 Compare May 2, 2026 18:44

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch 25 times, most recently from b607d9d to 983431a Compare May 13, 2026 02:57

red-hat-konflux Bot force-pushed the konflux/mintmaker/release-1.3/go-deps branch 3 times, most recently from c2e1321 to e25da5b Compare May 16, 2026 02:26

chore(deps): update go dependencies

58f1c7a

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update go dependencies#617

chore(deps): update go dependencies#617
red-hat-konflux[bot] wants to merge 1 commit into
release-1.3from
konflux/mintmaker/release-1.3/go-deps

red-hat-konflux Bot commented Apr 21, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented Apr 21, 2026 •

edited

Loading

Uh oh!

red-hat-konflux Bot commented Jul 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

red-hat-konflux Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.25.2

What's Changed

New Contributors

v0.21.0

v0.58.0

v0.57.0: v1.33.0/v0.57.0

What's Changed

New Contributors

v2.75.0: Beam 2.75.0 release

Highlights

I/Os

New Features / Improvements

Breaking Changes

Bugfixes

Known Issues

v2.74.0: Beam 2.74.0 release

Highlights

I/Os

New Features / Improvements

Breaking Changes

Deprecations

Bugfixes

v2.73.0: Beam 2.73.0 release

Highlights

I/Os

New Features / Improvements

Breaking Changes

Bugfixes

Security Fixes

List of Contributors

v2.72.0: Beam 2.72.0 release

Highlights

I/Os

New Features / Improvements

Deprecations

Bugfixes

Security Fixes

List of Contributors

v2.71.0: Beam 2.71.0 release

I/Os

New Features / Improvements

Bugfixes

Known Issues

List of Contributors

v2.70.0: Beam 2.70.0 release

Highlights

New Features / Improvements

Breaking Changes

Deprecations

List of Contributors

v2.69.0: Beam 2.69.0 release

Highlights

I/Os

New Features / Improvements

Breaking Changes

Bugfixes

List of Contributors

v2.68.0: Beam 2.68.0 release

Highlights

I/Os

Configuration

Documentation

Uh oh!

red-hat-konflux Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

red-hat-konflux Bot commented Jul 8, 2026

⚠️ Artifact update problem

File name: go.sum

Uh oh!

Reviewers

Assignees

Labels

red-hat-konflux Bot commented Apr 21, 2026 •

edited

Loading

`v0.25.2`

`v0.21.0`

`v0.58.0`

`v0.57.0`: v1.33.0/v0.57.0

`v2.75.0`: Beam 2.75.0 release

`v2.74.0`: Beam 2.74.0 release

`v2.73.0`: Beam 2.73.0 release

`v2.72.0`: Beam 2.72.0 release

`v2.71.0`: Beam 2.71.0 release

`v2.70.0`: Beam 2.70.0 release

`v2.69.0`: Beam 2.69.0 release

`v2.68.0`: Beam 2.68.0 release

red-hat-konflux Bot commented Apr 21, 2026 •

edited

Loading