Skip to content

build(deps): bump the go_modules group across 2 directories with 11 updates#1

Open
dependabot[bot] wants to merge 1 commit intodevelfrom
dependabot/go_modules/go_modules-726ca6f8c2
Open

build(deps): bump the go_modules group across 2 directories with 11 updates#1
dependabot[bot] wants to merge 1 commit intodevelfrom
dependabot/go_modules/go_modules-726ca6f8c2

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Apr 8, 2026

Bumps the go_modules group with 9 updates in the / directory:

Package From To
github.com/consensys/gnark-crypto 0.12.1 0.18.1
github.com/go-chi/chi/v5 5.0.11 5.2.2
github.com/golang-jwt/jwt/v4 4.5.0 4.5.2
github.com/rs/cors 1.10.1 1.11.0
github.com/vektah/gqlparser/v2 2.5.10 2.5.15
google.golang.org/grpc 1.63.2 1.79.3
github.com/quic-go/quic-go 0.38.2 0.57.0
github.com/quic-go/webtransport-go 0.5.3 0.10.0
github.com/sirupsen/logrus 1.9.0 1.9.1

Bumps the go_modules group with 3 updates in the /erigon-lib directory: github.com/consensys/gnark-crypto, google.golang.org/grpc and github.com/sirupsen/logrus.

Updates github.com/consensys/gnark-crypto from 0.12.1 to 0.18.1

Release notes

Sourced from github.com/consensys/gnark-crypto's releases.

v0.18.1

Full Changelog: Consensys/gnark-crypto@v0.18.0...v0.18.1

v0.18.0

What's Changed

New Contributors

Full Changelog: Consensys/gnark-crypto@v0.17.0...v0.18.0

v0.17.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from github.com/consensys/gnark-crypto's changelog.

[v0.18.1] - 2025-10-28

Docs

  • add CHANGELOG for 0.18.1

Perf

  • limit memory allocation during Vector deserialization (#759)

[v0.18.0] - 2025-06-09

Build

  • deps: bump golang.org/x/crypto from 0.33.0 to 0.35.0 (#677)

Chore

  • remove unused benchmark script (#675)

Docs

  • replace outdated link to article (#690)

Experiment

  • vortex on koalabear (#645)

Feat

  • remove dependency on internal package in ecc.go (#693)
  • make <31 bit field generated using uint32 (#676)

Fix

  • remove unimplemented path from fft ext
  • Eisenstein Half-GCD convergence (#680)

Perf

  • adds avx512 poseidon2 for small fields (#665)
  • remove useless copies in e4 mul by elem (#667)
  • disable cobra bit reverse for small fields (#662)

Refactor

  • hash to curve (#674)

[v0.17.0] - 2025-03-11

Chore

  • remove useless github workflow
  • generify poseidon2 parameters for other curves/fr (#636)
  • add auto close PR workflow (#638)

Feat

  • baby-bear and koala-bear extensions of degree 4 (#643)
  • poseidon2 for koala-bear, baby-bear and goldilocks (#629)
  • add sis avx512 and fft avx512 for koalabear (#622)
  • add Grumpkin elliptic curve (2-cycle with BN254) (#625)
  • Poseidon2 Hash Instantiation for BLS12-377 (#623)

Fix

  • poseidon2 templates (#648)
  • ensure fast path is taken only with fixed bound and degree (#651)
  • missing Poseidon2 round keys (#621)

Perf

  • subgroup membership (#635)
  • Poseidon2 GKR circuit (#628)

Refactor

  • generify small fields extensions (#647)
  • generate code for poseidon2_test (#660)

Style

... (truncated)

Commits

Updates github.com/go-chi/chi/v5 from 5.0.11 to 5.2.2

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.2.2

What's Changed

Security fix

  • Fixes GHSA-vrw8-fxc6-2r93 - "Host Header Injection Leads to Open Redirect in RedirectSlashes" commit
    • a lower-severity Open Redirect that can't be exploited in browser or email client, as it requires manipulation of a Host header
    • reported by Anuraag Baishya, @​anuraagbaishya. Thank you!

New Contributors

Full Changelog: go-chi/chi@v5.2.1...v5.2.2

v5.2.1

⚠️ Chi supports Go 1.20+

Starting this release, we will now support the four most recent major versions of Go. See go-chi/chi#963 for related discussion.

What's Changed

Full Changelog: go-chi/chi@v5.2.0...v5.2.1

v5.2.0

What's Changed

... (truncated)

Changelog

Sourced from github.com/go-chi/chi/v5's changelog.

Changelog

v5.0.12 (2024-02-16)

Commits

Updates github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.2

Release notes

Sourced from github.com/golang-jwt/jwt/v4's releases.

v4.5.2

See GHSA-mh63-6h87-95cp

Full Changelog: golang-jwt/jwt@v4.5.1...v4.5.2

v4.5.1

Security

Unclear documentation of the error behavior in ParseWithClaims in <= 4.5.0 could lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

This issue was documented in GHSA-29wx-vh33-7x7r and fixed in this release.

Note: v5 was not affected by this issue. So upgrading to this release version is also recommended.

What's Changed

  • Back-ported error-handling logic in ParseWithClaims from v5 branch. This fixes GHSA-29wx-vh33-7x7r.

Full Changelog: golang-jwt/jwt@v4.5.0...v4.5.1

Commits

Updates github.com/rs/cors from 1.10.1 to 1.11.0

Commits
  • 4c32059 Normalize allowed request headers and store them in a sorted set (fixes #170)...
  • 8d33ca4 Complete documentation; deprecate AllowOriginRequestFunc in favour of AllowOr...
  • af821ae Merge branch 'jub0bs-master'
  • 0bcf73f Update benchmark
  • eacc8e8 Fix skewed middleware benchmarks (#165)
  • 9297f15 Respect the documented precedence of options (#163)
  • 73f81b4 Fix readme benchmark rendering (#161)
  • See full diff in compare view

Updates github.com/vektah/gqlparser/v2 from 2.5.10 to 2.5.15

Release notes

Sourced from github.com/vektah/gqlparser/v2's releases.

v2.5.15

What's Changed

Full Changelog: vektah/gqlparser@v2.5.14...v2.5.15

v2.5.14

What's Changed

Full Changelog: vektah/gqlparser@v2.5.13...v2.5.14

v2.5.13

What's Changed

New Contributors

Full Changelog: vektah/gqlparser@v2.5.12...v2.5.13

v2.5.12

What's Changed

New Contributors

Full Changelog: vektah/gqlparser@v2.5.11...v2.5.12

v2.5.11

What's Changed

New Contributors

... (truncated)

Commits
  • 55a3c47 Revert ParseSchema default token limit of 1500, add ParseSchemaWithLimit, Par...
  • 36a3658 Add ParseQueryWithLimit (#304)
  • d457fc0 Token limit fix CVE-2023-49559 (#291)
  • 6db1bd3 Bump braces from 3.0.2 to 3.0.3 in /validator/imported (#302)
  • 3900414 Bump the actions-deps group in /validator/imported with 7 updates (#301)
  • 7c770f6 Bump prettier in /validator/imported in the actions-deps group (#299)
  • 0ed4973 Bump the actions-deps group in /validator/imported with 6 updates (#298)
  • 00fd36f Bump the actions-deps group in /validator/imported with 8 updates (#297)
  • 9638a21 Bump github.com/stretchr/testify in the actions-deps group (#296)
  • 55ebe37 Add Dependabot.yml
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.22.0 to 0.35.0

Commits
  • 7292932 ssh: limit the size of the internal packet queue while waiting for KEX
  • f66f74b acme/autocert: check host policy before probing the cache
  • b0784b7 x509roots/fallback: drop obsolete build constraint
  • 911360c all: bump golang.org/x/crypto dependencies of asm generators
  • 89ff08d all: upgrade go directive to at least 1.23.0 [generated]
  • e47973b all: update certs for go1.24
  • 9290511 go.mod: update golang.org/x dependencies
  • fa5273e x509roots/fallback: update bundle
  • a8ea4be ssh: add ServerConfig.PreAuthConnCallback, ServerPreAuthConn (banner) interface
  • 71d3a4c acme: support challenges that require the ACME client to send a non-empty JSO...
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.24.0 to 0.25.0

Commits
  • d27919b go.mod: update golang.org/x dependencies
  • e0324fc http2: use net.ErrClosed
  • b20cd59 quic: initiate key rotation earlier in connections
  • f95a3b3 html: fix typo in package doc
  • 0a24555 http/httpguts: speed up ValidHeaderFieldName
  • ec05fdc http2: don't retry the first request on a connection on GOAWAY error
  • b67a0f0 http2: send correct LastStreamID in stream-caused GOAWAY
  • a130fcc quic: don't consider goroutines running when tests start as leaked
  • See full diff in compare view

Updates google.golang.org/grpc from 1.63.2 to 1.79.3

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.79.3

Security

  • server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#8981)

Release 1.79.2

Bug Fixes

  • stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (grpc/grpc-go#8874)

Release 1.79.1

Bug Fixes

Release 1.79.0

API Changes

  • mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (#8806)
  • experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (#8780)

Behavior Changes

  • balancer/weightedtarget: Remove handling of Addresses and only handle Endpoints in resolver updates. (#8841)

New Features

  • experimental/stats: Add support for asynchronous gauge metrics through the new AsyncMetricReporter and RegisterAsyncReporter APIs. (#8780)
  • pickfirst: Add support for weighted random shuffling of endpoints, as described in gRFC A113.
    • This is enabled by default, and can be turned off using the environment variable GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (#8864)
  • xds: Implement :authority rewriting, as specified in gRFC A81. (#8779)
  • balancer/randomsubsetting: Implement the random_subsetting LB policy, as specified in gRFC A68. (#8650)

Bug Fixes

  • credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (#8726)
  • xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in CONNECTING state. (#8813)
  • health: Fix a bug where health checks failed for clients using legacy compression options (WithDecompressor or RPCDecompressor). (#8765)
  • transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (#8769)
  • server: Propagate status detail headers, if available, when terminating a stream during request header processing. (#8754)

Performance Improvements

  • credentials/alts: Optimize read buffer alignment to reduce copies. (#8791)
  • mem: Optimize pooling and creation of buffer objects. (#8784)
  • transport: Reduce slice re-allocations by reserving slice capacity. (#8797)

... (truncated)

Commits

Updates github.com/quic-go/quic-go from 0.38.2 to 0.57.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.57.0

This release contains a fix for CVE-2025-64702 by reworking the HTTP/3 header processing logic:

  • Both client and server now send their respective header size constraints using the SETTINGS_MAX_FIELD_SECTION_SIZE setting: #5431
  • For any QPACK-related errors, the correct error code (QPACK_DECOMPRESSION_FAILED) is now used: #5439
  • QPACK header parsing is now incremental (instead of parsing all headers at once), which is ~5-10% faster and reduces allocations: #5435 (and quic-go/qpack#67)
  • The server now sends a 431 status code (Request Header Fields Too Large) when encountering HTTP header fields exceeding the size constraint: #5452

 

Breaking Changes

  • http3: Transport.MaxResponseBytes is now an int (before: int64): #5433  

Notable Fixes

  • qlogwriter: fix storing of event schemas (this prevented qlog event logging from working for HTTP/3): #5430
  • http3: errors sending the request are now ignored, instead, the response from the server is read (thereby allowing the client to read the status code, for example): #5432

What's Changed

New Contributors

Full Changelog: quic-go/quic-go@v0.56.0...v0.57.0

v0.56.0

This release introduces qlog support for HTTP/3 (#5367, #5372, #5374, #5375, #5376, #5381, #5383).

For this, we completely changed how connection tracing works. Instead of a general-purpose logging.ConnectionTracer (which we removed entirely), we now have a qlog-specific tracer (#5356, #5417). quic-go users can now implement their own qlog events.

It also removes the Prometheus-based metrics collection. Please comment on the tracking issue (#5294) if you rely on metrics and are interested in seeing metrics brought back in a future release.

Notable Changes

  • replaced the unmaintained gojay with a custom, performance-optimized JSON encoder (#5353, #5371)

... (truncated)

Commits
  • 5b2d212 http3: limit size of decompressed headers (#5452)
  • e80b378 qlogwriter: use synctest to make tests deterministic (#5454)
  • d43c589 README: add nodepass to list of projects (#5448)
  • ca2835d don’t arm connection timer for connection ID retirement (#5449)
  • e84ebae ackhandler: don’t generate an immediate ACK for the first packet (#5447)
  • d4d168f add documentation for Conn.NextConnection (#5442)
  • 4cdebbe http3: use QPACK_DECOMPRESSION_FAILED for QPACK errors (#5439)
  • b7886d5 update qpack to v0.6.0 (#5434)
  • 2fc9705 http3: add a benchmark for header parsing (#5435)
  • dafdd6f http3: make Transport.MaxResponseBytes an int (#5433)
  • Additional commits viewable in compare view

Updates github.com/quic-go/webtransport-go from 0.5.3 to 0.10.0

Release notes

Sourced from github.com/quic-go/webtransport-go's releases.

v0.10.0

This release updates webtransport-go to use the new API introduced in quic-go v0.59.0 (#221): Instead of "hijacking" streams from the HTTP/3 layer, the underlying QUIC connection is now owned by WebTransport, and webtransport-go dispatches incoming streams to either the HTTP/3 layer or an existing or new WebTransport session.

New Features

Breaking Changes

  • Session.ConnectionState was renamed to SessionState: #189
  • The StreamID method was removed from Stream, SendStream and ReceiveStream: #226
  • The Server now embeds the http3.Server as a pointer (instead of by value): #215

Other Changes

  • The Stream and the SendStream now expose a Context method: #176 (thanks to @​Sicilica)
  • Delayed streams for already closed sessions are immediately reset: #235
  • The Session context now uses the request or dial context, allowing the application to attach values to the context: #199
  • When a WebTransport session is closed, streams are reset using the WT_SESSION_GONE error. Stream Read and Write now wait for the WT_CLOSE_SESSION capsule on the CONNECT stream to return a meaningful error: #213

Notable Fixes

  • Closed sessions are now properly cleaned up: #198 (thanks to @​rolaechea), #230
  • Session errors are now properly propagated to the stream Read and Write calls: #207
  • The length limit for WT_CLOSE_SESSION capsules is now enforced: #202
  • The dial timeout is now respected while waiting for the server's HTTP/3 settings: #216
  • A 10ms deadline is applied before attempting the WT_CLOSE_SESSION capsule, preventing Session.Close from blocking any longer than 10ms: #224
  • errors.Is error comparisons were fixed for StreamError and SessionError: #204, #205
  • The underlying QUIC connection is now closed when establishing a WebTransport session fails: #236

Changelog

@dependabot
build(deps): bump the go_modules group across 2 directories with 11 u…
2ca8240 
…pdates

Bumps the go_modules group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/consensys/gnark-crypto](https://github.com/consensys/gnark-crypto) | `0.12.1` | `0.18.1` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.0.11` | `5.2.2` |
| [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) | `4.5.0` | `4.5.2` |
| [github.com/rs/cors](https://github.com/rs/cors) | `1.10.1` | `1.11.0` |
| [github.com/vektah/gqlparser/v2](https://github.com/vektah/gqlparser) | `2.5.10` | `2.5.15` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.63.2` | `1.79.3` |
| [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) | `0.38.2` | `0.57.0` |
| [github.com/quic-go/webtransport-go](https://github.com/quic-go/webtransport-go) | `0.5.3` | `0.10.0` |
| [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus) | `1.9.0` | `1.9.1` |

Bumps the go_modules group with 3 updates in the /erigon-lib directory: [github.com/consensys/gnark-crypto](https://github.com/consensys/gnark-crypto), [google.golang.org/grpc](https://github.com/grpc/grpc-go) and [github.com/sirupsen/logrus](https://github.com/sirupsen/logrus).


Updates `github.com/consensys/gnark-crypto` from 0.12.1 to 0.18.1
- [Release notes](https://github.com/consensys/gnark-crypto/releases)
- [Changelog](https://github.com/Consensys/gnark-crypto/blob/master/CHANGELOG.md)
- [Commits](Consensys/gnark-crypto@v0.12.1...v0.18.1)

Updates `github.com/go-chi/chi/v5` from 5.0.11 to 5.2.2
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.0.11...v5.2.2)

Updates `github.com/golang-jwt/jwt/v4` from 4.5.0 to 4.5.2
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Commits](golang-jwt/jwt@v4.5.0...v4.5.2)

Updates `github.com/rs/cors` from 1.10.1 to 1.11.0
- [Commits](rs/cors@v1.10.1...v1.11.0)

Updates `github.com/vektah/gqlparser/v2` from 2.5.10 to 2.5.15
- [Release notes](https://github.com/vektah/gqlparser/releases)
- [Commits](vektah/gqlparser@v2.5.10...v2.5.15)

Updates `golang.org/x/crypto` from 0.22.0 to 0.35.0
- [Commits](golang/crypto@v0.22.0...v0.35.0)

Updates `golang.org/x/net` from 0.24.0 to 0.25.0
- [Commits](golang/net@v0.24.0...v0.25.0)

Updates `google.golang.org/grpc` from 1.63.2 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.63.2...v1.79.3)

Updates `github.com/quic-go/quic-go` from 0.38.2 to 0.57.0
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](quic-go/quic-go@v0.38.2...v0.57.0)

Updates `github.com/quic-go/webtransport-go` from 0.5.3 to 0.10.0
- [Release notes](https://github.com/quic-go/webtransport-go/releases)
- [Commits](quic-go/webtransport-go@v0.5.3...v0.10.0)

Updates `github.com/sirupsen/logrus` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/sirupsen/logrus/releases)
- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)
- [Commits](sirupsen/logrus@v1.9.0...v1.9.1)

Updates `github.com/consensys/gnark-crypto` from 0.12.1 to 0.18.1
- [Release notes](https://github.com/consensys/gnark-crypto/releases)
- [Changelog](https://github.com/Consensys/gnark-crypto/blob/master/CHANGELOG.md)
- [Commits](Consensys/gnark-crypto@v0.12.1...v0.18.1)

Updates `golang.org/x/crypto` from 0.22.0 to 0.35.0
- [Commits](golang/crypto@v0.22.0...v0.35.0)

Updates `golang.org/x/net` from 0.21.0 to 0.25.0
- [Commits](golang/net@v0.24.0...v0.25.0)

Updates `google.golang.org/grpc` from 1.63.2 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.63.2...v1.79.3)

Updates `github.com/sirupsen/logrus` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/sirupsen/logrus/releases)
- [Changelog](https://github.com/sirupsen/logrus/blob/master/CHANGELOG.md)
- [Commits](sirupsen/logrus@v1.9.0...v1.9.1)

---
updated-dependencies:
- dependency-name: github.com/consensys/gnark-crypto
  dependency-version: 0.18.1
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.2.2
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/golang-jwt/jwt/v4
  dependency-version: 4.5.2
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/rs/cors
  dependency-version: 1.11.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/vektah/gqlparser/v2
  dependency-version: 2.5.15
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.35.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/net
  dependency-version: 0.25.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.57.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/quic-go/webtransport-go
  dependency-version: 0.10.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/sirupsen/logrus
  dependency-version: 1.9.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/consensys/gnark-crypto
  dependency-version: 0.18.1
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.35.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/net
  dependency-version: 0.25.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/sirupsen/logrus
  dependency-version: 1.9.1
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Apr 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants