[dependabot]

Bumps github.com/xdg-go/scram from 1.2.0 to 1.4.0.

Release notes

Sourced from github.com/xdg-go/scram's releases.

v1.4.0

Changed

• PBKDF2 key derivation now always uses the stdlib crypto/pbkdf2 package, a FIPS 140-3 certified implementation.
• Minimum Go version bumped from 1.18 to 1.24.
• Removed dependency github.com/xdg-go/pbkdf2.

v1.3.0

Security

• NewClient no longer includes the plaintext password, or the rejected character, in the error it returns when SASLprep rejects the password.

Fixed

• Server now decodes the =2C and =3D escapes in the client-first username and authzid (RFC 5802 §5.1). Previously, the CredentialLookup callback, Username(), and AuthzID() received the escaped form, so users with , or = in their names failed with e=unknown-user.
• Server now rejects a username containing = not followed by 2C or 3D with e=invalid-username-encoding, and a malformed authzid with e=invalid-encoding.

Notes

• Behavior change: a CredentialLookup that matched the escaped form (e.g. "a=2Cb") must now match the decoded name ("a,b").

Changelog

Sourced from github.com/xdg-go/scram's changelog.

v1.4.0 - 2026-11-04

Changed

• PBKDF2 key derivation now always uses the stdlib crypto/pbkdf2 package, a FIPS 140-3 certified implementation.
• Minimum Go version bumped from 1.18 to 1.24.
• Removed dependency github.com/xdg-go/pbkdf2.

v1.3.0 - 2026-11-03

Security

• NewClient no longer includes the plaintext password, or the rejected character, in the error it returns when SASLprep rejects the password.

Fixed

• Server now decodes the =2C and =3D escapes in the client-first username and authzid (RFC 5802 §5.1). Previously, the CredentialLookup callback, Username(), and AuthzID() received the escaped form, so users with , or = in their names failed with e=unknown-user.
• Server now rejects a username containing = not followed by 2C or 3D with e=invalid-username-encoding, and a malformed authzid with e=invalid-encoding.

Notes

• Behavior change: a CredentialLookup that matched the escaped form (e.g. "a=2Cb") must now match the decoded name ("a,b").

Commits

• 961c178 Bump changelog
• 97e33c3 Always use "crypto/pbkdf2" for PBKDF2 key derivation.
• 78d3e3f Bump version in CHANGELOG
• e58dafd Broaden CI matrix and add format and vet checks
• 07bc3e8 Add Dependabot config for Actions and Go modules
• 1f960d6 Omit password from NewClient SASLprep errors
• 0418245 Decode escaped username and authzid on the server
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

✅ Auto-merge enabled. This PR will merge automatically / added to merge queue, once all checks pass.