Skip to content

chore(deps): Bump the dependencies group across 1 directory with 4 updates - #301

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/dependencies-78d8d7e811
Closed

chore(deps): Bump the dependencies group across 1 directory with 4 updates#301
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/dependencies-78d8d7e811

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 4 updates in the / directory: github.com/getkin/kin-openapi, github.com/getsentry/sentry-go, github.com/labstack/echo/v4 and github.com/slack-go/slack.

Updates github.com/getkin/kin-openapi from 0.133.0 to 0.145.0

Release notes

Sourced from github.com/getkin/kin-openapi's releases.

v0.145.0

What's Changed

Full Changelog: getkin/kin-openapi@v0.144.0...v0.145.0

v0.144.0

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.143.0...v0.144.0

v0.143.0

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.142.0...v0.143.0

v0.142.0

What's Changed

Full Changelog: getkin/kin-openapi@v0.141.0...v0.142.0

v0.141.0

What's Changed

... (truncated)

Commits
  • 88aa64c Merge commit from fork
  • f1a5b52 Merge commit from fork
  • 27bc028 openapi3: stop InternalizeRefs panicking on unresolved discriminator mappings...
  • f0407d5 Merge commit from fork
  • c947670 some fixes to please my moulinette (#1232)
  • 68ac2af Merge commit from fork
  • 3e5d7f4 openapi3filter: prefer non-empty value for repeated scalar query params (#1231)
  • 30e2923 Merge commit from fork
  • c11a481 openapi3gen: inline embedded struct with options-only JSON tag (#1229)
  • 0fb1f0e openapi3filter: skip schema checks for empty allowEmptyValue strings (#1228)
  • Additional commits viewable in compare view

Updates github.com/getsentry/sentry-go from 0.42.0 to 0.48.0

Release notes

Sourced from github.com/getsentry/sentry-go's releases.

0.48.0

Breaking Changes 🛠

New Features ✨

  • Add ClientOptions.DataCollection for granular control over data collected by automatic instrumentation, replacing the broad SendDefaultPII switch. DataCollection can independently configure automatic user.* population, cookies, request/response headers, HTTP bodies, and query parameters. When configured, it is the source of truth and SendDefaultPII is ignored. by @​giortzisg in #1339
    • For backwards compatibility, clients that do not configure DataCollection keep a best-effort mapping of the previous SendDefaultPII behavior. To opt in to the new defaults, pass an empty DataCollection and then restrict individual categories as needed.
    sentry.Init(sentry.ClientOptions{
    Dsn: "https://public@example.com/1",
// Opt in to the new data collection defaults. Omitted fields use their
// defaults: user info, cookies, headers, query params, and supported HTTP
// bodies are collected, with sensitive values filtered.
DataCollection: &sentry.DataCollection{},

})

    • To opt in while disabling automatic user info and HTTP bodies, configure those fields explicitly:
    sentry.Init(sentry.ClientOptions{
    Dsn: "https://public@example.com/1",
    DataCollection: &sentry.DataCollection{
        UserInfo:   sentry.Set(false),
        HTTPBodies: []sentry.BodyType{},
    },
})
  • PushScope shorthand now returns the new scope reference by @​DoctorJohn in #1335

Bug Fixes 🐛

Internal Changes 🔧

Deps

... (truncated)

Changelog

Sourced from github.com/getsentry/sentry-go's changelog.

0.48.0

Breaking Changes 🛠

New Features ✨

  • Add ClientOptions.DataCollection for granular control over data collected by automatic instrumentation, replacing the broad SendDefaultPII switch. DataCollection can independently configure automatic user.* population, cookies, request/response headers, HTTP bodies, and query parameters. When configured, it is the source of truth and SendDefaultPII is ignored. by @​giortzisg in #1339
    • For backwards compatibility, clients that do not configure DataCollection keep a best-effort mapping of the previous SendDefaultPII behavior. To opt in to the new defaults, pass an empty DataCollection and then restrict individual categories as needed.
    sentry.Init(sentry.ClientOptions{
    Dsn: "https://public@example.com/1",
// Opt in to the new data collection defaults. Omitted fields use their
// defaults: user info, cookies, headers, query params, and supported HTTP
// bodies are collected, with sensitive values filtered.
DataCollection: &sentry.DataCollection{},

})

    • To opt in while disabling automatic user info and HTTP bodies, configure those fields explicitly:
    sentry.Init(sentry.ClientOptions{
    Dsn: "https://public@example.com/1",
    DataCollection: &sentry.DataCollection{
        UserInfo:   sentry.Set(false),
        HTTPBodies: []sentry.BodyType{},
    },
})
  • PushScope shorthand now returns the new scope reference by @​DoctorJohn in #1335

Bug Fixes 🐛

Internal Changes 🔧

Deps

... (truncated)

Commits
  • d02f9ba release: 0.48.0
  • 99c424f feat!: remove issue creation from logging integrations (#1340)
  • d1c1d3f feat: parse request body for outgoing http (#1339)
  • 9b5cab2 fix: fix fiber route name when using middlewares (#1363)
  • 07a7975 fix: omit empty event id for standalone client reports (#1362)
  • c255382 build(deps): bump fiber/v2 to 2.52.14 (#1359)
  • 06c58dc ci: remove changelog-preview and codecov actions (#1357)
  • a99e044 fix: preserve '%' literal in log messages (#1358)
  • 8aaf1d4 feat: apply sensitive data filters to grpc & sql (#1333)
  • 4347773 feat: apply sensitive data filters to http (#1332)
  • Additional commits viewable in compare view

Updates github.com/labstack/echo/v4 from 4.15.1 to 4.15.4

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.15.4

Security

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#3016, released in v5.2.1). Thanks to @​a-tt-om and @​oran-gugu for reporting.

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")

for static middleware

	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.15.4 - 2026-06-15

Security

Fixes GHSA-vfp3-v2gw-7wfq

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")

for static middleware

	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

v4.15.3 - 2026-06-14

... (truncated)

Commits
  • ec79b58 Merge pull request #3020 from aldas/v4_v4-15-4_changelog
  • 2714c07 Changelog for v4.15.4 - security fix
  • 13f0ed1 Merge pull request #3019 from aldas/v4_backport_3016
  • d16a4ec backport PR 3016 from v4
  • 8f167b9 Merge pull request #3018 from aldas/v4_remove_v5_dep
  • 9afa4ba remove dependency on labstack/echo v5 introduced in go.mod and go.sum
  • 1e05f63 Merge pull request #3017 from aldas/v4_ci_updates
  • 11a3cc4 Update dependencies and add ignore for linting
  • 26bd016 Update CI action versions
  • aa52f6a ci: run workflows on the v4 branch, not just master (#3013)
  • Additional commits viewable in compare view

Updates github.com/slack-go/slack from 0.23.1 to 0.27.0

Release notes

Sourced from github.com/slack-go/slack's releases.

v0.27.0

Added

  • Support for data_visualization block through DataVisualizationBlock.
  • Teamnow preservesenterprise_idandenterprise_namewhen Slack includes Enterprise org details in interaction payloadteam` objects.

Full Changelog: slack-go/slack@v0.26.0...v0.27.0

v0.26.0

What's Changed

New Contributors

Full Changelog: slack-go/slack@v0.25.0...v0.26.0

v0.25.0

[!IMPORTANT] See CHANGELOG.md for details. Breaking change: TableBlock.Rows is now [][]TableCell (#1558).

What's Changed

New Contributors

Full Changelog: slack-go/slack@v0.24.0...v0.25.0

v0.24.0

What's Changed

[!IMPORTANT] NewTaskCardBlock and NewPlanBlock now guard against nil variadic options so if you were doing that (which you shouldn't) this is a breaking change.

New Contributors

Full Changelog: slack-go/slack@v0.23.1...v0.24.0

Changelog

Sourced from github.com/slack-go/slack's changelog.

[0.27.0]

Added

  • Block Kit: Add support for data_visualization block through DataVisualizationBlock.
  • Interaction payloads: Team now preserves enterprise_id and enterprise_name when Slack includes Enterprise org details in interaction payload team objects.

[0.26.0]

Added

  • slackevents: EventsAPIEvent now unmarshals the is_ext_shared_channel field, and ParseEvent propagates it for callback events (#1564 and #1565).
  • Block Kit: HeaderBlock now supports the optional level field (1-4, mapping to H1-H4 heading levels), with a HeaderBlockOptionLevel builder (#1563).
  • Block Kit: CardBlock now supports the slack_icon field via the new SlackIconObject composition object (with a NewSlackIconObject constructor and WithSlackIcon builder) and the subtext field (with a WithSubtext builder). slack_icon is mutually exclusive with icon (#1562).

[0.25.0]

Changed

[!WARNING] Breaking change.

  • TableBlock.Rows is now [][]TableCell (was [][]*RichTextBlock), so table blocks no longer drop raw_text, raw_number, and null cells (#1558).

[0.24.0]

Added

  • Block Kit: DataTableBlock for the data_table block, with NewDataTableBlock, AddRow, raw-text/raw-number/rich-text cell constructors, and WithPageSize / WithRowHeaderColumnIndex builders.

Changed

  • NewTaskCardBlock and NewPlanBlock nil-guard their variadic options, matching the other block constructors (#1236).
Commits
  • 7609cd3 Bump slack-go/slack to 0.27.0
  • 46d27c4 feat: add enterprise fields to interaction team payloads
  • c1c5406 feat: add data_visualization block kit support (#1568)
  • b08c432 chore(deps): bump actions/checkout from 6 to 7 (#1567)
  • 6fd5178 chore: bump golangci-lint to 2.12.2
  • 967c4e7 chore: bump go to 1.25.11
  • 56c434c feat: add slack_icon and subtext support to CardBlock
  • 0af06c5 feat: add level field support to HeaderBlock
  • 9843657 Propagate IsExtSharedChannel in ParseEvent for callback events
  • 2e46275 feat: unmarshal is_ext_shared_channel field in EventsAPIEvent (#1565)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels May 4, 2026
@vercel

vercel Bot commented May 4, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments
Project Deployment Actions Updated (UTC)
ainsleyclark.com Ignored Ignored Preview Aug 3, 2026 5:13pm
ainsleydev Ignored Ignored Preview Aug 3, 2026 5:13pm

Request Review

@dependabot
dependabot Bot force-pushed the dependabot/go_modules/dependencies-78d8d7e811 branch from 75d99c9 to 9bc3329 Compare May 25, 2026 23:09
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/dependencies-78d8d7e811 branch from 9bc3329 to ae4c01b Compare July 20, 2026 17:13
@vercel

vercel Bot commented Jul 20, 2026

Copy link
Copy Markdown

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

@dependabot
dependabot Bot force-pushed the dependabot/go_modules/dependencies-78d8d7e811 branch from ae4c01b to 6cad53a Compare July 27, 2026 17:13
@dependabot
chore(deps): Bump the dependencies group across 1 directory with 4 up…
c8843c0 
…dates

Bumps the dependencies group with 4 updates in the / directory: [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi), [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go), [github.com/labstack/echo/v4](https://github.com/labstack/echo) and [github.com/slack-go/slack](https://github.com/slack-go/slack).


Updates `github.com/getkin/kin-openapi` from 0.133.0 to 0.145.0
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](getkin/kin-openapi@v0.133.0...v0.145.0)

Updates `github.com/getsentry/sentry-go` from 0.42.0 to 0.48.0
- [Release notes](https://github.com/getsentry/sentry-go/releases)
- [Changelog](https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-go@v0.42.0...v0.48.0)

Updates `github.com/labstack/echo/v4` from 4.15.1 to 4.15.4
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/v4.15.4/CHANGELOG.md)
- [Commits](labstack/echo@v4.15.1...v4.15.4)

Updates `github.com/slack-go/slack` from 0.23.1 to 0.27.0
- [Release notes](https://github.com/slack-go/slack/releases)
- [Changelog](https://github.com/slack-go/slack/blob/master/CHANGELOG.md)
- [Commits](slack-go/slack@v0.23.1...v0.27.0)

---
updated-dependencies:
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.137.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/getsentry/sentry-go
  dependency-version: 0.46.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: github.com/labstack/echo/v4
  dependency-version: 4.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: github.com/slack-go/slack
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/dependencies-78d8d7e811 branch from 6cad53a to c8843c0 Compare August 3, 2026 17:13
@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 17, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/dependencies-78d8d7e811 branch August 17, 2026 18:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants