Update Go deps

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
connectrpc.com/connect	v1.20.0 → v1.21.0
golang.org/x/crypto	v0.55.0 → v0.57.0
golang.org/x/tools	v0.49.0 → v0.50.0

---

Release Notes

connectrpc/connect-go (connectrpc.com/connect)

v1.21.0

Compare Source

What's Changed

[!IMPORTANT]

This release adds a security-related feature for servers. The new handler option WithRequestGate runs after the request headers are available and before any message is received. Use this new option to register checks (e.g. authentication) that should happen before the request is decompressed or unmarshaled, and before any interceptors are run. See the documentation for details.

Governance

• Add pkwarren as a maintainer by @​bufdev in #​929 🎉

Enhancements

• Add WithRequestGate handler option by @​emcfarlane in #​962
• Create release binary for protoc-gen-connect-go by @​emcfarlane in #​966

Bugfixes

• Fix issue with user-agent getting inappropriately injected into request headers by @​jhump in #​934
• Fix client streaming operations blocking indefinitely after context cancellation by @​haru0017 in #​937
• Fix flaky HTTP2 testcase assertion by @​emcfarlane in #​940
• Fix data race and connection leak in duplexHTTPCall by @​emcfarlane in #​938
• Fix off-by-one in WithHTTPGetMaxURLSize URL length check by @​fchimpan in #​955
• Fix connect.WithGRPC typo in the missing client option error by @​NotAFlightRisk in #​956
• Only send a 304 when the request was a GET by @​NotAFlightRisk in #​957
• Fix panic in stream Spec and Peer when client construction failed by @​NotAFlightRisk in #​959
• Fix dropped headers on errStreamingClientConn by @​mohit-bhandari45 in #​964

New Contributors

• @​haru0017 made their first contribution in #​937
• @​dongjiang1989 made their first contribution in #​945
• @​fchimpan made their first contribution in #​955
• @​NotAFlightRisk made their first contribution in #​956
• @​mohit-bhandari45 made their first contribution in #​964

Full Changelog: connectrpc/connect-go@v1.20.0...v1.21.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=5 days

Details:

Package	Change
golang.org/x/sys	v0.47.0 -> v0.48.0
golang.org/x/text	v0.41.0 -> v0.42.0

File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=5 days

Details:

Package	Change
golang.org/x/mod	v0.40.0 -> v0.41.0
golang.org/x/sync	v0.22.0 -> v0.23.0
golang.org/x/sys	v0.47.0 -> v0.48.0

[github-actions]

The latest Buf updates on your PR. Results from workflow Pull Request / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Sep 14, 2026, 2:12 AM