Skip to content

deps(go): bump the go-minor-and-patch group across 1 directory with 3 updates - #164

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-and-patch-103f6440f6
Closed

deps(go): bump the go-minor-and-patch group across 1 directory with 3 updates#164
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-and-patch-103f6440f6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-minor-and-patch group with 3 updates in the / directory: github.com/caddyserver/caddy/v2, github.com/nats-io/nats-server/v2 and github.com/prometheus/client_golang.

Updates github.com/caddyserver/caddy/v2 from 2.11.4 to 2.11.7

Release notes

Sourced from github.com/caddyserver/caddy/v2's releases.

v2.11.7

This patch release fixes regressions from 2.11.6, including a crash when proxying over HTTP/2 and streams that were cut off after a minute. If you're on 2.11.6, we recommend upgrading. It also adds support for the brand new Incremental header field (RFC 10036).

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

Highlights

  • Fixed: crash and dropped streams caused by the new idle timeouts. 2.11.6 introduced default idle read/write timeouts, which caused some problems:

    • In 2.11.6, the request body's idle deadline could outlive the handler that set it:

      • Over HTTP/2, Caddy could panic with a nil pointer dereference when the reverse proxy was still reading a request body after the handler had returned. (#8101)
      • Over HTTP/1.1, streaming responses to requests with a body, such as SSE clients that open the stream with a POST, were cut off exactly 60 seconds after the body was read. (#8103)

      Both are fixed in #8107. Thanks @​steadytao!

    • Over HTTP/2, streaming responses that paused between writes for longer than write_idle (1 minute by default), like quiet SSE streams, were reset with a stream error. As documented, only a write that stalls should count. Thanks @​WeidiDeng! (#8118, #8119)

  • Fixed: placeholders for missing cookies are empty again. Since 2.11.6, places that keep unknown placeholders as written, like respond headers, would output {http.request.cookie.*} literally when the cookie wasn't in the request. The same happened to {http.request.tls.*} on plain HTTP requests. Both are empty again. Thanks @​steadytao! (#8019)

  • New: support for the Incremental header field (RFC 10036). It's the standard replacement for NGINX's proprietary X-Accel-Buffering header. If an upstream response has Incremental: ?1, reverse_proxy forwards it immediately, the same as flush_interval -1, and encode streams it instead of holding it back. Great for Mercure, SSE and other streaming apps.

    • If the request_buffers or response_buffers options would prevent incremental forwarding, Caddy responds with 501 Not Implemented instead of silently buffering, as the RFC requires.
    • The new proxy_status_name option adds a Proxy-Status header to those responses, explaining why the message was refused.

    Thanks @​dunglas! (#8020)

  • Faster TLS handshakes: When nothing subscribes to certificate events and debug logging is off, CertMagic no longer builds event data for every handshake. Certificate lookup per handshake is about twice as fast, with 10 allocations instead of 15. Thanks @​u5surf! (#8010)

  • Unix sockets: When a reload moves a listener (or the admin endpoint) off a Unix socket, the old socket now closes right away and its file is removed. Before, clients connecting to the old path would hang until the next garbage collection, about 2 minutes later. Thanks @​littfed! (#8061)

  • Headers handler: Multiple Set-Cookie values in a JSON config's set are now sent as separate header fields, instead of being joined with commas into one field that clients can't parse. Thanks @​Indra55! (#8080)

  • caddy fmt no longer deletes an opening brace at the very end of the input. Thanks @​n0liu! (#8047)

What's Changed

New Contributors

Full Changelog: caddyserver/caddy@v2.11.6...v2.11.7

v2.11.6

This patch release contains a large number of minor and some noticeable enhancements and bug fixes. Thank you to everyone who contributed or spent their LLM tokens responsibly to help with this release!

We have much more in the pipeline still, as AI has made contributions of all quality levels cheap and easy. We will be trying to go through them as quickly and efficiently as we can.

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

⚠️ Please read the breaking changes below before upgrading. Most of them come from security hardening, and most configs won't notice. If you were relying on one of the old behaviors, though, you'll want to know about it.

... (truncated)

Commits
  • 72dd0fb timeouts: fix idle writer terminate h2 response writers between writes (#8119)
  • ab7e6b6 caddyhttp: end request-body deadline ownership with handler (#8107)
  • ac63faa headers: Preserve separate Set-Cookie values (#8080)
  • 55a95ad caddyhttp: keep absent optional placeholders empty (#8019)
  • f357e2b reverseproxy: stabilise half-close test (#8049)
  • d483d78 listeners: close unix socket immediately and unlink file on reload (#8061)
  • b72bf7a caddyfile: keep an opening brace that ends the input (#8047)
  • 2f34b93 feat: implement the Incremental header field (RFC 10036) (#8020)
  • 4978c54 events: tell CertMagic which events are worth emitting (#8010)
  • ac834b5 ci: pin cosign to v2 for release signing (#8092)
  • Additional commits viewable in compare view

Updates github.com/nats-io/nats-server/v2 from 2.15.0 to 2.15.1

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.15.1

Changelog

Refer to the 2.15 Upgrade Guide for backwards compatibility notes with 2.14.x.

Go Version

Dependencies

  • github.com/klauspost/compress v1.20.1 (#8737)
  • github.com/nats-io/nats.go v1.53.1 (#8737)

Changed

JetStream

  • The max_ha_assets limit is now enforced consistently by the metalayer leader during stream and consumer placement, scaling and moves (#8639)

Gateways

  • Support for sending and handling the legacy $GR. reply prefix, used by servers prior to v2.1.2, has been removed (#8615)

Improved

JetStream

  • Stalled source and mirror flow control is now reported in stream info and warning logs, making missing $JS.FC.> imports or exports easier to diagnose (#8633)
  • Stream and consumer placement now prefers peers that have caught up with the metalayer, reducing delays in API responses (#8643)
  • Improved the performance of deleting entries from and encoding AVL sequence sets (#8646)
  • Fast batch publish now reports backward sequence gaps as well as forward gaps (#8699)
  • Stream pending message calculations avoid unnecessary filestore cache access and handle deleted sequence ranges more efficiently (#8680, #8681)
  • Stream restore format detection now stops after the first S2 chunk (#8693)
  • Stream restore waits for the preferred node to become leader, avoiding an incorrect create response during clustered restore (#8690)
  • Memory backed streams avoid copying message headers and bodies twice when storing messages (#8652, contributed by @​randomizedcoder)

Monitoring

  • Leafz now reports whether a leafnode connection uses WebSockets (#8683)

MQTT

  • QoS2 PUBLISH and PUBREL processing is now pipelined for increased throughput (#8416, contributed by @​levb)
  • Reduced allocations and buffer copying when processing QoS1 and QoS2 messages and issuing JetStream store and delete requests (#8624, #8625, contributed by @​levb)
  • Partial packets are no longer copied in full on every read, reducing allocations and buffer copying (#8692)

Fixed

General

... (truncated)

Commits
  • b2fd3ef Release v2.15.1
  • 5502536 Update to Go 1.27.2/1.26.9
  • 2f50d04 Cherry-picks for 2.15.1 (#164)
  • ff5047c Fix TestJetStreamClusterKeyValueLastSeqMismatch
  • bd33432 Update GHA dependencies
  • 86bf9f1 Update Go dependencies
  • c4aea1c [FIXED] Leafnode interest and request/reply across account imports
  • 04869d4 [FIXED] Recovered ephemeral pull consumer never deleted
  • 51d0113 De-flake TestJetStreamAtomicBatchPublishRejectPartialBatchOnLeaderChange
  • 21344fd NRG: Re-send vote request of preferred candidate
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.24.1 to 1.25.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.25.0

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

What's Changed

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(go): bump the go-minor-and-patch group across 1 directory with 3…
cf2bcfc 
… updates

Bumps the go-minor-and-patch group with 3 updates in the / directory: [github.com/caddyserver/caddy/v2](https://github.com/caddyserver/caddy), [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) and [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang).


Updates `github.com/caddyserver/caddy/v2` from 2.11.4 to 2.11.7
- [Release notes](https://github.com/caddyserver/caddy/releases)
- [Commits](caddyserver/caddy@v2.11.4...v2.11.7)

Updates `github.com/nats-io/nats-server/v2` from 2.15.0 to 2.15.1
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md)
- [Commits](nats-io/nats-server@v2.15.0...v2.15.1)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

---
updated-dependencies:
- dependency-name: github.com/caddyserver/caddy/v2
  dependency-version: 2.11.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-and-patch
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-and-patch
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 12, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/go-minor-and-patch-103f6440f6 branch November 2, 2026 04:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants