Skip to content

deps(go): bump the go-minor-and-patch group across 1 directory with 4 updates - #166

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-and-patch-c120692f0b
Open

deps(go): bump the go-minor-and-patch group across 1 directory with 4 updates#166
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-and-patch-c120692f0b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-minor-and-patch group with 4 updates in the / directory: github.com/caddyserver/caddy/v2, github.com/nats-io/nats-server/v2, github.com/nats-io/nats.go and github.com/prometheus/client_golang.

Updates github.com/caddyserver/caddy/v2 from 2.11.4 to 2.11.7

Release notes

Sourced from github.com/caddyserver/caddy/v2's releases.

v2.11.7

This patch release fixes regressions from 2.11.6, including a crash when proxying over HTTP/2 and streams that were cut off after a minute. If you're on 2.11.6, we recommend upgrading. It also adds support for the brand new Incremental header field (RFC 10036).

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

Highlights

  • Fixed: crash and dropped streams caused by the new idle timeouts. 2.11.6 introduced default idle read/write timeouts, which caused some problems:

    • In 2.11.6, the request body's idle deadline could outlive the handler that set it:

      • Over HTTP/2, Caddy could panic with a nil pointer dereference when the reverse proxy was still reading a request body after the handler had returned. (#8101)
      • Over HTTP/1.1, streaming responses to requests with a body, such as SSE clients that open the stream with a POST, were cut off exactly 60 seconds after the body was read. (#8103)

      Both are fixed in #8107. Thanks @​steadytao!

    • Over HTTP/2, streaming responses that paused between writes for longer than write_idle (1 minute by default), like quiet SSE streams, were reset with a stream error. As documented, only a write that stalls should count. Thanks @​WeidiDeng! (#8118, #8119)

  • Fixed: placeholders for missing cookies are empty again. Since 2.11.6, places that keep unknown placeholders as written, like respond headers, would output {http.request.cookie.*} literally when the cookie wasn't in the request. The same happened to {http.request.tls.*} on plain HTTP requests. Both are empty again. Thanks @​steadytao! (#8019)

  • New: support for the Incremental header field (RFC 10036). It's the standard replacement for NGINX's proprietary X-Accel-Buffering header. If an upstream response has Incremental: ?1, reverse_proxy forwards it immediately, the same as flush_interval -1, and encode streams it instead of holding it back. Great for Mercure, SSE and other streaming apps.

    • If the request_buffers or response_buffers options would prevent incremental forwarding, Caddy responds with 501 Not Implemented instead of silently buffering, as the RFC requires.
    • The new proxy_status_name option adds a Proxy-Status header to those responses, explaining why the message was refused.

    Thanks @​dunglas! (#8020)

  • Faster TLS handshakes: When nothing subscribes to certificate events and debug logging is off, CertMagic no longer builds event data for every handshake. Certificate lookup per handshake is about twice as fast, with 10 allocations instead of 15. Thanks @​u5surf! (#8010)

  • Unix sockets: When a reload moves a listener (or the admin endpoint) off a Unix socket, the old socket now closes right away and its file is removed. Before, clients connecting to the old path would hang until the next garbage collection, about 2 minutes later. Thanks @​littfed! (#8061)

  • Headers handler: Multiple Set-Cookie values in a JSON config's set are now sent as separate header fields, instead of being joined with commas into one field that clients can't parse. Thanks @​Indra55! (#8080)

  • caddy fmt no longer deletes an opening brace at the very end of the input. Thanks @​n0liu! (#8047)

What's Changed

New Contributors

Full Changelog: caddyserver/caddy@v2.11.6...v2.11.7

v2.11.6

This patch release contains a large number of minor and some noticeable enhancements and bug fixes. Thank you to everyone who contributed or spent their LLM tokens responsibly to help with this release!

We have much more in the pipeline still, as AI has made contributions of all quality levels cheap and easy. We will be trying to go through them as quickly and efficiently as we can.

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

⚠️ Please read the breaking changes below before upgrading. Most of them come from security hardening, and most configs won't notice. If you were relying on one of the old behaviors, though, you'll want to know about it.

... (truncated)

Commits
  • 72dd0fb timeouts: fix idle writer terminate h2 response writers between writes (#8119)
  • ab7e6b6 caddyhttp: end request-body deadline ownership with handler (#8107)
  • ac63faa headers: Preserve separate Set-Cookie values (#8080)
  • 55a95ad caddyhttp: keep absent optional placeholders empty (#8019)
  • f357e2b reverseproxy: stabilise half-close test (#8049)
  • d483d78 listeners: close unix socket immediately and unlink file on reload (#8061)
  • b72bf7a caddyfile: keep an opening brace that ends the input (#8047)
  • 2f34b93 feat: implement the Incremental header field (RFC 10036) (#8020)
  • 4978c54 events: tell CertMagic which events are worth emitting (#8010)
  • ac834b5 ci: pin cosign to v2 for release signing (#8092)
  • Additional commits viewable in compare view

Updates github.com/nats-io/nats-server/v2 from 2.15.0 to 2.15.2

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.15.2

Changelog

Refer to the 2.15 Upgrade Guide for backwards compatibility notes with 2.14.x.

Go Version

  • 1.27.3, which contains mitigations for CVE-2026-111943 by distrusting eMudhra intermediate certificates (#8798)

Dependencies

  • github.com/klauspost/compress v1.20.3 (#8798)
  • golang.org/x/crypto v0.58.0 (#8798)
  • golang.org/x/sys v0.49.0 (#8798)

Fixed

General

  • Allowed connection types are now correctly respected in auth callout setups
  • Fixed a potential queue sub weight amplification in the sublist
  • OCSP responses are now correctly bound to the certificate serial number

JetStream

  • Restored v1 stream snapshots now correctly guard against excessive subject lengths, subject counts or block counts

Leafnodes

  • ACLs on leafnode connections no longer override allow/deny lists to implicitly allow $MQTT.> permissions

MQTT

  • OCSP verification for MQTT connections now correctly obeys the ocsp_peer option in the mqtt block

Complete Changes

nats-io/nats-server@v2.15.1...v2.15.2

Release v2.15.1

Changelog

Refer to the 2.15 Upgrade Guide for backwards compatibility notes with 2.14.x.

Go Version

Dependencies

... (truncated)

Commits
  • 5a815f1 Release v2.15.2
  • ce74e90 Cherry-picks for 2.15.2
  • d607b66 [FIXED] OCSP peer debug log for invalid cached delegation missing fingerprint
  • d999a7c [IMPROVED] Reuse OCSP delegation check for route/gateway staples
  • 6fe5aa7 [FIXED] OCSP staple status accepted from signers not authorized by the CA
  • a9ea248 [FIXED] OCSP responses not bound to the certificate's serial number
  • 74a69e6 [FIXED] MQTT ocsp_peer ignored in favor of top-level TLS options
  • eb1459a [FIXED] Leafnode permissions bypassed for $MQTT. subjects
  • 2e6d391 [FIXED] Bound counts and lengths when recovering stream state
  • c33a421 [FIXED] Queue weight overflow withdrawing route and leaf interest
  • Additional commits viewable in compare view

Updates github.com/nats-io/nats.go from 1.54.0 to 1.55.0

Release notes

Sourced from github.com/nats-io/nats.go's releases.

Release v1.55.0

Changelog

This is the biggest nats.go release in a long time: 47 changes with more than half of them coming from 18 external contributors - thank you all!

Most of this release is a robustness effort. Nearly 30 bug fixes address deadlocks, goroutine and timer leaks, data races and stalls in reconnect and drain handling, pull and ordered consumers, async publish and service API. It also adds the FetchMaxBytes() option and Conn.RemoteAccount().

ADDED

  • Core NATS:
    • Conn.RemoteAccount() and ServerInfo.RemoteAccount exposing the account the client is bound to (#2156)
  • JetStream:
    • FetchMaxBytes() option to limit both the number of messages and total bytes in a single Fetch() request. Thanks @​manenim for the contribution (#2198)
    • StreamInfo.Domain, StreamInfo.Alternates, StreamState.Lost, StreamSourceInfo.External and StreamSourceInfo.Error in stream info (#2168)
    • ErrStreamMessageExceedsMaximum for JetStream error code 10054, returned when a message exceeds the stream's MaxMsgSize. Thanks @​matehsan for the contribution (#2110)

FIXED

  • Core NATS:
    • ForceReconnect() called while already reconnecting disabling ReconnectWait and custom reconnect delays, so the client dialed in a tight loop. Thanks @​Arsen302 for the contribution and @​MokiMeow for the diagnosis and test (#2179)
    • Connection closing for good instead of reconnecting after a partial write left a truncated message on the wire (#2169)
    • Connection status listeners losing an unread event and being unregistered when the next status was sent (#2193)
    • Message headers not counted against subscription pending byte limits, so header-heavy subscriptions could exceed the limit without reporting a slow consumer. Thanks @​Grivn for the contribution (#2200)
    • Requests interrupted by a reconnect returning ErrConnectionClosed instead of ErrDisconnected. Thanks @​AshSgDe29071999 for the contribution (#2129)
    • Default port added to the path instead of the host for server URLs with a path and no port, e.g. ws://host/nats. Thanks @​dannyshafer for the contribution (#2177)
    • Close() during Drain() flipping the closed connection back to DRAINING_PUBS and flushing on it. Thanks @​Kshot3000 for the contribution (#2163)
    • Drain() waiting for the full DrainTimeout when the connection was closed mid-drain (#2171)
    • IsSystemAccount() reset to false by async INFO updates, such as cluster topology changes or lame duck mode (#2156)
  • JetStream:
    • Pull consumer Consume() and Messages() deadlocking on Stop() or Drain() while buffered messages were still being delivered. Thanks @​clwluvw for the contribution (#2165)
    • Messages() iterator goroutines leaking after the connection is closed. Thanks @​clwluvw for the contribution (#2166)
    • Heartbeat timer and status listener left running when Consume() ends because the connection was closed. Thanks @​clwluvw for the contribution (#2164)
    • Messages() iterator returning ErrMsgIteratorClosed instead of the remaining buffered messages when Next() raced with Drain() (#2188)
    • Pull consumer with StopAfter stalling until the missed heartbeat check (30s by default) after a pull expired. Thanks @​huynguyen7 for the contribution (#2208)
    • Ordered consumer with StopAfter hanging on Stop()/Drain(), delivering too many or too few messages, or panicking after a consumer reset. Thanks @​clwluvw for the contribution (#2167)
    • Ordered consumer Fetch(), Next() and FetchBytes() blocking forever after returning ErrOrderedConsumerConcurrentRequests, and FetchNoWait() restarting from the beginning of the stream (#2211)
    • Ordered consumer Consume() and Messages() using the 15s pull consumer heartbeat instead of the 5s ordered default, so a stalled consumer was reset after ~30s instead of ~10s. Thanks @​arminazimi for the contribution (#2182)
    • PublishAsync() exceeding WithPublishAsyncMaxPending() under concurrent calls. Thanks @​ShravanthReddy for the contribution (#2126)
    • Async publish error callbacks for messages pending during a reconnect delayed until the publisher shut down. Thanks @​H-XX-D for the contribution (#2150)
    • Data race between Info() and CachedInfo() on streams and consumers. Thanks @​vulragrag-star for the contribution (#2152)
    • Reusing the same KeyValueConfig.Sources for several KeyValue buckets carrying the first bucket's subject transform into the next ones, so their reads returned ErrKeyNotFound. Thanks @​zhechen-cs for the contribution (#2190)
    • Object Store GetFile() leaving trailing bytes of an existing destination file when downloading a shorter object. Thanks @​zhechen-cs for the contribution (#2197)
  • Legacy JetStream:
    • Async publish error callbacks for messages pending during a reconnect delayed until the publisher shut down. Thanks @​H-XX-D for the contribution (#2150)
    • KeyValue Create() and Update() on a cross-domain mirrored bucket failing with nats: no response from stream. Thanks @​spicysharkco for the contribution (#2203)
    • Object Store GetFile() leaving trailing bytes of an existing destination file when downloading a shorter object. Thanks @​zhechen-cs for the contribution (#2197)
  • Service API:
    • Panic in AddService() on a closed connection (#2154)
    • Panic with send on closed channel when callbacks were queued during Stop() (#2173)
    • Service stopping on async errors from unrelated subscriptions with overlapping subjects. Async errors are now matched by subscription, recorded in endpoint stats and passed to ErrorHandler, and only a closed connection stops the service (#2174)

... (truncated)

Commits
  • 6068694 Release v1.55.0 (#2214)
  • 063b4ad [FIXED] Honor ReconnectWait after ForceReconnect during reconnect (#2179)
  • 0a4cfc1 [ADDED] JetStream: stream alternates, lost data, source external/error (#2168)
  • c3830a0 [IMPROVED] Document default MaxAckPending for legacy JetStream subscriptions ...
  • 2560ee4 [IMPROVED] Avoid per-message metadata allocations in JetStream consumers (#2212)
  • 8afc207 [FIXED] Ordered consumer Fetch deadlock and FetchNoWait redelivery (#2211)
  • d1936d7 [FIXED] Correct StopAfter pending accounting for pull consumers (#2208)
  • b431a07 [FIXED] micro: service and endpoint metadata can be changed after it is set (...
  • ef8ce42 [FIXED] micro: Reset clears the endpoint queue group in stats (#2195)
  • e28f7be [FIXED] Connection status listeners losing unread events (#2193)
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.24.1 to 1.25.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.25.0

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

What's Changed

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(go): bump the go-minor-and-patch group across 1 directory with 4…
1aad709 
… updates

Bumps the go-minor-and-patch group with 4 updates in the / directory: [github.com/caddyserver/caddy/v2](https://github.com/caddyserver/caddy), [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server), [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go) and [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang).


Updates `github.com/caddyserver/caddy/v2` from 2.11.4 to 2.11.7
- [Release notes](https://github.com/caddyserver/caddy/releases)
- [Commits](caddyserver/caddy@v2.11.4...v2.11.7)

Updates `github.com/nats-io/nats-server/v2` from 2.15.0 to 2.15.2
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md)
- [Commits](nats-io/nats-server@v2.15.0...v2.15.2)

Updates `github.com/nats-io/nats.go` from 1.54.0 to 1.55.0
- [Release notes](https://github.com/nats-io/nats.go/releases)
- [Commits](nats-io/nats.go@v1.54.0...v1.55.0)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

---
updated-dependencies:
- dependency-name: github.com/caddyserver/caddy/v2
  dependency-version: 2.11.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-and-patch
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-version: 2.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-and-patch
- dependency-name: github.com/nats-io/nats.go
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 2, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants