Bump the go-modules group with 6 updates by dependabot[bot] · Pull Request #1343 · paketo-buildpacks/python

dependabot · 2026-09-07T07:52:56Z

Bumps the go-modules group with 6 updates:

Package	From	To
github.com/ebitengine/purego	`0.10.2`	`0.11.0`
github.com/google/go-containerregistry	`0.22.0`	`0.22.1`
github.com/klauspost/compress	`1.19.2`	`1.20.0`
github.com/moby/moby/api	`1.55.0`	`1.56.0`
github.com/moby/moby/client	`0.5.1`	`0.6.0`
golang.org/x/crypto	`0.55.0`	`0.56.0`

Updates github.com/ebitengine/purego from 0.10.2 to 0.11.0

Release notes

Sourced from github.com/ebitengine/purego's releases.

v0.11.0

Require Go 1.25 or later (#469)

Support structs on Windows amd64/arm64, Android, iOS, loong64, and ppc64le (#237, #466, #473, #475)

Support structs as arguments and return values in callbacks (#225, #418)

Add NetBSD (amd64, arm64) as a Tier 2 platform (#349)

Support the ARM soft-float ABI (#490)

Support linux/s390x without Cgo (#422)

Support up to 32 arguments on 64-bit platforms (#425)

Add cstrings.NSStringToString (#438)

Fix some bugs

Commits

11ec78d all: v0.11.0 released
63002e0 purego: apply go fix modernizations (#504)
f389379 all: use range-over-int in counting loops (#503)
749871c all: use structs.HostLayout on structs that must match the C ABI (#502)
a66c0b0 purego: fix returning a C function pointer as a Go func (#500)
f2f4202 objc: encode 64-bit integers as q and Q (#499)
7d5f4c2 .github/workflows: test against Go 1.27 (#498)
f9d41fc purego: support arm soft-float abi (#494)
0960e99 all: remove zcallback_*.s from the external code list (#496)
4862512 .github/workflows: test against 1.27-rc2 (#495)
Additional commits viewable in compare view

Updates github.com/google/go-containerregistry from 0.22.0 to 0.22.1

Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.22.1

What's Changed

Reject non-canonical IP literals in all SSRF guards by @shaggyinsomniac in google/go-containerregistry#2426

daemon: fix stale docker/docker reference in WithClient docs by @BobDu in google/go-containerregistry#2428

build(deps): bump the go-deps group across 2 directories with 4 updates by @dependabot[bot] in google/go-containerregistry#2422

authn: do not overwrite AuthConfig.Auth when username and password are empty by @nileshpatil6 in google/go-containerregistry#2420

build(deps): bump the actions group across 1 directory with 8 updates by @dependabot[bot] in google/go-containerregistry#2423

Support pulling images by sha512 digest by @BobDu in google/go-containerregistry#2427

Allow empty label and annotation values in crane mutate by @theadsingh in google/go-containerregistry#2418

fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml by @tprussak in google/go-containerregistry#2434

validate: support index attestation manifests and empty configs by @Subserial in google/go-containerregistry#2414

name: improve error when parsing a reference with a URL scheme by @locker95 in google/go-containerregistry#2431

fix(build): install binaries to /ko-app and add to PATH (#2424) by @tprussak in google/go-containerregistry#2436

fix(release): honor declared Go toolchain by @rksharma-owg in google/go-containerregistry#2435

remote: apply checkRedirectSSRF to writer-side HTTP clients by @locker95 in google/go-containerregistry#2432

flatten: preserve config and layer media types when flattening by @Subserial in google/go-containerregistry#2438

fix(mutate): make Time layer updates lazy by @amarkdotdev in google/go-containerregistry#2429

build(deps): bump the go-deps group across 2 directories with 3 updates by @dependabot[bot] in google/go-containerregistry#2439

remote: copy manifest annotations to referrers fallback tag descriptors by @codysoyland in google/go-containerregistry#2441

New Contributors

@shaggyinsomniac made their first contribution in google/go-containerregistry#2426

@BobDu made their first contribution in google/go-containerregistry#2428

@nileshpatil6 made their first contribution in google/go-containerregistry#2420

@theadsingh made their first contribution in google/go-containerregistry#2418

@locker95 made their first contribution in google/go-containerregistry#2431

@rksharma-owg made their first contribution in google/go-containerregistry#2435

@codysoyland made their first contribution in google/go-containerregistry#2441

Full Changelog: google/go-containerregistry@v0.22.0...v0.22.1

Commits

8a72a42 remote: copy manifest annotations to referrers fallback tag descriptors (#2441)
5765c35 build(deps): bump the go-deps group across 2 directories with 3 updates (#2439)
969402f fix(mutate): make Time layer updates lazy (#2429)
25c682e flatten: preserve config and layer media types when flattening (#2438)
79af990 remote: add SSRF redirect protection to writer-side HTTP clients (#2432)
4b9b3c7 fix(release): honor declared Go toolchain (#2435)
e033b9c fix(build): install binaries to /ko-app and add to PATH (#2424) (#2436)
8bd7902 name: return a helpful error when a reference contains a URL scheme (#2431)
163134d validate: support index attestation manifests and empty configs (#2414)
44f7ea3 fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml (#2434)
Additional commits viewable in compare view

Updates github.com/klauspost/compress from 1.19.2 to 1.20.0

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.20.0

What's Changed

Add lzw reader/writer by @klauspost in klauspost/compress#1189

xpress: add Microsoft XPRESS (MS-XCA) decompression by @MP-GOWTHAM in klauspost/compress#1195

s2: arm64 assembly encoders, lowered from the amd64 avo program by @lizthegrey in klauspost/compress#1187

zstd, huff0: improved arm64 lowering, and narrow two table loads to MOVWQZX by @lizthegrey in klauspost/compress#1175

gzhttp: limit jitter hash to jitterBuffer bytes by @VedantMadane in klauspost/compress#1192

s2: clamp the Go EncodeBetter skip to match the assembly by @lizthegrey in klauspost/compress#1190

xxhash: bound input of non-preemptive assembly by @AskAlexSharov in klauspost/compress#1196

zstd/huff0: fold two ISA-gap x86 idioms in the avo arm64 lowering by @lizthegrey in klauspost/compress#1199

ci: test against go1.27.x, drop go1.24.x by @lizthegrey in klauspost/compress#1198

zstd/huff0: break false partial-register dependencies in seqdec/4X decoders by @lizthegrey in klauspost/compress#1197

flate: Writer L7-9 with dictionary can emit the dictionary to stream by @klauspost in klauspost/compress#1201

New Contributors

@VedantMadane made their first contribution in klauspost/compress#1192

@AskAlexSharov made their first contribution in klauspost/compress#1196

@MP-GOWTHAM made their first contribution in klauspost/compress#1195

Full Changelog: klauspost/compress@v1.19.2...v1.20.0

Commits

9d8ccb1 flate: Writer with a preset dictionary emits the dictionary into the output s...
f93f23a build(deps): bump the github-actions group with 6 updates (#1200)
42f9d96 xpress: add Microsoft XPRESS (MS-XCA) decompression (#1195)
629c2ea zstd/huff0: break false partial-register dependencies in seqdec/4X decoders (...
ba74977 ci: test against go1.27.x, drop go1.24.x (#1198)
f5c1529 zstd/huff0: pin avo peephole folds, regenerate arm64 (#1199)
73508b2 s2: arm64 assembly encoders, lowered from the amd64 avo program (#1187)
0e43f04 xxhash: bound input of non-preemptive assembly (#1196)
4005c15 s2: clamp the Go EncodeBetter skip to match the assembly (#1190)
dd6de45 gzhttp: limit jitter hash to jitterBuffer bytes (#1192)
Additional commits viewable in compare view

Updates github.com/moby/moby/api from 1.55.0 to 1.56.0

Release notes

Sourced from github.com/moby/moby/api's releases.

api/v1.56.0

1.56.0

Changelog

GET /containers/json now supports an annotation filter to filter containers by annotation, either by key (annotation=key) or by key and value (annotation="key=value"), similar to the existing label filter. moby/moby#53538

POST /containers/create now supports HostConfig.Umask to set the initial umask for a Unix container. When set, the daemon includes the value in the OCI process configuration for the container's entrypoint, exec processes, and healthchecks. When omitted, the runtime's default behavior applies.moby/moby#53463

api/docs: sync API docs v1.25 - v1.55. moby/moby#53246

api/swagger: Align Healthcheck name with Go struct. moby/moby#53567

api/types/plugin: Deprecated plugin.Privileges sorting methods in favor of slices.SortFunc. moby/moby#53511

api/types/plugin: fix Privileges Swap implementation. moby/moby#53510

api: Bump to 1.56. moby/moby#53425

api: document Task.NetworksAttachments in the swagger definition. moby/moby#53082

api: remove gotest.tools from tests. moby/moby#53535

api: swagger: Use int64 for build query params. moby/moby#53520

api: use blackbox testing. moby/moby#53525

Fix API reference documenting an unsupported names filter for GET /configs. moby/moby#53447

Commits

9b2179d Merge pull request #53572 from vvoland/api-docs-cut
575cf82 Merge pull request #53571 from thaJeztah/bump_tools
20beedb api/docs: Cut v1.56
bb86302 Merge pull request #53569 from vvoland/afvsock-lsm
65be55a Merge pull request #53513 from thaJeztah/daemon_fix_list
0af79c4 Merge pull request #53570 from vvoland/process-release
7d1ce6a Merge pull request #53568 from renovate-bot/renovate/github.com-mdlayher-sock...
0df1a00 Dockerfile: update cli v29.7.2, compose v5.5.1, buildx v0.37.0
e1d06bd Drop replace rules
b40d37e Merge pull request #53359 from vvoland/ext-namegenerator
Additional commits viewable in compare view

Updates github.com/moby/moby/client from 0.5.1 to 0.6.0

Release notes

Sourced from github.com/moby/moby/client's releases.

client/v0.6.0

0.6.0

Changelog

pkg/jsonmessage: add new WithMessagePrinter option to use a custom printer for messages. moby/moby#53489

api: Bump to 1.56. moby/moby#53425

minor cleanups, refactors. moby/moby#53509

Changelog

Sourced from github.com/moby/moby/client's changelog.

0.6.0 (2013-08-22)

Runtime: Load authConfig only when needed and fix useless WARNING

Runtime: Add lxc-conf flag to allow custom lxc options

Runtime: Fix race conditions in parallel pull

Runtime: Improve CMD, ENTRYPOINT, and attach docs.

Documentation: Small fix to docs regarding adding docker groups

Documentation: Add MongoDB image example

Builder: Add USER instruction do Dockerfile

Documentation: updated default -H docs

Remote API: Sort Images by most recent creation date.

Builder: Add workdir support for the Buildfile

Runtime: Add an option to set the working directory

Runtime: Show tag used when image is missing

Documentation: Update readme with dependencies for building

Documentation: Add instructions for creating and using the docker group

Remote API: Reworking opaque requests in registry module

Runtime: Fix Graph ByParent() to generate list of child images per parent image.

Runtime: Add Image name to LogEvent tests

Documentation: Add sudo to examples and installation to documentation

Hack: Bash Completion: Limit commands to containers of a relevant state

Remote API: Add image name in /events

Runtime: Apply volumes-from before creating volumes

Runtime: Make docker run handle SIGINT/SIGTERM

Runtime: Prevent crash when .dockercfg not readable

Hack: Add docker dependencies coverage testing into docker-ci

Runtime: Add -privileged flag and relevant tests, docs, and examples

Packaging: Docker-brew 0.5.2 support and memory footprint reduction

Runtime: Install script should be fetched over https, not http.

Packaging: Add new docker dependencies into docker-ci

Runtime: Use Go 1.1.2 for dockerbuilder

Registry: Improve auth push

Runtime: API, issue 1471: Use groups for socket permissions

Documentation: PostgreSQL service example in documentation

Contrib: bash completion script

Tests: Improve TestKillDifferentUser to prevent timeout on buildbot

Documentation: Fix typo in docs for docker run -dns

Documentation: Adding a reference to ps -a

Runtime: Correctly detect IPv4 forwarding

Packaging: Revert "docker.upstart: avoid spawning a sh process"

Runtime: Use ranged for loop on channels

Runtime: Fix typo: fmt.Sprint -> fmt.Sprintf

Tests: Fix typo in TestBindMounts (runContainer called without image)

Runtime: add websocket support to /container//attach/ws

Runtime: Mount /dev/shm as a tmpfs

Builder: Only count known instructions as build steps

Builder: Fix docker build and docker events output

Runtime: switch from http to https for get.docker.io

Tests: Improve TestGetContainersTop so it does not rely on sleep

Packaging: Docker-brew and Docker standard library

Testing: Add some tests in server and utils

... (truncated)

Commits

f4a4f1c Bump to 0.6.0
f925edd Merge pull request #1525 from griff/1503-fix
12715c8 Merge pull request #1609 from jpetazzo/release-docker-with-docker
326dadd Merge pull request #1565 from dotcloud/only_load_authconfig_when_needed
a3510c9 Merge pull request #1560 from dotcloud/439-allow-lxc-args
262d57e Merge pull request #1623 from mhennings/1592-fix-race-conditions-in-parallel-...
551092f Add lxc-conf flag to allow custom lxc options
3f802f4 Fix race conditions in parallel pull
0b9c8e2 Merge pull request #1596 from metalivedev/1149-easyfixes
42fe550 Merge pull request #1614 from denibertovic/docs
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.55.0 to 0.56.0

Commits

86efde5 ssh: reject unexpected message types on established channels
a6cdac6 ssh: drop traffic on undecided channels
39dc44e ssh: don't skip the source-address critical option in CheckCert
afebf4c x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+
89f4e9b x509roots/fallback: update bundle
71488c4 ssh/knownhosts: compare only public key portions for revocation
82adefa ssh: synchronize unexpected response test
c757c98 all: upgrade go directive to at least 1.26.0 [generated]
593c81a ssh: correctly ignore pre-banner lines
46efc8b acme: add crypto.SignMessage test coverage
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-modules group with 6 updates: | Package | From | To | | --- | --- | --- | | [github.com/ebitengine/purego](https://github.com/ebitengine/purego) | `0.10.2` | `0.11.0` | | [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.22.0` | `0.22.1` | | [github.com/klauspost/compress](https://github.com/klauspost/compress) | `1.19.2` | `1.20.0` | | [github.com/moby/moby/api](https://github.com/moby/moby) | `1.55.0` | `1.56.0` | | [github.com/moby/moby/client](https://github.com/moby/moby) | `0.5.1` | `0.6.0` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.55.0` | `0.56.0` | Updates `github.com/ebitengine/purego` from 0.10.2 to 0.11.0 - [Release notes](https://github.com/ebitengine/purego/releases) - [Commits](ebitengine/purego@v0.10.2...v0.11.0) Updates `github.com/google/go-containerregistry` from 0.22.0 to 0.22.1 - [Release notes](https://github.com/google/go-containerregistry/releases) - [Commits](google/go-containerregistry@v0.22.0...v0.22.1) Updates `github.com/klauspost/compress` from 1.19.2 to 1.20.0 - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](klauspost/compress@v1.19.2...v1.20.0) Updates `github.com/moby/moby/api` from 1.55.0 to 1.56.0 - [Release notes](https://github.com/moby/moby/releases) - [Commits](moby/moby@api/v1.55.0...api/v1.56.0) Updates `github.com/moby/moby/client` from 0.5.1 to 0.6.0 - [Release notes](https://github.com/moby/moby/releases) - [Changelog](https://github.com/moby/moby/blob/v0.6.0/CHANGELOG.md) - [Commits](moby/moby@v0.5.1...v0.6.0) Updates `golang.org/x/crypto` from 0.55.0 to 0.56.0 - [Commits](golang/crypto@v0.55.0...v0.56.0) --- updated-dependencies: - dependency-name: github.com/ebitengine/purego dependency-version: 0.11.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/google/go-containerregistry dependency-version: 0.22.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: go-modules - dependency-name: github.com/klauspost/compress dependency-version: 1.20.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/moby/moby/api dependency-version: 1.56.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: github.com/moby/moby/client dependency-version: 0.6.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules - dependency-name: golang.org/x/crypto dependency-version: 0.56.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: go-modules ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 7, 2026

dependabot Bot requested review from a team as code owners September 7, 2026 07:52

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 7, 2026

paketo-bot added the semver:patch A change requiring a patch version bump label Sep 7, 2026

paketo-bot-reviewer approved these changes Sep 7, 2026

View reviewed changes

paketo-bot merged commit 78cd932 into main Sep 7, 2026
8 of 9 checks passed

paketo-bot deleted the dependabot/go_modules/go-modules-384edc2e99 branch September 7, 2026 08:04

Navigation Menu

Uh oh!

Bump the go-modules group with 6 updates - #1343

Bump the go-modules group with 6 updates#1343
paketo-bot merged 1 commit into
mainfrom
dependabot/go_modules/go-modules-384edc2e99

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026

v0.11.0

v0.22.1

What's Changed

New Contributors

v1.20.0

What's Changed

New Contributors

api/v1.56.0

1.56.0

Changelog

client/v0.6.0

0.6.0

Changelog

0.6.0 (2013-08-22)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants