Skip to content

Bump the go-minor-and-patch group across 1 directory with 7 updates - #20

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/apps/desktop/go-minor-and-patch-0f5895f24d
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/apps/desktop/go-minor-and-patch-0f5895f24d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-minor-and-patch group with 7 updates in the /apps/desktop directory:

Package From To
github.com/klauspost/compress 1.19.1 1.20.3
github.com/pierrec/lz4/v4 4.1.27 4.1.33
github.com/wailsapp/wails/v2 2.16.0 2.17.0
golang.org/x/crypto 0.57.0 0.58.0
golang.org/x/mod 0.41.0 0.42.0
golang.org/x/sys 0.48.0 0.49.0
golang.org/x/text 0.42.0 0.43.0

Updates github.com/klauspost/compress from 1.19.1 to 1.20.3

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.20.3

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.20.1...v1.20.3

v1.20.2

Full Changelog: klauspost/compress@v1.20.1...v1.20.2

v1.20.1

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.20.0...v1.20.1

... (truncated)

Commits
  • b946d41 Revert #1255 (#1261)
  • 748550b Merge commit from fork
  • dd54d86 huff0: reuse Scratch across inputs in the fuzzers (#1257)
  • d189b4c gzhttp: do not compress 206 responses without Content-Range, read Accept-Enco...
  • 6b91995 zstd, huff0: keep the encoder bit writers in registers (#1245)
  • 402c3a5 s2: Reject short index chunk in RemoveIndexHeaders (#1254)
  • 29f5f81 build(deps): bump the github-actions group with 4 updates (#1252)
  • 9b8ba61 dict: Stricter input validation (#1250)
  • da4df9c zstd: decode at full speed into exact-size destinations (#1246)
  • 1971eec reject zip entries named "." in ReadDir (#1249)
  • Additional commits viewable in compare view

Updates github.com/pierrec/lz4/v4 from 4.1.27 to 4.1.33

Release notes

Sourced from github.com/pierrec/lz4/v4's releases.

v4.1.33

No release notes provided.

v4.1.32

No release notes provided.

v4.1.31

No release notes provided.

v4.1.30

Multiple contributed fixes and performance enhancements.

Commits
  • b3ae24d lz4: document OnBlockDone concurrency
  • d9853db xxh32: fix a stale BlockSize comment
  • 4972926 lz4stream: stop shadowing the data channel in initR
  • 6374928 lz4: drop an else after return in CompressingReader
  • 6b13fb9 lz4: clean up comments
  • 0a60c23 Merge pull request #277 from honeycombio/lizf.testdata-licensing
  • 3b766df testdata: record where each file comes from and its licence
  • d9034fe testdata: replace the bzImage sample with a C-made legacy frame of text
  • 2baa0ce Merge pull request #276 from honeycombio/lizf.legacy-writer-bound
  • b9c03e8 Merge pull request #275 from honeycombio/lizf.lz4c-install
  • Additional commits viewable in compare view

Updates github.com/wailsapp/wails/v2 from 2.16.0 to 2.17.0

Release notes

Sourced from github.com/wailsapp/wails/v2's releases.

Wails v2.17.0

Installation

go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.0

Changes

Security

  • Windows notifications no longer fall back to PowerShell when the WinRT toast API fails; the error is returned instead
  • wails init now warns that remote templates are code: the frontend:* commands in wails.json and the scripts they call run during wails build and wails dev. The warning lists the commands found in the generated wails.json and is also shown with -q. The template docs now describe this trust boundary.
  • Hardened the wails dev server against cross-origin and DNS-rebinding attacks on the IPC WebSocket. It previously accepted any origin and forwarded straight to the bound-method dispatcher, so a malicious page in the developer's browser could connect to ws://localhost:34115/wails/ipc and invoke the entire bound Go API. Every request's Host header is now checked against an allowlist (localhost, IP literals, the configured bind address, plus any hosts named in WAILS_DEV_ALLOWED_HOSTS), the IPC upgrade requires a same-origin Origin header, and a per-launch capability cookie (HttpOnly, SameSite=Strict) is required on the upgrade as defense in depth; the cookie is named per dev server port and refreshed before each reconnect, so open browser tabs reconnect after wails dev restarts the app. This protects against browser-based attacks; other processes running as the developer's own user are outside the dev server's threat model by @​nft

Changed

  • Replaced the github.com/wailsapp/mimetype fork with upstream github.com/gabriel-vasile/mimetype v1.4.16 for asset MIME type detection

The wails dev hardening comes from #6036 by @​nft, merged as part of #6288.

Also includes v2.15.0 and v2.16.0

v2.15.0 and v2.16.0 were tagged without GitHub releases. Their changes are part of this release:

v2.16.0

  • Fixed a memory leak in the macOS and Linux frontends where Calloc never freed the C strings it allocated for dialogs, menus and window setup by @​4RH1T3CT0R7

v2.15.0

  • Added EnableAutoplayWithoutUserAction macOS webview preference to allow HTML5 media to autoplay without a user gesture #5512 by @​Eyalm321

What's Changed

Commits
  • 60b1ff7 release: v2.17.0
  • e0a16fe chore(changelog): auto-add entry for PR #6293 — fix(v2/release): pin pnpm 10 ...
  • 3372105 fix(v2/release): pin pnpm 10 for the versioned docs step (#6293)
  • 6ff186e chore(v3): bump to v3.0.0-beta.31 and update changelog
  • a8e0605 Merge pull request #6292 from wailsapp/ci/go-1.26-1.27
  • 5caf16d fix(v3/generator): keep bindings stable when encoding/json aliases json/v2
  • 011af5b ci: run required PR checks for pull requests into releases/**
  • a3f4211 ci: test on Go 1.26 and 1.27 and stop silent toolchain downloads
  • b6f7849 chore(v3): build with Go 1.26 and refresh golang.org/x modules
  • 1375299 ci(v3): always run Build + Test v3 so its results job can be required (#6291)
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.57.0 to 0.58.0

Commits
  • 8fdf07b go.mod: update golang.org/x dependencies
  • 2437861 salsa20: fix keystream reuse in LoongArch LSX tail
  • c3db4df acme: prefer test log helpers in test contexts
  • 4e01a84 acme: adds support for profiles draft
  • 8f0f111 ssh: check that no Unicode-aware string function is used
  • b39ff6d ssh: add certificate algorithms for ML-DSA keys
  • 4465db3 ssh: add the ML-DSA public key algorithms
  • 83e695b ssh: implement ETM mode for CBC ciphers
  • 946083a ssh: only drop a trailing carriage return
  • 543dde9 ssh: accept known_hosts entries with a multi-word comment
  • Additional commits viewable in compare view

Updates golang.org/x/mod from 0.41.0 to 0.42.0

Commits
  • b5136e5 sumdb/tlog: use recorded responses in TestCertificateTransparency
  • 1e9a5ae go.mod: update golang.org/x dependencies
  • See full diff in compare view

Updates golang.org/x/sys from 0.48.0 to 0.49.0

Commits
  • b6b8557 unix/linux: unify ppc64x syscall wrappers
  • aab6988 unix: add PrctlArg5Ptr
  • cdfd984 unix: pass fcntl data as unsafe.Pointer in FcntlF{lock,store} on darwin
  • 782b836 unix/linux: don't warn about closed stderr from child process
  • 61592fb unix: return syscall error in *listxattrNS on BSD
  • c136fda unix/linux/Dockerfile: update to Go 1.26.8
  • f1d0d79 unix: pass xattr data as unsafe.Pointer in BSD xattr syscalls
  • 67f850b unix: update linux to v7.2
  • eb1f659 unix: add O_EXEC and O_SEARCH on darwin
  • 51bc731 unix: add Mmsghdr for linux
  • Additional commits viewable in compare view

Updates golang.org/x/text from 0.42.0 to 0.43.0

Commits
  • ac40b0f go.mod: update golang.org/x dependencies
  • 6dcc5b6 unicode/bidi: avoid quadratic behavior in Paragraph.Order and Paragraph.Line
  • d0ecd29 secure/bidirule: lazily precompute ASCII table
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-minor-and-patch group with 7 updates in the /apps/desktop directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/klauspost/compress](https://github.com/klauspost/compress) | `1.19.1` | `1.20.3` |
| [github.com/pierrec/lz4/v4](https://github.com/pierrec/lz4) | `4.1.27` | `4.1.33` |
| [github.com/wailsapp/wails/v2](https://github.com/wailsapp/wails) | `2.16.0` | `2.17.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.41.0` | `0.42.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.48.0` | `0.49.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.42.0` | `0.43.0` |



Updates `github.com/klauspost/compress` from 1.19.1 to 1.20.3
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](klauspost/compress@v1.19.1...v1.20.3)

Updates `github.com/pierrec/lz4/v4` from 4.1.27 to 4.1.33
- [Release notes](https://github.com/pierrec/lz4/releases)
- [Commits](pierrec/lz4@v4.1.27...v4.1.33)

Updates `github.com/wailsapp/wails/v2` from 2.16.0 to 2.17.0
- [Release notes](https://github.com/wailsapp/wails/releases)
- [Commits](wailsapp/wails@v2.16.0...v2.17.0)

Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0
- [Commits](golang/crypto@v0.57.0...v0.58.0)

Updates `golang.org/x/mod` from 0.41.0 to 0.42.0
- [Commits](golang/mod@v0.41.0...v0.42.0)

Updates `golang.org/x/sys` from 0.48.0 to 0.49.0
- [Commits](golang/sys@v0.48.0...v0.49.0)

Updates `golang.org/x/text` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.42.0...v0.43.0)

---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.20.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: github.com/pierrec/lz4/v4
  dependency-version: 4.1.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-and-patch
- dependency-name: github.com/wailsapp/wails/v2
  dependency-version: 2.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: golang.org/x/mod
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: golang.org/x/sys
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: golang.org/x/text
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 22, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants