Skip to content

chore(deps): bump the go_modules group across 1 directory with 7 updates#1925

Merged
RafilxTenfen merged 4 commits intomainfrom
dependabot/go_modules/go_modules-37283e3fdd
Feb 19, 2026
Merged

chore(deps): bump the go_modules group across 1 directory with 7 updates#1925
RafilxTenfen merged 4 commits intomainfrom
dependabot/go_modules/go_modules-37283e3fdd

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Jan 13, 2026

Bumps the go_modules group with 7 updates in the / directory:

Package From To
github.com/ethereum/go-ethereum 1.15.11 1.16.8
github.com/go-viper/mapstructure/v2 2.2.1 2.4.0
golang.org/x/crypto 0.41.0 0.45.0
github.com/docker/docker 25.0.6+incompatible 25.0.13+incompatible
github.com/hashicorp/go-getter 1.7.8 1.7.9
github.com/opencontainers/runc 1.1.12 1.2.8
github.com/ulikunitz/xz 0.5.11 0.5.14

Updates github.com/ethereum/go-ethereum from 1.15.11 to 1.16.8

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Moisture Filters (v1.16.8)

This is a security fix release and is recommended for all users. It resolves two p2p vulnerabilities reported through the Ethereum Foundation bug bounty program.

As with all our previous releases, you can find the:

Ballistic Drift Stabilizer (v1.16.7)

This is a re-roll of v1.16.6, including an important fix in the KZG cryptography library.

This release enables the Fusaka hardfork on Ethereum mainnet.

The Fusaka fork is scheduled to occur at 2025-12-03 21:49:11 UTC. Please upgrade your node to v1.16.7 in time for the fork.

This release also enables two blob-parameter-only (BPO) upgrades. These upgrades change protocol parameters to increase the available blob capacity.

  • BPO1 on2025-12-09
  • BPO2 on 2026-01-07

Fusaka

  • Set mainnet timestamps for Osaka (#33063)
  • Enable Fusaka for geth --dev mode (#32917)

RPC

  • Add eth_sendRawTransactionSync which waits until either a timeout or the transaction is mined. This feature is mostly useful on L2s with lower blocktimes. (#32830, #32930, #32929)
  • Add support for eth_simulateV1 in ethclient (#32856)
  • Fix for an issue that might crash debug_traceCall (#33015)
  • Fix for an issuer where local transactions were not persisted to the journal (#32921)

Core

  • Fix for a cryptographic vulnerability in c-kzg-4844. This is only exploitable post-Fusaka. (#33093)
  • Add geth --genesis flag as an alternative to running geth init genesis.json (#32844)
  • Fix for receipt insertion during ERA file import. (#32934)
  • Work on getting the trie node history in order to serve historical eth_getProof request with the new path-based archive node. (#32907, #32914, #32937)
  • Further work on cmd/keeper, our guest program for zkVMs (#32816)
  • Various optimizations (#32971, #32916, #32965, #32946)

... (truncated)

Commits
  • abeb78c Merge branch 'dos-fixes' into release/1.16
  • ce43eb9 version: release go-ethereum v1.16.8 stable
  • 638741b crypto/ecies: use aes blocksize
  • fdfd123 core/txpool: drop peers on invalid KZG proofs
  • 8ecb686 version: begin v1.16.8 release cycle
  • b9f3a3d Merge branch 'master' into release/1.16
  • 07129d2 version: release go-ethereum v1.16.7 stable
  • 653f8d4 go.mod: update to c-kzg v2.1.5 (#33093)
  • 5b77af3 version: begin v1.16.7 release cycle
  • 386c3de Merge branch 'master' into release/1.16
  • Additional commits viewable in compare view

Updates github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.4.0

Release notes

Sourced from github.com/go-viper/mapstructure/v2's releases.

v2.4.0

What's Changed

New Contributors

Full Changelog: go-viper/mapstructure@v2.3.0...v2.4.0

v2.3.0

What's Changed

New Contributors

Full Changelog: go-viper/mapstructure@v2.2.1...v2.3.0

Commits

Updates golang.org/x/crypto from 0.41.0 to 0.45.0

Commits
  • 4e0068c go.mod: update golang.org/x dependencies
  • e79546e ssh: curb GSSAPI DoS risk by limiting number of specified OIDs
  • f91f7a7 ssh/agent: prevent panic on malformed constraint
  • 2df4153 acme/autocert: let automatic renewal work with short lifetime certs
  • bcf6a84 acme: pass context to request
  • b4f2b62 ssh: fix error message on unsupported cipher
  • 79ec3a5 ssh: allow to bind to a hostname in remote forwarding
  • 122a78f go.mod: update golang.org/x dependencies
  • c0531f9 all: eliminate vet diagnostics
  • 0997000 all: fix some comments
  • Additional commits viewable in compare view

Updates github.com/docker/docker from 25.0.6+incompatible to 25.0.13+incompatible

Release notes

Sourced from github.com/docker/docker's releases.

v25.0.13

25.0.13

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

Bug fixes and enhancements

  • Prevent restoration of iptables rules for deleted networks and containers on firewalld reload. moby/moby#50445
  • Fix Swarm services becoming unreachable from published ports after a firewalld reload. moby/moby#50445
  • Improve the reliability of the Swarm overlay network control plane by fixing longstanding issues with NetworkDB. moby/moby#50511
  • Improve the reliability of Swarm overlay container networks by fixing longstanding issues with the overlay network driver. moby/moby#50551

v25.0.12

25.0.12

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

Bug fixes and enhancements

  • Fix an issue where all new tasks in the Swarm could get stuck in the PENDING state forever after scaling up a service with placement preferences. moby/moby#50203
  • Fix an issue which made DNS service discovery for Swarm services unreliable. moby/moby#50230

Packaging updates

v25.0.11

25.0.11

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

Networking

Known Issues

Full Changelog: moby/moby@v25.0.10...v25.0.11

v25.0.10

25.0.10

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

... (truncated)

Commits
  • 165516e Merge pull request #50551 from corhere/backport-25.0/libn/all-the-overlay-fixes
  • f099e91 libnetwork: handle coalesced endpoint events
  • bace1b8 libnetwork/d/overlay: handle coalesced peer updates
  • f9e5429 libn/d/win/overlay: dedupe NetworkDB definitions
  • fc3df55 libn/d/overlay: extract hashable address types
  • b22872a libnetwork/driverapi: make EventNotify optional
  • c7e17ae libn/networkdb: report prev value in update events
  • d60c71a libnetwork/d/overlay: fix logical race conditions
  • ad54b8f libn/d/overlay: fix encryption race conditions
  • 8075689 libn/d/overlay: inline secMapWalk into only caller
  • Additional commits viewable in compare view

Updates github.com/hashicorp/go-getter from 1.7.8 to 1.7.9

Release notes

Sourced from github.com/hashicorp/go-getter's releases.

v1.7.9

What's Changed

New Contributors

Full Changelog: hashicorp/go-getter@v1.7.8...v1.7.9

Commits
  • e702211 Merge pull request #532 from hashicorp/dependabot/github_actions/actions-8948...
  • df0a14f [chore] : Bump the actions group with 8 updates
  • 87541b2 fix: go-getter subdir paths (#540)
  • 3713030 [Compliance] - PR Template Changes Required
  • af2dd3c Merge pull request #529 from hashicorp/dependabot-intge
  • bf52629 updating dependabot.yml
  • 1f63e10 changelog added, updated dependabot.yaml
  • 45af459 fix additional lint errors and increase linter scope
  • c8c6aba fix errcheck lint errors and run it as part of pr checks
  • 9b76f98 copywrite header added
  • Additional commits viewable in compare view

Updates github.com/opencontainers/runc from 1.1.12 to 1.2.8

Release notes

Sourced from github.com/opencontainers/runc's releases.

runc v1.2.8 -- "鳥籠の中に囚われた屈辱を"

[!NOTE] Some vendors were given a pre-release version of this release. This public release includes two extra patches to fix regressions discovered very late during the embargo period and were thus not included in the pre-release versions. Please update to this version.

This release contains fixes for three high-severity security vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881). All three vulnerabilities ultimately allow (through different methods) for full container breakouts by bypassing runc's restrictions for writing to arbitrary /proc files.

Security

  • CVE-2025-31133 exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's /dev/null inode on top of the file. However, if an attacker can replace /dev/null with a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.

  • CVE-2025-52565 is very similar in concept and application to CVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount (to /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount the symlink target over /dev/console. This issue affected all versions of runc >= 1.0.0-rc3.

  • CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation we applied for CVE-2019-19921 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files. This issue affects all known runc versions.

Static Linking Notices

The runc binary distributed with this release are statically linked with the following GNU LGPL-2.1 licensed libraries, with runc acting as a "work that uses the Library":

... (truncated)

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.2.8] - 2025-11-05

鳥籠の中に囚われた屈辱を

Security

This release includes fixes for the following high-severity security issues:

  • CVE-2025-31133 exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's /dev/null inode on top of the file. However, if an attacker can replace /dev/null with a symlink to some other procfs file, runc will instead bind-mount the symlink target read-write. This issue affected all known runc versions.

  • CVE-2025-52565 is very similar in concept and application to CVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount (to /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount the symlink target over /dev/console. This issue affected all versions of runc >= 1.0.0-rc3.

  • CVE-2025-52881 is a more sophisticated variant of CVE-2019-19921, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation we applied for CVE-2019-19921 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files. This issue affects all known runc versions.

[1.4.0-rc.2] - 2025-10-10

私の役目は信じるかどうかではない。行うかどうかだ。

libcontainer API

  • The deprecated libcontainer/userns package has been removed; use github.com/moby/sys/userns instead. (#4910, #4911)

Added

  • Allow setting user.* sysctls for user-namespaced containers, as they are namespaced and thus safe to configure. (#4889, #4892)
  • Add support for using clone3(2)'s CLONE_INTO_CGROUP flag when configuring the runc exec process. This also included some internal changes to how we add processes to containers. (#4822, #4812, #4920)
  • Add support for configuring the NUMA pmemory policy for a container with set_mempolicy(2)opencontainers/runtime-spec#1282#4726, #4915)

... (truncated)

Commits
  • eeb7e60 VERSION: release v1.2.8
  • cdee962 merge private security patches into ghsa-release-1.2.8
  • b4cb2f5 rootfs: re-allow dangling symlinks in mount targets
  • ee56b85 openat2: improve resilience on busy systems
  • 2462b68 Merge pull request #4943 from lifubang/backport-1.2-4934-4937
  • 99e41a5 ci: only run lint-extra job on PRs to main
  • f2a1c98 CI: remove deprecated lima-vm/lima-actions/ssh
  • 8f90185 selinux: use safe procfs API for labels
  • 948d6e9 rootfs: switch to fd-based handling of mountpoint targets
  • 7aa42ad libct: align param type for mountCgroupV1/V2 functions
  • Additional commits viewable in compare view

Updates github.com/ulikunitz/xz from 0.5.11 to 0.5.14

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jan 13, 2026
@dependabot dependabot Bot requested a review from a team as a code owner January 13, 2026 22:08
@dependabot dependabot Bot requested review from Lazar955 and RafilxTenfen and removed request for a team January 13, 2026 22:08
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jan 13, 2026
@RafilxTenfen RafilxTenfen self-assigned this Jan 14, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Feb 19, 2026 •
edited
Loading

🔐 Commit Signature Verification

✅ All 4 commit(s) passed verification

Commit Author Signature Key Type Key Check
a387008bd5bb RafilxTenfen ✅ sk-ssh-ed25519 ✅
40f100e5652f RafilxTenfen ✅ sk-ssh-ed25519 ✅
fd4195a82c86 RafilxTenfen ✅ sk-ssh-ed25519 ✅
259f198e1990 dependabot[bot] ✅ sk-ssh-ed25519 ✅

Summary

  • Commits verified: 4
  • Signature check: ✅ All passed
  • Key type enforcement: ✅ All sk-ssh-ed25519

Required key type: sk-ssh-ed25519 (FIDO2 hardware key)

Last verified: 2026-02-19 20:25 UTC

dependabot Bot and others added 3 commits February 19, 2026 17:22
@dependabot @RafilxTenfen
chore(deps): bump the go_modules group across 1 directory with 7 updates
259f198 
Bumps the go_modules group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum) | `1.15.11` | `1.16.8` |
| [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) | `2.2.1` | `2.4.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.41.0` | `0.45.0` |
| [github.com/docker/docker](https://github.com/docker/docker) | `25.0.6+incompatible` | `25.0.13+incompatible` |
| [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter) | `1.7.8` | `1.7.9` |
| [github.com/opencontainers/runc](https://github.com/opencontainers/runc) | `1.1.12` | `1.2.8` |
| [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) | `0.5.11` | `0.5.14` |

Updates `github.com/ethereum/go-ethereum` from 1.15.11 to 1.16.8
- [Release notes](https://github.com/ethereum/go-ethereum/releases)
- [Commits](ethereum/go-ethereum@v1.15.11...v1.16.8)

Updates `github.com/go-viper/mapstructure/v2` from 2.2.1 to 2.4.0
- [Release notes](https://github.com/go-viper/mapstructure/releases)
- [Changelog](https://github.com/go-viper/mapstructure/blob/main/CHANGELOG.md)
- [Commits](go-viper/mapstructure@v2.2.1...v2.4.0)

Updates `golang.org/x/crypto` from 0.41.0 to 0.45.0
- [Commits](golang/crypto@v0.41.0...v0.45.0)

Updates `github.com/docker/docker` from 25.0.6+incompatible to 25.0.13+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](moby/moby@v25.0.6...v25.0.13)

Updates `github.com/hashicorp/go-getter` from 1.7.8 to 1.7.9
- [Release notes](https://github.com/hashicorp/go-getter/releases)
- [Commits](hashicorp/go-getter@v1.7.8...v1.7.9)

Updates `github.com/opencontainers/runc` from 1.1.12 to 1.2.8
- [Release notes](https://github.com/opencontainers/runc/releases)
- [Changelog](https://github.com/opencontainers/runc/blob/main/CHANGELOG.md)
- [Commits](opencontainers/runc@v1.1.12...v1.2.8)

Updates `github.com/ulikunitz/xz` from 0.5.11 to 0.5.14
- [Commits](ulikunitz/xz@v0.5.11...v0.5.14)

---
updated-dependencies:
- dependency-name: github.com/ethereum/go-ethereum
  dependency-version: 1.16.8
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/go-viper/mapstructure/v2
  dependency-version: 2.4.0
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/docker/docker
  dependency-version: 25.0.13+incompatible
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/hashicorp/go-getter
  dependency-version: 1.7.9
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/opencontainers/runc
  dependency-version: 1.2.8
  dependency-type: indirect
  dependency-group: go_modules
- dependency-name: github.com/ulikunitz/xz
  dependency-version: 0.5.14
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <[email protected]>
@RafilxTenfen
tryfix: bump deps
fd4195a
@RafilxTenfen
chore: add #1906 to cl
40f100e
@RafilxTenfen RafilxTenfen force-pushed the dependabot/go_modules/go_modules-37283e3fdd branch from bbc384b to 40f100e Compare February 19, 2026 20:23
@RafilxTenfen RafilxTenfen merged commit 706406a into main Feb 19, 2026
87 of 90 checks passed
@RafilxTenfen RafilxTenfen deleted the dependabot/go_modules/go_modules-37283e3fdd branch February 19, 2026 21:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@RafilxTenfen RafilxTenfen RafilxTenfen approved these changes

@Lazar955 Lazar955 Awaiting requested review from Lazar955 Lazar955 is a code owner automatically assigned from babylonlabs-io/core-dev

@KonradStaniec KonradStaniec Awaiting requested review from KonradStaniec

Assignees

@RafilxTenfen RafilxTenfen

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@RafilxTenfen