Skip to content

fix(deps): update backend dependencies - #831

Merged
zoltanbedi merged 1 commit into
mainfrom
renovate/backend-dependencies
Nov 2, 2026
Merged

fix(deps): update backend dependencies#831
zoltanbedi merged 1 commit into
mainfrom
renovate/backend-dependencies

Conversation

@renovate-sh-app

@renovate-sh-app renovate-sh-app Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update
github.com/goccy/go-json v0.11.2 → v0.12.0 age confidence indirect minor
github.com/grafana/grafana-plugin-sdk-go v0.297.0 → v0.298.0 age confidence require minor
github.com/grpc-ecosystem/grpc-gateway/v2 v2.32.0 → v2.33.0 age confidence indirect minor
github.com/prometheus/common v0.72.1 → v0.73.1 age confidence indirect minor
github.com/prometheus/procfs v0.22.0 → v0.23.0 age confidence indirect minor
golang.org/x/net v0.61.0 → v0.62.0 age confidence indirect minor
google.golang.org/genproto/googleapis/api ce908d2 → 2ffab32 age confidence indirect digest
google.golang.org/genproto/googleapis/rpc ce908d2 → 2ffab32 age confidence indirect digest

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

CVE-2026-78661 / GO-2026-6860

More information

Details

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies.

Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

CVE-2026-97045 / GO-2026-6866

More information

Details

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or fostered under ), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.

Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

goccy/go-json (github.com/goccy/go-json)

v0.12.0

Compare Source

What's Changed

  • Encoder: call a pointer-receiver marshaler with the address of a pointer-sized value by @​goccy in #​692
  • Add github.com/goccy/go-json/jsontext, faster than encoding/json/jsontext by @​goccy in #​689
  • Share number, string and formatting code between v1 and jsontext, and fix v1 deviations by @​goccy in #​693
  • Look up a type the recent opcodes miss in the shared table without a call by @​goccy in #​674
  • Prepare the encoder and jsontext for github.com/goccy/go-json/v2 by @​goccy in #​695
  • Add the compile mode of the encoding/json/v2 semantics to the encoder by @​goccy in #​696
  • Add github.com/goccy/go-json/v2 with Marshal, MarshalWrite and MarshalEncode by @​goccy in #​698
  • Add MarshalOf and MarshalWriteOf to github.com/goccy/go-json/v2, and benchmark the v2 encoder by @​goccy in #​699
  • Report the coverage by octocov instead of Codecov by @​goccy in #​700
  • Decoder: follow an embedded pointer to an unexported struct which is set by @​minhnhathoang in #​697
  • Encoder: read maps by values of their own size, and detect cycles through map values by @​goccy in #​704
  • Encoder: fix crashes on maps of keys of no size and of values of an interface type with methods by @​goccy in #​705
  • Encoder: record the values of cycle detection by their types, and a pointer in an interface by itself by @​goccy in #​706
  • v2: fix panics on keys of an interface type with methods and on misuse of a method's encoder by @​goccy in #​707
  • jsontext: fail an attached encoder which ends the level it is attached in by @​goccy in #​708
  • v2: fail the value of a method when a call of MarshalEncode within it fails by @​goccy in #​709
  • v2: detect cycles through declined values and MarshalEncode called by methods by @​goccy in #​710
  • v2: write json.Number as a number and fail time.Duration map keys by @​goccy in #​711
  • v2: rewrite only raw values by the options which rewrite raw values by @​goccy in #​712
  • Encode json.Number and pointer map keys by their names by @​goccy in #​713
  • v2: give the string option of a field to its methods and functions by @​goccy in #​714
  • v2: name keys in interfaces and behind pointers by the functions of their values by @​goccy in #​715
  • v2: escape field names for JavaScript and keep the escapes of nested calls by @​goccy in #​716
  • Fail values nested deeper than 10000 levels by @​goccy in #​717
  • v2: keep nothing of the caller's output in the state of MarshalEncode by @​goccy in #​718
  • v2: count the depth of methods, nested calls and declined values in the whole output by @​goccy in #​719
  • v2: fix the names which methods write for map keys by @​goccy in #​720
  • Count the levels a type nests in its frame for the max depth by @​goccy in #​721
  • v2: give the functions of marshaling a pointer at the top level as its value by @​goccy in #​722
  • Fix the option ,string with Colorize and on a pointer to a pointer by @​goccy in #​723
  • Write a pointer to a nil value with omitempty as null by @​goccy in #​724
  • Fix small defects found by a review of the whole encoder by @​goccy in #​725
  • Choose and indent the fields of embedded structs as encoding/json does by @​goccy in #​726
  • Fail for a value of an unsupported type only when it is encoded by @​goccy in #​727
  • Add benchmarks of decoding a stream from a chunked reader by @​goccy in #​728
  • Decode the option ,string on pointers and keys of pointer types as encoding/json of Go 1.27 does by @​goccy in #​729
  • Add benchmarks of encoding maps under every condition by @​goccy in #​732
  • Decode the keys of maps as encoding/json does by @​goccy in #​733
  • Encode the values of a sorted map in the order of the names by @​goccy in #​730
  • Name a map key of pointers by what they lead to, and fail for a cycle by @​goccy in #​735
  • Decoder: bound the memory of a stream (supersedes #​734) by @​goccy in #​736
  • Add the sonic Decoder to the stream benchmarks which had none by @​goccy in #​737
  • Decoder: match encoding/json at the depth limit wherever the reads end by @​goccy in #​739
  • Decode as encoding/json of Go 1.27 on every version of Go by @​goccy in #​740
  • Encode a pointer type which is a value of itself through what it points to by @​goccy in #​738
  • README: describe decoding as Go 1.27's on every Go version, and the stream decoder by elements by @​goccy in #​741
  • Decode recursive slice, map and array types instead of overflowing the stack by @​goccy in #​742
  • Decode the fields of embedded structs as encoding/json chooses them by @​goccy in #​743
  • Compare benchmarks of identical code as identical in the gate by @​goccy in #​744
  • Add the issues directory: the known work on go-json, one item per file by @​goccy in #​745
  • v2: add Unmarshal of bools, numbers, strings, bytes, interfaces, slices, arrays and pointers by @​goccy in #​746
  • Count a benchmark which fails in the base as new in the gate by @​goccy in #​747
  • v2: add Unmarshal of structs and maps by @​goccy in #​748
  • v2: add Unmarshal by methods, functions and the time types by @​goccy in #​749
  • v2: add Unmarshal by UnmarshalJSONFrom and UnmarshalFromFunc by @​goccy in #​750
  • v2: add UnmarshalOf, and the decoding of v2 to the benchmark report by @​goccy in #​751
  • v2: add UnmarshalRead and UnmarshalReadOf, which stream with bounded memory by @​goccy in #​752
  • Bump github.com/klauspost/compress from 1.17.11 to 1.18.7 in /benchmarks by @​dependabot[bot] in #​753
  • v2: add UnmarshalDecode and UnmarshalDecodeOf by @​goccy in #​754
  • v2: find struct member names by their words, as v1 does by @​goccy in #​755
  • v2: decode strings, and the texts of methods and times, in one read by @​goccy in #​756
  • Name the identifiers by what they do instead of "check" by @​goccy in #​757
  • v2: match folded names without folding them again, and make boolean options without an allocation by @​goccy in #​758
  • v2: decode the names of no field and skip their values faster by @​goccy in #​759
  • v2: skip the values of no field in one scan, and keep the names of a call in one stack by @​goccy in #​760
  • v2: look the folded names up in a table of the names of the fields by @​goccy in #​761
  • v2: decode bools and numbers by v1's decoders alone, and match folded names by the field of each folded name by @​goccy in #​762
  • v2: decode folded names as they are read, skip scalars once, and decode held pointers in place by @​goccy in #​763
  • v2: keep the name "" in the places of values, and decode the scalars of streams in their buffer by @​goccy in #​764
  • v2: take v1's paths where v2 decodes as v1, and make the others fast: names twice by hashes, values skipped in one read by @​goccy in #​765
  • v2: decode structs, streams and UnmarshalDecode by v1's paths where v2 decodes as v1 by @​goccy in #​766
  • Prepare v0.12.0: describe v2 and jsontext in the README, and pass the tests on Go 1.23 by @​goccy in #​767
  • Follow encoding/json of Go 1.27.3, and pin CI to it by @​goccy in #​768
  • Add the options of encoding/json, applied by the engine of v2 by @​goccy in #​771
  • Call MarshalJSONTo and UnmarshalJSONFrom from the root package by @​goccy in #​769
  • Decode a float whose digits wrap the mantissa around to 0 (#​770) by @​goccy in #​772
  • issues: drop the parts which master fixed, and state the rest as master has it by @​goccy in #​773
  • Path: return errors instead of panics, and select by .. at any depth (#​774) by @​goccy in #​776
  • Decoded values keep alive no memory but their own (#​775) by @​goccy in #​777
  • Docs: decoded values keep only their own memory, and DecodeNoCopyString keeps the input (#​775) by @​goccy in #​778

New Contributors

Full Changelog: goccy/go-json@v0.11.2...v0.12.0

grafana/grafana-plugin-sdk-go (github.com/grafana/grafana-plugin-sdk-go)

v0.298.0

Compare Source

What's Changed

Full Changelog: grafana/grafana-plugin-sdk-go@v0.297.0...v0.298.0

Compatibility

gorelease -base v0.297.0 -version v0.298.0

# github.com/grafana/grafana-plugin-sdk-go/backend
## compatible changes
ServeOptsDecorator: added

# github.com/grafana/grafana-plugin-sdk-go/backend/app

## compatible changes
ManageOpts.Licensing: added

# github.com/grafana/grafana-plugin-sdk-go/backend/datasource

## compatible changes
ManageOpts.Licensing: added

# github.com/grafana/grafana-plugin-sdk-go/build

## compatible changes
Build.DebugMarketplace: added
Build.DebugMarketplaceFor: added
Config.EnableDebugMarketplace: added

# github.com/grafana/grafana-plugin-sdk-go/data

## compatible changes
ErrorWideFrameTooLarge: added
LongToWideWithLimit: added

# github.com/grafana/grafana-plugin-sdk-go/experimental/marketplace

## incompatible changes
CheckMarketplacePluginLicense: removed
Manage: removed

## compatible changes
Licensing: added
Opts: added

Cannot suggest a release version.
Can only suggest a release version when compared against the most recent version of this major: v0.298.0.

v0.298.0 is a valid semantic version for this release (incompatible changes only in experimental/marketplace).
grpc-ecosystem/grpc-gateway (github.com/grpc-ecosystem/grpc-gateway/v2)

v2.33.0

Compare Source

Notice to all users

This release contains a security fix that changes the behavior of header parsing in the gateway. As part of fixing #​7281, the decision was made to stop automatically adding client headers with the Grpc-Metadata- prefix into the grpc metadata by default. This behavior can be restored using the new mux option WithLegacyHeaderMatching. See https://grpc-ecosystem.github.io/grpc-gateway/docs/operations/security_considerations/#request-headers-become-grpc-metadata-under-a-prefix for more information.

Changes

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.32.0...v2.33.0

prometheus/common (github.com/prometheus/common)

v0.73.1

Compare Source

What's Changed

Full Changelog: prometheus/common@v0.73.0...v0.73.1

v0.73.0

Compare Source

What's Changed

New Contributors

Full Changelog: prometheus/common@v0.72.1...v0.73.0

prometheus/procfs (github.com/prometheus/procfs)

v0.23.0

Compare Source

What's Changed

New Contributors

Full Changelog: prometheus/procfs@v0.22.0...v0.23.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

@renovate-sh-app
renovate-sh-app Bot requested a review from a team as a code owner October 26, 2026 16:02
@renovate-sh-app
renovate-sh-app Bot force-pushed the renovate/backend-dependencies branch from 2d9e4dd to 4bbd0da Compare October 28, 2026 01:02
@renovate-sh-app
renovate-sh-app Bot force-pushed the renovate/backend-dependencies branch from 4bbd0da to 3bf7a08 Compare October 29, 2026 16:01
renovate-reviewer[bot]
renovate-reviewer Bot previously approved these changes Oct 29, 2026
View reviewed changes
@renovate-reviewer

renovate-reviewer Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR requires manual review.

  • ❌ Risk scan: Manual review required: estimated input of 32583 tokens exceeds the 30000-token risk scan limit; model review not run
Passed checks
  • ✅ PR created by Renovate
  • ✅ Not flagged for manual review
  • ✅ All commits by Renovate
  • ✅ All commits are signed
  • ✅ Files previously updated by Renovate
  • ✅ TruffleHog Secret Scanning passed
  • ✅ zizmor GitHub Actions static analysis passed

This PR will not be automatically approved. Please review manually.

Reviewer notes: Manual review required: estimated input of 32583 tokens exceeds the 30000-token risk scan limit; model review not run

@renovate-sh-app
renovate-sh-app Bot force-pushed the renovate/backend-dependencies branch from 3bf7a08 to 80eaa35 Compare October 29, 2026 19:01
@renovate-sh-app
renovate-sh-app Bot force-pushed the renovate/backend-dependencies branch 7 times, most recently from 7215ad8 to a9f88cc Compare November 1, 2026 07:02
@renovate-sh-app
fix(deps): update backend dependencies
d9989ec 
| datasource | package                                   | from                               | to                                 |
| ---------- | ----------------------------------------- | ---------------------------------- | ---------------------------------- |
| go         | github.com/goccy/go-json                  | v0.11.2                            | v0.12.0                            |
| go         | github.com/grafana/grafana-plugin-sdk-go  | v0.297.0                           | v0.298.0                           |
| go         | github.com/grpc-ecosystem/grpc-gateway/v2 | v2.32.0                            | v2.33.0                            |
| go         | github.com/prometheus/common              | v0.72.1                            | v0.73.1                            |
| go         | github.com/prometheus/procfs              | v0.22.0                            | v0.23.0                            |
| go         | golang.org/x/net                          | v0.61.0                            | v0.62.0                            |
| go         | google.golang.org/genproto/googleapis/api | v0.0.0-20261019180522-ce908d29299b | v0.0.0-20261026165753-2ffab32bce7e |
| go         | google.golang.org/genproto/googleapis/rpc | v0.0.0-20261019180522-ce908d29299b | v0.0.0-20261026165753-2ffab32bce7e |


Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
@renovate-sh-app
renovate-sh-app Bot force-pushed the renovate/backend-dependencies branch from a9f88cc to d9989ec Compare November 2, 2026 13:01
@zoltanbedi
zoltanbedi merged commit bd06ad4 into main Nov 2, 2026
25 checks passed
@zoltanbedi
zoltanbedi deleted the renovate/backend-dependencies branch November 2, 2026 15:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zoltanbedi zoltanbedi zoltanbedi approved these changes
@renovate-reviewer renovate-reviewer[bot] renovate-reviewer[bot] left review comments

Assignees

No one assigned

Labels

automerge-patch automerge-security-update severity: update-minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@zoltanbedi