Skip to content

build(deps): bump the go-mod group with 8 updates#631

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/go-mod-79d6a811ac
Closed

build(deps): bump the go-mod group with 8 updates#631
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/go-mod-79d6a811ac

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 1, 2026 •
edited
Loading

Bumps the go-mod group with 8 updates:

Package From To
github.com/authzed/authzed-go 1.7.0 1.8.0
github.com/authzed/spicedb 1.49.1-0.20260205205028-286d6e84c0dd 1.49.1
github.com/mark3labs/mcp-go 0.43.2 0.44.1
golang.org/x/mod 0.32.0 0.33.0
golang.org/x/net 0.49.0 0.51.0
golang.org/x/term 0.39.0 0.40.0
google.golang.org/genproto/googleapis/rpc 0.0.0-20251124214823-79d6a2a48846 0.0.0-20260128011058-8636f8732409
google.golang.org/grpc 1.78.0 1.79.1

Updates github.com/authzed/authzed-go from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/authzed/authzed-go's releases.

v1.8.0

What's Changed

New Contributors

Full Changelog: authzed/authzed-go@v1.7.0...v1.8.0

Commits
  • d8c9a1a Merge pull request #394 from authzed/dependabot/go_modules/magefiles/go-mod-m...
  • ed6f0b8 chore(deps): bump the go-mod-magefiles group across 1 directory with 3 updates
  • bdf5808 Merge pull request #393 from authzed/dependabot/go_modules/go-mod-d64280bf30
  • 8adc898 chore(deps): bump the go-mod group with 3 updates
  • 43eca72 Merge pull request #375 from ivanauth/fix/issue-142-add-api-examples
  • 2ea2f5c Merge pull request #388 from ivanauth/fix/issue-137-contributing-local-protos
  • 41234c1 Merge pull request #389 from authzed/dependabot/go_modules/go-mod-bb2d16fde3
  • 70ff9af Merge pull request #390 from authzed/dependabot/github_actions/github-actions...
  • ea4533e Merge pull request #391 from authzed/dependabot/go_modules/magefiles/go-mod-m...
  • dcb53b3 chore(deps): bump the go-mod-magefiles group
  • Additional commits viewable in compare view

Updates github.com/authzed/spicedb from 1.49.1-0.20260205205028-286d6e84c0dd to 1.49.1

Release notes

Sourced from github.com/authzed/spicedb's releases.

v1.49.1

Highlights

What's Changed

Full Changelog: authzed/spicedb@v1.49.0...v1.49.1

Docker Images

This release is available at authzed/spicedb:v1.49.1, quay.io/authzed/spicedb:v1.49.1, ghcr.io/authzed/spicedb:v1.49.1

Changelog

Sourced from github.com/authzed/spicedb's changelog.

[1.49.1] - 2026-02-06

Added

Changed

Fixed

Security

[1.49.0] - 2026-02-03

Added

  • Support for self keyword added to permissions. Previously, if you wanted to represent something like "a user should be able to view themselves," this required adding a relation to the schema and then writing a relation from the user to itself. We've added support for a self keyword in permissions that represents this directly, which reduces storage requirements, removes the need for a trip to the database, and removes a relationship that needs to be synced. For more information, see the Docs and the PR

  • Experimental Postgres Foreign Data Wrapper.

    In #2806, we added a new experimental command to SpiceDB that serves a Postgres Foreign Data Wrapper: spicedb postgres-fdw [flags]. If you configure your Postgres instance accordingly, it can speak to SpiceDB through the FDW as a proxy, allowing you to write queries like:

    -- Check if user:alice has permission to view document:readme
SELECT has_permission
FROM permissions
WHERE resource_type = 'document'
  AND resource_id = 'readme'
  AND permission = 'view'
  AND subject_type = 'user'
  AND subject_id = 'alice';

    You can now express checks and lookups as SELECTs and JOINs in your main application code, and you can read, write, and delete relationships using Postgres as the client. For more information, see the documentation in the repo.

    NOTE:

    • This feature is experimental. We'd welcome you trying it out and providing feedback, but it will likely change before its final GA'd form.
    • This feature DOES NOT solve the Dual-Write Problem. You can make updates in the context of a Postgres transaction, but Postgres's FDW protocol doesn't support a two-phase commit semantic, which means there are still failure modes where a transactional write will land in SpiceDB but not Postgres or vice-versa.

  • Query Planner

    This release includes the first experimental handle on our new Query Planner. If you run SpiceDB with the new --experimental-query-plan flag, SpiceDB will use the query planner to resolve queries. This is mostly provided for the curious; there's still work to do on statistics sources and optimizations before we expect that it will provide performance benefits across most workloads. We don't yet recommend turning on this flag in your system outside of experiments in your local or development environments. We'll continue work and let you know when it's ready for production.

... (truncated)

Commits

Updates github.com/mark3labs/mcp-go from 0.43.2 to 0.44.1

Release notes

Sourced from github.com/mark3labs/mcp-go's releases.

Release v0.44.1

No release notes provided.

Release v0.44.0

What's Changed

New Contributors

... (truncated)

Commits
  • 6bea1d4 fix: add session idle TTL sweeper to prevent transport state leak (#724)
  • 0510f0c fix: SendRequest hangs forever when server process dies (#714)
  • 962f31b fix: use custom session id generator when provided (#715)
  • 7ce32bf fix: accept HTTP 204 No Content in SendNotification (#717)
  • 7c44752 fix(ci): pin Go version to 1.25 in lint workflow
  • 859588d fix: call onConnectionLost when SSE connection closes, not only on NO_ERROR (...
  • b2fb8ba tool "properties" and "required" fields missing if set them as null, Addition...
  • e2c1762 feat(server): implement task-augmented tools capability (#707)
  • 45740a0 typo: fix duplicate description of mcp-go in README (#701)
  • d46cf85 refactor: simplify tests with the usetesting linter (#703)
  • Additional commits viewable in compare view

Updates golang.org/x/mod from 0.32.0 to 0.33.0

Commits

Updates golang.org/x/net from 0.49.0 to 0.51.0

Commits
  • 60b3f6f internal/http3: prevent Server handler from writing longer body than declared
  • b0ca456 internal/http3: fix Write in Server Handler returning the wrong value
  • 1558ba7 publicsuffix: update to 2026-02-06
  • 4e1c745 internal/http3: make Server response include headers that can be inferred
  • 19f580f http2: fix nil panic in typeFrameParser for unassigned frame types
  • 818aad7 internal/http3: add server to client trailer header support
  • c1bbe1a internal/http3: add client to server trailer header support
  • 29181b8 all: remove go1.25 and older build constraints
  • 8109305 all: upgrade go directive to at least 1.25.0 [generated]
  • 0b37bdf quic: don't run TestStreamsCreateConcurrency in synctest bubble
  • Additional commits viewable in compare view

Updates golang.org/x/term from 0.39.0 to 0.40.0

Commits

Updates google.golang.org/genproto/googleapis/rpc from 0.0.0-20251124214823-79d6a2a48846 to 0.0.0-20260128011058-8636f8732409

Commits

Updates google.golang.org/grpc from 1.78.0 to 1.79.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.79.1

Bug Fixes

Release 1.79.0

API Changes

  • mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (#8806)
  • experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (#8780)

Behavior Changes

  • balancer/weightedtarget: Remove handling of Addresses and only handle Endpoints in resolver updates. (#8841)

New Features

  • experimental/stats: Add support for asynchronous gauge metrics through the new AsyncMetricReporter and RegisterAsyncReporter APIs. (#8780)
  • pickfirst: Add support for weighted random shuffling of endpoints, as described in gRFC A113.
    • This is enabled by default, and can be turned off using the environment variable GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (#8864)
  • xds: Implement :authority rewriting, as specified in gRFC A81. (#8779)
  • balancer/randomsubsetting: Implement the random_subsetting LB policy, as specified in gRFC A68. (#8650)

Bug Fixes

  • credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (#8726)
  • xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in CONNECTING state. (#8813)
  • health: Fix a bug where health checks failed for clients using legacy compression options (WithDecompressor or RPCDecompressor). (#8765)
  • transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (#8769)
  • server: Propagate status detail headers, if available, when terminating a stream during request header processing. (#8754)

Performance Improvements

  • credentials/alts: Optimize read buffer alignment to reduce copies. (#8791)
  • mem: Optimize pooling and creation of buffer objects. (#8784)
  • transport: Reduce slice re-allocations by reserving slice capacity. (#8797)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the go-mod group with 8 updates
cfdeef2 
Bumps the go-mod group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/authzed/authzed-go](https://github.com/authzed/authzed-go) | `1.7.0` | `1.8.0` |
| [github.com/authzed/spicedb](https://github.com/authzed/spicedb) | `1.49.1-0.20260205205028-286d6e84c0dd` | `1.49.1` |
| [github.com/mark3labs/mcp-go](https://github.com/mark3labs/mcp-go) | `0.43.2` | `0.44.1` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.32.0` | `0.33.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.49.0` | `0.51.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.39.0` | `0.40.0` |
| [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20251124214823-79d6a2a48846` | `0.0.0-20260128011058-8636f8732409` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.78.0` | `1.79.1` |


Updates `github.com/authzed/authzed-go` from 1.7.0 to 1.8.0
- [Release notes](https://github.com/authzed/authzed-go/releases)
- [Commits](authzed/authzed-go@v1.7.0...v1.8.0)

Updates `github.com/authzed/spicedb` from 1.49.1-0.20260205205028-286d6e84c0dd to 1.49.1
- [Release notes](https://github.com/authzed/spicedb/releases)
- [Changelog](https://github.com/authzed/spicedb/blob/main/CHANGELOG.md)
- [Commits](https://github.com/authzed/spicedb/commits/v1.49.1)

Updates `github.com/mark3labs/mcp-go` from 0.43.2 to 0.44.1
- [Release notes](https://github.com/mark3labs/mcp-go/releases)
- [Commits](mark3labs/mcp-go@v0.43.2...v0.44.1)

Updates `golang.org/x/mod` from 0.32.0 to 0.33.0
- [Commits](golang/mod@v0.32.0...v0.33.0)

Updates `golang.org/x/net` from 0.49.0 to 0.51.0
- [Commits](golang/net@v0.49.0...v0.51.0)

Updates `golang.org/x/term` from 0.39.0 to 0.40.0
- [Commits](golang/term@v0.39.0...v0.40.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20251124214823-79d6a2a48846 to 0.0.0-20260128011058-8636f8732409
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `google.golang.org/grpc` from 1.78.0 to 1.79.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.78.0...v1.79.1)

---
updated-dependencies:
- dependency-name: github.com/authzed/authzed-go
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: github.com/authzed/spicedb
  dependency-version: 1.49.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-mod
- dependency-name: github.com/mark3labs/mcp-go
  dependency-version: 0.44.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: golang.org/x/mod
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: golang.org/x/net
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: golang.org/x/term
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-version: 0.0.0-20260128011058-8636f8732409
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-mod
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the area/dependencies Affects dependencies label Mar 1, 2026
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Mar 2, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Mar 2, 2026
@dependabot dependabot bot deleted the dependabot/go_modules/go-mod-79d6a811ac branch March 2, 2026 16:17
@github-actions github-actions bot locked and limited conversation to collaborators Mar 2, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

area/dependencies Affects dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants