Bump the go_modules group across 6 directories with 7 updates by dependabot[bot] · Pull Request #23 · JSTONE1111/chainlink

dependabot · 2026-05-18T19:11:36Z

Bumps the go_modules group with 3 updates in the /core/scripts directory: github.com/Azure/go-ntlmssp, github.com/in-toto/in-toto-golang and github.com/moby/spdystream.
Bumps the go_modules group with 2 updates in the /deployment directory: github.com/Azure/go-ntlmssp and github.com/moby/spdystream.
Bumps the go_modules group with 4 updates in the /integration-tests directory: github.com/Azure/go-ntlmssp, github.com/moby/spdystream, github.com/slack-go/slack and github.com/grafana/loki/v3.
Bumps the go_modules group with 4 updates in the /integration-tests/load directory: github.com/Azure/go-ntlmssp, github.com/moby/spdystream, github.com/slack-go/slack and github.com/grafana/loki/v3.
Bumps the go_modules group with 3 updates in the /system-tests/lib directory: github.com/Azure/go-ntlmssp, github.com/in-toto/in-toto-golang and github.com/moby/spdystream.
Bumps the go_modules group with 4 updates in the /system-tests/tests directory: github.com/Azure/go-ntlmssp, github.com/in-toto/in-toto-golang, github.com/moby/spdystream and github.com/grafana/loki/v3.

Updates github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1

Release notes

Sourced from github.com/Azure/go-ntlmssp's releases.

v0.1.1

Fix CVE-2026-32952: A malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport.

v0.1.0

What's Changed

Bump minimum required version to Go 1.24 by @qmuntal in Azure/go-ntlmssp#53

Fix OOM in NTLM negotiator by avoiding buffering of seekable request bodies by @Copilot in Azure/go-ntlmssp#54

Don't modify the rountripped request by @qmuntal in Azure/go-ntlmssp#57

Fix a race occurring when the wrapped Rountripper closes the request body in another goroutine by @qmuntal in Azure/go-ntlmssp#58

Fix a race occurring when the wrapped Rountripper reads request fields in another goroutine by @qmuntal in Azure/go-ntlmssp#59

Only perform basic auth if requested by the server by @qmuntal in Azure/go-ntlmssp#60

Don't pass the original body in the client handshake request by @qmuntal in Azure/go-ntlmssp#61

Return latest server response in case there is an error processing the handshake by @qmuntal in Azure/go-ntlmssp#63

Send body on client NTLM handshake by @qmuntal in Azure/go-ntlmssp#64

Support user accounts not living in server's domain by @qmuntal in Azure/go-ntlmssp#65

Implement NewAuthenticateMessage and deprecate ProcessChallenge by @qmuntal in Azure/go-ntlmssp#67

Make basic authentication support opt-in by @qmuntal in Azure/go-ntlmssp#66

Allow passing custom client domain and workstation name by @qmuntal in Azure/go-ntlmssp#68

set NEGOTIATE_NTLM and NEGOTIATE_ALWAYS_SIGN capabilities by @qmuntal in Azure/go-ntlmssp#69

testing: add e2e tests by @gdams in Azure/go-ntlmssp#56

New Contributors

@qmuntal made their first contribution in Azure/go-ntlmssp#53

@Copilot made their first contribution in Azure/go-ntlmssp#54

Full Changelog: Azure/go-ntlmssp@v0.0.1...v0.1.0

v0.0.1

What's Changed

Commit to Go 1.6 by @boumenot in Azure/go-ntlmssp#5

Handle http redirect by @nqv in Azure/go-ntlmssp#4

drain request body for connection reuse by @paulmey in Azure/go-ntlmssp#6

Add CoC notice by @paulmey in Azure/go-ntlmssp#7

Support for auth when server responds with Www-Authenticate: NTLM by @lafriks in Azure/go-ntlmssp#8

update README with example by @PaluMacil in Azure/go-ntlmssp#11

add version, domain and workstation fields by @justdan96 in Azure/go-ntlmssp#13

move to a current version of Go by @boumenot in Azure/go-ntlmssp#19

(BUG) Negotiation fails for servers where 'NTLMv2 session security' i… by @davejohnston in Azure/go-ntlmssp#18

Update negotiator.go by @mszuyev in Azure/go-ntlmssp#24

Fix golint import path by @paulmey in Azure/go-ntlmssp#25

add ProcessChallengeWithHash function by @ropnop in Azure/go-ntlmssp#27

Set workstation to empty string in authenticate_message.go by @Catbuttes in Azure/go-ntlmssp#30

Change of the negociator working, to handle several identical header by @Resousse in Azure/go-ntlmssp#31

Support for UPN by @tirupatibg in Azure/go-ntlmssp#32

Adding Microsoft SECURITY.MD by @microsoft-github-policy-service[bot] in Azure/go-ntlmssp#39

Handle 3rd return value from GetDomain by @opoplawski in Azure/go-ntlmssp#41

initial refactor by @gdams in Azure/go-ntlmssp#48

fix linter errors by @gdams in Azure/go-ntlmssp#49

add dependabot/codeowners + installation instructions by @gdams in Azure/go-ntlmssp#50

... (truncated)

Commits

See full diff in compare view

Updates github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0

Release notes

Sourced from github.com/in-toto/in-toto-golang's releases.

v0.11.0

What's Changed

chore(deps): bump the all group with 2 updates by @dependabot[bot] in in-toto/in-toto-golang#453

chore(deps): bump the all group across 1 directory with 2 updates by @dependabot[bot] in in-toto/in-toto-golang#452

chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 by @dependabot[bot] in in-toto/in-toto-golang#457

chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in in-toto/in-toto-golang#459

match: Replace ^ with ! for negation in character classes by @adityasaky in in-toto/in-toto-golang#462

Full Changelog: in-toto/in-toto-golang@v0.10.0...v0.11.0

Commits

36d782f Merge pull request #462 from in-toto/fix-negation-character
4a09e3b match: Replace ^ with ! for negation in character classes
c3302e8 Merge pull request #459 from in-toto/dependabot/go_modules/github.com/go-jose...
016e87e chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
5b9df76 Merge pull request #457 from in-toto/dependabot/go_modules/google.golang.org/...
595b3fe chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3
e396d24 Merge pull request #452 from in-toto/dependabot/github_actions/all-502588e1ca
142b779 Merge pull request #453 from in-toto/dependabot/go_modules/all-d8ef5820aa
f741bcc chore(deps): bump the all group with 2 updates
c374dc9 chore(deps): bump the all group across 1 directory with 2 updates
See full diff in compare view

Updates github.com/moby/spdystream from 0.5.0 to 0.5.1

Release notes

Sourced from github.com/moby/spdystream's releases.

v0.5.1

What's Changed

Security

Fix memory amplification in SPDY frame parsing leads to denial of service (CVE-2026-35469 / GHSA-pc3f-x583-g7j2)

Changes

spdy: fix duplicate license headers, add LICENSE, PATENTS, and update NOTICE moby/spdystream#106

ci: update actions and test against latest Go versions moby/spdystream#107

use ioutil.Discard for go1.13 compatibility moby/spdystream#109

Full Changelog: moby/spdystream@v0.5.0...v0.5.1

Commits

c59e5d7 Merge pull request #109 from thaJeztah/use_ioutil
2fd0155 use ioutil.Discard for go1.13 compatibility
ef6121f Merge commit from fork
241cec9 compare with signed Int for 32-bit Arm
21c3864 Add options to customize limits
acf9b45 spdy: update godoc for MaxDataLength
eb63605 spdy: limit header-size and header-count
2f21da4 spdy: fix header block byte accounting
5976b66 spdy: enforce 24-bit frame length limits
cf0ec5d Guard against oversized SPDY frames
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.38.0 to 1.43.0

Changelog

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)

Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)

Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)

Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)

Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)

Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)

Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)

Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)

Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)

Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)

... (truncated)

Commits

9276201 Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)
61b8c94 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)
97a086e chore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)
5e363de limit response body size for OTLP HTTP exporters (#8108)
35214b6 Use an absolute path when calling bsd kenv (#8113)
290024c fix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)
e70658e fix: support getBody in otelploghttp (#8096)
4afe468 fix(deps): update googleapis to 9d38bb4 (#8117)
b9ca729 chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)
69472ec chore(deps): update fossas/fossa-action action to v1.9.0 (#8118)
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.38.0 to 1.43.0

Changelog

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)

Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)

Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)

Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)

Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)

Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)

Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)

Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)

Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)

Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)

WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)

Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)

... (truncated)

Commits

9276201 Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)
61b8c94 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)
97a086e chore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)
5e363de limit response body size for OTLP HTTP exporters (#8108)
35214b6 Use an absolute path when calling bsd kenv (#8113)
290024c fix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)
e70658e fix: support getBody in otelploghttp (#8096)
4afe468 fix(deps): update googleapis to 9d38bb4 (#8117)
b9ca729 chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)
69472ec chore(deps): update fossas/fossa-action action to v1.9.0 (#8118)
Additional commits viewable in compare view

Updates github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1

Release notes

Sourced from github.com/Azure/go-ntlmssp's releases.

v0.1.1

Fix CVE-2026-32952: A malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport.

v0.1.0

What's Changed

Bump minimum required version to Go 1.24 by @qmuntal in Azure/go-ntlmssp#53

Fix OOM in NTLM negotiator by avoiding buffering of seekable request bodies by @Copilot in Azure/go-ntlmssp#54

Don't modify the rountripped request by @qmuntal in Azure/go-ntlmssp#57

Fix a race occurring when the wrapped Rountripper closes the request body in another goroutine by @qmuntal in Azure/go-ntlmssp#58

Fix a race occurring when the wrapped Rountripper reads request fields in another goroutine by @qmuntal in Azure/go-ntlmssp#59

Only perform basic auth if requested by the server by @qmuntal in Azure/go-ntlmssp#60

Don't pass the original body in the client handshake request by @qmuntal in Azure/go-ntlmssp#61

Return latest server response in case there is an error processing the handshake by @qmuntal in Azure/go-ntlmssp#63

Send body on client NTLM handshake by @qmuntal in Azure/go-ntlmssp#64

Support user accounts not living in server's domain by @qmuntal in Azure/go-ntlmssp#65

Implement NewAuthenticateMessage and deprecate ProcessChallenge by @qmuntal in Azure/go-ntlmssp#67

Make basic authentication support opt-in by @qmuntal in Azure/go-ntlmssp#66

Allow passing custom client domain and workstation name by @qmuntal in Azure/go-ntlmssp#68

set NEGOTIATE_NTLM and NEGOTIATE_ALWAYS_SIGN capabilities by @qmuntal in Azure/go-ntlmssp#69

testing: add e2e tests by @gdams in Azure/go-ntlmssp#56

New Contributors

@qmuntal made their first contribution in Azure/go-ntlmssp#53

@Copilot made their first contribution in Azure/go-ntlmssp#54

Full Changelog: Azure/go-ntlmssp@v0.0.1...v0.1.0

v0.0.1

What's Changed

Commit to Go 1.6 by @boumenot in Azure/go-ntlmssp#5

Handle http redirect by @nqv in Azure/go-ntlmssp#4

drain request body for connection reuse by @paulmey in Azure/go-ntlmssp#6

Add CoC notice by @paulmey in Azure/go-ntlmssp#7

Support for auth when server responds with Www-Authenticate: NTLM by @lafriks in Azure/go-ntlmssp#8

update README with example by @PaluMacil in Azure/go-ntlmssp#11

add version, domain and workstation fields by @justdan96 in Azure/go-ntlmssp#13

move to a current version of Go by @boumenot in Azure/go-ntlmssp#19

(BUG) Negotiation fails for servers where 'NTLMv2 session security' i… by @davejohnston in Azure/go-ntlmssp#18

Update negotiator.go by @mszuyev in Azure/go-ntlmssp#24

Fix golint import path by @paulmey in Azure/go-ntlmssp#25

add ProcessChallengeWithHash function by @ropnop in Azure/go-ntlmssp#27

Set workstation to empty string in authenticate_message.go by @Catbuttes in Azure/go-ntlmssp#30

Change of the negociator working, to handle several identical header by @Resousse in Azure/go-ntlmssp#31

Support for UPN by @tirupatibg in Azure/go-ntlmssp#32

Adding Microsoft SECURITY.MD by @microsoft-github-policy-service[bot] in Azure/go-ntlmssp#39

Handle 3rd return value from GetDomain by @opoplawski in Azure/go-ntlmssp#41

initial refactor by @gdams in Azure/go-ntlmssp#48

fix linter errors by @gdams in Azure/go-ntlmssp#49

add dependabot/codeowners + installation instructions by @gdams in Azure/go-ntlmssp#50

... (truncated)

Commits

See full diff in compare view

Updates github.com/moby/spdystream from 0.5.0 to 0.5.1

Release notes

Sourced from github.com/moby/spdystream's releases.

v0.5.1

What's Changed

Security

Fix memory amplification in SPDY frame parsing leads to denial of service (CVE-2026-35469 / GHSA-pc3f-x583-g7j2)

Changes

spdy: fix duplicate license headers, add LICENSE, PATENTS, and update NOTICE moby/spdystream#106

ci: update actions and test against latest Go versions moby/spdystream#107

use ioutil.Discard for go1.13 compatibility moby/spdystream#109

Full Changelog: moby/spdystream@v0.5.0...v0.5.1

Commits

c59e5d7 Merge pull request #109 from thaJeztah/use_ioutil
2fd0155 use ioutil.Discard for go1.13 compatibility
ef6121f Merge commit from fork
241cec9 compare with signed Int for 32-bit Arm
21c3864 Add options to customize limits
acf9b45 spdy: update godoc for MaxDataLength
eb63605 spdy: limit header-size and header-count
2f21da4 spdy: fix header block byte accounting
5976b66 spdy: enforce 24-bit frame length limits
cf0ec5d Guard against oversized SPDY frames
Additional commits viewable in compare view

Updates github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1

Release notes

Sourced from github.com/Azure/go-ntlmssp's releases.

v0.1.1

Fix CVE-2026-32952: A malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport.

v0.1.0

What's Changed

Bump minimum required version to Go 1.24 by @qmuntal in Azure/go-ntlmssp#53

Fix OOM in NTLM negotiator by avoiding buffering of seekable request bodies by @Copilot in Azure/go-ntlmssp#54

Don't modify the rountripped request by @qmuntal in Azure/go-ntlmssp#57

Fix a race occurring when the wrapped Rountripper closes the request body in another goroutine by @qmuntal in Azure/go-ntlmssp#58

Fix a race occurring when the wrapped Rountripper reads request fields in another goroutine by @qmuntal in Azure/go-ntlmssp#59

Only perform basic auth if requested by the server by @qmuntal in Azure/go-ntlmssp#60

Don't pass the original body in the client handshake request by @qmuntal in Azure/go-ntlmssp#61

Return latest server response in case there is an error processing the handshake by @qmuntal in Azure/go-ntlmssp#63

Send body on client NTLM handshake by @qmuntal in Azure/go-ntlmssp#64

Support user accounts not living in server's domain by @qmuntal in Azure/go-ntlmssp#65

Implement NewAuthenticateMessage and deprecate ProcessChallenge by @qmuntal in Azure/go-ntlmssp#67

Make basic authentication support opt-in by @qmuntal in Azure/go-ntlmssp#66

Allow passing custom client domain and workstation name by @qmuntal in Azure/go-ntlmssp#68

set NEGOTIATE_NTLM and NEGOTIATE_ALWAYS_SIGN capabilities by @qmuntal in Azure/go-ntlmssp#69

testing: add e2e tests by @gdams in Azure/go-ntlmssp#56

New Contributors

@qmuntal made their first contribution in Azure/go-ntlmssp#53

@Copilot made their first contribution in Azure/go-ntlmssp#54

Full Changelog: Azure/go-ntlmssp@v0.0.1...v0.1.0

v0.0.1

What's Changed

Commit to Go 1.6 by @boumenot in Azure/go-ntlmssp#5

Handle http redirect by @nqv in Azure/go-ntlmssp#4

drain request body for connection reuse by @paulmey in Azure/go-ntlmssp#6

Add CoC notice by @paulmey in Azure/go-ntlmssp#7

Support for auth when server responds with Www-Authenticate: NTLM by @lafriks in Azure/go-ntlmssp#8

update README with example by @PaluMacil in Azure/go-ntlmssp#11

add version, domain and workstation fields by @justdan96 in Azure/go-ntlmssp#13

move to a current version of Go by @boumenot in Azure/go-ntlmssp#19

(BUG) Negotiation fails for servers where 'NTLMv2 session security' i… by @davejohnston in Azure/go-ntlmssp#18

Update negotiator.go by @mszuyev in Azure/go-ntlmssp#24

Fix golint import path by @paulmey in Azure/go-ntlmssp#25

add ProcessChallengeWithHash function by @ropnop in Azure/go-ntlmssp#27

Set workstation to empty string in authenticate_message.go by @Catbuttes in Azure/go-ntlmssp#30

Change of the negociator working, to handle several identical header by @Resousse in Azure/go-ntlmssp#31

Support for UPN by @tirupatibg in Azure/go-ntlmssp#32

Adding Microsoft SECURITY.MD by @microsoft-github-policy-service[bot] in Azure/go-ntlmssp#39

Handle 3rd return value from GetDomain by @opoplawski in Azure/go-ntlmssp#41

initial refactor by @gdams in Azure/go-ntlmssp#48

fix linter errors by @gdams in Azure/go-ntlmssp#49

add dependabot/codeowners + installation instructions by @gdams in Azure/go-ntlmssp#50

... (truncated)

Commits

See full diff in compare view

Updates github.com/moby/spdystream from 0.5.0 to 0.5.1

Release notes

Sourced from github.com/moby/spdystream's releases.

v0.5.1

What's Changed

Security

Fix memory amplification in SPDY frame parsing leads to denial of service (CVE-2026-35469 / GHSA-pc3f-x583-g7j2)

Changes

spdy: fix duplicate license headers, add LICENSE, PATENTS, and update NOTICE moby/spdystream#106

ci: update actions and test against latest Go versions moby/spdystream#107

use ioutil.Discard for go1.13 compatibility moby/spdystream#109

Full Changelog: moby/spdystream@v0.5.0...v0.5.1

Commits

c59e5d7 Merge pull request #109 from thaJeztah/use_ioutil
2fd0155 use ioutil.Discard for go1.13 compatibility
ef6121f Merge commit from fork
241cec9 compare with signed Int for 32-bit Arm
21c3864 Add options to customize limits
acf9b45 spdy: update godoc for MaxDataLength
eb63605 spdy: limit header-size and header-count
2f21da4 spdy: fix header block byte accounting
5976b66 spdy: enforce 24-bit frame length limits
cf0ec5d Guard against oversized SPDY frames
Additional commits viewable in compare view

Updates github.com/slack-go/slack from 0.15.0 to 0.23.1

Release notes

Sourced from github.com/slack-go/slack's releases.

v0.23.1

[!IMPORTANT] Even though this is a [security] patch release, if you were using an empty secret, this is a breaking change due to a change in behaviour. That's on purpose, to ensure you fix your approach so that there are no footguns.

Fixed

NewSecretsVerifier now rejects empty signing secrets to avoid accepting forged request signatures when applications are misconfigured.

Full Changelog: slack-go/slack@v0.23.0...v0.23.1

v0.23.0

Added

feat(socketmode): expose socketmode handler dispatcher method by @nlopes in

Bumps the go_modules group with 3 updates in the /core/scripts directory: [github.com/Azure/go-ntlmssp](https://github.com/Azure/go-ntlmssp), [github.com/in-toto/in-toto-golang](https://github.com/in-toto/in-toto-golang) and [github.com/moby/spdystream](https://github.com/moby/spdystream). Bumps the go_modules group with 2 updates in the /deployment directory: [github.com/Azure/go-ntlmssp](https://github.com/Azure/go-ntlmssp) and [github.com/moby/spdystream](https://github.com/moby/spdystream). Bumps the go_modules group with 4 updates in the /integration-tests directory: [github.com/Azure/go-ntlmssp](https://github.com/Azure/go-ntlmssp), [github.com/moby/spdystream](https://github.com/moby/spdystream), [github.com/slack-go/slack](https://github.com/slack-go/slack) and [github.com/grafana/loki/v3](https://github.com/grafana/loki). Bumps the go_modules group with 4 updates in the /integration-tests/load directory: [github.com/Azure/go-ntlmssp](https://github.com/Azure/go-ntlmssp), [github.com/moby/spdystream](https://github.com/moby/spdystream), [github.com/slack-go/slack](https://github.com/slack-go/slack) and [github.com/grafana/loki/v3](https://github.com/grafana/loki). Bumps the go_modules group with 3 updates in the /system-tests/lib directory: [github.com/Azure/go-ntlmssp](https://github.com/Azure/go-ntlmssp), [github.com/in-toto/in-toto-golang](https://github.com/in-toto/in-toto-golang) and [github.com/moby/spdystream](https://github.com/moby/spdystream). Bumps the go_modules group with 4 updates in the /system-tests/tests directory: [github.com/Azure/go-ntlmssp](https://github.com/Azure/go-ntlmssp), [github.com/in-toto/in-toto-golang](https://github.com/in-toto/in-toto-golang), [github.com/moby/spdystream](https://github.com/moby/spdystream) and [github.com/grafana/loki/v3](https://github.com/grafana/loki). Updates `github.com/Azure/go-ntlmssp` from 0.0.0-20221128193559-754e69321358 to 0.1.1 - [Release notes](https://github.com/Azure/go-ntlmssp/releases) - [Commits](https://github.com/Azure/go-ntlmssp/commits/v0.1.1) Updates `github.com/in-toto/in-toto-golang` from 0.10.0 to 0.11.0 - [Release notes](https://github.com/in-toto/in-toto-golang/releases) - [Changelog](https://github.com/in-toto/in-toto-golang/blob/master/CHANGELOG.md) - [Commits](in-toto/in-toto-golang@v0.10.0...v0.11.0) Updates `github.com/moby/spdystream` from 0.5.0 to 0.5.1 - [Release notes](https://github.com/moby/spdystream/releases) - [Commits](moby/spdystream@v0.5.0...v0.5.1) Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp` from 1.38.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.43.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.38.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.43.0) Updates `github.com/Azure/go-ntlmssp` from 0.0.0-20221128193559-754e69321358 to 0.1.1 - [Release notes](https://github.com/Azure/go-ntlmssp/releases) - [Commits](https://github.com/Azure/go-ntlmssp/commits/v0.1.1) Updates `github.com/moby/spdystream` from 0.5.0 to 0.5.1 - [Release notes](https://github.com/moby/spdystream/releases) - [Commits](moby/spdystream@v0.5.0...v0.5.1) Updates `github.com/Azure/go-ntlmssp` from 0.0.0-20221128193559-754e69321358 to 0.1.1 - [Release notes](https://github.com/Azure/go-ntlmssp/releases) - [Commits](https://github.com/Azure/go-ntlmssp/commits/v0.1.1) Updates `github.com/moby/spdystream` from 0.5.0 to 0.5.1 - [Release notes](https://github.com/moby/spdystream/releases) - [Commits](moby/spdystream@v0.5.0...v0.5.1) Updates `github.com/slack-go/slack` from 0.15.0 to 0.23.1 - [Release notes](https://github.com/slack-go/slack/releases) - [Changelog](https://github.com/slack-go/slack/blob/master/CHANGELOG.md) - [Commits](slack-go/slack@v0.15.0...v0.23.1) Updates `github.com/grafana/loki/v3` from 3.0.0-20250710111934-7be3efac7bc5 to 3.6.4 - [Release notes](https://github.com/grafana/loki/releases) - [Changelog](https://github.com/grafana/loki/blob/main/CHANGELOG.md) - [Commits](https://github.com/grafana/loki/commits/v3.6.4) Updates `github.com/Azure/go-ntlmssp` from 0.0.0-20221128193559-754e69321358 to 0.1.1 - [Release notes](https://github.com/Azure/go-ntlmssp/releases) - [Commits](https://github.com/Azure/go-ntlmssp/commits/v0.1.1) Updates `github.com/moby/spdystream` from 0.5.0 to 0.5.1 - [Release notes](https://github.com/moby/spdystream/releases) - [Commits](moby/spdystream@v0.5.0...v0.5.1) Updates `github.com/slack-go/slack` from 0.15.0 to 0.23.1 - [Release notes](https://github.com/slack-go/slack/releases) - [Changelog](https://github.com/slack-go/slack/blob/master/CHANGELOG.md) - [Commits](slack-go/slack@v0.15.0...v0.23.1) Updates `github.com/grafana/loki/v3` from 3.0.0-20250710111934-7be3efac7bc5 to 3.6.4 - [Release notes](https://github.com/grafana/loki/releases) - [Changelog](https://github.com/grafana/loki/blob/main/CHANGELOG.md) - [Commits](https://github.com/grafana/loki/commits/v3.6.4) Updates `github.com/Azure/go-ntlmssp` from 0.0.0-20221128193559-754e69321358 to 0.1.1 - [Release notes](https://github.com/Azure/go-ntlmssp/releases) - [Commits](https://github.com/Azure/go-ntlmssp/commits/v0.1.1) Updates `github.com/in-toto/in-toto-golang` from 0.10.0 to 0.11.0 - [Release notes](https://github.com/in-toto/in-toto-golang/releases) - [Changelog](https://github.com/in-toto/in-toto-golang/blob/master/CHANGELOG.md) - [Commits](in-toto/in-toto-golang@v0.10.0...v0.11.0) Updates `github.com/moby/spdystream` from 0.5.0 to 0.5.1 - [Release notes](https://github.com/moby/spdystream/releases) - [Commits](moby/spdystream@v0.5.0...v0.5.1) Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp` from 1.38.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.43.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.38.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.43.0) Updates `github.com/Azure/go-ntlmssp` from 0.0.0-20221128193559-754e69321358 to 0.1.1 - [Release notes](https://github.com/Azure/go-ntlmssp/releases) - [Commits](https://github.com/Azure/go-ntlmssp/commits/v0.1.1) Updates `github.com/in-toto/in-toto-golang` from 0.10.0 to 0.11.0 - [Release notes](https://github.com/in-toto/in-toto-golang/releases) - [Changelog](https://github.com/in-toto/in-toto-golang/blob/master/CHANGELOG.md) - [Commits](in-toto/in-toto-golang@v0.10.0...v0.11.0) Updates `github.com/moby/spdystream` from 0.5.0 to 0.5.1 - [Release notes](https://github.com/moby/spdystream/releases) - [Commits](moby/spdystream@v0.5.0...v0.5.1) Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp` from 1.38.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.43.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.38.0 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.38.0...v1.43.0) Updates `github.com/grafana/loki/v3` from 3.0.0-20250710111934-7be3efac7bc5 to 3.6.4 - [Release notes](https://github.com/grafana/loki/releases) - [Changelog](https://github.com/grafana/loki/blob/main/CHANGELOG.md) - [Commits](https://github.com/grafana/loki/commits/v3.6.4) --- updated-dependencies: - dependency-name: github.com/Azure/go-ntlmssp dependency-version: 0.1.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/in-toto/in-toto-golang dependency-version: 0.11.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/moby/spdystream dependency-version: 0.5.1 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/Azure/go-ntlmssp dependency-version: 0.1.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/moby/spdystream dependency-version: 0.5.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/Azure/go-ntlmssp dependency-version: 0.1.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/moby/spdystream dependency-version: 0.5.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/slack-go/slack dependency-version: 0.23.1 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/grafana/loki/v3 dependency-version: 3.6.4 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/Azure/go-ntlmssp dependency-version: 0.1.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/moby/spdystream dependency-version: 0.5.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/slack-go/slack dependency-version: 0.23.1 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/grafana/loki/v3 dependency-version: 3.6.4 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/Azure/go-ntlmssp dependency-version: 0.1.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/in-toto/in-toto-golang dependency-version: 0.11.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/moby/spdystream dependency-version: 0.5.1 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/Azure/go-ntlmssp dependency-version: 0.1.1 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/in-toto/in-toto-golang dependency-version: 0.11.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/moby/spdystream dependency-version: 0.5.1 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency-version: 1.43.0 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/grafana/loki/v3 dependency-version: 3.6.4 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels May 18, 2026

dependabot Bot had a problem deploying to integration May 18, 2026 19:11 Error

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the go_modules group across 6 directories with 7 updates#23

Bump the go_modules group across 6 directories with 7 updates#23
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/go_modules/core/scripts/go_modules-16386a18e5

dependabot Bot commented on behalf of github May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 18, 2026

v0.1.1

v0.1.0

What's Changed

New Contributors

v0.0.1

What's Changed

v0.11.0

What's Changed

v0.5.1

What's Changed

Security

Changes

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Changed

Deprecated

Fixed

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

Changed

Deprecated

Fixed

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

v0.1.1

v0.1.0

What's Changed

New Contributors

v0.0.1

What's Changed

v0.5.1

What's Changed

Security

Changes

v0.1.1

v0.1.0

What's Changed

New Contributors

v0.0.1

What's Changed

v0.5.1

What's Changed

Security

Changes

v0.23.1

Fixed

v0.23.0

Added

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants