Skip to content

fix(deps): update go module minor/patch updates - #881

Open
github-actions[bot] wants to merge 1 commit into
mainfrom
renovate/gomod-minor-patch
Open

fix(deps): update go module minor/patch updates#881
github-actions[bot] wants to merge 1 commit into
mainfrom
renovate/gomod-minor-patch

Conversation

@github-actions

@github-actions github-actions Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Age Confidence
github.com/dustinkirkland/golang-petname require digest 6e3915f → fdd95a3 age confidence
github.com/ethereum/go-ethereum require patch v1.17.7 → v1.17.10 age confidence
github.com/prometheus/client_golang require minor v1.24.1 → v1.25.0 age confidence
github.com/prometheus/common require patch v0.72.0 → v0.72.1 age confidence
github.com/shopspring/decimal require minor v1.5.0 → v1.6.0 age confidence
golang.org/x/crypto require minor v0.57.0 → v0.58.0 age confidence
golang.org/x/sys require minor v0.48.0 → v0.49.0 age confidence
golang.org/x/term require minor v0.46.0 → v0.47.0 age confidence
modernc.org/sqlite require minor v1.60.1 → v1.61.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

ethereum/go-ethereum (github.com/ethereum/go-ethereum)

v1.17.10: Soil Reducer (v1.17.10)

Compare Source

This is a quick release that postpones the Amsterdam fork on the Hoodi testnet, previously scheduled for Oct 26, 2026, 17:42:48 UTC. Hoodi node operators running v1.17.9 must upgrade before then. A new date will be set in a future release; other networks are unaffected.

Snap sync now switches to snap/2 automatically once Amsterdam is active. Use --snap.v2=false or --snap.v2=true to force a protocol.

Changes

  • Cancel the Amsterdam activation on Hoodi (#​36001)
  • Use snap/2 automatically once Amsterdam is active (#​35989)
  • Optimize DUP/SWAP dispatch in the interpreter (#​35959)

For a full rundown of the changes please consult the Geth 1.17.10 release milestone.

As with all our previous releases, you can find the:

v1.17.9: Universal Semiconductor (v1.17.9)

Compare Source

This release enables the Amsterdam fork 🦩 on the Hoodi testnet at block timestamp 1793036 (Mon, 26 Oct 2026 17:42:48 UTC).

It also contains changes to the EVM to improve the performance significantly.

This release is recommended for all users running their nodes on the Hoodi testnet.

Geth

  • Blsync now supports the Gloas beacon chain fork and had some bug fixes (#​35956, #​35385, #​35957)
  • When running an archive node, you can now configure the transaction index history using --history.transactions flag. (#​35907)

Core

  • Amsterdam fork is set to activate at block timestamp 1793036. (#​35974)
  • EVM interpreter opcode dispatching became 16% faster due to a new inlined switch implementation. (#​35638)
  • Several fixes for database corruption on power failure (#​35939, #​35936)
  • Bug fix in trie database related to concurrent state reading (#​35978)
  • RPC call concurrent with block processing could result in BAL corruption. (#​35905)
  • State history committing is moved to the background, making newPayload 2% faster. (#​35949)
  • Key-value database settings changed for improved write performance (#​35691)
  • Fixed log index under history pruning beyond the checkpoint (#​35875)

Networking

  • Fixed snap/2 restart issue by checking for pivot block reorg in the header chain (#​35930, #​35982)
  • Added metrics to discovery listeners (#​35673)
  • Fixed mempool corruption with tip below base fee (#​35988)

RPC

  • eth_simulateV1 spec compliance fixes (#​35841, #​35842, #​35953)
  • eth_call and similar methods will reject fields which are not aligned with forks
  • eth_fillTransaction always chooses AccessList transaction when accessList is provided by user. (#​35969)
  • eth_newFilter now accepts earliest in toBlock. (#​35933)
  • eth_sendTransaction rejects invalid yParity value in 7702 transactions. (#​35761)
  • In debug_traceTransaction, debug_traceCall, omit storage on halted SLOAD/SSTORE steps. (#​35961)
  • Pending block access was fixed on the Amsterdam fork transition block. (#​35968)
  • Historical RPC calls will reject transaction features which have not yet activated. (#​35914, #​35928)

For a full rundown of the changes please consult the Geth 1.17.9 release milestone.

As with all our previous releases, you can find the:

v1.17.8: Protein Sludge Pack (v1.17.8)

Compare Source

This is a security-focused release, fixing several DoS risk issues ❤️‍🩹 . Note most of the the fixes related to bugs which only become possible after the activation of the Amsterdam fork. There are also some general correctness improvements.

This release is recommended for all users.

All Changes

Security
  • In the eth and snap p2p protocol handler, DoS resistance has been improved for multiple packet handlers (#​35862, #​35883, #​35859, #​35857, #​35904, #​35856)
  • JUMPDEST analysis caching has been hardened for attack cases after Amsterdam fork (#​35881)
  • The IP address predictor now requires IP verification before accepting statements (#​35861)
  • A post-Amsterdam DoS vector related to BAL accounts is resolved (#​35865)
  • A rogue STUN server could crash the node with an invalid response (#​35863)
RPC
  • eth_createAccessList now works when the sender account has no balance (#​35397)
  • eth_simulateV1 has been fixed to correctly report ETH transfer logs post-Amsterdam (#​35617)
  • eth_simulateV1 virtual blocks are now aligned with the Amsterdam spec (#​35668)
  • eth_capabilities reports the availability of receipts bounded by the transaction hash index (#​35878)
  • For eth_call and related operations, the transaction gas limit is no longer applied (after Amsterdam fork) (#​35845)
  • A post-Amsterdam crash in journaled live tracers core/tracing: handle creator nonce change without an open frame (#​35896)
  • An edge case in processing beacon chain head updates after unclean shutdown is resolved (#​35804)
  • abigen will now use sequential nonces when deploying library dependencies of a contract (#​35888)
Core Library
  • The hard-coded Hoodi testnet beacon chain genesis time was incorrect (#​35876)
  • blsync could get stuck if the server was unresponsive or overloaded (#​35872)
P2P
  • A correctness issue in the EIP-8070 Sparse Blobpool (Amsterdam fork) implementation is fixed (#​35860)
  • The dial scheduler now handles IPv4 <> IPv6 transitions for DNS-resolved static nodes (#​35880)
Build
  • The PPA now publishes for Ubuntu 26.04 "Resolute Raccoon" (#​35854)

For a full rundown of the changes please consult the Geth 1.17.8 release milestone.

As with all our previous releases, you can find the:

prometheus/client_golang (github.com/prometheus/client_golang)

v1.25.0

Compare Source

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #​2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #​1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #​1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #​2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #​2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #​2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #​2090, #​2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #​2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #​2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #​2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #​2135
What's changed

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.24.1...v1.25.0

prometheus/common (github.com/prometheus/common)

v0.72.1

Compare Source

Bugfixes
  • fix(config): deep copy the header in cloneRequest #​982
Internal
  • Fix MAINTAINERS.md link text typo in RELEASE.md #​1009
  • Synchronize common files from prometheus/prometheus #​1010
  • build(deps): bump the codeql group with 4 updates #​1007

Full Changelog: prometheus/common@v0.72.0...v0.72.1

shopspring/decimal (github.com/shopspring/decimal)

v1.6.0

Compare Source

BEHAVIOR CHANGES
  • Decimal implements fmt.Formatter. %#v prints Go code that recreates the value, like decimal.New(314, -2), instead of the struct fields, and verbs that don't apply, like %d, print %!d(decimal.Decimal=3.14). %v, %s, %q, %x and fmt.Println print the same as before #​463
  • Ln rounds correctly, so some results change in the last digit: Ln of 10 to 5 places is 2.30259, not 2.30258 #​471
  • ExpHullAbrham returns overallPrecision significant figures for every input. Negative inputs used to lose digits or return 0, like -50 at precision 10, and large inputs returned extra digits #​429 #​470
  • Scan converts float32 with NewFromFloat32, so 54.33 stays 54.33 instead of becoming 54.33000183105469. NaN and infinite floats return an error instead of panicking #​469
  • On Go 1.10 to 1.12, NewFromFloat can pick a different shortest form in rare cases (golang/go#29491). It still converts back to the same float #​431
FEATURES
  • Add BSON Decimal128 support for Decimal and NullDecimal with the official MongoDB Go driver v2, without a new dependency #​460
  • Add %f formatting with precision, width and flags, like %.2f and %08.2f #​463
  • Add Normalize, which strips trailing zeros so equal decimals also match with reflect.DeepEqual, testify and gomock #​464
  • Add Sqrt and SqrtRound #​465
  • Add Root and RootRound for n-th roots #​473
  • Add NewFromBigFloat constructor #​457
  • Scan accepts Decimal, big.Int, *big.Int and all integer sizes, as passed by ClickHouse and other drivers #​469
ENHANCEMENTS
  • NewFromFloat and NewFromFloat32 are 3 to 6 times faster. They use strconv instead of a vendored copy of it from 2009, which is removed #​431
  • Ln is 3 to 14 times faster #​471
  • Slightly faster IsInteger and Ceil #​299
  • NewFromString accepts the Unicode minus sign − (U+2212) #​428
  • Scanning NULL into a Decimal returns an error that points to NullDecimal or *Decimal #​474
  • Document that global settings aren't goroutine-safe, and list them with their per-call alternatives in the README #​466
  • README: show how to control the JSON format of one field, add udecimal to the alternative libraries, and update the Go doc and playground links #​475 #​476 #​264
  • Fix doc examples that were wrong or didn't compile #​468
  • Fix benchmarks that measured their setup or the wrong function #​467
BUGFIXES
  • QuoRem and DivRound panic on precision math.MinInt32 instead of returning a wrong quotient #​472
cznic/sqlite (modernc.org/sqlite)

v1.61.0

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@github-actions

github-actions Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 9 additional dependencies were updated

Details:

Package Change
github.com/dustin/go-humanize v1.0.1 -> v1.1.0
github.com/ncruces/go-strftime v1.0.0 -> v1.1.0
github.com/prometheus/procfs v0.21.1 -> v0.22.0
golang.org/x/mod v0.41.0 -> v0.42.0
golang.org/x/net v0.59.0 -> v0.61.0
golang.org/x/sync v0.23.0 -> v0.24.0
golang.org/x/text v0.42.0 -> v0.43.0
golang.org/x/tools v0.50.0 -> v0.52.0
modernc.org/libc v1.77.1 -> v1.79.0

@github-actions
github-actions Bot force-pushed the renovate/gomod-minor-patch branch from 1c7639d to be340bd Compare October 14, 2026 13:11
@OisinKyne
OisinKyne enabled auto-merge (rebase) October 14, 2026 13:29
@github-actions
github-actions Bot force-pushed the renovate/gomod-minor-patch branch 3 times, most recently from d59371d to 410be79 Compare October 21, 2026 16:39
@github-actions
github-actions Bot force-pushed the renovate/gomod-minor-patch branch from 410be79 to 9972475 Compare October 23, 2026 12:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@OisinKyne OisinKyne OisinKyne approved these changes

Assignees

No one assigned

Labels

renovate/gomod

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@OisinKyne