Bump github.com/pelletier/go-toml/v2 from 2.2.4 to 2.3.0 by dependabot[bot] · Pull Request #1909 · awslabs/soci-snapshotter

dependabot · 2026-03-24T18:04:05Z

Bumps github.com/pelletier/go-toml/v2 from 2.2.4 to 2.3.0.

Release notes

Sourced from github.com/pelletier/go-toml/v2's releases.

v2.3.0

This is the first release built largely with the help of AI coding agents. Highlights include the complete removal of the unsafe package. go-toml is now fully safe Go code, with a geomean overhead of only ~1.4% vs v2.2.4 and zero additional allocations on benchmarks. This release also adds omitzero struct tag support, improves UnmarshalText/Unmarshaler handling for tables and array tables, and fixes several bugs including nil pointer marshaling, leap second handling, and datetime unmarshaling panics.

What's Changed

What's new

marshal: don't escape quotes unnecessarily by @virtuald in pelletier/go-toml#991

Add omitzero tag support by @NathanBaulch in pelletier/go-toml#998

Support custom IsZero() methods with omitzero tag by @pelletier in pelletier/go-toml#1020

UnmarshalText fallbacks to struct unmarshaling for tables and arrays by @pelletier in pelletier/go-toml#1026

[unstable] Support Unmarshaler interface for tables and array tables by @pelletier in pelletier/go-toml#1027

Fixed bugs

Add missing UnmarshalTOML call by @pelletier in pelletier/go-toml#996

Handle array table into an empty slice by @pelletier in pelletier/go-toml#997

Unwrap strict errors by @bersace in pelletier/go-toml#1012

Fix leap second handling found by fuzz by @pelletier in pelletier/go-toml#1019

Fix nil pointer map values not being marshaled by @pelletier in pelletier/go-toml#1025

Fix panic when unmarshaling datetime values to incompatible types (#1028) by @pelletier in pelletier/go-toml#1029

Fix parser error pointing to wrong line at EOF without trailing newline by @pelletier in pelletier/go-toml#1041

Documentation

Improve Unmarshaling README by @heckelson in pelletier/go-toml#1016

Create AGENTS.md guidelines file by @pelletier in pelletier/go-toml#1017

Other changes

Unsafe package removal by @pelletier in pelletier/go-toml#1021

Bump CI and test scripts to Go 1.26 by @pelletier in pelletier/go-toml#1030

New Contributors

@virtuald made their first contribution in pelletier/go-toml#991

@NathanBaulch made their first contribution in pelletier/go-toml#999

@bersace made their first contribution in pelletier/go-toml#1012

@flyn-org made their first contribution in pelletier/go-toml#1013

@heckelson made their first contribution in pelletier/go-toml#1016

Full Changelog: pelletier/go-toml@v2.2.4...v2.3.0

Commits

f36a3ec Reduce marshal and unmarshal overhead (#1044)
77f3862 Fix benchmark script replacing internal package imports (#1042)
16b1ef5 Fix parser error pointing to wrong line when last line has no trailing newlin...
e14bde7 build(deps): bump docker/login-action from 3 to 4 (#1039)
4b1ff01 build(deps): bump docker/setup-buildx-action from 3 to 4 (#1040)
048a25f Go 1.26 (#1030)
b357558 build(deps): bump goreleaser/goreleaser-action from 6 to 7 (#1035)
a0be52f build(deps): bump actions/upload-artifact from 6 to 7 (#1036)
316bfc6 Support Unmarshaler interface for tables and array tables (#1027)
2edc61f Fix panic when unmarshaling datetime values to incompatible types (#1028) (#1...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

github-actions · 2026-03-24T18:04:20Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 2 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 98a533e.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

cmd/go.mod

Package	Version	License	Issue Type
github.com/pelletier/go-toml/v2	2.3.0	Null	Unknown License

go.mod

Package	Version	License	Issue Type
github.com/pelletier/go-toml/v2	2.3.0	Null	Unknown License

Allowed Licenses:
Apache-2.0, BSD-2-Clause, BSD-2-Clause-FreeBSD, BSD-3-Clause, LicenseRef-scancode-google-patent-license-golang, MIT, ISC, Python-2.0, PostgreSQL, X11, Zlib

Excluded from license check:
pkg:golang/github.com/hashicorp/go-retryablehttp, pkg:golang/github.com/hashicorp/errwrap, pkg:golang/github.com/hashicorp/go-cleanhttp, pkg:golang/github.com/hashicorp/go-multierror

OpenSSF Scorecard

Package	Version	Score	Details
gomod/github.com/pelletier/go-toml/v2	2.3.0	Unknown	Unknown
gomod/github.com/pelletier/go-toml/v2	2.3.0	Unknown	Unknown

Scanned Files

cmd/go.mod
go.mod

Bumps [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) from 2.2.4 to 2.3.0. - [Release notes](https://github.com/pelletier/go-toml/releases) - [Commits](pelletier/go-toml@v2.2.4...v2.3.0) --- updated-dependencies: - dependency-name: github.com/pelletier/go-toml/v2 dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

coderbirju · 2026-03-31T17:13:27Z

@dependabot rebase

dependabot · 2026-03-31T17:13:30Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot · 2026-03-31T17:13:32Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Mar 24, 2026

dependabot Bot requested a review from a team as a code owner March 24, 2026 18:04

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Mar 24, 2026

github-actions Bot removed the go Pull requests that update Go code label Mar 24, 2026

coderbirju force-pushed the dependabot/go_modules/github.com/pelletier/go-toml/v2-2.3.0 branch from f27ebe7 to cd6030e Compare March 30, 2026 22:12

coderbirju force-pushed the dependabot/go_modules/github.com/pelletier/go-toml/v2-2.3.0 branch from cd6030e to 98a533e Compare March 30, 2026 22:19

coderbirju approved these changes Mar 30, 2026

View reviewed changes

coderbirju closed this Mar 31, 2026

dependabot Bot deleted the dependabot/go_modules/github.com/pelletier/go-toml/v2-2.3.0 branch March 31, 2026 17:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump github.com/pelletier/go-toml/v2 from 2.2.4 to 2.3.0#1909

Bump github.com/pelletier/go-toml/v2 from 2.2.4 to 2.3.0#1909
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/pelletier/go-toml/v2-2.3.0

dependabot Bot commented on behalf of github Mar 24, 2026

Uh oh!

github-actions Bot commented Mar 24, 2026 •

edited

Loading

Uh oh!

coderbirju commented Mar 31, 2026

Uh oh!

dependabot Bot commented on behalf of github Mar 31, 2026

Uh oh!

dependabot Bot commented on behalf of github Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Mar 24, 2026

v2.3.0

What's Changed

What's new

Fixed bugs

Documentation

Other changes

New Contributors

Uh oh!

github-actions Bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Snapshot Warnings

License Issues

cmd/go.mod

go.mod

OpenSSF Scorecard

Scanned Files

Uh oh!

coderbirju commented Mar 31, 2026

Uh oh!

dependabot Bot commented on behalf of github Mar 31, 2026

Uh oh!

dependabot Bot commented on behalf of github Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Mar 24, 2026 •

edited

Loading