Skip to content

Bump the go group across 1 directory with 5 updates - #1611

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/go-52663ebac8
Open

Bump the go group across 1 directory with 5 updates#1611
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/go-52663ebac8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go group with 5 updates in the / directory:

Package From To
github.com/beevik/etree 1.7.0 1.7.1
github.com/buger/jsonparser 1.3.0 1.6.1
github.com/stretchr/testify 1.11.1 1.12.1
github.com/vbauerster/mpb/v8 8.14.0 8.16.0
golang.org/x/text 0.40.0 0.41.0

Updates github.com/beevik/etree from 1.7.0 to 1.7.1

Release notes

Sourced from github.com/beevik/etree's releases.

Release v1.7.1

Changes

  • Improve efficiency of Element.Text and Element.Tail.
Changelog

Sourced from github.com/beevik/etree's changelog.

Release 1.7.1

Changes

  • Improve efficiency of Element.Text and Element.Tail.
Commits

Updates github.com/buger/jsonparser from 1.3.0 to 1.6.1

Release notes

Sourced from github.com/buger/jsonparser's releases.

v1.6.1 — Fastest across all payload sizes (now benchmarks vs gjson + sonic)

🔒 Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

Performance — gjson-style fast-skip

Ported gjson's >'\\' single-comparison fast-skip to three hot loops. The trick skips all non-structural bytes (those > 0x5C) in one unsigned comparison per byte, reducing branch overhead.

Payload Before After Change
Small (190B) 382 ns 339 ns -11.3%
Medium (2.4kB) 3,899 ns 3,141 ns -19.4%
Large (24kB) 20,788 ns 20,114 ns -3.2%

Now benchmarks against gjson and sonic

Added tidwall/gjson (15.5k⭐) and bytedance/sonic (9.6k⭐) to the benchmark suite.

Large payload — the definitive ranking:

Library time/op allocs
jsonparser 20,114 ns 0
gjson 22,756 ns 2
easyjson 33,771 ns 134
sonic 41,053 ns 71
ffjson 59,063 ns 144
encoding/json 130,565 ns 147

jsonparser is the fastest across ALL payload sizes and the only zero-allocation parser.

Full changelog: CHANGELOG.md

v1.6.0 — Append function + zero open known issues

🔒 Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings, 0 open known issues)

New API: Append

// Append to an array without knowing its length
data, _ = jsonparser.Append(data, []byte(`"new_item"`), "items")

Append(data, value, keys...) ([]byte, error) — clean array-append API. Works on top-level and nested arrays. Auto-creates missing paths as single-element arrays. No need for [N] path syntax.

Bug fixes — all known issues resolved

KI Fix
KI-2 ParseInt("-") now returns MalformedValueError (was returning 0, nil)
KI-3 Disposition corrected to fixed (auto-coerce was implemented in v1.3.0)

... (truncated)

Changelog

Sourced from github.com/buger/jsonparser's changelog.

[v1.6.1] — 2026-07-29

Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

Performance — gjson-style fast-skip in hot loops

Ported gjson's >'\\' fast-skip trick to three inner loops in parser.go: stringEndConfig tail, blockEndConfig, and searchKeysConfig. The trick uses a single unsigned comparison (byte > 0x5C) to skip all non-structural bytes in bulk, reducing per-byte branch overhead.

Payload Before After Improvement
Small (190B) 382 ns 339 ns -11.3%
Medium (2.4kB) 3,899 ns 3,141 ns -19.4%
Large (24kB) 20,788 ns 20,114 ns -3.2%

Zero allocations maintained on all paths.

Benchmarks — now includes gjson and sonic

Added tidwall/gjson (15.5k⭐, path-based parser like jsonparser) and bytedance/sonic (9.6k⭐, SIMD-accelerated deserializer) to the benchmark suite.

Final leaderboard (large payload):

Library time/op bytes/op allocs/op
buger/jsonparser 20,114 0 0
tidwall/gjson 22,756 28,672 2
mailru/easyjson 33,771 4,016 134
bytedance/sonic 41,053 31,368 71
pquerna/ffjson 59,063 4,822 144
encoding/json 130,565 4,432 147

jsonparser is the fastest across all payload sizes and the only zero-allocation parser.

[v1.6.0] — 2026-07-29

Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

New API — Append

// Append to an array without knowing its length
data, _ = jsonparser.Append(data, []byte(`"new_item"`), "items")

... (truncated)

Commits
  • 5663ba4 v1.6.1: gjson-style fast-skip optimization + benchmarks vs gjson/sonic
  • caa05b0 perf: gjson-style fast-skip in hot loops + benchmarks vs gjson/sonic
  • f1c83ac docs: remove anniversary article from repo (private draft)
  • 6c82735 docs: ten-year anniversary article with personal backstory and transitive deps
  • 3005d5b v1.6.0: Append function + all KI fixes (zero open known issues)
  • a55c29b v1.5.1: 6.1x large-payload speedup + fresh benchmarks
  • 09dbcf6 perf: SWAR string scan in stringEndConfig (8% large-payload speedup)
  • df5ae5b perf: bound stringEnd backslash scan to string body (5.8x large-payload speedup)
  • ae21251 Add MC/DC witnesses for SYS-REQ-115 (Config) and SYS-REQ-116 (ReaderParser)
  • dfb33c1 docs: complete CHANGELOG with v1.3.0–v1.5.0 entries, all mentioning ReqProof ...
  • Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

Updates github.com/vbauerster/mpb/v8 from 8.14.0 to 8.16.0

Release notes

Sourced from github.com/vbauerster/mpb/v8's releases.

v8.16.0

Full Changelog: vbauerster/mpb@v8.15.2...v8.16.0

v8.15.2

Full Changelog: vbauerster/mpb@v8.15.1...v8.15.2

v8.15.1

Full Changelog: vbauerster/mpb@v8.15.0...v8.15.1

v8.15.0

What's Changed

Full Changelog: vbauerster/mpb@v8.14.0...v8.15.0

Commits
  • 2d72456 v8.16.0
  • ad84d9d go get -u
  • 15a96e9 refactoring: CancelCauseFunc -> CancelFunc
  • 84415fe minor: it's ok to pass just writeCloser
  • a058c64 fix: issue 165
  • ebbac47 refactoring: nolint:staticcheck QF1008
  • 4d7945a refactoring: pass Reader|Writer directly
  • 86a1683 refactoring: io example
  • 4777af7 refactoring: io.Closer assertion is enough
  • aa38696 refactoring: newProxyReader and newProxyWriter
  • Additional commits viewable in compare view

Updates golang.org/x/text from 0.40.0 to 0.41.0

Commits
  • acdba66 go.mod: update golang.org/x dependencies
  • 02aa981 secure/precis: fix short destination buffer handling in Nickname profile
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 19, 2026
@ehl-jf ehl-jf added the ignore for release Automatically generated release notes label Aug 19, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-52663ebac8 branch from 5594632 to e616ac4 Compare August 27, 2026 00:53
@dependabot
Bump the go group across 1 directory with 5 updates
483b988 
Bumps the go group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/beevik/etree](https://github.com/beevik/etree) | `1.7.0` | `1.7.1` |
| [github.com/buger/jsonparser](https://github.com/buger/jsonparser) | `1.3.0` | `1.6.1` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.1` |
| [github.com/vbauerster/mpb/v8](https://github.com/vbauerster/mpb) | `8.14.0` | `8.16.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.40.0` | `0.41.0` |



Updates `github.com/beevik/etree` from 1.7.0 to 1.7.1
- [Release notes](https://github.com/beevik/etree/releases)
- [Changelog](https://github.com/beevik/etree/blob/main/RELEASE_NOTES.md)
- [Commits](beevik/etree@v1.7.0...v1.7.1)

Updates `github.com/buger/jsonparser` from 1.3.0 to 1.6.1
- [Release notes](https://github.com/buger/jsonparser/releases)
- [Changelog](https://github.com/buger/jsonparser/blob/master/CHANGELOG.md)
- [Commits](buger/jsonparser@v1.3.0...v1.6.1)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

Updates `github.com/vbauerster/mpb/v8` from 8.14.0 to 8.16.0
- [Release notes](https://github.com/vbauerster/mpb/releases)
- [Commits](vbauerster/mpb@v8.14.0...v8.16.0)

Updates `golang.org/x/text` from 0.40.0 to 0.41.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.40.0...v0.41.0)

---
updated-dependencies:
- dependency-name: github.com/beevik/etree
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/buger/jsonparser
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/vbauerster/mpb/v8
  dependency-version: 8.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/text
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-52663ebac8 branch from e616ac4 to 483b988 Compare August 28, 2026 00:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ehl-jf ehl-jf ehl-jf approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code ignore for release Automatically generated release notes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ehl-jf