Bump the go group across 1 directory with 6 updates by dependabot[bot] · Pull Request #1382 · jfrog/jfrog-client-go

dependabot · 2026-08-25T15:53:03Z

Bumps the go group with 3 updates in the / directory: github.com/CycloneDX/cyclonedx-go, github.com/buger/jsonparser and github.com/go-git/go-git/v5.

Updates github.com/CycloneDX/cyclonedx-go from 0.11.0 to 0.12.0

Release notes

Sourced from github.com/CycloneDX/cyclonedx-go's releases.

v0.12.0

Changelog

Building and Packaging

5dfc64ab963e76da86efe7faae291ed095923484: build(deps): bump actions/checkout from 6.0.2 to 7.0.1 (@dependabot[bot])

1ede59bde7338f3c399d3fb8496fea1d09a64c4a: build(deps): bump actions/checkout from 6.0.2 to 7.0.1 (@dependabot[bot])

0802b2051bf0bab06d4292ffe9544f1b81b7d871: build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 (@dependabot[bot])

912c03326d52e05a11c8b4c04611e645e23a511f: build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (@dependabot[bot])

3b6942c801ce9089f70ce5d6823f9bc412ff1083: build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (@dependabot[bot])

14a734c429eb00311801569d0fca83d528f7807b: build(deps): bump github.com/terminalstatic/go-xsd-validate (@dependabot[bot])

c3551dd3988ca16fc885906fdbed9871b97ed15f: build(deps): bump github.com/terminalstatic/go-xsd-validate (@dependabot[bot])

4598c3a9e8b7a69f9e5c30b4082cce6f12da9ad6: build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.3.0 (@dependabot[bot])

0d3dc12d273ad6c9bb80d3b00b52908f3df228b0: build(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.3 (@dependabot[bot])

Others

ed2c60ec63e49257c9b943be633157777d70bd97: Encode evidence identity as a single object when downgrading below 1.6 (@sueun-dev)

3d9769a7919bf961da7c90286e9b6aa8f6389c8f: Strip fields newer than the target spec version when downgrading (@sueun-dev)

cdee31c65c4f9675f81aff69deadae480019030c: chore: bump minimum go version to 1.25 (@nscuro)

b3fcca54d5debbfe3cbf51078bf2c69bf65ed789: chore: harden GHA workflows; add zizmor job (@nscuro)

cbc84f956ef2472a864d055705df0901335bf8fb: chore: refresh goreleaser setup (@nscuro)

Commits

717afd1 Merge pull request #289 from CycloneDX/go-1.25
cdee31c chore: bump minimum go version to 1.25
a748788 Merge pull request #288 from CycloneDX/goreleaser-config-update
c69efae Merge pull request #287 from CycloneDX/dependabot/github_actions/actions/chec...
cbc84f9 chore: refresh goreleaser setup
5dfc64a build(deps): bump actions/checkout from 6.0.2 to 7.0.1
2c4927c Merge pull request #286 from CycloneDX/gha-hardening
b3fcca5 chore: harden GHA workflows; add zizmor job
9401da7 Merge pull request #285 from CycloneDX/dependabot/go_modules/github.com/stret...
3b6942c build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1
Additional commits viewable in compare view

Updates github.com/buger/jsonparser from 1.2.0 to 1.6.1

Release notes

Sourced from github.com/buger/jsonparser's releases.

v1.6.1 — Fastest across all payload sizes (now benchmarks vs gjson + sonic)

🔒 Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

Performance — gjson-style fast-skip

Ported gjson's >'\\' single-comparison fast-skip to three hot loops. The trick skips all non-structural bytes (those > 0x5C) in one unsigned comparison per byte, reducing branch overhead.

Payload Before After Change

Small (190B) 382 ns 339 ns -11.3%

Medium (2.4kB) 3,899 ns 3,141 ns -19.4%

Large (24kB) 20,788 ns 20,114 ns -3.2%

Now benchmarks against gjson and sonic

Added tidwall/gjson (15.5k⭐) and bytedance/sonic (9.6k⭐) to the benchmark suite.

Large payload — the definitive ranking:

Library time/op allocs

jsonparser 20,114 ns 0

gjson 22,756 ns 2

easyjson 33,771 ns 134

sonic 41,053 ns 71

ffjson 59,063 ns 144

encoding/json 130,565 ns 147

jsonparser is the fastest across ALL payload sizes and the only zero-allocation parser.

Full changelog: CHANGELOG.md

v1.6.0 — Append function + zero open known issues

🔒 Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings, 0 open known issues)

New API: Append
// Append to an array without knowing its length
data, _ = jsonparser.Append(data, []byte(`"new_item"`), "items")
Append(data, value, keys...) ([]byte, error) — clean array-append API. Works on top-level and nested arrays. Auto-creates missing paths as single-element arrays. No need for [N] path syntax.

Bug fixes — all known issues resolved

KI Fix

KI-2 ParseInt("-") now returns MalformedValueError (was returning 0, nil)

KI-3 Disposition corrected to fixed (auto-coerce was implemented in v1.3.0)

... (truncated)

Changelog

Sourced from github.com/buger/jsonparser's changelog.

[v1.6.1] — 2026-07-29

Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

Performance — gjson-style fast-skip in hot loops

Ported gjson's >'\\' fast-skip trick to three inner loops in parser.go: stringEndConfig tail, blockEndConfig, and searchKeysConfig. The trick uses a single unsigned comparison (byte > 0x5C) to skip all non-structural bytes in bulk, reducing per-byte branch overhead.

Payload Before After Improvement

Small (190B) 382 ns 339 ns -11.3%

Medium (2.4kB) 3,899 ns 3,141 ns -19.4%

Large (24kB) 20,788 ns 20,114 ns -3.2%

Zero allocations maintained on all paths.

Benchmarks — now includes gjson and sonic

Added tidwall/gjson (15.5k⭐, path-based parser like jsonparser) and bytedance/sonic (9.6k⭐, SIMD-accelerated deserializer) to the benchmark suite.

Final leaderboard (large payload):

Library time/op bytes/op allocs/op

buger/jsonparser 20,114 0 0

tidwall/gjson 22,756 28,672 2

mailru/easyjson 33,771 4,016 134

bytedance/sonic 41,053 31,368 71

pquerna/ffjson 59,063 4,822 144

encoding/json 130,565 4,432 147

jsonparser is the fastest across all payload sizes and the only zero-allocation parser.

[v1.6.0] — 2026-07-29

Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

New API — Append
// Append to an array without knowing its length
data, _ = jsonparser.Append(data, []byte(`"new_item"`), "items")

... (truncated)

Commits

5663ba4 v1.6.1: gjson-style fast-skip optimization + benchmarks vs gjson/sonic
caa05b0 perf: gjson-style fast-skip in hot loops + benchmarks vs gjson/sonic
f1c83ac docs: remove anniversary article from repo (private draft)
6c82735 docs: ten-year anniversary article with personal backstory and transitive deps
3005d5b v1.6.0: Append function + all KI fixes (zero open known issues)
a55c29b v1.5.1: 6.1x large-payload speedup + fresh benchmarks
09dbcf6 perf: SWAR string scan in stringEndConfig (8% large-payload speedup)
df5ae5b perf: bound stringEnd backslash scan to string body (5.8x large-payload speedup)
ae21251 Add MC/DC witnesses for SYS-REQ-115 (Config) and SYS-REQ-116 (ReaderParser)
dfb33c1 docs: complete CHANGELOG with v1.3.0–v1.5.0 entries, all mentioning ReqProof ...
Additional commits viewable in compare view

Updates github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2

Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.19.2

What's Changed

build: Update module golang.org/x/crypto to v0.52.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2150

build: Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2141

build: Update module golang.org/x/net to v0.55.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2152

git: Worktree: Add stores index entires with backslashes on Windows by @joshblum in go-git/go-git#2262

storage: dotgit, reject path traversal in reference names by @pjbgf in go-git/go-git#2254

build: Update module golang.org/x/net to v0.56.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2267

build: Update module golang.org/x/text to v0.39.0 [SECURITY] (releases/v5.x) by @go-git-renovate[bot] in go-git/go-git#2268

[v5] git: worktree, make the filesystem wrapper a symlink-safe boundary by @pjbgf in go-git/go-git#2277

Full Changelog: go-git/go-git@v5.19.1...v5.19.2

Commits

3eeb238 Merge pull request #2277 from go-git/checkout-v5
008a78f git: worktree, make the filesystem wrapper a symlink-safe boundary
2263fb5 Merge pull request #2268 from go-git/renovate/releases/v5.x-go-golang.org-x-t...
77b7625 build: Update module golang.org/x/text to v0.39.0 [SECURITY]
85ea767 Merge pull request #2267 from go-git/renovate/releases/v5.x-go-golang.org-x-n...
198675a build: Update module golang.org/x/net to v0.56.0 [SECURITY]
4a0e66d Merge pull request #2254 from pjbgf/v5-dotgit-ref-name-containment
3b306ef storage: dotgit, align reference-name safety with refname_is_safe
f3d0cc1 storage: dotgit, reject path traversal in reference names
979cfe9 Merge pull request #2262 from joshblum/joshblum/to-slash-v5
Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

Change yaml library to go.yaml.in/yaml/v3 by @harryzcy in stretchr/testify#1935

change yaml library to go.yaml.in/yaml/v3 by @boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

@harryzcy made their first contribution in stretchr/testify#1935

@boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

Change yaml library to go.yaml.in/yaml/v3 by @harryzcy in stretchr/testify#1935

change yaml library to go.yaml.in/yaml/v3 by @boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

@harryzcy made their first contribution in stretchr/testify#1935

@boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

assert: make *AssertionFunc types just aliases by @dolmen in stretchr/testify#1563

Fixes

mock: avoid panic when expected type is nil in Arguments.Diff by @mutaiib in stretchr/testify#1775

mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @brackendawson in stretchr/testify#1786

suite: validate method signatures and continue execution for valid tests by @vyas-git in stretchr/testify#1665

assert.PanicsWithError: report error message by @olivergondza in stretchr/testify#1400

assert: IsIncreasing et al can return false w/out failing by @brackendawson in stretchr/testify#1787

add type to error message of assert.Same by @egawata in stretchr/testify#1792

mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @brackendawson in stretchr/testify#1795

assert: truncate very long objects in test failure messages by @brackendawson in stretchr/testify#1646

assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @nghiack7 in stretchr/testify#1888

suite: prevent panic when SetupTest skips with HandleStats by @blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

CI: test also with Go 1.23 by @dolmen in stretchr/testify#1783

Vendor unmaintained github.com/pmezard/go-difflib by @brackendawson in stretchr/testify#1708

Promote ccoVeille to maintainer by @brackendawson in stretchr/testify#1784

build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in stretchr/testify#1790

assert.YAMLEq: Document mutlidoc behavior by @brackendawson in stretchr/testify#1791

_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @dolmen in stretchr/testify#1782

doc: remove ineffective inline code blocks by @brackendawson in stretchr/testify#1714

Tag generated assertions as non-generated in new .gitattributes by @ubunatic in stretchr/testify#1815

... (truncated)

Commits

959dbda Merge pull request #1935 from harryzcy/yaml-update
9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
001eb79 Merge pull request #1905 from Kentzo/patch-1
ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
f8c01f3 mock: Mock.Return does not exist anymore
12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
a11649e assert: make *AssertionFunc type just aliases
dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
098f8d7 _codegen: use strings.Builder
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.52.0 to 0.53.0

Commits

45460e0 go.mod: update golang.org/x dependencies
d37c95e pkcs12: limit PBKDF iteration count to prevent CPU exhaustion
e2ffffe ssh: reject incomplete gssapi-with-mic configurations
60e158a ssh/test: isolate CLI tests from user SSH config and agent
1b77d23 ssh/knownhosts: reject lines with multiple or unknown markers
3872a2b ssh/knownhosts: verify declared key type matches decoded key
9f72ecc ssh/knownhosts: treat only ASCII space and tab as whitespace
8f405a4 ssh: validate ECDSA curve matches expected algorithm
bb41b3d ssh: improve DH GEX group selection using PreferredBits
e04e721 ssh/agent: validate ed25519 private key length in Add
Additional commits viewable in compare view

Updates golang.org/x/term from 0.43.0 to 0.44.0

Commits

3b43943 go.mod: update golang.org/x dependencies
See full diff in compare view

Bumps the go group with 3 updates in the / directory: [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go), [github.com/buger/jsonparser](https://github.com/buger/jsonparser) and [github.com/go-git/go-git/v5](https://github.com/go-git/go-git). Updates `github.com/CycloneDX/cyclonedx-go` from 0.11.0 to 0.12.0 - [Release notes](https://github.com/CycloneDX/cyclonedx-go/releases) - [Commits](CycloneDX/cyclonedx-go@v0.11.0...v0.12.0) Updates `github.com/buger/jsonparser` from 1.2.0 to 1.6.1 - [Release notes](https://github.com/buger/jsonparser/releases) - [Changelog](https://github.com/buger/jsonparser/blob/master/CHANGELOG.md) - [Commits](buger/jsonparser@v1.2.0...v1.6.1) Updates `github.com/go-git/go-git/v5` from 5.19.1 to 5.19.2 - [Release notes](https://github.com/go-git/go-git/releases) - [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md) - [Commits](go-git/go-git@v5.19.1...v5.19.2) Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.1) Updates `golang.org/x/crypto` from 0.52.0 to 0.53.0 - [Commits](golang/crypto@v0.52.0...v0.53.0) Updates `golang.org/x/term` from 0.43.0 to 0.44.0 - [Commits](golang/term@v0.43.0...v0.44.0) --- updated-dependencies: - dependency-name: github.com/buger/jsonparser dependency-version: 1.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/CycloneDX/cyclonedx-go dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.19.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/stretchr/testify dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: golang.org/x/crypto dependency-version: 0.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: golang.org/x/term dependency-version: 0.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 25, 2026

dependabot Bot had a problem deploying to build-gate August 25, 2026 15:53 Error

ehl-jf added the ignore for release Automatically generated release notes label Aug 25, 2026

dependabot Bot force-pushed the dependabot/go_modules/go-132c4bed65 branch from 1ee15ba to ac0a69c Compare August 27, 2026 15:52

dependabot Bot requested a deployment to build-gate August 27, 2026 15:53 Waiting

Navigation Menu

Uh oh!

Bump the go group across 1 directory with 6 updates - #1382

Bump the go group across 1 directory with 6 updates#1382
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/go-132c4bed65

dependabot Bot commented on behalf of github Aug 25, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Payload	Before	After	Change
Small (190B)	382 ns	339 ns	-11.3%
Medium (2.4kB)	3,899 ns	3,141 ns	-19.4%
Large (24kB)	20,788 ns	20,114 ns	-3.2%

Library	time/op	allocs
jsonparser	20,114 ns	0
gjson	22,756 ns	2
easyjson	33,771 ns	134
sonic	41,053 ns	71
ffjson	59,063 ns	144
encoding/json	130,565 ns	147

KI	Fix
KI-2	`ParseInt("-")` now returns `MalformedValueError` (was returning `0, nil`)
KI-3	Disposition corrected to `fixed` (auto-coerce was implemented in v1.3.0)

Library	time/op	bytes/op	allocs/op
buger/jsonparser	20,114	0	0
tidwall/gjson	22,756	28,672	2
mailru/easyjson	33,771	4,016	134
bytedance/sonic	41,053	31,368	71
pquerna/ffjson	59,063	4,822	144
encoding/json	130,565	4,432	147

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.12.0

Changelog

Building and Packaging

Others

v1.6.1 — Fastest across all payload sizes (now benchmarks vs gjson + sonic)

🔒 Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

Performance — gjson-style fast-skip

Now benchmarks against gjson and sonic

v1.6.0 — Append function + zero open known issues

🔒 Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings, 0 open known issues)

New API: Append

Bug fixes — all known issues resolved

[v1.6.1] — 2026-07-29

Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

Performance — gjson-style fast-skip in hot loops

Benchmarks — now includes gjson and sonic

[v1.6.0] — 2026-07-29

Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

New API — Append

v5.19.2

What's Changed

v1.12.1

What's Changed

New Contributors

What's Changed

New Contributors

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 25, 2026 •

edited

Loading

New API: `Append`

New API — `Append`