Skip to content

fix(deps): update osv-scanner minor#2674

Open
renovate-bot wants to merge 2 commits intogoogle:mainfrom
renovate-bot:renovate/osv-scanner-minor
Open

fix(deps): update osv-scanner minor#2674
renovate-bot wants to merge 2 commits intogoogle:mainfrom
renovate-bot:renovate/osv-scanner-minor

Conversation

@renovate-bot
Copy link
Copy Markdown
Collaborator

@renovate-bot renovate-bot commented Mar 22, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
charm.land/bubbles/v2 v2.0.0 → v2.1.0 age confidence require minor
charm.land/bubbletea/v2 v2.0.1 → v2.0.2 age confidence require patch
charm.land/lipgloss/v2 v2.0.1 → v2.0.2 age confidence require patch
github.com/gkampitakis/go-snaps v0.5.20 → v0.5.21 age confidence require patch
github.com/go-git/go-git/v5 v5.17.1 → v5.17.2 age confidence require patch
github.com/jedib0t/go-pretty/v6 v6.7.8 → v6.7.9 age confidence require patch
github.com/modelcontextprotocol/go-sdk v1.4.1 → v1.5.0 age confidence require minor
github.com/ossf/osv-schema/bindings/go ec3272c → 2a6a0b9 age confidence require digest
github.com/urfave/cli/v3 v3.7.0 → v3.8.0 age confidence require minor
golang.org/x/net v0.51.0 → v0.52.0 age confidence require minor v0.53.0
golang.org/x/term v0.40.0 → v0.41.0 age confidence require minor v0.42.0
google.golang.org/grpc v1.79.3 → v1.80.0 age confidence require minor

Release Notes

charmbracelet/bubbles (charm.land/bubbles/v2)

v2.1.0

Compare Source

Shrink ’n’ grow your textareas

The update adds a new feature to automatically resize your textarea vertically as its content changes.

ta := textarea.New()
ta.DynamicHeight = true   // Enable dynamic resizing
ta.MinHeight = 3          // Minimum visible rows
ta.MaxHeight = 10         // Maximum visible rows
ta.MaxContentHeight = 20  // Maximum rows of content

Piece of cake, right?

Enjoy! 💘

Changelog

New!

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/bubbletea (charm.land/bubbletea/v2)

v2.0.2

Compare Source

This release contains a small patch fixing a rendering that might affect Wish users running on Unix platforms.

Changelog

Fixed

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

charmbracelet/lipgloss (charm.land/lipgloss/v2)

v2.0.2

Compare Source

Table patch

If you don't know, we made big improvements in table rendering recently shipped in v2.0.0.

@​MartinodF made a good job on improving it even further for tricky edge cases, in particular when content wrapping is enabled.

Changelog

Fixed

The Charm logo

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

gkampitakis/go-snaps (github.com/gkampitakis/go-snaps)

v0.5.21

Compare Source

What's Changed

Full Changelog: gkampitakis/go-snaps@v0.5.20...v0.5.21

go-git/go-git (github.com/go-git/go-git/v5)

v5.17.2

Compare Source

What's Changed

⚠️ This release fixes a bug (#​1942) that blocked some users from upgrading to v5.17.1. Thanks @​pskrbasu for reporting it. 🙇

Full Changelog: go-git/go-git@v5.17.1...v5.17.2

jedib0t/go-pretty (github.com/jedib0t/go-pretty/v6)

v6.7.9

Compare Source

What's Changed

Full Changelog: jedib0t/go-pretty@v6.7.8...v6.7.9

modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)

v1.5.0

Compare Source

This release is equivalent to v1.5.0-pre.1. Thank you to those who tested the pre-release.

In this release we introduce important enhancements to the client-side OAuth flows. We also introduce several smaller fixes and improvements.

Stabilization of client-side OAuth APIs

As previously communicated, we're stabilizing the client-side OAuth APIs in v1.5.0. This means that the mcp_go_client_oauth build tag will no longer be required to compile the functionality and standard backward compatibility guarantees apply from now on.

Compared to the experimental support published in v1.4.0, we made some backwards incompatible changes:

  • auth.AuthorizationCodeHandlerConfig.AuthorizationCodeFetcher's type was changed from func(context.Context, *auth.AuthorizationArgs) (*auth.AuthorizationResult, error) to auth.AuthorizationCodeFetcher which is a reusable definition carrying the same underlying function type.
  • auth.AuthorizationCodeHandlerConfig.PreregisteredClientConfig was removed and replaced with auth.AuthorizationCodeHandlerConfig.PreregisteredClient which uses a newly introduced oauthex.ClientCredentials type. The type used previously (auth.PreregisteredClientConfig) has been removed.
  • Deprecated functionality has been removed from both auth and oauthex packages.

Enterprise Managed Authorization support added

Support for Enterprise Managed Authorization has been added to auth/extauth package. Huge thanks to @​radar07 for the implementation!

Note: this support is part of an official MCP extension and is not part of the core protocol. The support of this functionality is not covered by the principles defined in SDK tiers.

Other changes to the SDK

New Contributors

Full Changelog: modelcontextprotocol/go-sdk@v1.4.1...v1.5.0

urfave/cli (github.com/urfave/cli/v3)

v3.8.0

Compare Source

What's Changed

New Contributors

Full Changelog: urfave/cli@v3.7.0...v3.8.0

grpc/grpc-go (google.golang.org/grpc)

v1.80.0: Release 1.80.0

Compare Source

Behavior Changes

  • balancer: log a warning if a balancer is registered with uppercase letters, as balancer names should be lowercase. In a future release, balancer names will be treated as case-insensitive; see #​5288 for details. (#​8837)
  • xds: update resource error handling and re-resolution logic (#​8907)
    • Re-resolve all LOGICAL_DNS clusters simultaneously when re-resolution is requested.
    • Fail all in-flight RPCs immediately upon receipt of listener or route resource errors, instead of allowing them to complete.

Bug Fixes

  • xds: support the LB policy configured in LOGICAL_DNS cluster resources instead of defaulting to pick_first. (#​8733)
  • credentials/tls: perform per-RPC authority validation against the leaf certificate instead of the entire peer certificate chain. (#​8831)
  • xds: enabling A76 ring hash endpoint keys no longer causes EDS resources with invalid proxy metadata to be NACKed when HTTP CONNECT (gRFC A86) is disabled. (#​8875)
  • xds: validate that the sum of endpoint weights in a locality does not exceed the maximum uint32 value. (#​8899)
  • xds: fix incorrect proto field access in the weighted round robin (WRR) configuration where blackout_period was used instead of weight_expiration_period. (#​8915)
  • xds/rbac: handle addresses with ports in IP matchers. (#​8990)

New Features

  • ringhash: enable gRFC A76 (endpoint hash keys and request hash headers) by default. (#​8922)

Performance Improvements

  • credentials/alts: pool write buffers to reduce memory allocations and usage. (#​8919)
  • grpc: enable the use of pooled write buffers for buffering HTTP/2 frame writes by default. This reduces memory usage when connections are idle. Use the WithSharedWriteBuffer dial option or the SharedWriteBuffer server option to disable this feature. (#​8957)
  • xds/priority: stop caching child LB policies removed from the configuration. This will help reduce memory and cpu usage when localities are constantly switching between priorities. (#​8997)
  • mem: add a faster tiered buffer pool; use the experimental mem.NewBinaryTieredBufferPool function to create such pools. (#​8775)

Configuration

📅 Schedule: (in timezone Australia/Sydney)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@forking-renovate
Copy link
Copy Markdown

forking-renovate bot commented Mar 22, 2026 •
edited
Loading

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 7 additional dependencies were updated

Details:

Package Change
github.com/mattn/go-runewidth v0.0.20 -> v0.0.21
golang.org/x/crypto v0.48.0 -> v0.49.0
golang.org/x/mod v0.32.0 -> v0.33.0
golang.org/x/oauth2 v0.34.0 -> v0.35.0
golang.org/x/telemetry v0.0.0-20260109210033-bd525da824e2 -> v0.0.0-20260209163413-e7419c687ee4
golang.org/x/text v0.34.0 -> v0.35.0
golang.org/x/tools v0.41.0 -> v0.42.0

@forking-renovate forking-renovate bot added the dependencies Pull requests that update a dependency file label Mar 22, 2026
@renovate-bot renovate-bot force-pushed the renovate/osv-scanner-minor branch 3 times, most recently from 375eae7 to b01979e Compare March 23, 2026 02:06
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Mar 23, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.63%. Comparing base (800145f) to head (244485b).

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #2674      +/-   ##
==========================================
+ Coverage   71.60%   71.63%   +0.03%     
==========================================
  Files         164      164              
  Lines       12090    12090              
==========================================
+ Hits         8657     8661       +4     
+ Misses       2805     2803       -2     
+ Partials      628      626       -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate-bot renovate-bot force-pushed the renovate/osv-scanner-minor branch 16 times, most recently from 5cd8b42 to 079d4e7 Compare March 30, 2026 17:20
@renovate-bot renovate-bot force-pushed the renovate/osv-scanner-minor branch from 079d4e7 to f987814 Compare March 31, 2026 05:49
@renovate-bot renovate-bot force-pushed the renovate/osv-scanner-minor branch 6 times, most recently from e2068da to 0f8cbc6 Compare April 7, 2026 13:57
@renovate-bot renovate-bot force-pushed the renovate/osv-scanner-minor branch 11 times, most recently from 26f4263 to 4d2f0c7 Compare April 13, 2026 00:47
@renovate-bot renovate-bot force-pushed the renovate/osv-scanner-minor branch from 4d2f0c7 to 3478b3f Compare April 13, 2026 01:00
@cuixq
Copy link
Copy Markdown
Contributor

cuixq commented Apr 13, 2026

for version 3.8.0 of github.com/urfave/cli/v3, it seems an empty flag now sets the argument to be empty instead of erroring, see urfave/cli#2297 which caused the snapshot change.

we probably should rename the test case of WithDefaults/empty_plugins_flag_does_nothing to empty_plugins_flag_does_default considering the empty experimental plugins flag now indicates an empty list of experimental plugins which means the default list of plugins will be run.

@another-rex

@forking-renovate
Copy link
Copy Markdown

forking-renovate bot commented Apr 13, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@Solhack Solhack Solhack approved these changes

Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@renovate-bot @codecov-commenter @cuixq @Solhack