chore(deps): bump the go-minor-patch group across 1 directory with 2 updates#32
chore(deps): bump the go-minor-patch group across 1 directory with 2 updates#32dependabot[bot] wants to merge 1 commit intomasterfrom
Conversation
…updates Bumps the go-minor-patch group with 2 updates in the / directory: [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles) and [github.com/meigma/blob](https://github.com/meigma/blob). Updates `github.com/charmbracelet/bubbles` from 0.21.0 to 0.21.1 - [Release notes](https://github.com/charmbracelet/bubbles/releases) - [Commits](charmbracelet/bubbles@v0.21.0...v0.21.1) Updates `github.com/meigma/blob` from 1.1.1 to 1.1.2 - [Release notes](https://github.com/meigma/blob/releases) - [Changelog](https://github.com/meigma/blob/blob/master/CHANGELOG.md) - [Commits](meigma/blob@v1.1.1...v1.1.2) --- updated-dependencies: - dependency-name: github.com/charmbracelet/bubbles dependency-version: 0.21.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch - dependency-name: github.com/meigma/blob dependency-version: 1.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch ... Signed-off-by: dependabot[bot] <[email protected]>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Kusari Analysis Results:Caution Flagged Issues Detected While the dependency health profile is acceptable with no deprecated packages and permissive licenses, this PR contains 6 critical security vulnerabilities that must be addressed before merging. Most severe are: (1) Two crypto/tls vulnerabilities in Go stdlib (CVE-2025-68121, CVE-2025-61730) that could enable session hijacking and compromise secure communications, (2) Path traversal vulnerability in go-tuf (CVE-2026-24686) allowing arbitrary file writes to the system, and (3) Memory exhaustion in net/url (CVE-2025-61726) enabling DoS attacks. These exploitable CVEs in critical infrastructure components (Go stdlib and go-tuf) pose immediate security risks that override the otherwise healthy dependency maintenance profile. Required actions: Update Go stdlib to latest patched version, upgrade go-tuf v0.7.0 and v2.3.1 to patched releases addressing the path traversal vulnerabilities. The maintenance concerns noted for indirect UI dependencies can be monitored post-remediation but are not blocking issues. Note View full detailed analysis result for more information on the output and the checks that were run. Required Code MitigationsUpdate Go stdlib to address crypto/tls and net/url vulnerabilities (CVE-2025-68121, CVE-2025-61730, CVE-2025-61726). Upgrade to the latest patched Go version that addresses these vulnerabilities.Update github.com/theupdateframework/go-tuf from v0.7.0 to the latest patched version that addresses CVE-2026-23991, CVE-2026-23992, and CVE-2026-24686. The path traversal vulnerability (CVE-2026-24686) is particularly critical as it allows arbitrary file writes.Update github.com/theupdateframework/go-tuf/v2 from v2.3.1 to address the path traversal vulnerability (CVE-2026-24686).Required Dependency Mitigations
Found this helpful? Give it a 👍 or 👎 reaction! |
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
bot
deleted the
dependabot/go_modules/go-minor-patch-31f10a0df0
branch
Bumps the go-minor-patch group with 2 updates in the / directory: github.com/charmbracelet/bubbles and github.com/meigma/blob.
Updates
github.com/charmbracelet/bubblesfrom 0.21.0 to 0.21.1Release notes
Sourced from github.com/charmbracelet/bubbles's releases.
Commits
9329772chore: update dependenciesff8b5a8chore(deps): bump actions/checkout from 5 to 6 in the all group (#863)62c7911chore(deps): bump the all group with 2 updates (#855)49ff5c0fix(textinput): improve placeholder (#768)d6934a1chore(deps): bump github.com/mattn/go-runewidth in the all group (#852)f2d1266chore(deps): bump github.com/charmbracelet/bubbletea in the all group (#850)5caedd7chore(deps): bump the all group with 2 updates (#848)cfdc19bchore(deps): bump actions/setup-go from 5 to 6 in the all group (#842)3532a32chore(deps): bump github.com/charmbracelet/bubbletea in the all group (#841)7c44f63v1: fix(list): ensure correct cursor positions with page/cursor methods (#831)Updates
github.com/meigma/blobfrom 1.1.1 to 1.1.2Release notes
Sourced from github.com/meigma/blob's releases.
Changelog
Sourced from github.com/meigma/blob's changelog.
Commits
36e2e64chore(master): release 1.1.2 (#61)7857128fix: wire blockCache through to registry Pull (#62)5d4b964fix: wire WithRefCacheTTL to ref cache creation (#60)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions