Skip to content

chore(deps): update security updates (major)#186

Merged
NumaryBot merged 2 commits intomainfrom
renovate/major-security
Mar 20, 2026
Merged

chore(deps): update security updates (major)#186
NumaryBot merged 2 commits intomainfrom
renovate/major-security

Conversation

@NumaryBot
Copy link
Copy Markdown
Contributor

@NumaryBot NumaryBot commented Mar 20, 2026

This PR contains the following updates:

Package Type Update Change
github.com/alitto/pond require major v1.9.2 -> v2.7.0
github.com/formancehq/go-libs/v2 require major v2.2.3 -> v4.1.1
github.com/lestrrat-go/jwx indirect major v1.2.30 -> v3.0.13
github.com/lestrrat-go/option indirect major v1.0.1 -> v2.0.0
github.com/lithammer/shortuuid/v3 indirect major v3.0.7 -> v4.2.0
github.com/oklog/ulid indirect major v1.3.1 -> v2.1.1
go.yaml.in/yaml/v2 indirect major v2.4.3 -> v3.0.4
gopkg.in/evanphx/json-patch.v4 indirect major v4.13.0 -> v5.9.11

Release Notes

alitto/pond (github.com/alitto/pond)

v2.7.0

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.6.2...v2.7.0

v2.6.2

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.6.1...v2.6.2

v2.6.1

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.6.0...v2.6.1

v2.6.0

Compare Source

What's Changed

Breaking Changes

  • Setting the queue size option to zero (0) via WithQueueSize(0) now disables the task queue altogether (all task submissions block until a worker becomes available unless the pool is set to non-blocking mode). Before this change, setting queue size to 0 would cause the queue to be unbounded. Pools are still unbounded by default, but now there's a constant that can be used to set queue size to unbounded explicitly. E.g. pond.NewPool(10, pond.WithQueueSize(pond.Unbounded)).

Full Changelog: alitto/pond@v2.5.0...v2.6.0

v2.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: alitto/pond@v2.4.0...v2.5.0

v2.4.0

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.3.4...v2.4.0

v2.3.4

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.3.3...v2.3.4

v2.3.3

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.3.2...v2.3.3

v2.3.2

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.3.1...v2.3.2

v2.3.1

Compare Source

Pull requests

Changes

  • Ensure closed atomic bool is toggled and checked while holding the mutex to avoid race conditions.
  • Ensure workersWaitGroup.Add() is always called while holding the mutex to avoid race conditions.
  • Improve comments on submit methods to clarify the behavior when the pool is stopped.
  • Refactor trySubmit method to make it simpler and more clear.
  • Centralize worker launch in a new method called launchWorker.
  • Replace subpoolSubmit with subpoolWorker method.
  • Add methods to submit individual tasks in a non-blocking fashion (TrySubmit and TrySubmitErr). Requested in https://github.com/alitto/pond/issues/103
  • Expose new DroppedTasks metric that reflects the number of tasks that were not executed because the queue was full. Issue reported in https://github.com/alitto/pond/issues/100
  • SubmittedTasks metric now includes dropped tasks and it stops being updated once the pool is stopped.

Fixes

  • Decrement workerCount counter when the pool context is cancelled.
  • Resize() now supports setting maxConcurrency to 0 (no limit)

Full Changelog: alitto/pond@v2.3.0...v2.3.1

v2.3.0

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.2.0...v2.3.0

v2.2.0

Compare Source

What's Changed

  • feat(pool): add option to bound task queue (v2) by @​alitto in https://github.com/alitto/pond/pull/99
    • Add support to create bounded pools by specifying a queue size (WithQueueSize option).
    • Add support to choose how to deal with tasks submitted when the queue is full (WithNonBlocking option).
    • Ensure RunningWorkers() method in subpools reflect the actual number of workers running tasks belonging to the subpool.
    • Allow overriding pool options when creating a subpool via NewSupool.
    • Simplify pool submission logic and remove dispatcher goroutine.
    • Simplify subpool implementation.

Full Changelog: alitto/pond@v2.1.6...v2.2.0

v2.1.6

Compare Source

What's Changed

New Contributors

Full Changelog: alitto/pond@v2.1.5...v2.1.6

v2.1.5

Compare Source

What's Changed

New Contributors

Full Changelog: alitto/pond@v2.1.4...v2.1.5

v2.1.4

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.1.3...v2.1.4

v2.1.3

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.1.2...v2.1.3

v2.1.2

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.1.1...v2.1.2

v2.1.1

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.1.0...v2.1.1

v2.1.0

Compare Source

What's Changed

  • feat(taskgroup): improve task group functionality by @​alitto in https://github.com/alitto/pond/pull/81
    • Added a new method to the pool to create a task group associated with a context (pool.NewGroupContext(ctx))
    • Added new methods to task groups:
      • group.Done(): returns a channel that is closed when all tasks in the group finish or the first error is returned.
      • group.Stop(): stops the task group. Queued tasks will be discarded but running tasks will complete their execution.
    • Added a new example showcasing the new pool.NewGroupContext(ctx) method.

Full Changelog: alitto/pond@v2.0.4...v2.1.0

v2.0.4

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.0.3...v2.0.4

v2.0.3

Compare Source

What's Changed

Full Changelog: alitto/pond@v2.0.2...v2.0.3

v2.0.2

Compare Source

Changes

  • Expose Stopped() bool method in pools to indicate whether the pool has been stopped or its associated context has been cancelled.

Fixes

  • Ensure ErrPoolStopped error is always returned when attempting to submit a task to a pool that has been stopped or its associated context cancelled.

v2.0.1

Compare Source

Fixes

  • Avoid launching workers that exit immediately without running any tasks.
  • Prevent task group Wait() from returning eagerly when tasks are executed before submitting the last one of the group.

v2.0.0

Compare Source

What's new in v2?

Version 2 of pond introduces many improvements and new features:

  • Unbounded Task Queues: Task queues are now unbounded by default, simplifying pool creation.
  • Task Submission with Results: New APIs allow tasks to return results, enhancing flexibility.
  • Awaitable Task Completion: Tasks can now be awaited, providing better control over task execution.
  • Type Safe APIs: Improved type safety for tasks that return errors or results.
  • Panics Recovery: Panics during task execution are captured and returned as errors, allowing graceful error handling.
  • Subpools: Create subpools with a fraction of the parent pool's workers for specific tasks.
  • Default Pool: A global default pool is available for task submission without explicit pool creation.
Migration from v1 to v2

There have been a significant number of breaking changes in v2, so please make sure to read the migration guide if you are upgrading from v1.

formancehq/go-libs (github.com/formancehq/go-libs/v2)

v4.1.1

Compare Source

v4.1.0

Compare Source

What's Changed

Full Changelog: formancehq/go-libs@v4.0.0...v4.1.0

v4.0.0

Compare Source

v3.6.1

Compare Source

v3.6.0

Compare Source

v3.5.0

Compare Source

v3.4.0

Compare Source

What's Changed

New Contributors

Full Changelog: formancehq/go-libs@v3.3.0...v3.4.0

v3.3.0

Compare Source

v3.2.1

Compare Source

v3.2.0

Compare Source

v3.1.0

Compare Source

v3.0.1

Compare Source

v3.0.0

Compare Source

v2.2.4

Compare Source

lestrrat-go/jwx (github.com/lestrrat-go/jwx)

v3.0.13

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.12...v3.0.13

v3.0.12

Compare Source

What's Changed

New Contributors

Full Changelog: lestrrat-go/jwx@v3.0.11...v3.0.12

v3.0.11

Compare Source

What's Changed

New Contributors

Full Changelog: lestrrat-go/jwx@v3.0.10...v3.0.11

v3.0.10

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.9...v3.0.10

v3.0.9

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.8...v3.0.9

v3.0.8

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.7...v3.0.8

v3.0.7

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.6...v3.0.7

v3.0.6

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.5...v3.0.6

v3.0.5

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.4...v3.0.5

v3.0.4

Compare Source

v3.0.3

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.2...v3.0.3

v3.0.2

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.1...v3.0.2

v3.0.1

Compare Source

What's Changed

Please read the Changes file and upgrade accordingly, especially if you are using the following combinations for JWE:

  • DIRECT mode content encryption
  • Using A256CBC_HS512
  • With an erroneously created CEK of exactly 32-bytes.

New Contributors

Full Changelog: lestrrat-go/jwx@v3.0.0...v3.0.1

v3.0.0

Compare Source

What's Changed

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@NumaryBot NumaryBot requested a review from a team as a code owner March 20, 2026 02:59
@NumaryBot NumaryBot enabled auto-merge (squash) March 20, 2026 02:59
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 20, 2026

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)
  • go.mod is excluded by !**/*.mod
  • go.sum is excluded by !**/*.sum, !**/*.sum

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f0d2622e-5f10-4b09-9268-39ef5493db59

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/major-security
📝 Coding Plan
  • Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@NumaryBot NumaryBot merged commit 430edbf into main Mar 20, 2026
8 checks passed
@NumaryBot NumaryBot deleted the renovate/major-security branch March 20, 2026 06:47
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 20, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (b2203c1) to head (36ab816).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files 
@@     Coverage Diff     @@
##   main   #186   +/-   ##
===========================
===========================

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

flemzord added a commit that referenced this pull request Mar 20, 2026
@flemzord
Revert "chore(deps): update security updates (major) (#186)"
85ca218 
This reverts commit 430edbf.
@flemzord flemzord mentioned this pull request Mar 20, 2026
Merged
NumaryBot pushed a commit that referenced this pull request Mar 20, 2026
@flemzord
Revert "chore(deps): update security updates (major) (#186)" (#187)
c9fd897 
This reverts commit 430edbf.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@flemzord flemzord flemzord approved these changes

Assignees

No one assigned

Labels

security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@NumaryBot @flemzord