Skip to content

chore(deps): update security updates#124

Merged
NumaryBot merged 1 commit intomainfrom
renovate/security
Mar 19, 2026
Merged

chore(deps): update security updates#124
NumaryBot merged 1 commit intomainfrom
renovate/security

Conversation

@NumaryBot
Copy link
Contributor

@NumaryBot NumaryBot commented Mar 19, 2026

This PR contains the following updates:

Package Type Update Change
github.com/getsentry/sentry-go require minor v0.35.1 -> v0.43.0
github.com/gkampitakis/ciinfo indirect patch v0.3.3 -> v0.3.4
github.com/gkampitakis/go-snaps require patch v0.5.14 -> v0.5.21
github.com/goccy/go-yaml indirect minor v1.18.0 -> v1.19.2
github.com/mailru/easyjson indirect minor v0.7.7 -> v0.9.2
github.com/mark3labs/mcp-go require minor v0.41.1 -> v0.45.0
github.com/maruel/natural indirect minor v1.1.1 -> v1.3.0
github.com/segmentio/asm indirect minor v1.1.3 -> v1.2.1
github.com/segmentio/encoding indirect minor v0.3.4 -> v0.5.4
github.com/spf13/cast indirect minor v1.7.1 -> v1.10.0
github.com/spf13/cobra require patch v1.10.1 -> v1.10.2
go.uber.org/atomic indirect minor v1.9.0 -> v1.11.0
go.uber.org/multierr indirect minor v1.8.0 -> v1.11.0
go.uber.org/zap indirect minor v1.21.0 -> v1.27.1
golang.org/x/exp indirect digest 8b4c13b -> 7ab1446
golang.org/x/sys indirect minor v0.36.0 -> v0.42.0
golang.org/x/text indirect minor v0.29.0 -> v0.35.0

Release Notes

getsentry/sentry-go (github.com/getsentry/sentry-go)

v0.43.0: 0.43.0

Compare Source

Breaking Changes 🛠
  • Add support for go 1.26 by @​giortzisg in #​1193
    • bump minimum supported go version to 1.24
  • change type signature of attributes for Logs and Metrics. by @​giortzisg in #​1205
    • users are not supposed to modify Attributes directly on the Log/Metric itself, but this is still is a breaking change on the type.
  • Send uint64 overflowing attributes as numbers. by @​giortzisg in #​1198
    • The SDK was converting overflowing uint64 attributes to strings for slog and logrus integrations. To eliminate double types for these attributes, the SDK now sends the overflowing attribute as is, and lets the server handle the overflow appropriately.
    • It is expected that overflowing unsigned integers would now get dropped, instead of converted to strings.
New Features ✨
Bug Fixes 🐛
Internal Changes 🔧
Deps
Other

v0.42.0: 0.42.0

Compare Source

Breaking Changes 🛠
  • refactor Telemetry Processor to use TelemetryItem instead of ItemConvertible by @​giortzisg in #​1180
    • remove ToEnvelopeItem from single log items
    • rename TelemetryBuffer to Telemetry Processor to adhere to spec
    • remove unsed ToEnvelopeItem(dsn) from Event.
New Features ✨
  • Add metric support by @​aldy505 in #​1151
    • support for three metric methods (counter, gauge, distribution)
    • custom metric units
    • unexport batchlogger
Internal Changes 🔧
Release
Other

v0.41.0: 0.41.0

Compare Source

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.41.0.

Features
  • Add HTTP client integration for distributed tracing via sentryhttpclient package (#​876)
    • Provides an http.RoundTripper implementation that automatically creates spans for outgoing HTTP requests
    • Supports trace propagation targets configuration via WithTracePropagationTargets option
    • Example usage: 
      import sentryhttpclient "github.com/getsentry/sentry-go/httpclient"

roundTripper := sentryhttpclient.NewSentryRoundTripper(nil)
client := &http.Client{
    Transport: roundTripper,
}
  • Add ClientOptions.PropagateTraceparent option to control W3C traceparent header propagation in outgoing HTTP requests (#​1161)
  • Add SpanID field to structured logs (#​1169)

v0.40.0: 0.40.0

Compare Source

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.40.0.

Bug Fixes
  • Disable DisableTelemetryBuffer flag and noop Telemetry Buffer, to prevent a panic at runtime (#​1149).

v0.39.0: 0.39.0

Compare Source

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.39.0.

Features
  • Drop events from the telemetry buffer when rate-limited or transport is full, allowing the buffer queue to empty itself under load (#​1138).
Bug Fixes
  • Fix scheduler's hasWork() method to check if buffers are ready to flush. The previous implementation was causing CPU spikes (#​1143).

v0.38.0: 0.38.0

Compare Source

Breaking Changes
Features

  • Introduce a new async envelope transport and telemetry buffer to prioritize and batch events (#​1094, #​1093, #​1107).

    • Advantages:
      • Prioritized, per-category buffers (errors, transactions, logs, check-ins) reduce starvation and improve resilience under load
      • Batching for high-volume logs (up to 100 items or 5s) cuts network overhead
      • Bounded memory with eviction policies
      • Improved flush behavior with context-aware flushing

  • Add ClientOptions.DisableTelemetryBuffer to opt out and fall back to the legacy transport layer (HTTPTransport / HTTPSyncTransport).

    err := sentry.Init(sentry.ClientOptions{
  Dsn: "__DSN__",
  DisableTelemetryBuffer: true, // fallback to legacy transport
})
Notes
  • If a custom Transport is provided, the SDK automatically disables the telemetry buffer and uses the legacy transport for compatibility.

v0.37.0: 0.37.0

Compare Source

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.37.0.

Breaking Changes
  • Behavioral change for the TraceIgnoreStatusCodes option. The option now defaults to ignoring 404 status codes (#​1122).
Features
  • Add sentry.origin attribute to structured logs to identify log origin for slog and logrus integrations (auto.log.slog, auto.log.logrus) (#​1121).
Bug Fixes
  • Fix slog event handler to use the initial context, ensuring events use the correct hub/span when the emission context lacks one (#​1133).
  • Improve exception chain processing by checking pointer values when tracking visited errors, avoiding instability for certain wrapped errors (#​1132).
Misc
  • Bump golang.org/x/net to v0.38.0 (#​1126).

v0.36.2: 0.36.2

Compare Source

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.36.2.

Bug Fixes
  • Fix context propagation for logs to ensure logger instances correctly inherit span and hub information from their creation context (#​1118)
    • Logs now properly propagate trace context from the logger's original context, even when emitted in a different context
    • The logger will first check the emission context, then fall back to its creation context, and finally to the current hub

v0.36.1: 0.36.1

Compare Source

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.36.1.

Bug Fixes
  • Prevent panic when converting error chains containing non-comparable error types by using a safe fallback for visited detection in exception conversion (#​1113)

v0.36.0: 0.36.0

Compare Source

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.36.0.

Breaking Changes

  • Behavioral change for the MaxBreadcrumbs client option. Removed the hard limit of 100 breadcrumbs, allowing users to set a larger limit and also changed the default limit from 30 to 100 (#​1106))

  • The changes to error handling (#​1075) will affect issue grouping. It is expected that any wrapped and complex errors will be grouped under a new issue group.

Features

  • Add support for improved issue grouping with enhanced error chain handling (#​1075)

    The SDK now provides better handling of complex error scenarios, particularly when dealing with multiple related errors or error chains. This feature automatically detects and properly structures errors created with Go's errors.Join() function and other multi-error patterns.

    // Multiple errors are now properly grouped and displayed in Sentry
err1 := errors.New("err1")
err2 := errors.New("err2") 
combinedErr := errors.Join(err1, err2)

// When captured, these will be shown as related exceptions in Sentry
sentry.CaptureException(combinedErr)

  • Add TraceIgnoreStatusCodes option to allow filtering of HTTP transactions based on status codes (#​1089)

    • Configure which HTTP status codes should not be traced by providing single codes or ranges
    • Example: TraceIgnoreStatusCodes: [][]int{{404}, {500, 599}} ignores 404 and server errors 500-599
Bug Fixes
  • Fix logs being incorrectly filtered by BeforeSend callback (#​1109)
    • Logs now bypass the processEvent method and are sent directly to the transport
    • This ensures logs are only filtered by BeforeSendLog, not by the error/message BeforeSend callback
Misc
  • Add support for Go 1.25 and drop support for Go 1.22 (#​1103)

v0.35.3: 0.35.3

Compare Source

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.35.3.

Bug Fixes
  • Add missing rate limit categories (#​1082)

v0.35.2: 0.35.2

Compare Source

The Sentry SDK team is happy to announce the immediate availability of Sentry Go SDK v0.35.2.

Bug Fixes
  • Fix OpenTelemetry spans being created as transactions instead of child spans (#​1073)
Misc
  • Add MockTransport to test clients for improved testing (#​1071)
gkampitakis/ciinfo (github.com/gkampitakis/ciinfo)

v0.3.4

Compare Source

gkampitakis/go-snaps (github.com/gkampitakis/go-snaps)

v0.5.21

Compare Source

What's Changed

Full Changelog: gkampitakis/go-snaps@v0.5.20...v0.5.21

v0.5.20

Compare Source

What's Changed

Full Changelog: gkampitakis/go-snaps@v0.5.19...v0.5.20

v0.5.19

Compare Source

What's Changed

Full Changelog: gkampitakis/go-snaps@0.5.18...v0.5.19

v0.5.18

Compare Source

v0.5.17

Compare Source

v0.5.16

Compare Source

What's Changed

Full Changelog: gkampitakis/go-snaps@v0.5.15...v0.5.16

v0.5.15

Compare Source

What's Changed

Full Changelog: gkampitakis/go-snaps@v0.5.14...v0.5.15

goccy/go-yaml (github.com/goccy/go-yaml)

v1.19.2: 1.19.2

Compare Source

What's Changed

New Contributors

Full Changelog: goccy/go-yaml@v1.19.1...v1.19.2

v1.19.1: 1.19.1

Compare Source

What's Changed

Full Changelog: goccy/go-yaml@v1.19.0...v1.19.1

v1.19.0: 1.19.0

Compare Source

What's Changed

New Contributors

Full Changelog: goccy/go-yaml@v1.18.0...v1.19.0

mailru/easyjson (github.com/mailru/easyjson)

v0.9.2

Compare Source

What's Changed

Full Changelog: mailru/easyjson@v0.9.1...v0.9.2

v0.9.1

Compare Source

What's Changed

New Contributors

Full Changelog: mailru/easyjson@v0.9.0...v0.9.1

v0.9.0

Compare Source

up go version and bugfixes

v0.8.0

Compare Source

stable version before go version bump

mark3labs/mcp-go (github.com/mark3labs/mcp-go)

v0.45.0

Compare Source

v0.44.1

Compare Source

v0.44.0

Compare Source

What's Changed

New Contributors

Full Changelog: mark3labs/mcp-go@v0.43.2...v0.44.0

v0.43.2

Compare Source

What's Changed

Full Changelog: mark3labs/mcp-go@v0.43.1...v0.43.2

v0.43.1

Compare Source

What's Changed

New Contributors

Full Changelog: mark3labs/mcp-go@v0.43.0...v0.43.1

v0.43.0

Compare Source

What's Changed

New Contributors

Full Changelog: mark3labs/mcp-go@v0.42.0...v0.43.0

v0.42.0

Compare Source

What's Changed

New Contributors

Full Changelog: mark3labs/mcp-go@v0.41.1...v0.42.0

maruel/natural (github.com/maruel/natural)

v1.3.0: Supports arbitrary long numbers (larger than uint64)

Compare Source

Fixes #​5

v1.2.1

Compare Source

v1.2.0

Compare Source

segmentio/asm (github.com/segmentio/asm)

v1.2.1

Compare Source

v1.2.0

Compare Source

What's Changed

Full Changelog: segmentio/asm@v1.1.5...v1.2.0

v1.1.5

Compare Source

v1.1.4

Compare Source

segmentio/encoding (github.com/segmentio/encoding)

v0.5.4

Compare Source

What's Changed

Full Changelog: segmentio/encoding@v0.5.3...v0.5.4

v0.5.3

Compare Source

What's Changed

Full Changelog: segmentio/encoding@v0.5.2...v0.5.3

v0.5.2: : address performance regression in json decoding

Compare Source

What's Changed

New Contributors

Full Changelog: segmentio/encoding@v0.5.1...v0.5.2

v0.5.1: : json parity with stdlib for \b and \f encoding

Compare Source

What's Changed

Full Changelog: segmentio/encoding@v0.5.0...v0.5.1

v0.5.0: : protobuf rewrite rule overrides

Compare Source

What's Changed

Full Changelog: segmentio/encoding@v0.4.0...v0.5.0

v0.4.1

Compare Source

v0.4.0: : configurable numeric decoding support

Compare Source

When decoding into any, ParseFlags can now be used to control decoding into any combination of uint64, int64, and *big.Int, in addition to the prior support for json.Number and float64. Choice of type will depend on each value encountered, and as before, when json.Number is requested, float64 will not be used.

v0.3.7: : tolerate leading spacing in json.RawMessage

Compare Source

v0.3.6

Compare Source

What's Changed

Full Changelog: segmentio/encoding@v0.3.5...v0.3.6

v0.3.5

Compare Source

What's Changed

Full Changelog: segmentio/encoding@v0.3.4...v0.3.5

spf13/cast (github.com/spf13/cast)

v1.10.0

Compare Source

What's Changed

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@NumaryBot NumaryBot enabled auto-merge (squash) March 19, 2026 17:37
@NumaryBot
Copy link
Contributor Author

NumaryBot commented Mar 19, 2026

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.24.4 -> 1.25.0

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Mar 19, 2026

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)
  • go.mod is excluded by !**/*.mod
  • go.sum is excluded by !**/*.sum, !**/*.sum

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a711d21a-ca70-4d11-9433-e667768a4028

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/security
📝 Coding Plan
  • Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@codecov
Copy link

codecov bot commented Mar 19, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.50%. Comparing base (e3d1574) to head (eb4c36a).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #124   +/-   ##
=======================================
  Coverage   68.50%   68.50%           
=======================================
  Files          46       46           
  Lines        4648     4648           
=======================================
  Hits         3184     3184           
  Misses       1290     1290           
  Partials      174      174

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@NumaryBot NumaryBot merged commit 064b5e3 into main Mar 19, 2026
7 of 11 checks passed
@NumaryBot NumaryBot deleted the renovate/security branch March 19, 2026 17:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@flemzord flemzord flemzord approved these changes

Assignees

No one assigned

Labels

security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@NumaryBot @flemzord