Skip to content

build(deps): bump the gomod-minor-and-patch group across 1 directory with 4 updates - #77

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-minor-and-patch-4728e45191
Open

build(deps): bump the gomod-minor-and-patch group across 1 directory with 4 updates#77
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-minor-and-patch-4728e45191

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the gomod-minor-and-patch group with 4 updates in the / directory: github.com/go-playground/validator/v10, github.com/modelcontextprotocol/go-sdk, github.com/revrost/go-openrouter and github.com/stretchr/testify.

Updates github.com/go-playground/validator/v10 from 10.30.1 to 10.30.6

Release notes

Sourced from github.com/go-playground/validator/v10's releases.

v10.30.6

What's Changed

New Contributors

Full Changelog: go-playground/validator@v10.30.5...v10.30.6

Release 10.30.5

What's Changed

New Contributors

... (truncated)

Commits
  • 19397f2 Add uuid7 validation tag (#1614)
  • 5b09d8d Convert to time.Time before asserting in isNeField (#1619)
  • 563e738 fix: reject duplicate variants in strict BCP47 tags (#1678)
  • 0f885d2 fix: reject ULIDs outside the 128-bit range (#1660)
  • c9cfe75 fix: anchor GB and LI postcode patterns as a whole (#1646)
  • 29d05a7 docs: fix stale alias, uuid and snippet details in package docs (#1679)
  • 0411012 chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.15 to 1.4.16 (#...
  • a5843c6 Add postcode patterns for IE (Ireland), AL (Albania), GI (Gibraltar) and IL (...
  • c29fac1 Clarify separators for non-existent directory paths (#1672)
  • 3b54840 ci: send coverage from the Go 1.26.x leg (step skipped since #1535) (#1671)
  • Additional commits viewable in compare view

Updates github.com/modelcontextprotocol/go-sdk from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.8.0

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction. Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

  • plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #1143.
  • blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #1151.

Options below were removed, according to plan:

  • seterroroverwrite
  • enableoriginverification
  • disablecontenttypecheck

... (truncated)

Commits
  • 3f3b699 refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1...
  • 830f0b7 mcp: update conformance tests (#1231)
  • 12cbafe oauthex: oauth discovery checks (#1220)
  • 3632967 mcp: add an sse event size cap (#1205)
  • 0d3036f mcp: allow per request Cacheable customization (#1203)
  • cb0de64 mcp: add a max request body size of the old transport (#1224)
  • 2fdabde mcp: do not check metatada on notifications (#1215)
  • 59185e6 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#1217)
  • a6764cf build(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#1218)
  • 8227246 fix: only subscribe when server advertises capability (#1221)
  • Additional commits viewable in compare view

Updates github.com/revrost/go-openrouter from 1.1.5 to 1.8.0

Commits
  • 42a4738 address image generation review feedback (#62)
  • e4a9de8 feat: add image generation endpoint (#59)
  • da61faf fix: clarify service tier response semantics (#61)
  • 60809ec feat: support service tier (#57)
  • 67cdd29 fix: preserve "signature" field on ChatCompletionReasoningDetails (#56)
  • 2b8d13b docs: add speech API file example
  • 389e621 feat: add audio speech and transcription APIs
  • 10dea39 feat: add OpenRouter response caching (#54)
  • 396bc39 fix for incorrect json struct tag for token usage details (#53)
  • 32cb418 feat: add chat completion model fallback
  • Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

@dependabot
dependabot Bot requested a review from hudsonaikins as a code owner November 8, 2026 21:34
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 8, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-11T04:46:51.603714Z d38e3c5 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@dependabot
build(deps): bump the gomod-minor-and-patch group across 1 directory …
d38e3c5 
…with 4 updates

Bumps the gomod-minor-and-patch group with 4 updates in the / directory: [github.com/go-playground/validator/v10](https://github.com/go-playground/validator), [github.com/modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk), [github.com/revrost/go-openrouter](https://github.com/revrost/go-openrouter) and [github.com/stretchr/testify](https://github.com/stretchr/testify).


Updates `github.com/go-playground/validator/v10` from 10.30.1 to 10.30.6
- [Release notes](https://github.com/go-playground/validator/releases)
- [Commits](go-playground/validator@v10.30.1...v10.30.6)

Updates `github.com/modelcontextprotocol/go-sdk` from 1.7.0 to 1.8.0
- [Release notes](https://github.com/modelcontextprotocol/go-sdk/releases)
- [Commits](modelcontextprotocol/go-sdk@v1.7.0...v1.8.0)

Updates `github.com/revrost/go-openrouter` from 1.1.5 to 1.8.0
- [Commits](reVrost/go-openrouter@v1.1.5...v1.8.0)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

---
updated-dependencies:
- dependency-name: github.com/go-playground/validator/v10
  dependency-version: 10.30.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/modelcontextprotocol/go-sdk
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/revrost/go-openrouter
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump the gomod-minor-and-patch group with 4 updates build(deps): bump the gomod-minor-and-patch group across 1 directory with 4 updates Nov 11, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/gomod-minor-and-patch-4728e45191 branch from 6da68cc to d38e3c5 Compare November 11, 2026 04:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hudsonaikins hudsonaikins Awaiting requested review from hudsonaikins hudsonaikins is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants