Repository navigation
Release v1.19.7 - #863
Merged
Merged
Release v1.19.7#863
Conversation
Mechanical dependency bumps only; no intended product or behavior changes. ## Ready now (scan) - cloud.google.com/go/storage v1.69.0 -> v1.70.0 - github.com/auth0/go-auth0/v3 v3.7.0 -> v3.10.0 - github.com/googleapis/gax-go/v2 v2.26.2 -> v2.27.0 - github.com/nats-io/nats.go v1.54.0 -> v1.55.0 ## Vulnerability fixes (High/Critical) - github.com/klauspost/compress v1.20.1 -> v1.20.2 (CVE-2026-116591) - golang.org/x/net v0.59.0 -> v0.62.0 (CVE-2026-78661) - Go toolchain / service images golang:1.27.1 -> golang:1.27.3 (stdlib CVE-2026-111943) ## Test plan - [ ] CI green on this draft Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 40a375bf35405edb06b6102c0021183c5c5c61e4
Mechanical dependency bumps only; no intended product or behavior changes. ## Ready now (scan) - cloud.google.com/go/aiplatform v1.127.0 -> v1.127.1 - cloud.google.com/go/bigquery v1.85.0 -> v1.86.2 - cloud.google.com/go/certificatemanager v1.16.0 -> v1.17.1 - cloud.google.com/go/container v1.55.0 -> v1.56.1 - cloud.google.com/go/dataplex v1.37.0 -> v1.38.1 - cloud.google.com/go/dataproc/v2 v2.27.0 -> v2.28.1 - cloud.google.com/go/eventarc v1.26.0 -> v1.27.1 - cloud.google.com/go/filestore v1.17.0 -> v1.18.1 - cloud.google.com/go/functions v1.26.0 -> v1.27.1 - cloud.google.com/go/iam v1.14.0 -> v1.15.1 - cloud.google.com/go/kms v1.35.0 -> v1.36.1 - cloud.google.com/go/logging v1.20.0 -> v1.21.1 - cloud.google.com/go/monitoring v1.31.0 -> v1.32.1 - cloud.google.com/go/orgpolicy v1.21.0 -> v1.22.1 - cloud.google.com/go/redis v1.27.0 -> v1.29.0 - cloud.google.com/go/resourcemanager v1.17.0 -> v1.18.1 - cloud.google.com/go/run v1.23.0 -> v1.24.1 - cloud.google.com/go/secretmanager v1.22.0 -> v1.24.0 - cloud.google.com/go/securitycentermanagement v1.7.0 -> v1.8.1 - cloud.google.com/go/storagetransfer v1.20.0 -> v1.21.1 - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3 -> v1.24.0 - github.com/auth0/go-auth0/v3 v3.10.0 -> v3.11.0 - github.com/aws/smithy-go v1.28.5 -> v1.28.8 - github.com/brianvoe/gofakeit/v7 v7.18.0 -> v7.18.1 - github.com/cenkalti/backoff/v7 v7.0.1 -> v7.0.3 - github.com/go-jose/go-jose/v4 v4.1.6 -> v4.1.9 - github.com/jackc/pgx/v5 v5.11.0 -> v5.12.0 - github.com/nats-io/nats-server/v2 v2.15.1 -> v2.15.2 - github.com/neo4j/neo4j-go-driver/v6 v6.3.0 -> v6.4.0 - github.com/onsi/ginkgo/v2 v2.33.1 -> v2.34.0 - github.com/resend/resend-go/v4 v4.9.0 -> v4.12.0 - github.com/spf13/pflag v1.0.10 -> v1.1.0 - go.yaml.in/yaml/v3 v3.0.5 -> v3.0.6 - google.golang.org/grpc v1.84.0 -> v1.85.0 Indirect modules raised by minimum version selection: - cloud.google.com/go/longrunning v1.3.0 -> v1.5.0 - github.com/envoyproxy/go-control-plane/envoy v1.37.0 -> v1.39.1-0.20260819172001-e6e3fd93e4be - github.com/jackc/puddle/v2 v2.2.2 -> v2.2.3 - github.com/klauspost/compress v1.20.2 -> v1.20.3 Left out: `cloud.google.com/go/compute` stays at v1.70.0. Every release from v1.71.0 removes `ReturnPartialSuccess` from the `AggregatedList*Request` types used in `sources/gcp/manual`, so the bump needs a code change. ## Vulnerability fixes (High/Critical) - github.com/andybalholm/brotli v1.1.1 -> v1.2.7 (CVE-2026-111497) - zlib1g (Debian, `services/frontend/Dockerfile.playwright`) 1:1.3.dfsg+really1.3.1-1+b1 -> 1:1.3.dfsg+really1.3.1-1+deb13u1 (CVE-2026-85091, CVE-2026-76844) - apt / libapt-pkg7.0 (Ubuntu, `plugins/private-evals/container/Dockerfile`) 3.2.0 -> 3.2.1ubuntu0.1 (CVE-2026-109518) ## Test plan - [x] `go build ./...` - [x] `go vet` on `sources/gcp`, `services/until-backend`, `go/` - [ ] CI green on this draft <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Wide dependency surface (auth/JWT, Postgres, gRPC, GCP clients) with no code changes—regression risk is integration/behavior drift in cloud and auth paths; compute client deliberately not bumped due to API breakage in manual GCP sources. > > **Overview** > Bumps a large batch of Go module versions in **`go.mod`** / **`go.sum`**, including many **`cloud.google.com/go/*`** clients, **`google.golang.org/grpc`** (v1.84.0 → v1.85.0), **`github.com/jackc/pgx/v5`** (5.12.0), **`github.com/auth0/go-auth0/v3`**, **`github.com/go-jose/go-jose/v4`**, AWS/Azure SDK helpers, test tooling (**ginkgo**, **gofakeit**), and several indirect deps (e.g. **brotli**, **envoy** control-plane, **puddle**). No application source changes—mechanical dependency refresh only. > > Addresses container scan findings with **pinned/upgraded OS packages** in two images: **`plugins/private-evals/container/Dockerfile`** pins **`apt`** / **`libapt-pkg7.0`** to `3.2.1ubuntu0.1`, and **`services/frontend/Dockerfile.playwright`** adds an **`apt-get --only-upgrade`** step for **`zlib1g`** to the trixie-security build. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 96fc5fa4a76c7c92ed2fc3364e58abe9affaa7b1. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 2761b98fecd1f52d5d7630ed149e14636a6f9ce5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Copybara Sync - Release v1.19.7
This PR was automatically created by Copybara, syncing changes from the overmindtech/workspace monorepo.
Original author: Dylan (dylan@overmind.tech)
What happens when this PR is merged?
tag-on-mergeworkflow will automatically create thev1.19.7tag on mainReview Checklist