build(deps): bump the go-dependencies group across 1 directory with 26 updates

[dependabot]

Bumps the go-dependencies group with 23 updates in the / directory:

Package	From	To
github.com/Azure/azure-sdk-for-go/sdk/azidentity	1.13.1	1.14.0
github.com/flanksource/kopper	1.0.22	1.0.23
github.com/labstack/echo/v4	4.15.2	4.15.4
github.com/onsi/ginkgo/v2	2.29.0	2.32.0
github.com/onsi/gomega	1.40.0	1.42.1
github.com/ory/client-go	1.22.39	1.22.58
gorm.io/gorm	1.31.1	1.31.2
k8s.io/apimachinery	0.36.1	0.36.2
k8s.io/client-go	0.36.1	0.36.2
github.com/aws/aws-sdk-go-v2/config	1.32.25	1.32.26
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs	1.75.2	1.78.1
github.com/firebase/genkit/go	1.9.0	1.10.0
github.com/flanksource/clicky	1.21.18	1.21.33
github.com/fluxcd/pkg/gittestserver	0.28.0	0.29.0
github.com/jenkins-x/go-scm	1.15.22	1.15.31
github.com/mark3labs/mcp-go	0.53.0	0.55.1
github.com/prometheus/common	0.68.1	0.69.0
github.com/redis/go-redis/v9	9.19.0	9.21.0
github.com/slack-go/slack	0.23.1	0.27.0
github.com/tg123/go-htpasswd	1.2.4	1.2.5
github.com/xavidop/genkit-aws-bedrock-go	1.14.0	1.20.0
go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho	0.68.0	0.69.0
google.golang.org/api	0.283.0	0.286.0

Updates github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/azidentity/v1.14.0

1.14.0 (2026-06-15)

Breaking Changes

These changes affect only code written against a beta version such as v1.14.0-beta.3

• Removed WorkloadIdentityCredentialOptions.EnableAzureProxy. It will return in v1.15.0-beta.1

Bugs Fixed

• AzureDeveloperCLICredential improved reporting of error messages returned from azd

Other Changes

• Returned azidentity errors include links to the troubleshooting guide when appropriate
• This module now requires a minimum Go version of 1.25
• Upgraded dependencies

Commits

• 0495c20 Prep azcore 1.14.0 for release (#23293)
• 217edee fix(generator tool): filter tsp-client diagnostics log (#23292)
• 023c88f Increment package version after release of azidentity (#23290)
• 17f3361 Sync eng/common directory with azure-sdk-tools for PR 8760 (#23271)
• f5f3234 bump proxy to one with an audit log and more correct locking (#23288)
• d707091 Prepare azidentity v1.8.0-beta.2 for release (#23289)
• 84d213c NewManagedIdentityCredential returns an error for unsupported ID options (#23...
• ea67e9c azcontainerregistry: move method to function (#23270)
• 40dad0a fix (#23287)
• a368082 fix generator tool: ExecuteGoGenerate func (#23286)
• Additional commits viewable in compare view

Updates github.com/flanksource/kopper from 1.0.22 to 1.0.23

Release notes

Sourced from github.com/flanksource/kopper's releases.

v1.0.23

1.0.23 (2026-06-25)

Bug Fixes

• Replace codfish/semantic-release-action with flanksource/action-workflows (#36) (c3a4987)

Commits

• c3a4987 fix: Replace codfish/semantic-release-action with flanksource/action-workflow...
• See full diff in compare view

Updates github.com/labstack/echo/v4 from 4.15.2 to 4.15.4

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.15.4

Security

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#3016, released in v5.2.1). Thanks to @​a-tt-om and @​oran-gugu for reporting.

---

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")

for static middleware

	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.15.4 - 2026-06-15

Security

Fixes GHSA-vfp3-v2gw-7wfq

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt
// 1. share public/ folder contents from the server root. This folder actually contains subfolder admin which
// contents we want to forbid from downloading
e.Static("/", "public")
// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")

for static middleware

	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

v4.15.3 - 2026-06-14

... (truncated)

Commits

• ec79b58 Merge pull request #3020 from aldas/v4_v4-15-4_changelog
• 2714c07 Changelog for v4.15.4 - security fix
• 13f0ed1 Merge pull request #3019 from aldas/v4_backport_3016
• d16a4ec backport PR 3016 from v4
• 8f167b9 Merge pull request #3018 from aldas/v4_remove_v5_dep
• 9afa4ba remove dependency on labstack/echo v5 introduced in go.mod and go.sum
• 1e05f63 Merge pull request #3017 from aldas/v4_ci_updates
• 11a3cc4 Update dependencies and add ignore for linting
• 26bd016 Update CI action versions
• aa52f6a ci: run workflows on the v4 branch, not just master (#3013)
• Additional commits viewable in compare view

Updates github.com/onsi/ginkgo/v2 from 2.29.0 to 2.32.0

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.32.0

2.32.0

-fd generate RSpec-style documentation output. Thank @​woodie ! --sleep-on-failure pauses a failed spec before teardown. Thanks @​qinqon !

v2.31.0

2.31.0

Add a bunch of Claude Skills via the marketplace:

/plugin marketplace add onsi/ginkgo
/plugin install ginkgo@ginkgo

v2.30.0

2.30.0

Features

Ginkgo now allows extentions/global.Reset to support running multiple suites from within a single process. This may take some massaging on your part (see 1672) but can dramatically speed up codebases with O(hundreds) of test suites.

Thanks @​lawrencejones !

Fixes

• Fix nested --github-output group for progress report nested inside timeline [4f62d7a]

Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.32.0

-fd generate RSpec-style documentation output. Thank @​woodie ! --sleep-on-failure pauses a failed spec before teardown. Thanks @​qinqon !

2.31.0

Add a bunch of Claude Skills via the marketplace:

/plugin marketplace add onsi/ginkgo
/plugin install ginkgo@ginkgo

2.30.0

Features

Ginkgo now allows extentions/global.Reset to support running multiple suites from within a single process. This may take some massaging on your part (see 1672) but can dramatically speed up codebases with O(hundreds) of test suites.

Thanks @​lawrencejones !

Fixes

• Fix nested --github-output group for progress report nested inside timeline [4f62d7a]

Commits

• 9ff1646 v2.32.0
• 0491f2a Make -fd exclusive of -p/-procs and -randomize-all
• 334f74a respect SilenceSkips in fd mode, add test
• 21047ce No need for a new method.
• 7d281e1 Break out to two methods.
• 5313727 More integration, fewer changes.
• b83f524 Fewer new methods.
• 73c59df feat: add -fd flag for RSpec-style documentation output
• 76a2074 feat: add --sleep-on-failure to pause a failed spec before teardown
• 3c7bde4 v2.31.0
• Additional commits viewable in compare view

Updates github.com/onsi/gomega from 1.40.0 to 1.42.1

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.42.1

1.42.1

Bump Dependencies

v1.42.0

1.42.0

Add a set of Claude skill as a marketplace plugin

v1.41.0

No release notes provided.

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.42.1

Bump Dependencies

1.42.0

Add a set of Claude skill as a marketplace plugin

1.41.0

Features

Add BeASlice and BeAnArray matchers

Fixes

Object formatting now detects pointer cycles to avoid runaway formatting output.

Commits

• ced6c1c v1.42.1
• 2beb9fb v1.42.1 (full)
• 006cd2c bump al lthe things
• 35ca084 v1.42.0
• d72697b v1.42.0 (full)
• 1f95d86 add a set of claude skills as a marketplace plugin
• af2bccb v1.41.0
• 73e81f6 v1.41.0 (full)
• e35a84f feat: devcontainer configuration with local pkgsite and GH pages
• f12e5e1 fix(format): detect pointer cycles to avoid runaway formatting output
• Additional commits viewable in compare view

Updates github.com/ory/client-go from 1.22.39 to 1.22.58

Commits

• 2dc8874 autogen: regenerate OpenAPI client for v1.22.58
• 59bb686 autogen: regenerate OpenAPI client for v1.22.57
• 7e19e86 autogen: regenerate OpenAPI client for v1.22.56
• 5b9c92c autogen: regenerate OpenAPI client for v1.22.55
• 44f1c18 autogen: regenerate OpenAPI client for v1.22.54
• 2a28c24 autogen: regenerate OpenAPI client for v1.22.53
• b8d3d47 autogen: regenerate OpenAPI client for v1.22.52
• ece3542 autogen: regenerate OpenAPI client for v1.22.51
• 67d8f58 autogen: regenerate OpenAPI client for v1.22.50
• bb95743 autogen: regenerate OpenAPI client for v1.22.49
• Additional commits viewable in compare view

Updates gorm.io/gorm from 1.31.1 to 1.31.2

Release notes

Sourced from gorm.io/gorm's releases.

Release v1.31.2

Changes

• Fix potential rows leak on panic by deferring rows.Close() @​omer-cengel (#7798)
• perf: replace fmt.Sprintf with strconv in ExplainSQL numeric formatting @​alpardfm (#7796)
• Document NowFunc timezone behavior @​morning-verlu (#7799)
• correct typo and rename fileType to fieldType in AlterColumn @​cragone (#7748)
• fix: panic when using clause.Returning with CreateInBatches @​Truongquangkhang (#7768)
• fix(migrator): add nil guards to ColumnType methods to prevent panic @​lihan3238 (#7767)
• ci: switch tests Go matrix to stable/oldstable and update setup-go @​smf-h (#7726)
• chore(ci): bump actions/stale to v9 @​Olexandr88 (#7696)
• fix(migrator): don't clear alterColumn when defaults match @​qqxhb (#7728)
• Add package comments to fix ST1000 warnings @​twocs (#7708)
• generics: populate WithResult error @​qqxhb (#7723)
• fix(utils): restore FileWithLineNum caller depth and add regression test @​smf-h (#7717)
• tests: skip customized foreign key many2many on MySQL 8.4+ @​smf-h (#7727)
• fix tiny typo in error message @​snelg (#7738)
• Add unit test verifying chainable query methods mutate statement @​miladev95 (#7684)
• fix: Close connection after ping failure to prevent goroutine leak @​liang09255 (#7689)
• fix: Row() and Rows() functions should automaticaly apply the generic type as model @​hakanakyurek (#7664)
• internal/lru: improve concurrency with RWMutex @​miladev95 (#7668)
• Fix nil pointer panic in serializer for nil any-type fields @​doraemonkeys (#7634)
• staticcheck QF1001 @​miladev95 (#7648)
• Support array/slice expansion for named SQL parameters in parentheses @​bafflingbug (#7614)

Commits

• 1d6ce99 Fix potential rows leak on panic by deferring rows.Close() (#7798)
• f648834 perf: replace fmt.Sprintf with strconv in ExplainSQL numeric formatting (#7796)
• 49cd6b8 Document NowFunc timezone behavior (#7799)
• d0ee5e2 correct typo and rename fileType to fieldType in AlterColumn (#7748)
• 2a22022 fix: panic when using clause.Returning with CreateInBatches (#7768)
• 3322929 fix(migrator): add nil guards to ColumnType methods to prevent panic (#7767)
• 40cd2af ci: switch tests Go matrix to stable/oldstable and update setup-go (#7726)
• ba38501 chore(ci): bump actions/stale to v9 (#7696)
• c1f742d fix: don't override alterColumn when defaults match (#7728)
• c14d3ac update github ci golang version
• Additional commits viewable in compare view

Updates k8s.io/apimachinery from 0.36.1 to 0.36.2

Commits

• ae3f98e Update dependencies to v0.36.2 tag
• 2ec982d Merge pull request #139508lalitc375/automated-cherry-pick-of-#139480
• 6a88102 Fix wrong marking of errors
• See full diff in compare view

Updates k8s.io/client-go from 0.36.1 to 0.36.2

Commits

• 877f535 Update dependencies to v0.36.2 tag
• See full diff in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.25 to 1.32.26

Commits

• 26060c5 Release 2026-06-29
• 24e918a Regenerated Clients
• 334471f Update API model
• 96d81dc Deprecate iotevents, ioteventsdata, panorama and simspaceweaver (#3458)
• 30502cb feat: mark common plugins and fix per-op ordering for invokeOperation refacto...
• 8881653 Revert "feat: mark common plugins and fix per-op ordering for invokeOperation...
• eba2f01 feat: mark common plugins and fix per-op ordering for invokeOperation… (#3443)
• 2c5e1db Release 2026-06-23
• d09eeb5 Regenerated Clients
• 2f5f5f9 Update API model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.19.24 to 1.19.25

Commits

• 26060c5 Release 2026-06-29
• 24e918a Regenerated Clients
• 334471f Update API model
• 96d81dc Deprecate iotevents, ioteventsdata, panorama and simspaceweaver (#3458)
• 30502cb feat: mark common plugins and fix per-op ordering for invokeOperation refacto...
• 8881653 Revert "feat: mark common plugins and fix per-op ordering for invokeOperation...
• eba2f01 feat: mark common plugins and fix per-op ordering for invokeOperation… (#3443)
• 2c5e1db Release 2026-06-23
• d09eeb5 Regenerated Clients
• 2f5f5f9 Update API model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.75.2 to 1.78.1

Commits

• 9bd153c Release 2025-03-04.2
• b967446 Regenerated Clients
• 188c52a Update endpoints model
• defaf5c Update API model
• 8f2dd23 add test that verifies SRA order of operations (#3025)
• 3d547b0 Release 2025-03-04
• 554a149 Regenerated Clients
• 3abb221 Update endpoints model
• 95ae39d Update API model
• c62ec38 create kitchen sink test service (#3023)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/sts from 1.43.3 to 1.43.4

Commits

• 7146c2b Release 2026-06-04
• 5aef2fd Regenerated Clients
• f94c044 Update API model
• f00b205 bump to smithy-go v1.27.1 (#3434)
• c4ad7de drop service/internal/benchmark (#3433)
• 91eca46 Release 2026-06-03.2
• e9d9e15 Regenerated Clients
• def6a3a Update API model
• See full diff in compare view

Updates github.com/firebase/genkit/go from 1.9.0 to 1.10.0

Release notes

Sourced from github.com/firebase/genkit/go's releases.

Genkit JS 1.10.0

What's Changed

• chore(js/plugins/googleai): added google search options to gemini config schema by @​pavelgj in firebase/genkit#2938
• feat(js): added reasoning part type and implemented for googleai and vertexai by @​pavelgj in firebase/genkit#2945

Dev UI changes:

• fix: update genkit title font weight by @​tonybaroneee
• fix: wrong background color in flow runner by @​hugomurillomtz
• feat: make trace drawer collapse when clicking chevron by @​hugomurillomtz
• fix: trace details overflow by @​hugomurillomtz
• Update runners to use json-viewer by @​MichaelDoyle
• set container-border-radius to 8px by @​MichaelDoyle
• feat: update flow runner to use json-viewer by @​MichaelDoyle
• feat: Add toggles for custom option objects to explicitly set/unset the option by @​shrutip90
• fix: Allow zeroes for temperature in dotprompt files by @​shrutip90
• feat: update span tree layout by @​tonybaroneee
• fix: Set custom option object toggles during patch/reset config by @​shrutip90

Full Changelog: https://github.com/firebase/genkit/compare/genkit@1.9.0...genkit@1.10.0

Commits

• 2b555af feat(go): realtime telemetry for live agents and the basic-agents sample (#5637)
• f37effb chore: JS version bump
• 54c60aa chore: CLI version bump
• a21d43d feat(go/ai/exp/localstore): add per-session pointer files for faster snapshot...
• fcf87c4 chore(py/samples): drop redundant uvloop dependency (#5595)
• aacfdee chore(js): add missing license headers to vercel-ai-elements configs (#5623)
• dc67fba feat(js/ai/session-stores): add per-session pointer files for faster snapshot...
• 2fed8df feat(go/genkit): gate genkit/exp behind WithExperimental() init option (#5620)
• 4f78d0d fix(go/ai/exp/localstore): default FileSessionStore snapshots to a "global" s...
• b477126 feat(go): experimental agent middleware for sub-agent delegation and artifact...
• Additional commits viewable in compare view

Updates github.com/flanksource/clicky from 1.21.18 to 1.21.33

Release notes

Sourced from github.com/flanksource/clicky's releases.

v1.21.33

1.21.33 (2026-06-28)

⚠ BREAKING CHANGES

• prompt: PromptSelect, PromptMultiSelect, and PromptText now delegate to context-aware internal functions; behavior is unchanged for callers without a Scope.

✨ Features

• exec: add bidirectional stdio pipes for long-lived processes (e93b8ca)
• prompt: add context-aware prompt routing and interactive sink support (07e5ab6)

🐛 Bug Fixes

• ci,prompt,exec: tidy go.mod and address review findings (c1a9660)
• ci: tidy example submodule go.mod files (fa5980c)

🔧 Maintenance

• release: pin sub-modules to v1.21.32 [skip ci] (216e838)

v1.21.32

1.21.32 (2026-06-26)

👷 CI/CD

• release: check out branch tip for GoReleaser and decouple submodule tags (7cb946d)

v1.21.31

1.21.31 (2026-06-26)

👷 CI/CD

• release: rename goreleaser folder field to directory (29bb8d6)

v1.21.30

1.21.30 (2026-06-26)

🐛 Bug Fixes

• aichat: pin clicky require to v1.21.29 so go get works (95378c7)

v1.21.29

1.21.29 (2026-06-26)

... (truncated)

Changelog

Sourced from github.com/flanksource/clicky's changelog.

1.21.33 (2026-06-28)

⚠ BREAKING CHANGES

• prompt: PromptSelect, PromptMultiSelect, and PromptText now delegate to context-aware internal functions; behavior is unchanged for callers without a Scope.

✨ Features

• exec: add bidirectional stdio pipes for long-lived processes (e93b8ca)
• prompt: add context-aware prompt routing and interactive sink support (07e5ab6)

🐛 Bug Fixes

• ci,prompt,exec: tidy go.mod and address review findings (c1a9660)
• ci: tidy example submodule go.mod files (fa5980c)

🔧 Maintenance

• release: pin sub-modules to v1.21.32 [skip ci] (216e838)

1.21.32 (2026-06-26)

👷 CI/CD

• release: check out branch tip for GoReleaser and decouple submodule tags (7cb946d)

1.21.31 (2026-06-26)

👷 CI/CD

• release: rename goreleaser folder field to directory (29bb8d6)

1.21.30 (2026-06-26)

🐛 Bug Fixes

• aichat: pin clicky require to v1.21.29 so go get works (95378c7)

1.21.29 (2026-06-26)

⚠ BREAKING CHANGES

• cli: Removed SourceMarkdown field from markdown Node and Document structures; removed PreserveSource option from markdown parser. Parser provenance fields are no longer included in clicky-json output.

... (truncated)

Commits

• 27d907d chore(release): 1.21.33 [skip ci]
• fa5980c fix(ci): tidy example submodule go.mod files
• c1a9660 fix(ci,prompt,exec): tidy go.mod and address review findings
• 07e5ab6 feat(prompt): add context-aware prompt routing and interactive sink support
• e93b8ca feat(exec): add bidirectional stdio pipes for long-lived processes
• 216e838 chore(release): pin sub-modules to v1.21.32 [skip ci]
• 4c7b29c chore(release): 1.21.32 [skip ci]
• 7cb946d ci(release): check out branch tip for GoReleaser and decouple submodule tags
• b4f0402 chore(release): 1.21.31 [skip ci]
• 29bb8d6 ci(release): rename goreleaser folder field to directory
• Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/gittestserver from 0.28.0 to 0.29.0

Commits

• 3ba849f Merge pull request #919 from fluxcd/auth-valid-registry
• d89e633 [RFC-0010] Validate artifact repository for all auth providers
• 1985bd8 Merge pull request #918 from fluxcd/gogit-agnostic
• 5b6454a Package git/gogit should be agnostic of providers
• See full diff in compare view

Updates github.com/jenkins-x/go-scm from 1.15.22 to 1.15.31

Release notes

Sourced from github.com/jenkins-x/go-scm's releases.

1.15.31

Changes in version 1.15.31

Bug Fixes

• Bitbucket: updated URL for retrieving a list of workspaces (Nathan Hale)

Chores

• release 1.15.31 (jenkins-x-bot)
• add variables (jenkins-x-bot)

1.15.30

Changes in version 1.15.30

Chores

• release 1.15.30 (jenkins-x-bot)
• add variables (jenkins-x-bot)
• deps: bump k8s.io/apimachinery from 0.36.1 to 0.36.2 (dependabot[bot])

1.15.29

Changes in version 1.15.29

Chores

• release 1.15.29 (jenkins-x-bot)
• add variables (jenkins-x-bot)
• deps: bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4 (dependabot[bot])

1.15.28

Changes in version 1.15.28

Chores

• release 1.15.28 (jenkins-x-bot)
• add variables (jenkins-x-bot)
• deps: bump code.gitea.io/sdk/gitea from 0.14.0 to 0.22.1 (dependabot[bot])

1.15.27

Changes in version 1.15.27

Chores

• release 1.15.27 (jenkins-x-bot)
• add variables (jenkins-x-bot)
• use stdlib (Mårten Svantesson)
• deps: bump k8s.io/apimachinery from 0.34.1 to 0.36.1 (dependabot[bot])

1.15.26

... (truncated)

Commits

• b2cac59 chore: release 1.15.31
• 9853dcc chore: add variables
• a062408 Merge pull request #541 from NrdyN8/main
• e4953cf fix(Bitbucket): updated URL for retrieving a list of workspaces
• c03f672 Merge pull request #539 from jenkins-x/dependabot/go_modules/k8s.io/apimachin...
• e921d4f chore(deps): bump k8s.io/apimachinery from 0.36.1 to 0.36.2
• 690a83a Merge pull request #538 from jenkins-x/dependabot/go_modules/github.com/sirup...
• 1ff58a3 chore(deps): bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4
• 66929c8 Merge pull request #527 from vdemeester/dependabot/go_modules/code.gitea.io/s...
• cb1f5b9 chore(deps): bump code.gitea.io/sdk/gitea from 0.14.0 to 0.22.1
• Additional commits viewable in compare view

Updates github.com/mark3labs/mcp-go from 0.53.0 to 0.55.1

Release notes

Sourced from github.com/mark3labs/mcp-go's releases.

Release v0.55.1

No release notes provided.

Release v0.55.0

No release notes provided.

Release v0.54.1

No release notes provided.

Release v0.54.0

What's Changed

• fix(server): handle resources/subscribe and resources/unsubscribe (#865) by @​ezynda3 in mark3labs/mcp-go#873
• fix(oauth): use LATEST_PROTOCOL_VERSION in metadata discovery (#868) by @​ezynda3 in mark3labs/mcp-go#874
• fix(oauth): don't hold metadataMu across HTTP discovery (#871) by @​ezynda3 in mark3labs/mcp-go#875
• feat(mcp): add 2025-11-25 sampling-with-tools and capability sub-fields (#867) by @​ezynda3 in mark3labs/mcp-go#876
• refactor: use MCP method constants by @​nanookclaw in mark3labs/mcp-go#878
• docs: add missing godoc comments by @​aqilaziz in mark3labs/mcp-go#877
• fix: add panic recovery to SSE message handler and stdio tool call worker by @​blackwell-systems in mark3labs/mcp-go#882
• fix: add panic recovery to task goroutines, fix cleanup goroutine leak by @​blackwell-systems in mark3labs/mcp-go#880
• feat: add OpenTelemetry tracing hooks to server and client by @​QuentinBisson in mark3labs/mcp-go#856
• fix: add panic recovery to session hook goroutines by @​blackwell-systems in mark3labs/mcp-go#883
• feat(mcp): add BaseMetadata.title, Icon.theme, Resource.size (#870) by @​ezynda3 in mark3labs/mcp-go#885

New Contributors

• @​nanookclaw made their first contribution in mark3labs/mcp-go#878
• @​aqilaziz made their first contribution in mark3labs/mcp-go#877

Full Changelog: mark3labs/mcp-go@v0.53.0...v0.54.0

Commits

• b6e6224 fix(client): avoid forwarding inbound request headers (#909)
• 6d28e6d fix: avoid full filter scans on call hot paths (#908)
• 43c2ca0 oauth: return error instead of (nil, nil) from getServerMetadata (#903) (#904)
• 3b66aa7 mcptest: add SetSamplingHandler and SetElicitationHandler (#902)
• 42bc0b2 feat(otel): WithServerLogging — OTEL slog bridge for server structured logs (...
• d972f3f docs(prompts): add review-pr kit prompt for Go PRs
• d5c0727 feat(server): WithLogger consolidates structured logging onto *slog.Logger (#...
• 3f1c760 feat(tracing): add MetaPropagator for W3C trace context via MCP _meta (SEP-41...
• 2cacbe7 fix: enforce tool/prompt filters at call time, not just list time (#898)
• 481f056 fix(tools): print errors to stderr for invalid jsonschema tags (#894)
• Additional commits viewable in

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​onsi/​gomega@​v1.42.1
	golang/​github.com/​labstack/​echo/​v4@​v4.15.2 ⏵ v4.15.4	+1
	golang/​github.com/​slack-go/​slack@​v0.23.1 ⏵ v0.27.0	+1
	golang/​github.com/​mark3labs/​mcp-go@​v0.53.0 ⏵ v0.55.1	+1
	golang/​github.com/​jenkins-x/​go-scm@​v1.15.22 ⏵ v1.15.31	+1
	golang/​github.com/​flanksource/​clicky@​v1.21.18 ⏵ v1.21.33	+1
	golang/​github.com/​firebase/​genkit/​go@​v1.9.0 ⏵ v1.10.0	+1
	golang/​github.com/​redis/​go-redis/​v9@​v9.19.0 ⏵ v9.21.0	+1
	golang/​k8s.io/​apimachinery@​v0.36.1 ⏵ v0.36.2
	golang/​k8s.io/​client-go@​v0.36.1 ⏵ v0.36.2
	golang/​k8s.io/​api@​v0.36.1 ⏵ v0.36.2
	golang/​google.golang.org/​api@​v0.283.0 ⏵ v0.286.0	+1
	golang/​github.com/​prometheus/​common@​v0.68.1 ⏵ v0.69.0
	golang/​gorm.io/​gorm@​v1.31.1 ⏵ v1.31.2	+1
	golang/​github.com/​Azure/​azure-sdk-for-go/​sdk/​azidentity@​v1.13.1 ⏵ v1.14.0	-3
	golang/​github.com/​onsi/​ginkgo/​v2@​v2.29.0 ⏵ v2.32.0	+1
	golang/​github.com/​ory/​client-go@​v1.22.39 ⏵ v1.22.58	-2
	golang/​github.com/​aws/​aws-sdk-go-v2/​config@​v1.32.25 ⏵ v1.32.26
	golang/​go.opentelemetry.io/​contrib/​instrumentation/​github.com/​labstack/​echo/​otelecho@​v0.68.0 ⏵ v0.69.0
	golang/​github.com/​aws/​aws-sdk-go-v2/​credentials@​v1.19.24 ⏵ v1.19.25
	golang/​github.com/​aws/​aws-sdk-go-v2/​service/​sts@​v1.43.3 ⏵ v1.43.4
	golang/​github.com/​aws/​aws-sdk-go-v2/​service/​cloudwatchlogs@​v1.75.2 ⏵ v1.78.1
	golang/​github.com/​tg123/​go-htpasswd@​v1.2.4 ⏵ v1.2.5	+1
	golang/​github.com/​fluxcd/​pkg/​gittestserver@​v0.28.0 ⏵ v0.29.0
	golang/​github.com/​xavidop/​genkit-aws-bedrock-go@​v1.14.0 ⏵ v1.20.0
	golang/​github.com/​flanksource/​kopper@​v1.0.22 ⏵ v1.0.23

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: golang k8s.io/client-go is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → golang/k8s.io/client-go@v0.36.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/k8s.io/client-go@v0.36.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.