chore(renovate): minor Update Go Dependencies (minor) by renovate[bot] · Pull Request #315 · sammcj/mcp-devtools

renovate · 2026-08-14T23:45:30Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/PuerkitoBio/goquery	`v1.12.0` → `v1.13.0`
github.com/knights-analytics/hugot	`v0.7.9` → `v0.8.5`
github.com/modelcontextprotocol/go-sdk	`v1.7.0` → `v1.8.0`
github.com/openai/openai-go/v3	`v3.50.0` → `v3.96.0`
github.com/pdfcpu/pdfcpu	`v0.15.0` → `v0.16.4`
github.com/sirupsen/logrus	`v1.9.4` → `v1.10.2`
github.com/urfave/cli/v3	`v3.10.1` → `v3.14.0`
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	`v0.70.0` → `v0.72.0`
go.opentelemetry.io/otel	`v1.45.0` → `v1.47.0`
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	`v1.45.0` → `v1.47.0`
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	`v1.45.0` → `v1.47.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace	`v1.45.0` → `v1.47.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	`v1.45.0` → `v1.47.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	`v1.45.0` → `v1.47.0`
go.opentelemetry.io/otel/metric	`v1.45.0` → `v1.47.0`
go.opentelemetry.io/otel/sdk	`v1.45.0` → `v1.47.0`
go.opentelemetry.io/otel/sdk/metric	`v1.45.0` → `v1.47.0`
go.opentelemetry.io/otel/trace	`v1.45.0` → `v1.47.0`
golang.org/x/oauth2	`v0.36.0` → `v0.37.0`
golang.org/x/text	`v0.42.0` → `v0.43.0`
golang.org/x/time	`v0.15.0` → `v0.16.0`

Release Notes

PuerkitoBio/goquery (github.com/PuerkitoBio/goquery)

`v1.13.0`

Compare Source

Performance improvements and new top-level goquery.Text function to extract text from a selection with more control than the sel.Text jquery-like method.

knights-analytics/hugot (github.com/knights-analytics/hugot)

`v0.8.5`

Compare Source

[0.8.5]

Changed

The Go backend now attempts to use dynamic axes to reduce graph compilations, falling back to bucketed compilations.

[0.8.4]

This release brings the list of supported pipelines to parity with Huggingface transformers, adding the remaining pipelines and removing others that have been deprecated.

Added

Added AnyToAnyPipeline for supported multimodal models, tested with Phi-4 multimodal, Janus, and LFM bundles.
Added VideoClassificationPipeline for VideoMAE ONNX models.
Added KeypointMatchingPipeline for SuperGlue exports.
Added DownloadOptions.CacheDir and DownloadGraphBundle to configure the Hugging Face cache and download complete ONNX graph bundles, including related weights and child graphs.
Added TextGenerationPipeline.GetContextLength() to report the model's configured context length.
Fine-tuning for TextClassificationPipeline, single-label and multi-label, with datasets.TextClassificationDataset (JSONL or in memory). The defaults are AdamW (learning rate 5e-5, weight decay 0.01) with softmax or sigmoid cross-entropy.
Fine-tuning for TokenClassificationPipeline (e.g. NER) with datasets.TokenClassificationDataset. Each word's tag goes on its first sub-word token; other sub-word, special and padding tokens are masked out of the loss.
TrainingStatistics.EpochTrainAccuracies and EpochEvalAccuracies, recorded for classifiers.
Contrastive fine-tuning of embeddings with in-batch negatives (sentence-transformers' MultipleNegativesRankingLoss): datasets.ContrastiveDataset takes anchor/positive pairs with optional hard negatives, and needs no similarity scores.
The new evaluation package: entity-level precision, recall and F1 for token classification (ScoreEntities, EvaluateTokenClassification), and per-class precision, recall and F1 with macro, weighted and micro averages for text classification (ScoreClassification, ScoreMultiLabel, EvaluateTextClassification).
TrainingStatistics.EpochTrainF1 / EpochEvalF1: entity-level F1 for token classification and macro-F1 for text classification, per epoch.
pipelines.WithWordSplitter for token classification: one function splits raw text into the words the model labels, at inference (Run labels the splitter's words, as RunWords would) and in training, where TokenClassificationDataset examples may be given as raw text and are split by the trainer's pipeline. New TrainerConfig.PipelineOptions passes pipeline options such as the splitter to the trainer.
Span-annotated training data for token classification, in the format Prodigy's ner_manual exports: TokenClassificationExample.Spans holds entities as character offsets, converted to IOB word tags with the pipeline's word splitter or the annotation tool's tokens as the words. Word-level and span lines can share a file, and examples not answered accept are skipped. EvaluateTokenClassification scores span examples the same way.
Prodigy text classification exports for TextClassificationDataset: choice annotations (accept lists) for single- and multi-label datasets, and binary annotations (label + answer). A binary rejection becomes the other class of a two-class model and is skipped otherwise; binary annotations train a multi-label model only when it has that single label. ignore answers are skipped. EvaluateTextClassification resolves them the same way.

Breaking changes

Removed QuestionAnsweringPipeline.
Removed VisualQuestionAnsweringPipeline.
Removed ImageToTextPipeline and its configuration types. Use AnyToAnyPipeline with a supported multimodal model for image understanding and captioning.

Changed

WithGenerativeEngine now admits requests fairly. Free batch slots go round-robin across jobs, with new jobs served first in arrival order. Before, slots went to whichever job Go's randomized map iteration picked first, so a request could be passed over repeatedly under load.
Embedding training reads the number of model inputs and the attention mask's position from the model, instead of assuming three inputs with the mask second.
Trainer.Save also copies the model's config.json, so a saved model keeps its labels and configuration.
The last epoch is now evaluated too. Before, the epoch statistics and early stopping skipped it.
TrainerConfig.EvalDataset is evaluated every epoch whenever it is set. Before, it was evaluated only with early stopping and otherwise silently ignored.

Fixed

On backends that embed variables as constants (the Go backend), every evaluation during training reused the weights of the first one, so the epoch statistics and early stopping never saw training progress. Evaluation graphs are now rebuilt before each evaluation on those backends.

`v0.8.4`

Compare Source

[0.8.4]

This release brings the list of supported pipelines to parity with Huggingface transformers, adding the remaining pipelines and removing others that have been deprecated.

Added

Added AnyToAnyPipeline for supported multimodal models, tested with Phi-4 multimodal, Janus, and LFM bundles.
Added VideoClassificationPipeline for VideoMAE ONNX models.
Added KeypointMatchingPipeline for SuperGlue exports.
Added DownloadOptions.CacheDir (Thanks @NarcisDavins) and DownloadGraphBundle to configure the Hugging Face cache and download complete ONNX graph bundles, including related weights and child graphs.
Added TextGenerationPipeline.GetContextLength() to report the model's configured context length.
Fine-tuning for TextClassificationPipeline, single-label and multi-label, with datasets.TextClassificationDataset (JSONL or in memory). The defaults are AdamW (learning rate 5e-5, weight decay 0.01) with softmax or sigmoid cross-entropy.
Fine-tuning for TokenClassificationPipeline (e.g. NER) with datasets.TokenClassificationDataset. Each word's tag goes on its first sub-word token; other sub-word, special and padding tokens are masked out of the loss.
TrainingStatistics.EpochTrainAccuracies and EpochEvalAccuracies, recorded for classifiers.
Contrastive fine-tuning of embeddings with in-batch negatives (sentence-transformers' MultipleNegativesRankingLoss): datasets.ContrastiveDataset takes anchor/positive pairs with optional hard negatives, and needs no similarity scores.
The new evaluation package: entity-level precision, recall and F1 for token classification (ScoreEntities, EvaluateTokenClassification), and per-class precision, recall and F1 with macro, weighted and micro averages for text classification (ScoreClassification, ScoreMultiLabel, EvaluateTextClassification).
TrainingStatistics.EpochTrainF1 / EpochEvalF1: entity-level F1 for token classification and macro-F1 for text classification, per epoch.
pipelines.WithWordSplitter for token classification: one function splits raw text into the words the model labels, at inference (Run labels the splitter's words, as RunWords would) and in training, where TokenClassificationDataset examples may be given as raw text and are split by the trainer's pipeline. New TrainerConfig.PipelineOptions passes pipeline options such as the splitter to the trainer.
Span-annotated training data for token classification, in the format Prodigy's ner_manual exports: TokenClassificationExample.Spans holds entities as character offsets, converted to IOB word tags with the pipeline's word splitter or the annotation tool's tokens as the words. Word-level and span lines can share a file, and examples not answered accept are skipped. EvaluateTokenClassification scores span examples the same way.
Prodigy text classification exports for TextClassificationDataset: choice annotations (accept lists) for single- and multi-label datasets, and binary annotations (label + answer). A binary rejection becomes the other class of a two-class model and is skipped otherwise; binary annotations train a multi-label model only when it has that single label. ignore answers are skipped. EvaluateTextClassification resolves them the same way.

Breaking changes

Removed QuestionAnsweringPipeline.
Removed VisualQuestionAnsweringPipeline.
Removed ImageToTextPipeline and its configuration types. Use AnyToAnyPipeline with a supported multimodal model for image understanding and captioning.

Changed

WithGenerativeEngine now admits requests fairly. Free batch slots go round-robin across jobs, with new jobs served first in arrival order. Before, slots went to whichever job Go's randomized map iteration picked first, so a request could be passed over repeatedly under load.
Embedding training reads the number of model inputs and the attention mask's position from the model, instead of assuming three inputs with the mask second.
Trainer.Save also copies the model's config.json, so a saved model keeps its labels and configuration.
The last epoch is now evaluated too. Before, the epoch statistics and early stopping skipped it.
TrainerConfig.EvalDataset is evaluated every epoch whenever it is set. Before, it was evaluated only with early stopping and otherwise silently ignored.

Fixed

On backends that embed variables as constants (the Go backend), every evaluation during training reused the weights of the first one, so the epoch statistics and early stopping never saw training progress. Evaluation graphs are now rebuilt before each evaluation on those backends.

`v0.8.3`

Compare Source

[0.8.3] - 2026-10-14

Added

GroundedObjectDetectionPipeline implements support for Grounding DINO models, which allow for object detection using a set of textual labels (zero shot)
Support for SAM2 models in maskGeneration with both box and point based segmentation prompts

Changed

Do not pad batches when using the Go backend (performance improvement).
Fixed #149 Hugot/GoMLX panics with index out of range when the batch size is padded.
Upgraded to ONNX Runtime v1.31.0.

`v0.8.2`

Compare Source

[0.8.2] - 2026-10-06

Changed

Python parity tests: embedded Python ONNX reference vectors with pinned tolerances to verify numeric parity across ORT, GoMLX, and XLA backends.
Raw feature access and dimensions for text and image feature-extraction pipelines.

`v0.8.1`

Compare Source

[v0.8.1]

Added

New pipelines:
- Image: FillMaskPipeline, MaskGenerationPipeline, ImageSegmentationPipeline, DepthEstimationPipeline, BackgroundRemovalPipeline, ZeroShotImageClassificationPipeline.
- Audio: AudioClassificationPipeline, ZeroShotAudioClassificationPipeline, AutomaticSpeechRecognitionPipeline, TextToAudioPipeline, TextToSpeechPipeline.
- Multimodal: VisualQuestionAnsweringPipeline, DocumentQuestionAnsweringPipeline, TableQuestionAnsweringPipeline, ImageToTextPipeline, ImageTextToTextPipeline.
Image pipelines expose RunWithImages(ctx, []image.Image) so callers can feed in-memory image.Image values without a disk round-trip, in addition to Run(ctx, []string) which loads from paths or data URIs.
Audio input plumbing: backends.AudioWaveform, backends.AudioURLs, Message.AudioURLs, and ConversationHasAudio / FlattenAudioURLs helpers used by the ORT session pipeline.
Per-conversation system turns are expressed as History[0] = {Role: "system", ...} on all five input types. The pipeline-level SystemPrompt on multimodalGeneration continues to be applied globally by the ORT backend via createORTMessages.
Upgraded to ONNX Runtime GenAI 0.17.0.

Changed

Pipeline operations are now methods on *hugot.Session (session.NewPipeline, session.GetPipeline, session.GetPipelines, session.ClosePipeline); the old free-function variants are deprecated thin wrappers kept for compatibility.
BREAKING: Training is now configured with session.NewTrainer(TrainerConfig, ...TrainerOption) and run with trainer.Train(ctx).

Removed

Removed the Rust tokenizer dependency; the Go tokenizer is fast enough, supports all of our test pipelines, and avoids the extra cgo dependency/project complexity.

`v0.8.0`

Compare Source

[0.8.0] - 2026-09-22

Fixed

Fix compilation on non-linux platforms.

[0.7.9] - 2026-09-22

Added

Upgraded to ONNX Runtime v1.30.0.
Migrated to Go bindings from the official repository.
Fixed a missing filesystem error if using downloader before starting a session.
Made file copies atomic to avoid partial model downloads on abort.
Reject a non-directory destination before downloading a model by @slachiewicz in #144

New Contributors

@slachiewicz made their first contribution in #144

Full Changelog: knights-analytics/hugot@v0.7.8...v0.8.0

modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)

`v1.8.0`

Compare Source

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

internal/json: json nesting depth check by @yarolegovich (#1200)
mcp: add an sse event size cap by @yarolegovich (#1205)
mcp: add a max request body size of the old transport by @yarolegovich (#1224)
oauthex: bound dcr read to 1mb by @yarolegovich (#1206)
oauthex: oauth discovery checks by @yarolegovich (#1220)

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction.
Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

mcp: allow restricting the protocol versions a server supports by @guglielmo-san (#1199)
mcp: return json-rpc error on stateful server serving protocolVersion20260728 requests by @guglielmo-san (#1143)
mcp: limit SSE discover supportedVersions to SSE-defined revisions by @arimu1 (#1121)
mcp: prefer the negotiated protocol version over the request context by @gwyszynski-sa (#1163)
mcp: export ClientSessionOptions.ProtocolVersion by @arimu1 (#1127)

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

mcp: allow per request Cacheable customization by @guglielmo-san (#1203)

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #1143.
blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #1151.

Options below were removed, according to plan:

seterroroverwrite
enableoriginverification
disablecontenttypecheck
disablelocalhostprotection

Other Changes to the SDK

mcp: fix ListTools panic and null normalization on malformed tools by @n0liu (#1120)
mcp: avoid panicking when a resource handler returns nil by @latent-9 (#1176)
mcp: prevent MemoryEventStore.After panic on index past the end by @PratikDhanave (#1132)
internal/jsonrpc2: test WireError.Is and fix nil target panic by @aha-jansen (#1079)
jsonrpc2: wrap write error in server-closing error by @Tethys0 (#1186)
internal/jsonrpc2: plumb cancellation cause through request context by @aha-jansen (#1103)
mcp: preserve single-request batch responses by @wmh123wmh1 (#1214)
mcp: don't mutate caller params on multi-round-trip retries by @yhxlele (#1145)
mcp: do not check metatada on notifications by @guglielmo-san (#1215)
fix: only subscribe when server advertises capability by @yarolegovich (#1221)
mcp: tolerate 404 on subscriptions/listen in stateless mode by @smlx (#1193)
mcp: keep request log levels scoped to each request by @jstar0 (#1168)
mcp: add docs for tier 1 assessment by @guglielmo-san (#1195)
docs: make the protocol.md table of contents resolve by @tonydzi (#1196)
docs: fix the streamable client snippet to use (*Client).Connect by @tonydzi (#1142)
docs: quick start go get leaves the module unbuildable by @tonydzi (#1148)
docs: fix four dead links to the Multi Round-Trip Requests section by @tonydzi (#1159)
mcp: fix typo in protocol version comment by @latent-9 (#1156)
mcp: fix ListChanged doc comments on server capabilities by @qhzhu (#1219)
mcp: add ServerSession.NotifyElicitationComplete by @guglielmo-san (#1194)
mcp: update conformance tests by @guglielmo-san (#1231)
Disable scheduled nightly runs on forks by @IAmSurajBobade (#1083)
auth: add ScopeFilter hook to AuthorizationCodeHandlerConfig by @toabctl (#1044)
auth: validate unadvertised RFC 9207 iss instead of rejecting it by @asjdf (#1187)
mcp: prevent leaks of ServerSession on StatefulServer by @guglielmo-san (#1137)
mcp: avoid Client.Connect leaks by @guglielmo-san (#1158)
mcp: resolve deadlock on serverSession.Close() with subscriptionsListen call by @guglielmo-san (#1166)
mcp: prune completed listen request IDs from the session by @latent-9 (#1190)
mcp: bound streamable Close DELETE so a silent peer cannot hang teardown by @LPX-E5BD8 (#1184)
mcp: allow asynchronous cancel notification by @guglielmo-san (#1151)
mcp: fix error propagation to prevent session closing by @guglielmo-san (#1118)
refactor: remove legacy MCPGODEBUG compatibility for new protocol release by @guglielmo-san
build(deps): bump the codeql-action group with 3 updates by @dependabot (#1122)
build(deps): bump the codeql-action group with 3 updates by @dependabot (#1216)
build(deps): bump actions/setup-node from 6.0.0 to 7.0.0 by @dependabot (#1123)
build(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot (#1124)
build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot (#1125)
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot (#1126)
build(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 by @dependabot (#1218)
build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot (#1217)

New Contributors

@n0liu made their first contribution in #1120
@arimu1 made their first contribution in #1127
@tonydzi made their first contribution in #1142
@latent-9 made their first contribution in #1156
@jstar0 made their first contribution in #1168
@gwyszynski-sa made their first contribution in #1163
@aha-jansen made their first contribution in #1103
@PratikDhanave made their first contribution in #1132
@LPX-E5BD8 made their first contribution in #1184
@asjdf made their first contribution in #1187
@Tethys0 made their first contribution in #1186
@wmh123wmh1 made their first contribution in #1214
@yhxlele made their first contribution in #1145
@qhzhu made their first contribution in #1219

Full Changelog: modelcontextprotocol/go-sdk@v1.7.0...v1.8.0-pre.1

openai/openai-go (github.com/openai/openai-go/v3)

`v3.96.0`

Compare Source

Features

api: add a model option for Responses (#1220) (94977c6)

`v3.95.0`

Compare Source

Features

api: add Australia, India, and Japan residency options (#1218) (6d16502)
api: add GPT-6 Rosalind to the model catalog (#1216) (a47bab2)
api: add image complexity and GIF and SVG output controls (#1219) (6e7ade4)

`v3.94.0`

Compare Source

Features

api: add project service tier settings (#1212) (90fa868)
api: add Responses cache-write usage details (#1213) (d3c5a9a)

Documentation

clarify generated-file ownership (#1214) (709822f)

Build System

deps: bump github.com/Azure/azure-sdk-for-go/sdk/azcore in / (#1096) (74ab0b2)

`v3.93.0`

Compare Source

Features

api: add workload identity providers and federation rules (#1209) (6f36b01)

`v3.92.0`

Compare Source

Features

api: expand Live Responses delegation tools (#1208) ([b587c9d](https://redirect.github.com/openai/openai-go/commit/b587c9d74994245db46

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Australia/Melbourne)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-08-14T23:45:48Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	License
golang/github.com/modelcontextprotocol/go-sdk@v1.7.0 ⏵ v1.8.0	⁺¹
golang/golang.org/x/oauth2@v0.36.0 ⏵ v0.37.0
golang/github.com/openai/openai-go/v3@v3.50.0 ⏵ v3.77.0	^-1
golang/github.com/pdfcpu/pdfcpu@v0.15.0 ⏵ v0.16.2	^-7	⁺¹¹
golang/go.opentelemetry.io/otel@v1.45.0 ⏵ v1.47.0	⁺¹
golang/golang.org/x/text@v0.42.0 ⏵ v0.43.0	⁺¹
golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.70.0 ⏵ v0.72.0
golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.45.0 ⏵ v1.47.0	⁺¹
golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.45.0 ⏵ v1.47.0	⁺¹
golang/github.com/urfave/cli/v3@v3.10.1 ⏵ v3.14.0
golang/github.com/knights-analytics/hugot@v0.7.9 ⏵ v0.8.2	⁺³
golang/go.opentelemetry.io/otel/sdk@v1.45.0 ⏵ v1.47.0
golang/github.com/sirupsen/logrus@v1.9.4 ⏵ v1.10.2	⁺¹
golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc@v1.45.0 ⏵ v1.47.0	⁺¹
golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 ⏵ v1.47.0	⁺¹
golang/github.com/PuerkitoBio/goquery@v1.12.0 ⏵ v1.13.0	⁺¹
golang/go.opentelemetry.io/otel/sdk/metric@v1.45.0 ⏵ v1.47.0	⁺¹
golang/go.opentelemetry.io/otel/trace@v1.45.0 ⏵ v1.47.0	⁺¹
golang/go.opentelemetry.io/otel/metric@v1.45.0 ⏵ v1.47.0
golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.45.0 ⏵ v1.47.0
golang/golang.org/x/time@v0.15.0 ⏵ v0.16.0

View full report

renovate · 2026-08-25T22:05:20Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

20 additional dependencies were updated

Details:

Package	Change
`github.com/gomlx/compute`	`v0.1.14` -> `v0.1.16`
`github.com/gomlx/compute-onnx`	`v0.1.13` -> `v0.1.15`
`github.com/gomlx/go-huggingface`	`v0.4.12` -> `v0.4.17`
`github.com/gomlx/go-xla`	`v0.4.13` -> `v0.4.16`
`github.com/gomlx/gomlx`	`v0.28.16` -> `v0.28.19`
`github.com/gomlx/onnx-gomlx`	`v0.5.13` -> `v0.5.16`
`github.com/hhrutter/tiff`	`v1.0.6` -> `v1.0.7`
`github.com/knights-analytics/ortgenai`	`v0.3.2` -> `v0.3.4`
`github.com/mattn/go-runewidth`	`v0.0.27` -> `v0.0.31`
`github.com/microsoft/onnxruntime/go`	`v0.0.0-20260922015325-62e95311b771` -> `v0.0.0-20261030073735-b5fe413d0b05`
`github.com/tidwall/gjson`	`v1.19.0` -> `v1.20.0`
`golang.org/x/crypto`	`v0.55.0` -> `v0.58.0`
`golang.org/x/exp`	`v0.0.0-20260908205506-85c1c2202aba` -> `v0.0.0-20261014143641-f0251eb4aa3e`
`golang.org/x/image`	`v0.46.0` -> `v0.47.0`
`golang.org/x/net`	`v0.58.0` -> `v0.60.0`
`golang.org/x/sync`	`v0.23.0` -> `v0.24.0`
`golang.org/x/sys`	`v0.48.0` -> `v0.49.0`
`golang.org/x/term`	`v0.46.0` -> `v0.47.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260810153831-ec0a7760b754` -> `v0.0.0-20260928230214-8a89bd6388cc`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260810153831-ec0a7760b754` -> `v0.0.0-20260928230214-8a89bd6388cc`

renovate Bot added minor renovate version-update labels Aug 14, 2026

renovate Bot changed the title ~~chore(renovate): minor Update module github.com/sirupsen/logrus to v1.10.0~~ chore(renovate): minor Update Go Dependencies (minor) Aug 15, 2026

renovate Bot force-pushed the renovate/go-dependencies branch 10 times, most recently from 6eaba02 to 650dbf4 Compare August 21, 2026 16:48

renovate Bot force-pushed the renovate/go-dependencies branch 2 times, most recently from 51c88d7 to 0ef8450 Compare August 25, 2026 22:05

renovate Bot force-pushed the renovate/go-dependencies branch 9 times, most recently from 97d7383 to a8fc346 Compare August 29, 2026 21:40

renovate Bot force-pushed the renovate/go-dependencies branch 9 times, most recently from a38712b to 1d5abf1 Compare September 9, 2026 20:36

renovate Bot force-pushed the renovate/go-dependencies branch 6 times, most recently from a7d4b17 to 91e5047 Compare September 17, 2026 02:54

renovate Bot force-pushed the renovate/go-dependencies branch 13 times, most recently from 401b39f to 5ccfb68 Compare September 24, 2026 06:43

renovate Bot force-pushed the renovate/go-dependencies branch from 5ccfb68 to ef98f23 Compare September 27, 2026 09:09

chore(renovate): minor Update Go Dependencies

5903662

Navigation Menu

Repository navigation

chore(renovate): minor Update Go Dependencies (minor) - #315

chore(renovate): minor Update Go Dependencies (minor)#315
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-dependencies

renovate Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Aug 25, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

[0.8.5]

Changed

[0.8.4]

Added

Breaking changes

Changed

Fixed

[0.8.4]

Added

Breaking changes

Changed

Fixed

[0.8.3] - 2026-10-14

Added

Changed

[0.8.2] - 2026-10-06

Changed

[v0.8.1]

Added

Changed

Removed

[0.8.0] - 2026-09-22

Fixed

[0.7.9] - 2026-09-22

Added

New Contributors

Hardening against resource exhaustion

Restricting the protocol versions a server supports

Per-request cache control

Behavior changes guarded by MCPGODEBUG

Other Changes to the SDK

New Contributors

Features

Features

Features

Documentation

Build System

Features

Features

Configuration

Uh oh!

socket-security Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renovate Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 14, 2026 •

edited

Loading

socket-security Bot commented Aug 14, 2026 •

edited

Loading

renovate Bot commented Aug 25, 2026 •

edited

Loading