[dependabot]

Bumps the gomod group with 4 updates in the / directory: github.com/codefly-dev/core, golang.org/x/mod, golang.org/x/tools and google.golang.org/grpc.

Updates github.com/codefly-dev/core from 0.19.5 to 0.19.6

Release notes

Sourced from github.com/codefly-dev/core's releases.

v0.19.6

CLI-agent compatibility

Protocol version: 1 (independent of the Core module version). Startup protocol version: 2. Server capabilities: container-recovery-scope/v1.

Contract unchanged from v0.19.5. No agent rebuild is required solely for this Core bump.

Host-supported operation contracts: artifact-execution/v1, codefly.dev/docker-build-recipe/v4, codefly.dev/docker-build-recipe/v5, codefly.dev/docker-build-recipe/v6, configuration-value-template/v1, deployment-composition-provenance/v1, runtime-init-dependency-mappings/v1, runtime-init-image/v1, runtime-started-artifact/v1. This is not an executor advertisement. Selected executors must implement and advertise the required operation contract before dispatch.

The CLI selects required capabilities for each operation. A matching protocol does not replace capability checks or this run's recovery-scope acknowledgement.

Commits

• 3a9e608 release: v0.19.6 (#834)
• 51aa81a Merge pull request #832 from saurabhmaheshwari-obin/feat/git-source-downloads
• f72e10b Merge branch 'main' into feat/git-source-downloads
• 4c895ee fix(agents): a Buildx acknowledgement is owed only by an in-agent image build...
• abdc707 feat(builder): export the git source repository and commit checks for agents
• 519efae fix(builder): refuse a git source port outside 1-65535 and an ssh login or ho...
• 9c4eef0 fix(builder): refuse percent-encoding and "@" in a git source path
• 71f98a0 fix(builder): refuse unsafe git source URLs without echoing them; record reci...
• d693563 feat(builder): a recipe declares the locked git sources it fetches (contract v6)
• b81d92e Merge pull request #812 from codefly-dev/feat/module-manifest
• Additional commits viewable in compare view

Updates golang.org/x/mod from 0.41.0 to 0.42.0

Commits

• b5136e5 sumdb/tlog: use recorded responses in TestCertificateTransparency
• 1e9a5ae go.mod: update golang.org/x dependencies
• See full diff in compare view

Updates golang.org/x/tools from 0.50.0 to 0.51.0

Commits

• ea2f152 go.mod: update golang.org/x dependencies
• 00443da go/analysis/passes/printf: pin testdata Go versions
• 9ba0a15 internal/refactor/inline: check import accessibility before Go version
• 25196fc cmd/toolstash: check -linkobj files to support early export
• ead0503 gopls/internal/golang: unexport dragon*Question variables
• 5693030 gopls/internal/golang: call arguments mistreated in inlineAllCalls
• 134264d gopls/internal/golang/stubmethods: do not panic when FindByPos fails
• 01d93d7 gopls/internal/golang: slay the dragon: update questions
• 405de39 go/callgraph: fix benchmarks to analyze whole program
• 231a7fa go/ssa, cmd/deadcode: release type information once functions are built
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

• stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • Special Thanks: @​aryansk
• metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
  • Special Thanks: @​yuyangguo42

Bug Fixes

• transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
• server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • Special Thanks: @​stanhu
• server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
• server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
• xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • Special Thanks: @​winklemad
• client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • Special Thanks: @​nvxbug
• transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
  • Special Thanks: @​buger

Commits

• c9ab42c Change version to 1.85.0 (#9434)
• bfb7561 cherry pick (#9433) and (#9563) (#9566)
• 46a2db2 *: update dockerfiles to build using go1.26 to match go.mod (#9548)
• 076bb1c Cherrypick #9533 to v1.85.x. (#9534)
• baaf083 *: update the net package and go version (#9506)
• 678b9b3 Cherrypick #9385 to v1.85.x (#9504)
• 705f9b9 Cherry-pick #9425 into v1.85.x (#9438)
• 1648161 transport: stop read throttling due to controlBuf size, on the client (#9431)
• 1863b59 protoc-gen-go-grpc: Update supported Edition to 2026 (#9426)
• d331f11 server: release mutex while waiting for handlers in stop() (#9394)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions