fix(deps): update weekly dependencies (main) by tribble-trouble[bot] · Pull Request #777 · cplieger/plex-language-sync

tribble-trouble · 2026-10-22T04:03:47Z

This PR contains the following updates:

Package	Type	Update	Change
gcr.io/distroless/static-debian13	final	digest	`e2e927e` → `d620678`
github.com/cplieger/atomicfile/v4	require	minor	`v4.1.0` → `v4.2.0`
github.com/cplieger/envx/v2	require	minor	`v2.0.7` → `v2.1.0`
github.com/cplieger/health	require	minor	`v1.8.2` → `v1.10.0`
github.com/cplieger/httpx/v5	require	minor	`v5.0.5` → `v5.2.0`
github.com/cplieger/keyenc	require	minor	`v1.0.11` → `v1.1.0`
github.com/cplieger/pathinside/v2	indirect	minor	`v2.0.3` → `v2.1.0`
github.com/cplieger/runesafe/v3	require	minor	`v3.0.0` → `v3.2.0`
github.com/cplieger/scheduler/v4	require	minor	`v4.2.3` → `v4.3.0`
github.com/cplieger/slogx	require	minor	`v1.7.0` → `v1.8.0`
github.com/cplieger/xmlx	indirect	minor	`v1.0.6` → `v1.1.0`
go (source)		patch	`1.27.2` → `1.27.3`

Release Notes

cplieger/atomicfile (github.com/cplieger/atomicfile/v4)

`v4.2.0`

Compare Source

Promoted from v4.2.0-dev.1

Full changelog: cplieger/atomicfile@v4.1.0...v4.2.0

Dependencies: 1 change (go)

go 1.27.2 to 1.27.3 (Go)

cplieger/envx (github.com/cplieger/envx/v2)

`v2.1.0`

Compare Source

Promoted from v2.1.0-dev.3

Fixed

Pin first-party libraries to their stable releases (#398)

Full changelog: cplieger/envx@v2.0.7...v2.1.0

Dependencies: 2 changes (github.com/cplieger/pathinside/v2, go)

github.com/cplieger/pathinside/v2 v2.0.3 to v2.1.0 (Go)
go 1.27.2 to 1.27.3 (Go)

cplieger/health (github.com/cplieger/health)

`v1.10.0`

Compare Source

Promoted from v1.10.0-dev.1

Full changelog: cplieger/health@v1.9.0...v1.10.0

Dependencies: 1 change (go)

go 1.27.2 to 1.27.3 (Go)

`v1.9.0`

Compare Source

Promoted from v1.9.0-dev.1

Fixed

Log only real marker changes, not a first Set(false) at startup (#589)

Full changelog: cplieger/health@v1.8.2...v1.9.0

cplieger/httpx (github.com/cplieger/httpx/v5)

`v5.2.0`

Compare Source

Promoted from v5.2.0-dev.1

Full changelog: cplieger/httpx@v5.1.0...v5.2.0

Dependencies: 1 change (go)

go 1.27.2 to 1.27.3 (Go)

`v5.1.0`

Compare Source

Promoted from v5.1.0-dev.2

This release fixes a redirect allowlist bypass that let a redirect reach a loopback or other local IPv6 address. Every v5.0.x release has it, so upgrade if you use WithAllowedSuffixes or DockerGitHubRedirectPolicy. It also adds WithSameOrigin and a typed error for refused redirects.

Security

WithAllowedSuffixes and DockerGitHubRedirectPolicy matched an allowed suffix against the whole host string, IPv6 zone included. A redirect to https://[::1%25.docker.com]/ passed the .docker.com check and reached the loopback address. net/http forwards custom headers on a redirect, so a credential sent in one could reach that address. An allowed suffix now matches host names only, never an IP address. (#603)

Added

WithSameOrigin(true) follows a redirect to the original host only when the scheme, host and port all match, so a credential header never reaches another port on the same host. Other hosts keep the allowlist and downgrade rules. (#590)
Every hard redirect refusal from RedirectPolicyFunc, DefaultRedirectPolicy and DockerGitHubRedirectPolicy is now a *RedirectRefusedError, with its Origin and a Reason of RedirectNotAllowed, RedirectOtherOrigin, RedirectDowngrade or RedirectTooMany. Read it with errors.As. RefuseAllRedirects and WithPreserveMethod still return http.ErrUseLastResponse. (#590)

Changed

Refusal messages name the target's origin instead of the bare host, for example refusing redirect to https://evil.example:8443. If your code matches on the message text, switch to errors.As. (#590)
WithMaxHops(n) and the default cap of 5 now follow exactly n redirects and refuse the next one. Before, they followed one fewer. (#590)

Fixed

Redirect checks compare an IPv6 zone exactly, so a redirect to fe80::1%ETH0 after a request to fe80::1%eth0 is refused as another origin. DNS host names still compare without regard to ASCII case. (#603)
Redirect policies compare an IP address by its value, so 2001:db8::a and 2001:db8:0::a are one host, and an empty allowlist entry matches nothing. (#603)

Full changelog: cplieger/httpx@v5.0.5...v5.1.0

cplieger/keyenc (github.com/cplieger/keyenc)