fix(deps): update backend dependencies by renovate-sh-app[bot] · Pull Request #784 · grafana/github-datasource

renovate-sh-app · 2026-07-16T16:01:52Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
github.com/apache/arrow-go/v18	`v18.5.2` → `v18.7.0`	indirect	minor
github.com/bradleyfalzon/ghinstallation/v2	`v2.18.0` → `v2.19.0`	require	minor
github.com/clipperhouse/displaywidth	`v0.10.0` → `v0.11.0`	indirect	minor
github.com/clipperhouse/uax29/v2	`v2.6.0` → `v2.7.0`	indirect	minor
github.com/emicklei/go-restful/v3	`v3.11.0` → `v3.13.0`	indirect	minor
github.com/fatih/color	`v1.18.0` → `v1.19.0`	indirect	minor
github.com/go-logr/logr	`v1.4.3` → `v1.4.4`	indirect	patch
github.com/go-openapi/jsonpointer	`v0.22.5` → `v0.24.0`	indirect	minor
github.com/go-openapi/jsonreference	`v0.21.5` → `v0.21.6`	indirect	patch
github.com/go-openapi/swag	`v0.23.0` → `v0.27.3`	indirect	minor
github.com/go-openapi/swag/jsonname	`v0.25.5` → `v0.27.3`	indirect	minor
github.com/goccy/go-json	`v0.10.5` → `v0.10.6`	indirect	patch
github.com/google/gnostic-models	`v0.7.0` → `v0.7.1`	indirect	patch
github.com/grafana/grafana-plugin-sdk-go	`v0.291.1` → `v0.294.0`	require	minor
github.com/grafana/otel-profiling-go	`v0.5.1` → `v0.6.0`	indirect	minor
github.com/grafana/pyroscope-go/godeltaprof	`v0.1.9` → `v0.1.12`	indirect	patch
github.com/grafana/schemads	`v0.0.8` → `v0.2.3`	require	minor
github.com/grpc-ecosystem/grpc-gateway/v2	`v2.28.0` → `v2.29.0`	indirect	minor
github.com/hashicorp/go-plugin	`v1.7.0` → `v1.8.0`	indirect	minor
github.com/huandu/go-sqlbuilder	`v1.39.1` → `v1.42.1`	indirect	minor
github.com/huandu/xstrings	`v1.4.0` → `v1.5.0`	indirect	minor
github.com/jaegertracing/jaeger-idl	`v0.6.0` → `v0.9.0`	indirect	minor
github.com/jszwedko/go-datemath	`640a500` → `7f666ee`	indirect	digest
github.com/klauspost/compress	`v1.18.4` → `v1.19.1`	indirect	minor
github.com/klauspost/cpuid/v2	`v2.3.0` → `v2.4.0`	indirect	minor
github.com/magefile/mage	`v1.16.1` → `v1.17.2`	indirect	minor
github.com/mailru/easyjson	`v0.7.7` → `v0.9.2`	indirect	minor
github.com/mattn/go-colorable	`v0.1.14` → `v0.1.15`	indirect	patch
github.com/mattn/go-isatty	`v0.0.20` → `v0.0.24`	indirect	patch
github.com/mattn/go-runewidth	`v0.0.19` → `v0.0.27`	indirect	patch
github.com/oklog/run	`v1.1.0` → `v1.2.0`	indirect	minor
github.com/olekukonko/errors	`v1.2.0` → `v1.3.0`	indirect	minor
github.com/olekukonko/ll	`v0.1.6` → `v0.1.8`	indirect	patch
github.com/pierrec/lz4/v4	`v4.1.25` → `v4.1.27`	indirect	patch
github.com/prometheus/client_golang	`v1.23.2` → `v1.24.1`	indirect	minor
github.com/prometheus/common	`v0.67.5` → `v0.70.1`	indirect	minor
github.com/prometheus/procfs	`v0.16.1` → `v0.21.1`	indirect	minor
github.com/shurcooL/graphql	`3cf50f8` → `7ee5256`	indirect	digest
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	`v0.67.0` → `v0.69.0`	indirect	minor
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace	`v0.67.0` → `v0.69.0`	indirect	minor
go.opentelemetry.io/contrib/propagators/jaeger	`v1.42.0` → `v1.44.0`	indirect	minor
go.opentelemetry.io/contrib/samplers/jaegerremote	`v0.36.0` → `v0.37.1`	indirect	minor
go.opentelemetry.io/otel	`v1.43.0` → `v1.44.0`	indirect	minor
go.opentelemetry.io/otel/exporters/otlp/otlptrace	`v1.42.0` → `v1.44.0`	indirect	minor
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	`v1.42.0` → `v1.44.0`	indirect	minor
go.opentelemetry.io/otel/metric	`v1.43.0` → `v1.44.0`	indirect	minor
go.opentelemetry.io/otel/sdk	`v1.43.0` → `v1.44.0`	indirect	minor
go.opentelemetry.io/otel/trace	`v1.43.0` → `v1.44.0`	indirect	minor
go.opentelemetry.io/proto/otlp	`v1.9.0` → `v1.11.0`	indirect	minor
go.yaml.in/yaml/v2	`v2.4.3` → `v2.4.4`	indirect	patch
golang.org/x/mod	`v0.37.0` → `v0.38.0`	indirect	minor
golang.org/x/telemetry	`59b4966` → `bdb8988`	indirect	digest
golang.org/x/tools	`v0.47.0` → `v0.48.0`	indirect	minor
google.golang.org/grpc	`v1.79.3` → `v1.82.1`	indirect	minor
k8s.io/kube-openapi	`a19766b` → `d427ff9`	indirect	digest
pgregory.net/rapid	`v1.2.0` → `v1.3.0`	require	minor

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

CVE-2026-41178 / GHSA-5wrp-cwcj-q835 / GO-2026-5158

More information

Details

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

GHSA-hrxh-6v49-42gf

More information

Details

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:

Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing Metadata or RequestedServerName fields.
Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets.
Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing NOT rules around unsupported fields.

Impact

What kind of vulnerability is it? Who is impacted?

xDS RBAC Authorization Bypass via `Metadata` & `RequestedServerName` matchers

Affected Component: xDS RBAC
Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported permission and principal rules (specifically Metadata and RequestedServerName) were silently ignored and treated as no-ops.
- If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions.
If these unsupported rules were nested inside logical NOT rules (Permission_NotRule / Principal_NotId) or multi-condition OR/AND rules, silently dropping them changed the boolean logic flow of the authorization engine.

As a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources.

HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts

Affected Component: HTTP/2 transport
Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as SETTINGS ACKs or server-initiated RST_STREAMs.

When a client initiated a rapid flood of stream creation (HEADERS) immediately followed by stream termination RST_STREAM, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS).

Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules

Affected Component: xDS RBAC
Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a NOT rule wrapped an unsupported or unhandled field (such as SourcedMetadata), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request.

An attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a NOT rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service).

Patches

Has the problem been patched? What versions should users upgrade to?

All three issues have been fixed in master and will be released in 1.82.1 shortly.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture:

For xDS RBAC Vulnerabilities & Panics: Ensure that upstream xDS management servers do not push RBAC policies containing Metadata, RequestedServerName, or NOT rules wrapping unsupported fields (such as SourcedMetadata) to grpc-go servers.
For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection.

Severity

Vulnerability	Qualitative Severity	Approximate CVSS v3.1 Score	Primary Impact
xDS RBAC Authorization Bypass	High	`8.2`	Unauthorized Access / Fail-Open
HTTP/2 Rapid Reset DOS Bypass	High	`7.5`	High CPU Consumption / Denial of Service
xDS RBAC Engine Server Panic	Medium	`5.9`	Process Crash / Denial of Service

Severity

CVSS Score: 8.8 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

GHSA-hrxh-6v49-42gf

More information

Details

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:

Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing Metadata or RequestedServerName fields.
Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets.
Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing NOT rules around unsupported fields.

Impact

What kind of vulnerability is it? Who is impacted?

xDS RBAC Authorization Bypass via `Metadata` & `RequestedServerName` matchers

Affected Component: xDS RBAC
Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported permission and principal rules (specifically Metadata and RequestedServerName) were silently ignored and treated as no-ops.
- If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions.
If these unsupported rules were nested inside logical NOT rules (Permission_NotRule / Principal_NotId) or multi-condition OR/AND rules, silently dropping them changed the boolean logic flow of the authorization engine.

As a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources.

HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts

Affected Component: HTTP/2 transport
Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as SETTINGS ACKs or server-initiated RST_STREAMs.

When a client initiated a rapid flood of stream creation (HEADERS) immediately followed by stream termination RST_STREAM, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS).

Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules

Affected Component: xDS RBAC
Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a NOT rule wrapped an unsupported or unhandled field (such as SourcedMetadata), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request.

An attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a NOT rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service).

Patches

Has the problem been patched? What versions should users upgrade to?

All three issues have been fixed in master and will be released in 1.82.1 shortly.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture:

For xDS RBAC Vulnerabilities & Panics: Ensure that upstream xDS management servers do not push RBAC policies containing Metadata, RequestedServerName, or NOT rules wrapping unsupported fields (such as SourcedMetadata) to grpc-go servers.
For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection.

Severity

Vulnerability	Qualitative Severity	Approximate CVSS v3.1 Score	Primary Impact
xDS RBAC Authorization Bypass	High	`8.2`	Unauthorized Access / Fail-Open
HTTP/2 Rapid Reset DOS Bypass	High	`7.5`	High CPU Consumption / Denial of Service
xDS RBAC Engine Server Panic	Medium	`5.9`	Process Crash / Denial of Service

Severity

CVSS Score: 8.8 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

apache/arrow-go (github.com/apache/arrow-go/v18)

`v18.7.0`: Apache Arrow Go v18.7.0

Compare Source

What's Changed

fix(release): keys download by @zeroshade in #781
parquet/compress: enable WithAllLitEntropyCompression(true) for zstd by @varun0630 in #779
release: fix syntax error in verify_rc.sh by @amoeba in #782
chore: Bump modernc.org/sqlite from 1.49.1 to 1.50.0 by @dependabot[bot] in #783
fix(parquet): align dictionary fallback with parquet-mr by @twuebi in #786
fix(arrow/cdata): make nativeCRecordBatchReader deterministic by @zeroshade in #793
fix(compute/kernels): map FSB byte-width to numeric memo type for is_in by @SAY-5 in #797
chore: Bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in #798
chore: Bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by @dependabot[bot] in #799
fix(arrow/flight): deliver response headers eagerly in streaming client middleware by @zeroshade in #801
chore: Bump golang.org/x/sys from 0.43.0 to 0.44.0 by @dependabot[bot] in #810
chore: Bump modernc.org/sqlite from 1.50.0 to 1.50.1 by @dependabot[bot] in #811
fix(ipc): preserve map child field metadata by @dimakuz in #809
fix(avro): error on complex (non-nullable) unions instead of silently dropping (#777) by @SAY-5 in #808
fix(parquet/metadata): do not pre-set hasDistinctCount in stat factories by @SAY-5 in #807
feat(compute): support casts between binary/string and binary_view/string_view by @zeroshade in #802
fix(arrow/array): preserve large integer precision in JSON decoding by @zeroshade in #816
feat(arrow/array): add Resize method to RecordBuilder by @oakad in #805
chore: Bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #818
chore: Bump github.com/substrait-io/substrait-go/v8 from 8.1.0 to 8.1.1 by @dependabot[bot] in #819
perf(parquet/pqarrow): cap RecordReader batch size to actual row count by @paveon in #817
docs(parquet): correct DefaultDataPageSize comment from 1K to 1M by @zeroshade in #822
fix(arrow/array): silence copylocks warning in numeric_generic.go by @zeroshade in #823
feat(arrow/compute/exprs): support expr.IntervalYearToMonthLiteral in literalToDatum by @zeroshade in #825
chore: Bump golang.org/x/sys from 0.44.0 to 0.45.0 by @dependabot[bot] in #829
chore: Bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #828
fix(parquet): return error instead of panicking on first-write failure by @zeroshade in #824
[Parquet] Add SIMD-accelerated byte-stream-split decoding by @daniel-adam-tfs in #654
perf(parquet/metadata): avoid constructing ColumnChunkMetaData in page index range determination by @paveon in #831
chore: Bump modernc.org/sqlite from 1.50.1 to 1.51.0 by @dependabot[bot] in #837
chore: Bump github.com/pierrec/lz4/v4 from 4.1.26 to 4.1.27 by @dependabot[bot] in #836
chore: Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #835
feat: filter and take for dictionary arrays by @lesam in #716
fix(arrow/array): adding string boundary checking for (*String).Value by @happydave1 in #844
fix(parquet/variant): correct binary search bounds in ObjectValue.ValueByKey by @qzyu999 in #841
fix(parquet/variant): correct is_large bit position in valueSize for arrays by @qzyu999 in #840
feat(avro): support local-timestamp logical types by @abir-eon in #832
chore: Bump modernc.org/sqlite from 1.51.0 to 1.52.0 by @dependabot[bot] in #845
chore: Bump golang.org/x/sys from 0.45.0 to 0.46.0 by @dependabot[bot] in #846
fix(avro): append raw bytes by @matan129 in #850
fix(arrow/array): use scale-aware ValueStr in decimal array String() by @zeroshade in #849
feat(parquet/pqarrow): support writing LARGE_LIST types by @lidavidm in #838
chore: Bump golang.org/x/sync from 0.20.0 to 0.21.0 by @dependabot[bot] in #847
fix(arrow/scalar): implement Release()/Retain() on *scalar.Extension by @zeroshade in #851
docs(arrow/ipc): document that Writer and FileWriter are not concurrency safe by @zeroshade in #856
fix(parquet): add WriteBatchSpacedWithError to surface spaced-write failures by @zeroshade in #852
ci: pin Go to go.mod in RC verify so the matching toolchain is used by @zeroshade in #857
chore: Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #860
chore: Bump modernc.org/sqlite from 1.52.0 to 1.53.0 by @dependabot[bot] in #861
feat(arrow/extensions): add UnshredVariant to collapse a shredded variant array by @nssalian in #859
fix(arrow/compute): accept type max value in safe decimal-to-int cast by @zeroshade in #862
chore: Bump github.com/andybalholm/brotli from 1.2.1 to 1.2.2 by @dependabot[bot] in #869
chore: Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #866
chore: Bump actions/cache from 5 to 6 by @dependabot[bot] in #867
chore: Bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #868
fix(array): validate negative bounds in NewSliceData by @fallintoplace in #870
fix(array): dictionary null index zeroing by @fallintoplace in #871
fix(array): struct stringer required child mask by @fallintoplace in #873
fix(array): empty chunked approximate equality by @fallintoplace in #874
fix(array): validate dense union offset lengths by @fallintoplace in #875
Use semantic type equality in AddColumn by @fallintoplace in #878
fix(array): clear dictionary data on reset by @fallintoplace in #876
Reject negative chunked slice bounds by @fallintoplace in #879
fix(array): array data hashing coverage by @fallintoplace in #872
Support dense union slice offsets by @fallintoplace in #877
Support sparse union sliced type ids by @fallintoplace in #881
fix(build): correct phony target declaration by @fallintoplace in #890
fix(parquet/compress): Gzip CompressBound by @fallintoplace in #886
fix(parquet): free excluded stats bytes in ApplyStatSizeLimits by @mdibaiee in #885
fix(tmpl): preserve escaped JSON string bytes by @fallintoplace in #889
fix(parquet/compress): Brotli CompressBound by @fallintoplace in #884
chore: Bump golang.org/x/net from 0.54.0 to 0.55.0 by @dependabot[bot] in #893
fix(parquet): align DataPageV2 pages to row boundaries in spaced writes by @truffle-dev in #883
fix(array): guard BinaryViewBuilder size checks by @fallintoplace in #888
fix: clarify StringViewBuilder UnmarshalJSON error message by @fallintoplace in #894
chore: Bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #912
chore: Bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot[bot] in #915
chore: Bump github.com/klauspost/cpuid/v2 from 2.3.0 to 2.4.0 by @dependabot[bot] in #914
fix: clarify StringViewBuilder.UnmarshalOne expected type by @fallintoplace in #897
chore: Bump github.com/klauspost/compress from 1.18.6 to 1.19.0 by @dependabot[bot] in #913
fix: guard multiBufferBuilder UnsafeAppend against short copy by @fallintoplace in #896
fix(array): make SetNull idempotent and track null count by @fallintoplace in #905
fix(ci): accept --json and pin gobenchdata by @fallintoplace in #906
build: verify Apache RAT jar checksum before execution by @fallintoplace in #908
fix(parquet): read full bloom filter buffers by @fallintoplace in #892
fix(docs): fix CPU markdown link in README by @fallintoplace in #907
fix(parquet): validate DataPageV2 decoded length by @fallintoplace in #911
fix(arreflect): validate primitive conversion assignment overflow checks by @fallintoplace in #903
fix(parquet): clamp repLevels in byte-array DataPageV2 row-boundary alignment by @zeroshade in #919
fix(parquet/metadata): fix BloomFilter memory recycling, doc contract, and benchmark by @Patzifist in #864
fix(flight/flightsql): recover real error when prepared DoPut stream closes early by @fornwall in #920
fix: guard protobuf oneof/union reflection on nil oneof values by @fallintoplace in #910
fix(parquet): copy ByteArray statistics min/max to prevent use-after-free by @zeroshade in #917
fix(array): bounds check FixedSizeBinary.Value by @fallintoplace in #923
fix(array): reject unsupported type IDs by @fallintoplace in #925
fix(array): validate JSON start offsets by @fallintoplace in #929
fix(scalar): validate dictionary indices before conversion by @fallintoplace in #927
fix(array): retain dictionary before replacement by @fallintoplace in #926
feat(parquet): opt-in streaming reads for large data pages by @joechenrh in #880
chore: Bump golang.org/x/sync from 0.21.0 to 0.22.0 by @dependabot[bot] in #934
chore: Bump github.com/apache/thrift from 0.22.0 to 0.24.0 by @dependabot[bot] in #932
chore: Bump golang.org/x/sys from 0.46.0 to 0.47.0 by @dependabot[bot] in #933
fix(parquet): propagate row-group and page-index write errors by @fallintoplace in #921
fix(array): honor struct offsets in constructors and validity masks by @fallintoplace in #922
fix(parquet): make column reader cleanup idempotent by @fallintoplace in #924
fix(scalar): hash list values logically by @fallintoplace in #928
fix(array): recursively validate nested arrays by @fallintoplace in #930
feat(parquet/variant): add Metadata.SizeBytes to split a concatenated variant by @nssalian in #939
fix(cdata): validate imported array sizes by @fallintoplace in #931
fix(avro): decode nullable logical timestamps by @abir-eon in #935
fix(flight/flightsql/example): support dictionary-encoded parameter columns by @fornwall in #936
fix(arrow/scalar): reject negative indices in GetScalar by @fornwall in #940
fix(flight): reject malformed unary bearer headers by @fallintoplace in #941
fix(flight): reject Basic credentials without a separator by @fallintoplace in #942
fix(memory): keep allocator ownership across Buffer.Reset by @fallintoplace in #947
fix(parquet): limit page allocations by @fallintoplace in #953
fix(parquet): return decompr

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

renovate-sh-app · 2026-07-16T16:01:57Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.26.1` -> `1.26.5`

| datasource | package | from | to | | ---------- | ---------------------------------------------------------------------------- | ---------------------------------- | ---------------------------------- | | go | github.com/apache/arrow-go/v18 | v18.5.2 | v18.7.0 | | go | github.com/bradleyfalzon/ghinstallation/v2 | v2.18.0 | v2.19.0 | | go | github.com/clipperhouse/displaywidth | v0.10.0 | v0.11.0 | | go | github.com/clipperhouse/uax29/v2 | v2.6.0 | v2.7.0 | | go | github.com/emicklei/go-restful/v3 | v3.11.0 | v3.13.0 | | go | github.com/fatih/color | v1.18.0 | v1.19.0 | | go | github.com/go-logr/logr | v1.4.3 | v1.4.4 | | go | github.com/go-openapi/jsonpointer | v0.22.5 | v0.24.0 | | go | github.com/go-openapi/jsonreference | v0.21.5 | v0.21.6 | | go | github.com/go-openapi/swag | v0.23.0 | v0.27.3 | | go | github.com/go-openapi/swag/jsonname | v0.25.5 | v0.27.3 | | go | github.com/goccy/go-json | v0.10.5 | v0.10.6 | | go | github.com/google/gnostic-models | v0.7.0 | v0.7.1 | | go | github.com/grafana/grafana-plugin-sdk-go | v0.291.1 | v0.294.0 | | go | github.com/grafana/otel-profiling-go | v0.5.1 | v0.6.0 | | go | github.com/grafana/pyroscope-go/godeltaprof | v0.1.9 | v0.1.12 | | go | github.com/grafana/schemads | v0.0.8 | v0.2.3 | | go | github.com/grpc-ecosystem/grpc-gateway/v2 | v2.28.0 | v2.29.0 | | go | github.com/hashicorp/go-plugin | v1.7.0 | v1.8.0 | | go | github.com/huandu/go-sqlbuilder | v1.39.1 | v1.42.1 | | go | github.com/huandu/xstrings | v1.4.0 | v1.5.0 | | go | github.com/jaegertracing/jaeger-idl | v0.6.0 | v0.9.0 | | go | github.com/klauspost/compress | v1.18.4 | v1.19.1 | | go | github.com/klauspost/cpuid/v2 | v2.3.0 | v2.4.0 | | go | github.com/magefile/mage | v1.16.1 | v1.17.2 | | go | github.com/mailru/easyjson | v0.7.7 | v0.9.2 | | go | github.com/mattn/go-colorable | v0.1.14 | v0.1.15 | | go | github.com/mattn/go-isatty | v0.0.20 | v0.0.24 | | go | github.com/mattn/go-runewidth | v0.0.19 | v0.0.27 | | go | github.com/oklog/run | v1.1.0 | v1.2.0 | | go | github.com/olekukonko/errors | v1.2.0 | v1.3.0 | | go | github.com/olekukonko/ll | v0.1.6 | v0.1.8 | | go | github.com/pierrec/lz4/v4 | v4.1.25 | v4.1.27 | | go | github.com/prometheus/client_golang | v1.23.2 | v1.24.1 | | go | github.com/prometheus/common | v0.67.5 | v0.70.1 | | go | github.com/prometheus/procfs | v0.16.1 | v0.21.1 | | go | github.com/shurcooL/graphql | v0.0.0-20220606043923-3cf50f8a0a29 | v0.0.0-20240915155400-7ee5256398cf | | go | go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc | v0.67.0 | v0.69.0 | | go | go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace | v0.67.0 | v0.69.0 | | go | go.opentelemetry.io/contrib/propagators/jaeger | v1.42.0 | v1.44.0 | | go | go.opentelemetry.io/contrib/samplers/jaegerremote | v0.36.0 | v0.37.1 | | go | go.opentelemetry.io/otel | v1.43.0 | v1.44.0 | | go | go.opentelemetry.io/otel/exporters/otlp/otlptrace | v1.42.0 | v1.44.0 | | go | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc | v1.42.0 | v1.44.0 | | go | go.opentelemetry.io/otel/metric | v1.43.0 | v1.44.0 | | go | go.opentelemetry.io/otel/sdk | v1.43.0 | v1.44.0 | | go | go.opentelemetry.io/otel/trace | v1.43.0 | v1.44.0 | | go | go.opentelemetry.io/proto/otlp | v1.9.0 | v1.11.0 | | go | go.yaml.in/yaml/v2 | v2.4.3 | v2.4.4 | | go | golang.org/x/mod | v0.37.0 | v0.38.0 | | go | golang.org/x/telemetry | v0.0.0-20260625142307-59b4966ccb57 | v0.0.0-20260717140457-bdb89881bb75 | | go | golang.org/x/tools | v0.47.0 | v0.48.0 | | go | google.golang.org/grpc | v1.79.3 | v1.82.1 | | go | k8s.io/kube-openapi | v0.0.0-20260127142750-a19766b6e2d4 | v0.0.0-20260721132016-d427ff9ee9ad | | go | pgregory.net/rapid | v1.2.0 | v1.3.0 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>

renovate-sh-app Bot requested a review from a team as a code owner July 16, 2026 16:01

renovate-sh-app Bot added automerge-patch automerge-security-update severity: update-minor update-patch labels Jul 16, 2026

renovate-sh-app Bot force-pushed the renovate/backend-dependencies branch 16 times, most recently from f365d1c to 602053e Compare July 24, 2026 10:01

renovate-sh-app Bot force-pushed the renovate/backend-dependencies branch 2 times, most recently from ca067cd to 50bfafc Compare July 25, 2026 01:02

renovate-sh-app Bot force-pushed the renovate/backend-dependencies branch 8 times, most recently from afddc7b to 43399a9 Compare July 27, 2026 07:03

renovate-sh-app Bot force-pushed the renovate/backend-dependencies branch from 43399a9 to 9e6658f Compare July 27, 2026 19:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update backend dependencies - #784

fix(deps): update backend dependencies#784
renovate-sh-app[bot] wants to merge 1 commit into
mainfrom
renovate/backend-dependencies

renovate-sh-app Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

renovate-sh-app Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate-sh-app Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Details

Severity

References

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Details

Impact

xDS RBAC Authorization Bypass via Metadata & RequestedServerName matchers

HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts

Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules

Patches

Workarounds

Severity

Severity

References

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Details

Impact

xDS RBAC Authorization Bypass via Metadata & RequestedServerName matchers

HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts

Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules

Patches

Workarounds

Severity

Severity

References

Release Notes

v18.7.0: Apache Arrow Go v18.7.0

What's Changed

Configuration

Need help?

Uh oh!

renovate-sh-app Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate-sh-app Bot commented Jul 16, 2026 •

edited

Loading

xDS RBAC Authorization Bypass via `Metadata` & `RequestedServerName` matchers

xDS RBAC Authorization Bypass via `Metadata` & `RequestedServerName` matchers

`v18.7.0`: Apache Arrow Go v18.7.0

renovate-sh-app Bot commented Jul 16, 2026 •

edited

Loading