Open
Conversation
Bumps the bundler group with 2 updates in the /integration/examples/ruby/backend directory: [rack](https://github.com/rack/rack) and [puma](https://github.com/puma/puma). Bumps the bundler group with 2 updates in the /examples/ruby/backend directory: [rack](https://github.com/rack/rack) and [puma](https://github.com/puma/puma). Updates `rack` from 2.2.6.4 to 2.2.20 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.6.4...v2.2.20) Updates `puma` from 5.6.8 to 5.6.9 - [Release notes](https://github.com/puma/puma/releases) - [Changelog](https://github.com/puma/puma/blob/main/History.md) - [Commits](puma/puma@v5.6.8...v5.6.9) Updates `rack` from 2.2.6.4 to 2.2.20 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.6.4...v2.2.20) Updates `puma` from 5.6.8 to 5.6.9 - [Release notes](https://github.com/puma/puma/releases) - [Changelog](https://github.com/puma/puma/blob/main/History.md) - [Commits](puma/puma@v5.6.8...v5.6.9) --- updated-dependencies: - dependency-name: rack dependency-version: 2.2.20 dependency-type: direct:production dependency-group: bundler - dependency-name: puma dependency-version: 5.6.9 dependency-type: direct:production dependency-group: bundler - dependency-name: rack dependency-version: 2.2.20 dependency-type: direct:production dependency-group: bundler - dependency-name: puma dependency-version: 5.6.9 dependency-type: direct:production dependency-group: bundler ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the go_modules group with 2 updates in the /hack/tools directory: [golang.org/x/crypto](https://github.com/golang/crypto) and [golang.org/x/oauth2](https://github.com/golang/oauth2). Bumps the go_modules group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.17.0` | `0.45.0` | | [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.13.0` | `0.27.0` | | [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.11.0` | `5.13.0` | | [github.com/golang/glog](https://github.com/golang/glog) | `1.1.2` | `1.2.4` | | [github.com/moby/buildkit](https://github.com/moby/buildkit) | `0.11.6` | `0.12.5` | | google.golang.org/protobuf | `1.31.0` | `1.33.0` | | gopkg.in/go-jose/go-jose.v2 | `2.6.1` | `2.6.3` | | [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) | `4.5.0` | `4.5.2` | Bumps the go_modules group with 2 updates in the /integration/examples/grpc-e2e-tests/service directory: [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/oauth2](https://github.com/golang/oauth2). Bumps the go_modules group with 2 updates in the /integration/examples/grpc-e2e-tests/cloud-spanner-bootstrap directory: [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/oauth2](https://github.com/golang/oauth2). Bumps the go_modules group with 2 updates in the /examples/grpc-e2e-tests/service directory: [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/oauth2](https://github.com/golang/oauth2). Bumps the go_modules group with 2 updates in the /examples/grpc-e2e-tests/cloud-spanner-bootstrap directory: [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/oauth2](https://github.com/golang/oauth2). Updates `golang.org/x/crypto` from 0.17.0 to 0.45.0 - [Commits](golang/crypto@v0.17.0...v0.45.0) Updates `golang.org/x/net` from 0.17.0 to 0.47.0 - [Commits](golang/net@v0.17.0...v0.38.0) Updates `golang.org/x/oauth2` from 0.0.0-20190604053449-0f29369cfe45 to 0.27.0 - [Commits](https://github.com/golang/oauth2/commits/v0.27.0) Updates `golang.org/x/crypto` from 0.17.0 to 0.45.0 - [Commits](golang/crypto@v0.17.0...v0.45.0) Updates `golang.org/x/net` from 0.19.0 to 0.47.0 - [Commits](golang/net@v0.17.0...v0.38.0) Updates `golang.org/x/oauth2` from 0.13.0 to 0.27.0 - [Commits](https://github.com/golang/oauth2/commits/v0.27.0) Updates `github.com/go-git/go-git/v5` from 5.11.0 to 5.13.0 - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.11.0...v5.13.0) Updates `github.com/golang/glog` from 1.1.2 to 1.2.4 - [Release notes](https://github.com/golang/glog/releases) - [Commits](golang/glog@v1.1.2...v1.2.4) Updates `github.com/moby/buildkit` from 0.11.6 to 0.12.5 - [Release notes](https://github.com/moby/buildkit/releases) - [Commits](moby/buildkit@v0.11.6...v0.12.5) Updates `google.golang.org/protobuf` from 1.31.0 to 1.33.0 Updates `gopkg.in/go-jose/go-jose.v2` from 2.6.1 to 2.6.3 Updates `github.com/cloudflare/circl` from 1.3.3 to 1.3.7 - [Release notes](https://github.com/cloudflare/circl/releases) - [Commits](cloudflare/circl@v1.3.3...v1.3.7) Updates `github.com/golang-jwt/jwt/v4` from 4.5.0 to 4.5.2 - [Release notes](https://github.com/golang-jwt/jwt/releases) - [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md) - [Commits](golang-jwt/jwt@v4.5.0...v4.5.2) Updates `golang.org/x/net` from 0.17.0 to 0.38.0 - [Commits](golang/net@v0.17.0...v0.38.0) Updates `golang.org/x/oauth2` from 0.7.0 to 0.27.0 - [Commits](https://github.com/golang/oauth2/commits/v0.27.0) Updates `google.golang.org/protobuf` from 1.30.0 to 1.36.10 Updates `golang.org/x/net` from 0.17.0 to 0.38.0 - [Commits](golang/net@v0.17.0...v0.38.0) Updates `golang.org/x/oauth2` from 0.7.0 to 0.27.0 - [Commits](https://github.com/golang/oauth2/commits/v0.27.0) Updates `google.golang.org/protobuf` from 1.30.0 to 1.36.10 Updates `golang.org/x/net` from 0.17.0 to 0.38.0 - [Commits](golang/net@v0.17.0...v0.38.0) Updates `golang.org/x/oauth2` from 0.7.0 to 0.27.0 - [Commits](https://github.com/golang/oauth2/commits/v0.27.0) Updates `google.golang.org/protobuf` from 1.30.0 to 1.36.10 Updates `golang.org/x/net` from 0.17.0 to 0.38.0 - [Commits](golang/net@v0.17.0...v0.38.0) Updates `golang.org/x/oauth2` from 0.7.0 to 0.27.0 - [Commits](https://github.com/golang/oauth2/commits/v0.27.0) Updates `google.golang.org/protobuf` from 1.30.0 to 1.36.10 --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.47.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/oauth2 dependency-version: 0.27.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: direct:production dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.47.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/oauth2 dependency-version: 0.27.0 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.13.0 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/golang/glog dependency-version: 1.2.4 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/moby/buildkit dependency-version: 0.12.5 dependency-type: direct:production dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-version: 1.33.0 dependency-type: direct:production dependency-group: go_modules - dependency-name: gopkg.in/go-jose/go-jose.v2 dependency-version: 2.6.3 dependency-type: direct:production dependency-group: go_modules - dependency-name: github.com/cloudflare/circl dependency-version: 1.3.7 dependency-type: indirect dependency-group: go_modules - dependency-name: github.com/golang-jwt/jwt/v4 dependency-version: 4.5.2 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.38.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/oauth2 dependency-version: 0.27.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-version: 1.36.10 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.38.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/oauth2 dependency-version: 0.27.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-version: 1.36.10 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.38.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/oauth2 dependency-version: 0.27.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-version: 1.36.10 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/net dependency-version: 0.38.0 dependency-type: indirect dependency-group: go_modules - dependency-name: golang.org/x/oauth2 dependency-version: 0.27.0 dependency-type: indirect dependency-group: go_modules - dependency-name: google.golang.org/protobuf dependency-version: 1.36.10 dependency-type: indirect dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>
…s/go_modules-5fb714c104 chore: bump the go_modules group across 6 directories with 10 updates
…examples/ruby/backend/bundler-096d4fe7ad chore: bump the bundler group across 2 directories with 2 updates
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
Author
|
@copilot |
Contributor
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request primarily focuses on upgrading core dependencies and introducing new cryptographic features. It updates the Go language version and numerous libraries to their latest stable releases, ensuring the project benefits from recent improvements and security patches. A major part of the changes involves integrating advanced OpenPGP features, enhancing the security and robustness of cryptographic operations. Additionally, filesystem interaction utilities have been modernized for improved safety and reliability. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request primarily consists of a large number of dependency updates across various go.mod and go.sum files, as well as a Gemfile.lock. The Go version is also bumped to 1.24.0.
Beyond dependency management, there are significant updates to vendored libraries, notably github.com/ProtonMail/go-crypto and github.com/go-git/go-git.
The changes in go-crypto introduce support for modern cryptographic algorithms and OpenPGP v6 keys, including new formats for encrypted keys and signatures. This involves substantial refactoring to accommodate these new features, such as making CRC checksums optional in armored data and adding context propagation.
The updates to go-git include correctness fixes, performance optimizations, and new features like git restore functionality, improved worktree status strategies, and support for partial clones via filters. There are also several security and robustness improvements, such as sanitizing author information in commits and more careful handling of file paths and system calls.
A significant addition is the pathrs-lite package within the vendored filepath-securejoin library, which provides safer, race-free alternatives for filesystem operations on Linux, inspired by libpathrs.
Overall, the changes appear to be a mix of routine maintenance, feature enhancements, and correctness/security improvements. The new features are substantial and seem to be implemented correctly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes: #nnn
Related: Relevant tracking issues, for context
Merge before/after: Dependent or prerequisite PRs
Description
User facing changes (remove if N/A)
Follow-up Work (remove if N/A)