chore: deps bump 2026 07 09

.github/workflows/cluster.yml

@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build cluster image
         run: |

.github/workflows/docs.yml

@@ -25,7 +25,7 @@ on:
       - "cmd/hypercache-server/README.md"
       - ".github/workflows/docs.yml"
   push:
-    branches: [ main ]
+    branches: [main]
     paths:
       - "docs/**"
       - "mkdocs.yml"
@@ -54,9 +54,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
-          fetch-depth: 0  # docs/ may reference files via relative paths
+          # docs/ may reference files via relative paths
+          fetch-depth: 0
 
       - name: Setup Python
         uses: actions/setup-python@v6

.github/workflows/gitleaks.yml

@@ -15,7 +15,7 @@ jobs:
         name: gitleaks
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@v7
               with:
                   fetch-depth: 0
             - uses: gitleaks/gitleaks-action@v3

.github/workflows/go.yml

@@ -10,7 +10,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Load project settings
         id: settings
         run: |
@@ -23,7 +23,7 @@ jobs:
           echo "proto_enabled=${PROTO_ENABLED:-true}" >> "$GITHUB_OUTPUT"
 
       - name: Set up Go
-        uses: actions/setup-go@v6.1.0
+        uses: actions/setup-go@v6.5.0
         with:
           go-version: "${{ steps.settings.outputs.go_version }}"
           check-latest: true

.github/workflows/image.yml

@@ -17,8 +17,8 @@ name: image
 on:
   pull_request:
   push:
-    branches: [ main ]
-    tags: [ "v*.*.*" ]
+    branches: [main]
+    tags: ["v*.*.*"]
   workflow_dispatch:
 
 permissions:
@@ -31,13 +31,14 @@ env:
 
 jobs:
   build:
-    name: build${{ github.event_name == 'pull_request' && ' (no push)' || ' + push'
+    name:
+      build${{ github.event_name == 'pull_request' && ' (no push)' || ' + push'
       }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
@@ -51,7 +52,7 @@ jobs:
       # avoids an avoidable failure on those events.
       - name: Log in to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4.2.0
+        uses: docker/login-action@v4.4.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -83,7 +84,7 @@ jobs:
             latest=false
 
       - name: Build${{ github.event_name == 'pull_request' && '' || ' + push' }}
-        uses: docker/build-push-action@v7.2.0
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           file: cmd/hypercache-server/Dockerfile

.github/workflows/lint.yml

@@ -4,14 +4,14 @@ name: lint
 on:
   pull_request:
   push:
-    branches: [ main ]
+    branches: [main]
 permissions:
   contents: read
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Load project settings
         id: settings
         run: |
@@ -55,7 +55,8 @@ jobs:
           "./pkg/api/*" -not -path "./vendor/*" -not -path "./.gocache/*" -not
           -path "./.git/*")
       - name: gofumpt
-        run: gofumpt -l -w $(find . -type f -name '*.go' -not -path "./pkg/api/*" -not
+        run:
+          gofumpt -l -w $(find . -type f -name '*.go' -not -path "./pkg/api/*" -not
           -path "./vendor/*" -not -path "./.gocache/*" -not -path "./.git/*")
       - name: staticcheck
         run: staticcheck ./...

.github/workflows/openapi.yml

@@ -22,7 +22,7 @@ on:
       - "cmd/hypercache-server/main.go"
       - ".github/workflows/openapi.yml"
   push:
-    branches: [ main ]
+    branches: [main]
     paths:
       - "cmd/hypercache-server/openapi.yaml"
       - "cmd/hypercache-server/openapi.go"
@@ -39,7 +39,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Setup Node
         uses: actions/setup-node@v6
@@ -57,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Load project settings
         id: settings

.github/workflows/release.yml

@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Fetch the full history so the auto-notes generator can
           # diff against the previous tag.

.github/workflows/security.yml

@@ -12,7 +12,7 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Load project settings
         id: settings
         run: |

.github/workflows/test.yml

@@ -10,7 +10,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Load project settings
         id: settings
         run: |
@@ -40,7 +40,7 @@ jobs:
           go test -race -count=10 -shuffle=on -timeout=15m
           -coverprofile=coverage.out ./...
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: coverage
           path: coverage.out

.golangci.yaml

@@ -42,7 +42,7 @@ run:
   # Define the Go version limit.
   # Mainly related to generics support since go1.18.
   # Default: use Go version from the go.mod file, fallback on the env var `GOVERSION`, fallback on 1.17
-  go: "1.26.4"
+  go: "1.26.5"
 
 linters:
   # Enable specific linter
@@ -161,16 +161,16 @@ linters:
         - name: cognitive-complexity
           severity: warning
           disabled: false
-          arguments: [ 15 ]
+          arguments: [15]
 
         - name: cyclomatic
-          arguments: [ 15 ]
+          arguments: [15]
 
         # - name: function-length
         #   arguments: [80, 0]
 
         - name: max-public-structs
-          arguments: [ 10 ]
+          arguments: [10]
 
         - name: nested-structs
           disabled: true
@@ -179,7 +179,7 @@ linters:
           disabled: true
 
         - name: line-length-limit
-          arguments: [ 150 ]
+          arguments: [150]
 
         - name: var-naming
           disabled: true

.pre-commit-config.yaml

@@ -41,7 +41,7 @@ repos:
     hooks:
       - id: hadolint-docker
   - repo: https://github.com/streetsidesoftware/cspell-cli
-    rev: v10.0.0
+    rev: v10.0.1
     hooks:
       # Spell check changed files
       - id: cspell
@@ -57,7 +57,7 @@ repos:
         stages: [ commit-msg ]
         always_run: true
   - repo: https://github.com/markdownlint/markdownlint.git
-    rev: v0.15.0
+    rev: v0.17.0
     hooks:
       - id: markdownlint
         name: Markdownlint

.pre-commit/unit-test-hook

@@ -21,7 +21,7 @@ hook() {
 	local root_dir
 	root_dir=$(git rev-parse --show-toplevel)
 
-	local toolchain_version="1.26.4"
+	local toolchain_version="1.26.5"
 	if [[ -f "${root_dir}/.project-settings.env" ]]; then
 		# shellcheck disable=SC1090
 		source "${root_dir}/.project-settings.env"

.project-settings.env

@@ -1,5 +1,5 @@
 GOLANGCI_LINT_VERSION=v2.12.2
 BUF_VERSION=v1.70.0
-GO_VERSION=1.26.4
+GO_VERSION=1.26.5
 GCI_PREFIX=github.com/hyp3rd/hypercache
 PROTO_ENABLED=false

Makefile

@@ -2,7 +2,7 @@ include .project-settings.env
 
 GOLANGCI_LINT_VERSION ?= v2.12.2
 BUF_VERSION ?= v1.70.0
-GO_VERSION ?= 1.26.4
+GO_VERSION ?= 1.26.5
 GCI_PREFIX ?= github.com/hyp3rd/hypercache
 PROTO_ENABLED ?= true
 

go.mod

@@ -1,13 +1,13 @@
 module github.com/hyp3rd/hypercache
 
-go 1.26.4
+go 1.26.5
 
 require (
 	github.com/cespare/xxhash/v2 v2.3.0
-	github.com/coreos/go-oidc/v3 v3.19.0
+	github.com/coreos/go-oidc/v3 v3.20.0
 	github.com/go-jose/go-jose/v4 v4.1.4
 	github.com/goccy/go-json v0.10.6
-	github.com/gofiber/fiber/v3 v3.3.0
+	github.com/gofiber/fiber/v3 v3.4.0
 	github.com/hyp3rd/ewrap v1.5.1
 	github.com/hyp3rd/sectools v1.2.8
 	github.com/redis/go-redis/v9 v9.21.0
@@ -18,31 +18,31 @@ require (
 	go.opentelemetry.io/otel/sdk v1.44.0
 	go.opentelemetry.io/otel/sdk/metric v1.44.0
 	go.opentelemetry.io/otel/trace v1.44.0
-	golang.org/x/crypto v0.53.0
+	golang.org/x/crypto v0.54.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.21.0
+	golang.org/x/sync v0.22.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
-	github.com/andybalholm/brotli v1.2.1 // indirect
+	github.com/andybalholm/brotli v1.2.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/gofiber/schema v1.8.0 // indirect
-	github.com/gofiber/utils/v2 v2.1.0 // indirect
+	github.com/gofiber/schema v1.8.1 // indirect
+	github.com/gofiber/utils/v2 v2.1.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/klauspost/compress v1.19.0 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect
 	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/tinylib/msgp v1.6.4 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
-	github.com/valyala/fasthttp v1.71.0 // indirect
+	github.com/valyala/fasthttp v1.72.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
 )