Skip to content

build(deps): bump the go-mod group across 1 directory with 3 updates#686

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/go-mod-9b00e86085
Open

build(deps): bump the go-mod group across 1 directory with 3 updates#686
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/go-mod-9b00e86085

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 1, 2026

Bumps the go-mod group with 3 updates in the / directory: github.com/authzed/spicedb, github.com/mark3labs/mcp-go and github.com/rs/zerolog.

Updates github.com/authzed/spicedb from 1.51.2-0.20260429171948-76fc1537501e to 1.52.0

Release notes

Sourced from github.com/authzed/spicedb's releases.

v1.52.0

What's changed

Added

  • Added support for YAML-based validation files in DevContext (authzed/spicedb#3024)
  • Added support for YAML-based validation files in the Language Server (authzed/spicedb#3024)
  • Enable statistics-based optimizations when --experimental-query-plan is enabled. (authzed/spicedb#3052)
  • Added missing implementations of cursoring for LookupResource, LookupSubjects and ReadRelationships calls in FDW (authzed/spicedb#3016)
  • Add new gRPC Dispatch API and messages for dispatching query plans (authzed/spicedb#3072)
  • Support new withDebug flag in LookupResources calls to identify cycles (authzed/spicedb#3070)

Changed

Fixed

  • Improved error message when expiration is written before caveat in a relationship (authzed/spicedb#3071)
  • On a Postgres setup with read replicas, some requests may silently swallow errors of sort "revision not found in replica" (authzed/spicedb#2979)
  • Use cgroup-aware memory detection for cache and watch buffer sizing in containerized environments (authzed/spicedb#3000)
  • Upgraded the spanner client, which changed the internal implementation to not use a session pool. This means that the --datastore-spanner-max-sessions and --datastore-spanner-min-sessions flags are now deprecated and no-op. We also strongly recommend using Application Default Credentials in favor of a credentials file. (authzed/spicedb#3038)
  • Query Planner: error "ERROR: index \"pk_relation_tuple\" cannot be used for this query (SQLSTATE 42809)" returned when using wildcards (authzed/spicedb#3039)
  • Providing one of (--grpc-tls-cert-path, --grpc-tls-key-path) but not the other is now considered an error state, as both are necessary if you want to use TLS.
  • In a caveat context that uses nested lists of lists, the hashes generated for cache keys could collide because of an issue with the serialization logic. The serialization now uses deterministic protobuf serialization which avoids this issue (authzed/spicedb#3065)
Changelog

Sourced from github.com/authzed/spicedb's changelog.

[1.52.0] - 2026-04-30

Added

  • Added support for YAML-based validation files in DevContext (authzed/spicedb#3024)
  • Added support for YAML-based validation files in the Language Server (authzed/spicedb#3024)
  • Enable statistics-based optimizations when --experimental-query-plan is enabled. (authzed/spicedb#3052)
  • Added missing implementations of cursoring for LookupResource, LookupSubjects and ReadRelationships calls in FDW (authzed/spicedb#3016)
  • Add new gRPC Dispatch API and messages for dispatching query plans (authzed/spicedb#3072)
  • Support new withDebug flag in LookupResources calls to identify cycles (authzed/spicedb#3070)

Changed

Fixed

  • Improved error message when expiration is written before caveat in a relationship (authzed/spicedb#3071)
  • On a Postgres setup with read replicas, some requests may silently swallow errors of sort "revision not found in replica" (authzed/spicedb#2979)
  • Use cgroup-aware memory detection for cache and watch buffer sizing in containerized environments (authzed/spicedb#3000)
  • Upgraded the spanner client, which changed the internal implementation to not use a session pool. This means that the --datastore-spanner-max-sessions and --datastore-spanner-min-sessions flags are now deprecated and no-op. We also strongly recommend using Application Default Credentials in favor of a credentials file. (authzed/spicedb#3038)
  • Query Planner: error "ERROR: index \"pk_relation_tuple\" cannot be used for this query (SQLSTATE 42809)" returned when using wildcards (authzed/spicedb#3039)
  • Providing one of (--grpc-tls-cert-path, --grpc-tls-key-path) but not the other is now considered an error state, as both are necessary if you want to use TLS.
  • In a caveat context that uses nested lists of lists, the hashes generated for cache keys could collide because of an issue with the serialization logic. The serialization now uses deterministic protobuf serialization which avoids this issue (authzed/spicedb#3065)

[1.51.1] - 2026-04-14

Fixed

[1.51.0] - 2026-03-24 [YANKED]

⚠️ Warning: Due to CVE-2026-40091, please use v1.51.1.

Changed

Fixed

  • Fix duplicate diagnostics in LSP server when VS Code pulls diagnostics (authzed/spicedb#2977)
  • In DevContext's schema position mapper, only the first occurrence of a caveat parameter could be found (authzed/spicedb#2972)
  • Fix increase in memory usage brought in v1.50.0 due to replacing protoc-gen-validate with protovalidate (authzed/spicedb#2984)

[1.50.0] - 2026-03-19 [YANKED]

⚠️ Warning: Due to an increase in memory usage and CVE-2026-40091, please use v1.51.1.

Added

  • New pkg/query/queryopt package for building optimizations into the query plan

Changed

  • Updated CI so that Postgres tests run against v18 which is GA and not against v13 which is EOL (authzed/spicedb#2926)
  • Added tracing to request validation (authzed/spicedb#2950)
  • Query Planner optimization: in Check requests, prune branches that cannot lead to the subject type specified (authzed/spicedb#2968)
  • Added lr and ls to --experimental-query-plan for those endpoints, as well as in-memory statistics for optimizing the plans (authzed/spicedb#2929)

... (truncated)

Commits

Updates github.com/mark3labs/mcp-go from 0.46.0 to 0.50.0

Release notes

Sourced from github.com/mark3labs/mcp-go's releases.

Release v0.50.0

No release notes provided.

Release v0.49.0

No release notes provided.

Release v0.48.0

No release notes provided.

Release v0.47.1

What's Changed

New Contributors

Full Changelog: mark3labs/mcp-go@v0.47.0...v0.47.1

Release v0.47.0

What's Changed

New Contributors

Full Changelog: mark3labs/mcp-go@v0.46.0...v0.47.0

Commits
  • 62f00b7 Merge branch 'main' of github.com:mark3labs/mcp-go
  • b1c82f0 feat(server): opt-in input schema validation per SEP-1303 (#834)
  • e206095 feat: add ListPrompts and ListResources methods (#831)
  • dc2ea91 fix(examples): redirect hook output to stderr in everything server (#828)
  • 994ab43 Handle non-compliant JSON-RPC error responses where error is a string (#825)
  • c48486c feat: add WithInteger and WithIntegerItems options (#805)
  • a442928 fmt
  • 092e9be feat: implement RFC9728 OAuth Protected Resource Metadata discovery (take 2) ...
  • 6de0d29 fix(server): improve response codes for sampling errors (#764)
  • 118ac92 fix: return error for non-object entries in tool_result content array (#819)
  • Additional commits viewable in compare view

Updates github.com/rs/zerolog from 1.34.0 to 1.35.1

Commits
  • 116c806 event: restore Err() logging when ErrorStackMarshaler returns nil (#763)
  • 1396655 Bump CI Go matrix minimum from 1.21 to 1.23
  • 4b65a2f Bump actions/cache from 4 to 5 (#741)
  • b835796 Bump actions/setup-go from 5 to 6 (#742)
  • 134caf8 Added sanitization of journald keys (#751)
  • e133b6a Added variadic StrsV, ObjectsV, and StringersV (#752)
  • 82017d8 Bump github.com/coreos/go-systemd/v22 from 22.6.0 to 22.7.0 (#753)
  • 2f5b8a9 fix: UpdateContext skips Nop and zero-value loggers (#754)
  • d64c9a7 Add slog.Handler implementation for zerolog (#755)
  • a0d61dc fix: return dict to Event pool (#749)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-mod group with 3 updates in the / directory: [github.com/authzed/spicedb](https://github.com/authzed/spicedb), [github.com/mark3labs/mcp-go](https://github.com/mark3labs/mcp-go) and [github.com/rs/zerolog](https://github.com/rs/zerolog).


Updates `github.com/authzed/spicedb` from 1.51.2-0.20260429171948-76fc1537501e to 1.52.0
- [Release notes](https://github.com/authzed/spicedb/releases)
- [Changelog](https://github.com/authzed/spicedb/blob/main/CHANGELOG.md)
- [Commits](https://github.com/authzed/spicedb/commits/v1.52.0)

Updates `github.com/mark3labs/mcp-go` from 0.46.0 to 0.50.0
- [Release notes](https://github.com/mark3labs/mcp-go/releases)
- [Commits](mark3labs/mcp-go@v0.46.0...v0.50.0)

Updates `github.com/rs/zerolog` from 1.34.0 to 1.35.1
- [Commits](rs/zerolog@v1.34.0...v1.35.1)

---
updated-dependencies:
- dependency-name: github.com/authzed/spicedb
  dependency-version: 1.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: github.com/mark3labs/mcp-go
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: github.com/rs/zerolog
  dependency-version: 1.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the area/dependencies Affects dependencies label May 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/dependencies Affects dependencies

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants