Skip to content

deps: Bump the "all-dependencies" group with 1 update across multiple ecosystems - #452

Open
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/all_dependencies-71b98f3bc4
Open

deps: Bump the "all-dependencies" group with 1 update across multiple ecosystems#452
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/all_dependencies-71b98f3bc4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 10 updates:

Package From To
github.com/maximhq/bifrost/core 1.14.1 1.15.0
golang.org/x/sync 0.24.0 0.25.0
github.com/googleapis/enterprise-certificate-proxy 0.3.24 0.3.25
github.com/modelcontextprotocol/registry 1.8.7 1.8.8
github.com/pandatix/go-abnf 0.5.3 0.5.5
github.com/sigstore/sigstore 1.11.2 1.11.3
github.com/slack-go/slack 0.33.0 0.35.0
github.com/tidwall/gjson 1.20.0 1.20.1
github.com/tidwall/sjson 1.2.6 1.2.7
golang.org/x/arch 0.32.0 0.33.0

Updates github.com/maximhq/bifrost/core from 1.14.1 to 1.15.0

Release notes

Sourced from github.com/maximhq/bifrost/core's releases.

Core v1.15.0

Core Release v1.15.0

  • feat: mcp - per-user tool discovery: pluggable discovery store, per-caller tools, prompts and resources on the gateway, per-caller connect tool, Refresh tools, and an explicit pending_verification flag
  • feat: mcp - serve MCP Apps tools and ui:// resources on the gateway, keep app-only tools away from models, and accept tools by their upstream names
  • feat: mcp - relay input_required to gateway callers, forward callers' declared capabilities upstream, and log rounds by round_trip_id and MCP Apps use
  • feat: mcp - dial boot MCP clients in the background
  • feat: anthropic - workload identity federation for Anthropic and Anthropic-based keys
  • feat: accept SOCKS5 global proxies, trust the global proxy's CA, and always verify targets through a proxy
  • feat: record caller IP and user email on LLM, MCP and relay logs; bring relay logging to LLM log parity
  • feat: count containers started by OpenAI and Azure code interpreter and hosted shell and by Anthropic code execution on usage.tool_usage.container_sessions, including under previous_response_id and conversation
  • feat: openai - keep tool_usage.image_gen on Responses output with the image tool's model, and support prompt cache breakpoint TTL
  • feat: gemini - treat the Interactions agent as the model on /genai_passthrough and name it on poll records
  • feat: schemas - raw response formats and raw request/response text rewriters so plugins can edit streamed and passthrough payloads
  • fix: anthropic - keep message-level cache_control on chat messages, and map prompt cache breakpoints to cache_control for Anthropic and Bedrock (thanks @​Atharva-Kanherkar!)
  • fix: preserve explicitly reported zero token usage (thanks @​Constantine3!)
  • fix: anthropic - Claude Haiku 5.x takes reasoning effort as adaptive thinking plus output_config.effort, drops sampling params, and Anthropic-based custom providers read their base provider's capabilities (thanks @​macdod!)
  • fix: anthropic - Responses requests drop empty text blocks instead of failing with a 400 (thanks @​david-choi-querypie!)
  • fix: anthropic - preserve explicit web search and web fetch versions (thanks @​ykakade!)
  • fix: anthropic - keep source type on text documents with empty data; drop web_search and code_execution for Claude on Bedrock; run Codex's client tool search as the caller's own; replay invalid tool arguments as {}
  • fix: responses - merge re-declared additional tools instead of duplicating them after namespace flattening
  • fix: openai - keep content on Codex assistant messages with encrypted_content; keep the name on a function_call_output without call_id
  • fix: gemini - keep minted item ids under 64 characters and add ids to non-streamed reasoning items; bedrock mantle replay keeps them
  • fix: vllm and sglang - keep unsigned thinking blocks and replayed reasoning content; emit thinking deltas for raw reasoning_text events
  • fix: anthropic - streamed web_search blocks always carry the query
  • fix: bedrock - strip leaked DSML tags from DeepSeek V3.2; omit stopSequences for models that reject it
  • fix: databricks - strip the Anthropic-only safeguards param
  • fix: github copilot - serve tool search without the rejected beta header
  • fix: keep assistant text alongside tool calls when converting chat to Responses messages
  • fix: runware - poll the task when a sync request turns async
  • fix: multi-key providers - follow-up calls on a stored response, container or video find the key that created it; video list pages across every key
  • fix: routing rules fall back when the primary target returns 4xx
  • fix: run post-hooks for requests rejected before enqueue
  • fix: relays - match passthrough for headers and streams
  • fix: mcp - call upstream tools by exact name, keep tool error flags, log every code mode call in agent mode, apply tool_execution_timeout to code mode and in-process clients, and report the caller's deadline in timeout errors
  • fix: mcp - stop retrying permanent connect errors, refresh per-call credentials once on 401, keep failed enables unstable with the checker retrying, apply TLS/SSE/ping edits live, and check sooner after a failed reconnect
  • fix: mcp - return 400, 404 and 409 instead of 500 for client create, rename and reconnect mistakes

Installation

go get github.com/maximhq/bifrost/core@v1.15.0

This release was automatically created from version file: core/version

Commits
  • 8dd835b test fixes round 3 (#9708) --skip-core-test
  • d9f5ae0 test fixes round 3
  • 8543bff test case fixes (#9706) --skip-core-test
  • 16c4969 test case fixes
  • cc538ec fix: test case fixes (#9705) --skip-core-test
  • 4e7ed15 fix: test case fixes
  • 77698c2 v2.5.0 (#9436) --skip-core-test
  • 7694223 test(harness): fix the remaining stale case expectations (#9703)
  • 13d8925 test(harness): align stale case expectations with current gateway behavior (#...
  • 52e927e fix(schemas): keep a block's prompt_cache_breakpoint when chat is converted t...
  • Additional commits viewable in compare view

Updates golang.org/x/sync from 0.24.0 to 0.25.0

Commits

Updates github.com/googleapis/enterprise-certificate-proxy from 0.3.24 to 0.3.25

Release notes

Sourced from github.com/googleapis/enterprise-certificate-proxy's releases.

v0.3.25

What's Changed

Full Changelog: googleapis/enterprise-certificate-proxy@v0.3.24...v0.3.25

Commits
  • 4ed9cfa feat: Bump version from v0.3.24 to v0.3.25 (#236)
  • 8710c41 fix: bind http_proxy to loopback and require shared-secret auth on proxied re...
  • See full diff in compare view

Updates github.com/modelcontextprotocol/registry from 1.8.7 to 1.8.8

Release notes

Sourced from github.com/modelcontextprotocol/registry's releases.

v1.8.8

This release uses the source commit validated in staging. Different server names may now share a remote URL; consumers should key listings by server name and version rather than assuming URL uniqueness. No database migration is required.

What's Changed

Full Changelog: modelcontextprotocol/registry@v1.8.7...v1.8.8

Commits
  • d6b071e fix(deploy): refresh state before applying saved plans (#1810)
  • 02bc451 fix(deploy): restore normal staging and production release flow (#1809)
  • 38ddb10 build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.272.0 to 3.273.0 in ...
  • e2397a6 Allow remote URLs to be shared across server names (#1806)
  • 2729b4c fix(infra): promote security patches to production (#1803)
  • 7e52e83 fix(infra): constrain the new CRD reference in saved plans (#1804)
  • e17878f fix(infra): exclude completed admission hooks from saved-plan upgrades (#1802)
  • d57d326 fix(infra): qualify patched controllers and Grafana in staging (#1801)
  • c3b93b5 docs: clarify production preview access (#1800)
  • a48b6a7 Enable public listing compression and selective log retention in production (...
  • Additional commits viewable in compare view

Updates github.com/pandatix/go-abnf from 0.5.3 to 0.5.5

Release notes

Sourced from github.com/pandatix/go-abnf's releases.

v0.5.5

Changelog

  • fc74189cd4c343e15092ae6dd4c20b5030a50f06 Improve parsing efficiency with a lookahead, fix testdata and nullable elements validation (#277)

v0.5.4

Changelog

  • 4634a6745474ac50566f8920b59327cd23414e0e Update ClusterFuzzLite setup and keep fuzz files out of main package by default (#275)
Commits
  • fc74189 Improve parsing efficiency with a lookahead, fix testdata and nullable elemen...
  • 4634a67 Update ClusterFuzzLite setup and keep fuzz files out of main package by defau...
  • See full diff in compare view

Updates github.com/sigstore/sigstore from 1.11.2 to 1.11.3

Release notes

Sourced from github.com/sigstore/sigstore's releases.

v1.11.3

What's Changed

Full Changelog: sigstore/sigstore@v1.11.2...v1.11.3

Commits
  • cbad9db build(deps): Bump github.com/aws/aws-sdk-go-v2/service/kms (#2460)
  • 800062e build(deps): Bump google.golang.org/api in /pkg/signature/kms/gcp (#2461)
  • 142c004 build(deps): Bump the gomod group across 1 directory with 2 updates (#2459)
  • 87076ef build(deps): Bump cloud.google.com/go/kms in /pkg/signature/kms/gcp (#2462)
  • e7acb91 Fix GCP KMS PQC signing to verify correct CRC32 digest (#2464)
  • 9c10797 Add OpenBao e2e integration tests for the hashivault KMS (#2458)
  • See full diff in compare view

Updates github.com/slack-go/slack from 0.33.0 to 0.35.0

Release notes

Sourced from github.com/slack-go/slack's releases.

v0.35.0

This release fixes interaction payload spoofing, preserves huddle profile data, and corrects several message handling and 32-bit compatibility issues.

Upgrade notes

[!WARNING] slackevents.Profile has three new fields. Positional struct literals no longer compile. Convert them to keyed literals before upgrading.

Events API profiles now preserve huddle state, expiration, and call ID through HuddleState, HuddleStateExpirationTS, and HuddleStateCallID.

Use field names when constructing profiles:

profile := slackevents.Profile{
    DisplayName: "Alex",
    Team:        "T123ABC456",
}

Security

InteractionCallbackParse now reads payload exclusively from the form-encoded request body.

Previously, it could accept an unsigned URL query payload while the application verified a signature covering only the body. An attacker who obtained a valid signed request within the accepted timestamp window could replay it with a forged interaction payload.

Callers must supply payload in an application/x-www-form-urlencoded request body. Form parsing errors are now returned to the caller.

See GHSA-pj2x-fjjr-q84c. Thanks to @​jjiang-stripe for reporting the issue and providing the fix.

Fixes

  • Prevent repeated escaping and data races when reusing a MsgOptionText option.
  • Encode context block elements correctly when a block is passed by value.
  • Preserve plus signs and percent signs in slacktest message blocks and attachments.
  • Keep slacktest bot identities independent when generating RTM connection information.
  • Prevent retry jitter panics with large durations on 32-bit platforms.
  • Decode JSONTime timestamps outside the 32-bit integer range on 32-bit platforms.

Full changelog: v0.34.0…v0.35.0

v0.34.0

Huge thank you to Michal Mazurek (@​akfaew) for submitting a bunch of patches for this release.

Breaking changes — read before upgrading

[!WARNING] v0.34.0 includes breaking API, decoding, serialization, and event-dispatch changes.

**Your code may fail to compile. Code that still compiles may decode, serialize,

... (truncated)

Changelog

Sourced from github.com/slack-go/slack's changelog.

[0.35.0] - 2026-11-05

A big thank you to @​jjiang-stripe for the security find and fix!

Breaking changes (but mostly shouldn't affect anyone)

[!WARNING] slackevents.Profile now includes three huddle fields. Positional struct literals no longer compile. Use keyed literals when constructing a profile:

profile := slackevents.Profile{
  DisplayName: "Alex",
  Team:        "T123ABC456",
}

Security

  • InteractionCallbackParse no longer falls back to the URL query string for the payload field. A request's signature only covers its POST body, so the fallback let a validly-signed request be replayed with an attacker-controlled payload smuggled in via the query string. Callers must supply payload in an application/x-www-form-urlencoded request body. Form parsing errors are now returned to the caller.

Fixed

  • Prevent repeated escaping and data races when reusing a MsgOptionText option.
  • Preserve plus signs and percent signs in slacktest message blocks and attachments.
  • Encode context block elements as an array when a block is passed by value.
  • Keep slacktest bot identities independent when generating RTM connection information.
  • Preserve huddle state, expiration, and call ID in Events API user profiles as slackevents.Profile.HuddleState, HuddleStateExpirationTS, and HuddleStateCallID. These fields follow Slack's documented user_huddle_changed payload.
  • Fix retry jitter panics for large durations on 32-bit platforms.
  • Decode JSONTime timestamps outside the 32-bit integer range on 32-bit platforms.

[0.34.0] - 2026-11-03

Huge thank you to Michal Mazurek (@​akfaew) for submitting a bunch of patches for this release.

Breaking changes — read before upgrading

[!WARNING] v0.34.0 includes breaking API, decoding, serialization, and event-dispatch changes.

**Your code may fail to compile. Code that still compiles may decode, serialize,

... (truncated)

Commits

Updates github.com/tidwall/gjson from 1.20.0 to 1.20.1

Commits

Updates github.com/tidwall/sjson from 1.2.6 to 1.2.7

Commits

Updates golang.org/x/arch from 0.32.0 to 0.33.0

Commits
  • 4e08723 x86/x86asm: sign-extend 16- and 32-bit displacements
  • 6a31474 loong64: add SIMD instruction decode support
  • d4f50f4 loong64: add new tool to parse SIMD instruction information
  • b1b4ab7 arm/armasm: drop '$' from constant shift counts in GoSyntax
  • 2706cbc riscv64: fix c.j offset decoding
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the all-dependencies group with 10 updates
b3cc00c 
Bumps the all-dependencies group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/maximhq/bifrost/core](https://github.com/maximhq/bifrost) | `1.14.1` | `1.15.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.24.0` | `0.25.0` |
| [github.com/googleapis/enterprise-certificate-proxy](https://github.com/googleapis/enterprise-certificate-proxy) | `0.3.24` | `0.3.25` |
| [github.com/modelcontextprotocol/registry](https://github.com/modelcontextprotocol/registry) | `1.8.7` | `1.8.8` |
| [github.com/pandatix/go-abnf](https://github.com/pandatix/go-abnf) | `0.5.3` | `0.5.5` |
| [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) | `1.11.2` | `1.11.3` |
| [github.com/slack-go/slack](https://github.com/slack-go/slack) | `0.33.0` | `0.35.0` |
| [github.com/tidwall/gjson](https://github.com/tidwall/gjson) | `1.20.0` | `1.20.1` |
| [github.com/tidwall/sjson](https://github.com/tidwall/sjson) | `1.2.6` | `1.2.7` |
| [golang.org/x/arch](https://github.com/golang/arch) | `0.32.0` | `0.33.0` |


Updates `github.com/maximhq/bifrost/core` from 1.14.1 to 1.15.0
- [Release notes](https://github.com/maximhq/bifrost/releases)
- [Changelog](https://github.com/maximhq/bifrost/blob/dev/docs/release-cadence.mdx)
- [Commits](maximhq/bifrost@core/v1.14.1...core/v1.15.0)

Updates `golang.org/x/sync` from 0.24.0 to 0.25.0
- [Commits](golang/sync@v0.24.0...v0.25.0)

Updates `github.com/googleapis/enterprise-certificate-proxy` from 0.3.24 to 0.3.25
- [Release notes](https://github.com/googleapis/enterprise-certificate-proxy/releases)
- [Commits](googleapis/enterprise-certificate-proxy@v0.3.24...v0.3.25)

Updates `github.com/modelcontextprotocol/registry` from 1.8.7 to 1.8.8
- [Release notes](https://github.com/modelcontextprotocol/registry/releases)
- [Commits](modelcontextprotocol/registry@v1.8.7...v1.8.8)

Updates `github.com/pandatix/go-abnf` from 0.5.3 to 0.5.5
- [Release notes](https://github.com/pandatix/go-abnf/releases)
- [Commits](pandatix/go-abnf@v0.5.3...v0.5.5)

Updates `github.com/sigstore/sigstore` from 1.11.2 to 1.11.3
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.11.2...v1.11.3)

Updates `github.com/slack-go/slack` from 0.33.0 to 0.35.0
- [Release notes](https://github.com/slack-go/slack/releases)
- [Changelog](https://github.com/slack-go/slack/blob/master/CHANGELOG.md)
- [Commits](slack-go/slack@v0.33.0...v0.35.0)

Updates `github.com/tidwall/gjson` from 1.20.0 to 1.20.1
- [Commits](tidwall/gjson@v1.20.0...v1.20.1)

Updates `github.com/tidwall/sjson` from 1.2.6 to 1.2.7
- [Commits](tidwall/sjson@v1.2.6...v1.2.7)

Updates `golang.org/x/arch` from 0.32.0 to 0.33.0
- [Commits](golang/arch@v0.32.0...v0.33.0)

---
updated-dependencies:
- dependency-name: github.com/maximhq/bifrost/core
  dependency-version: 1.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: github.com/googleapis/enterprise-certificate-proxy
  dependency-version: 0.3.25
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: github.com/modelcontextprotocol/registry
  dependency-version: 1.8.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: github.com/pandatix/go-abnf
  dependency-version: 0.5.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: github.com/sigstore/sigstore
  dependency-version: 1.11.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: github.com/slack-go/slack
  dependency-version: 0.35.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: github.com/tidwall/gjson
  dependency-version: 1.20.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: github.com/tidwall/sjson
  dependency-version: 1.2.7
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: golang.org/x/arch
  dependency-version: 0.33.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 9, 2026
@coderabbitai

coderabbitai Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 0508ac26-84c4-4baa-9771-d00223c8e7ec

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-09T15:38:32.360240Z 9f479cc New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

0xh0b0 added 2 commits November 9, 2026 15:31
@0xh0b0
fix(llm): build Bifrost 1.15 and hoist its Anthropic key config
1c83627 
Bifrost core 1.15.0 calls mcp-go's client.WithRequestClientCapabilities,
which only exists in Bifrost's own mcp-go fork. Bifrost pulls the fork in
through a replace directive in its go.mod, and Go ignores replace
directives in dependencies, so our build selected mark3labs/mcp-go v1.5.0
and failed to compile. go.mod now carries the same replace, and
gomoddirectives allows exactly that module.

1.15.0 also adds AnthropicKeyConfig for workload identity federation,
which failed TestProviderEntry_HoistsEveryKeyConfig. It is hoisted as
llm.anthropic and folded by all three alias chains. When
workload_identity is set, ANTHROPIC_API_KEY is not read: Bifrost sends a
non-empty key value as x-api-key and skips the federation, the same trap
llm.oauth already guards against.

The ValidateKeyConfigs comment is re-cited against 1.15.0. docs/proxy.md
notes that the Anthropic exchange follows proxy_config rather than
HTTPS_PROXY.
@0xh0b0
docs(providers): narrow the anthropic workload identity failure note
9f479cc

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@0xh0b0