chore: update dependencies

[renovate]

Update Request | Renovate Bot

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
github.com/cenkalti/backoff/v4	v4.3.0 → v7.0.0					require	major
github.com/planetscale/vtprotobuf	0393e58 → 8ae5a48					require	digest
github.com/stretchr/testify	v1.11.1 → v1.12.1					require	minor
google.golang.org/grpc	v1.83.0 → v1.83.1					require	patch

---

Release Notes

cenkalti/backoff (github.com/cenkalti/backoff/v4)

v7.0.0

Compare Source

v6.0.1

Compare Source

v6.0.0

Compare Source

v5.0.3

Compare Source

v5.0.2

Compare Source

v5.0.1

Compare Source

v5.0.0

Compare Source

stretchr/testify (github.com/stretchr/testify)

v1.12.1

Compare Source

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in #​1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in #​1772

New Contributors

• @​harryzcy made their first contribution in #​1935
• @​boekkooi-impossiblecloud made their first contribution in #​1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in #​1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in #​1772

New Contributors

• @​harryzcy made their first contribution in #​1935
• @​boekkooi-impossiblecloud made their first contribution in #​1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

Compare Source

What's Changed

Functional Changes

• assert: make *AssertionFunc types just aliases by @​dolmen in #​1563

Fixes

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in #​1775
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in #​1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in #​1665
• assert.PanicsWithError: report error message by @​olivergondza in #​1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in #​1787
• add type to error message of assert.Same by @​egawata in #​1792
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in #​1795
• assert: truncate very long objects in test failure messages by @​brackendawson in #​1646
• assert: fix NotSubset error messages using %#v instead of %q (fixes #​1800) by @​nghiack7 in #​1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in #​1877

Documentation, Build & CI

• CI: test also with Go 1.23 by @​dolmen in #​1783
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in #​1708
• Promote ccoVeille to maintainer by @​brackendawson in #​1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in #​1790
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in #​1791
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in #​1782
• doc: remove ineffective inline code blocks by @​brackendawson in #​1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in #​1815
• chore: vendor go-spew from https://github.com/davecgh/go-spew by @​ccoVeille in #​1827
• require: fix godoc generation for assertions returning a bool by @​Baxromumarov in #​1850
• docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by @​a2not in #​1821
• docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by @​a2not in #​1842
• EMERITUS.md: add @​tylerb by @​dolmen in #​1812
• CI: test also with Go 1.24 by @​alexandear in #​1856
• deps: bump objx to v0.5.3 and remove dependency cycle issue by @​ccoVeille in #​1823
• CI: upgrade GitHub Actions and pin hashes by @​SuperQ in #​1883
• CI: add _readme-gofmt tool to reformat Go code in README by @​dolmen in #​1889
• CI: add check of GitHub Action pinned hashes against tag by @​dolmen in #​1885
• _codegen: modernize by @​dolmen in #​1890
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​1906
• mock: Mock.Return does not exist anymore by @​Kentzo in #​1905

New Contributors

• @​mutaiib made their first contribution in #​1775
• @​vyas-git made their first contribution in #​1665
• @​olivergondza made their first contribution in #​1400
• @​egawata made their first contribution in #​1792
• @​ubunatic made their first contribution in #​1815
• @​Baxromumarov made their first contribution in #​1850
• @​a2not made their first contribution in #​1821
• @​nghiack7 made their first contribution in #​1888
• @​blackwell-systems made their first contribution in #​1877
• @​Kentzo made their first contribution in #​1905

Full Changelog: stretchr/testify@v1.11.0...v1.12.0

What's Changed

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in #​1775
• CI: test also with Go 1.23 by @​dolmen in #​1783
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in #​1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in #​1665
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in #​1708
• Promote ccoVeille to maintainer by @​brackendawson in #​1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in #​1790
• assert.PanicsWithError: report error message by @​olivergondza in #​1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in #​1787
• add type to error message of assert.Same by @​egawata in #​1792
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in #​1791
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in #​1795
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in #​1782
• assert: truncate very long objects in test failure messages by @​brackendawson in #​1646
• doc: remove ineffective inline code blocks by @​brackendawson in #​1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in #​1815
• chore: vendor go-spew from https://github.com/davecgh/go-spew by @​ccoVeille in #​1827
• require: fix godoc generation for assertions returning a bool by @​Baxromumarov in #​1850
• docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by @​a2not in #​1821
• docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by @​a2not in #​1842
• EMERITUS.md: add @​tylerb by @​dolmen in #​1812
• CI: test also with Go 1.24 by @​alexandear in #​1856
• deps: bump objx to v0.5.3 and remove dependency cycle issue by @​ccoVeille in #​1823
• CI: upgrade GitHub Actions and pin hashes by @​SuperQ in #​1883
• assert: fix NotSubset error messages using %#v instead of %q (fixes #​1800) by @​nghiack7 in #​1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in #​1877
• CI: add _readme-gofmt tool to reformat Go code in README by @​dolmen in #​1889
• CI: add check of GitHub Action pinned hashes against tag by @​dolmen in #​1885
• _codegen: modernize by @​dolmen in #​1890
• assert: make *AssertionFunc types just aliases by @​dolmen in #​1563
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​1906
• mock: Mock.Return does not exist anymore by @​Kentzo in #​1905

New Contributors

• @​mutaiib made their first contribution in #​1775
• @​vyas-git made their first contribution in #​1665
• @​olivergondza made their first contribution in #​1400
• @​egawata made their first contribution in #​1792
• @​ubunatic made their first contribution in #​1815
• @​Baxromumarov made their first contribution in #​1850
• @​a2not made their first contribution in #​1821
• @​nghiack7 made their first contribution in #​1888
• @​blackwell-systems made their first contribution in #​1877
• @​Kentzo made their first contribution in #​1905

Full Changelog: stretchr/testify@v1.11.0...v1.12.0

grpc/grpc-go (google.golang.org/grpc)

v1.83.1: Release 1.83.1

Compare Source

Security

• xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#​9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#​9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#​9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#​9332)
  • Special Thanks: @​alimony
• xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#​9332)
  • Special Thanks: @​alimony

Performance

• transport: Restrict memory overhead of buffering small data frames. (#​9331)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 6 additional dependencies were updated

Details:

Package	Change
golang.org/x/crypto	v0.40.0 -> v0.43.0
golang.org/x/net	v0.42.0 -> v0.46.1-0.20251013234738-63d1a5100f82
golang.org/x/sys	v0.34.0 -> v0.37.0
golang.org/x/text	v0.29.0 -> v0.30.0
google.golang.org/genproto/googleapis/api	v0.0.0-20250929231259-57b25ae835d4 -> v0.0.0-20251022142026-3a174f9686a8
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250929231259-57b25ae835d4 -> v0.0.0-20251022142026-3a174f9686a8