Skip to content

Bump the go-minor-and-patch group across 1 directory with 4 updates - #41

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-and-patch-6c6e758d94
Open

Bump the go-minor-and-patch group across 1 directory with 4 updates#41
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-and-patch-6c6e758d94

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 22, 2026

Copy link
Copy Markdown

Bumps the go-minor-and-patch group with 4 updates in the / directory: github.com/alibaba/OpenSandbox/sdks/sandbox/go, github.com/mark3labs/mcp-go, github.com/pelletier/go-toml/v2 and github.com/stretchr/testify.

Updates github.com/alibaba/OpenSandbox/sdks/sandbox/go from 1.0.0 to 1.0.5

Release notes

Sourced from github.com/alibaba/OpenSandbox/sdks/sandbox/go's releases.

Go Sandbox SDK v1.0.5

What's New

✨ Features

  • Retrying pool acquire policies — Go sandbox pools now support AcquirePolicyRetryNextIdle and AcquirePolicyRetryNextIdleThenCreate, allowing Acquire to skip stale idle candidates before failing or falling back to direct create. Existing policies keep their current behavior; MaxAcquireRetries defaults to 3. #1347
  • Sandbox create metrics — Sandbox.Create now reports fire-and-forget sandbox.create latency events to the lifecycle server. Reporting ignores old-server version skew and can be disabled with OPENSANDBOX_DISABLE_METRICS=1. #1307
  • Client IP header — the SDK now best-effort detects the host intranet IPv4 and sends it as OPEN-SANDBOX-CLIENT-IP on outbound requests. User-provided headers are never overwritten. #1326
  • Attach to isolated sessions — the SDK can now attach to an existing isolated session by session ID, allowing stateless workers to recover a functional handle while the execd in-memory session remains alive. #1295
  • UID mode availability — isolated session responses now expose per-mode setpriv / userns availability, and unavailable requested modes fail with 503 NOT_SUPPORTED. #1320
  • Exact snapshot name filtering — snapshot listing now supports an exact name filter. #1301
  • Isolated session bind mounts and listing — isolated sessions can now receive explicit bind mounts, and the SDK exposes isolated session listing so callers can inspect active sessions. #1264 #1269
  • Credential Vault placeholder substitutions — request matching now supports opt-in placeholders for path, query, header, and body surfaces, including passthrough auth bindings. #1251

🐛 Bug Fixes

  • Streaming and stale connection hardening — long-lived SSE command streams no longer use the normal total request timeout, so command output is not cut off by RequestTimeout. Idempotent GET / HEAD requests retry once on a fresh connection after timeout, reset, or EOF errors. #1316

📦 Misc

  • Bumped the Go SDK version constant and default User-Agent string for this release. #1384

👥 Contributors

Go Sandbox SDK v1.0.4

What's New

Breaking Changes

  • The credential vault binding match no longer carries a Ports field. Port is now derived from the scheme (https → 443, http → 80), matching what the intercept layer (iptables/nft) actually redirects. If your Go code constructs credential vault bindings and sets Match.Ports, remove that field on upgrade — port selection is now implicit from the scheme. This removes a field that never provided real flexibility (only 80/443 were ever intercepted). #1189

Features

  • Added a client-side sandbox pool (OSEP-0005) for the Go SDK, enabling millisecond-level sandbox acquisition from pre-warmed idle instances. The new SandboxPool API (via PoolBuilder) provides a background reconcile loop with leader election, fill-deficit / shrink-excess management, exponential backoff on warmup failures, and near-expiry-aware idle reuse. InMemoryPoolStateStore covers single-process deployments; a separate optional poolredis sub-module (go-redis v9) provides RedisPoolStateStore with atomic Lua-script operations for distributed setups. The main SDK module stays on go 1.20 with zero external dependencies — the pool is a fully opt-in, backward-compatible addition. Aligned with the Python and Kotlin pool implementations. #1198
  • Added run_once and withSession isolation convenience helpers to the Go SDK. sandbox.IsolationRunOnce(ctx, req, run, handlers) wraps create → run → delete into a single call with guaranteed cleanup, and sandbox.IsolationWithSession(ctx, req, fn) scopes a multi-run isolated workflow with auto-delete on exit. Cleanup is best-effort so it never masks the original error. These build on the execd-backed isolation support added to the Go SDK (isolated.go, sandbox_isolated.go). #1008 #1222
  • Added an LRU + TTL endpoint cache with in-flight request deduplication. The SDK now caches (sandbox_id, port, use_server_proxy) → Endpoint to avoid repeated resolution round-trips. It is enabled by default (TTL 600s, max size 1024) and tunable via ConnectionConfig; Kill() actively invalidates cached entries for the sandbox. #1133
  • Sandbox lifecycle responses now surface extensions. The Go SDK response models expose opensandbox.extensions.* data returned by create/get/list so callers can read extension values round-tripped from the server. #1112
  • Added the optional resourceRequests field to sandbox creation. Kubernetes-backed sandboxes can now set resource requests separately from limits (enabling Burstable QoS). Omitting the field preserves the existing behavior where requests equal limits. #1074

Misc

  • Updated the Go SDK README GitHub links to the new opensandbox-group/OpenSandbox org (Go module/import paths unchanged). #1197
  • Bumped the Go Sandbox SDK version constant to 1.0.4 and added a regression test that locks the default User-Agent to the release version. #1248

... (truncated)

Commits
  • 7093068 Merge pull request #150 from Pangjiping/hotfix/fileinfo-model
  • 21743f0 Merge pull request #149 from alibaba/chore/readme-updates
  • 68ee690 chore(docs): sync zh README examples
  • 41d4762 chore(readme): refine examples and docs
  • 5e103dd fix(components/execd): remove omitempty under FileInfo model
  • de678f1 Merge pull request #148 from Pangjiping/hotfix/flush-command
  • 4f56801 fix(components/execd): flush trailing stdout line without newline
  • d63936d Merge pull request #140 from yunnian/feature/custom-mount
  • 7e5cdcf Merge pull request #134 from Pangjiping/feat/execd-bootstrap-bash
  • 645bea9 Merge pull request #135 from Pangjiping/feat/redirect-logs
  • Additional commits viewable in compare view

Updates github.com/mark3labs/mcp-go from 0.50.0 to 0.58.0

Release notes

Sourced from github.com/mark3labs/mcp-go's releases.

Release v0.58.0

What's Changed

New Contributors

Full Changelog: mark3labs/mcp-go@v0.57.0...v0.58.0

Release v0.57.0

What's Changed

New Contributors

Full Changelog: mark3labs/mcp-go@v0.56.0...v0.57.0

Release v0.56.0

What's Changed

Full Changelog: mark3labs/mcp-go@v0.55.1...v0.56.0

... (truncated)

Commits
  • 9740d3a fix(mcp): preserve schema tags on nested fields (#920)
  • 8897dc8 Fix #943: refuse unsupported subscribe requests (#946)
  • 8c04c05 fix(server): flush final SSE response in handlePost (#945)
  • d4651c3 fix: rewrite draft-07 definitions refs when adopting them as $defs (#950)
  • c8cc0d7 docs: CONTRIBUTING says Go 1.23, but go.mod requires 1.25.5 (#929)
  • 28271e8 fix(server): deliver request-scoped elicitation on the originating POST SSE s...
  • d7c7b06 [mcp] document exported helper functions (#940)
  • 4ff6c3b fix(server): return 200 for HEAD requests instead of 404 (#937)
  • e395444 fmt
  • bab128e fix: deliver server notifications to in-process transport clients (#919)
  • Additional commits viewable in compare view

Updates github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.3

Release notes

Sourced from github.com/pelletier/go-toml/v2's releases.

v2.4.3

What's Changed

What's new

Fixed bugs

Documentation

Other changes

New Contributors

Full Changelog: pelletier/go-toml@v2.4.2...v2.4.3

v2.4.2

What's Changed

Fixed bugs

Full Changelog: pelletier/go-toml@v2.4.1...v2.4.2

v2.4.1

What's Changed

Fixed bugs

Full Changelog: pelletier/go-toml@v2.4.0...v2.4.1

v2.4.0

What's Changed

What's new

... (truncated)

Commits
  • 071a36c fix: bound array and inline table nesting depth to prevent stack-overflow DoS...
  • 57fec25 Add RawMessage marshal support to unstable (#1084)
  • 79f82e3 fix: error instead of panic on nil unexported embedded pointer (#1089)
  • a28afed unstable/kind: drop duplicate 'a' from LocalDate comment (#1062)
  • 6fa69af fix: do not recurse forever on recursively embedded structs (#1087)
  • 82b792e fix: report table placement errors with position and key context (#1086)
  • f93de50 perf: avoid interface boxing when decoding date/time values (#1085)
  • 21f8286 Deliver the whole document to a root Unmarshaler (#994) (#1083)
  • 98e94ae Update bundled toml.abnf to TOML 1.1.0 and pin spec-corner behaviour (#1082)
  • 35f78d5 Fix invalid TOML from commented multi-line values (#1081)
  • Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the go-minor-and-patch group across 1 directory with 4 updates
e52ed1d 
Bumps the go-minor-and-patch group with 4 updates in the / directory: [github.com/alibaba/OpenSandbox/sdks/sandbox/go](https://github.com/alibaba/OpenSandbox), [github.com/mark3labs/mcp-go](https://github.com/mark3labs/mcp-go), [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) and [github.com/stretchr/testify](https://github.com/stretchr/testify).


Updates `github.com/alibaba/OpenSandbox/sdks/sandbox/go` from 1.0.0 to 1.0.5
- [Release notes](https://github.com/alibaba/OpenSandbox/releases)
- [Commits](opensandbox-group/OpenSandbox@docker/execd/1.0.0...docker/execd/v1.0.5)

Updates `github.com/mark3labs/mcp-go` from 0.50.0 to 0.58.0
- [Release notes](https://github.com/mark3labs/mcp-go/releases)
- [Commits](mark3labs/mcp-go@v0.50.0...v0.58.0)

Updates `github.com/pelletier/go-toml/v2` from 2.3.1 to 2.4.3
- [Release notes](https://github.com/pelletier/go-toml/releases)
- [Commits](pelletier/go-toml@v2.3.1...v2.4.3)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

---
updated-dependencies:
- dependency-name: github.com/alibaba/OpenSandbox/sdks/sandbox/go
  dependency-version: 1.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-and-patch
- dependency-name: github.com/mark3labs/mcp-go
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: github.com/pelletier/go-toml/v2
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants