chore(deps): bump the go-modules group across 1 directory with 29 updates

[dependabot]

Note: github.com/sirupsen/logrus has been held back at v1.9.4 (excluded from this bump). v1.10.0 rewrote TextFormatter.appendValue to call fmt.Stringer.String() directly instead of through fmt.Sprint (which used to recover panics from it). nuts-node logs several nilable *ssi.URI fields (credential/presentation IDs, optional per the VC/VP data model) via WithField, and URI.String() has a value receiver, so calling it through a nil *URI now panics instead of just producing a garbled log line. Confirmed by two tests that crashed under v1.10.0: Test_wallet_HandleCredentialOffer and Test_networkPublisher_PublishCredential. A separate PR bumps logrus together with a fix for the nil-unsafe log call sites.

---

Bumps the go-modules group with 24 updates in the / directory:

Package	From	To
github.com/Azure/azure-sdk-for-go/sdk/azcore	1.22.0	1.23.0
github.com/knadh/koanf/parsers/yaml	1.1.0	1.1.1
github.com/knadh/koanf/providers/posflag	1.0.1	1.0.2
github.com/knadh/koanf/providers/structs	1.0.0	1.0.1
github.com/knadh/koanf/v2	2.3.5	2.3.6
github.com/nats-io/nats-server/v2	2.14.3	2.14.5
github.com/nats-io/nats.go	1.52.0	1.53.1
github.com/redis/go-redis/v9	9.21.0	9.22.0
github.com/sirupsen/logrus	1.9.4	1.10.0
google.golang.org/grpc	1.82.1	1.83.0
google.golang.org/protobuf	1.36.11	1.36.12
gorm.io/driver/postgres	1.6.0	1.6.2
gorm.io/driver/sqlserver	1.6.3	1.6.4
modernc.org/sqlite	1.54.0	1.56.0
github.com/aws/aws-sdk-go-v2	1.43.0	1.43.5
github.com/aws/aws-sdk-go-v2/config	1.32.31	1.32.36
github.com/aws/aws-sdk-go-v2/feature/rds/auth	1.6.31	1.6.36
github.com/eko/gocache/lib/v4	4.2.3	4.2.4
github.com/lestrrat-go/jwx/v3	3.1.1	3.2.0
go.opentelemetry.io/contrib/bridges/otellogrus	0.19.0	0.20.0
go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho	0.69.0	0.70.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	0.69.0	0.70.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp	0.20.0	0.21.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	1.44.0	1.45.0

Updates github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.22.0 to 1.23.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azcore's releases.

sdk/azcore/v1.23.0

1.23.0 (2026-08-11)

Features Added

• Helper method runtime.NewRequestForNextLink for creating requests for pageable operations that uses a next link. It handles absolute and relative next links.

Bugs Fixed

• Fixed an issue where runtime.Pager[T].More could return true indefinitely after NextPage failed to retrieve the first page, causing for pager.More() loops to spin. After a page fetch returns an error the Pager now enters a terminal state: More returns false and subsequent NextPage calls return the same error without invoking the fetcher again.

Commits

• 86f252c Prep azcore for release (#27366)
• 7f66fdd Configurations: 'specification/netapp/resource-manager/Microsoft.NetApp/NetA...
• 7dcf481 Add runtime.NewRequestForNextLink (#27349)
• e5a54a6 azqueue: reference generated StorageErrorCode constants in queueerror (#27300)
• 8053e3a Sync eng/common directory with azure-sdk-tools for PR 16449 (#27355)
• 7ab8185 Expand eng common sync to support microsoft org (#27347)
• 2b59c65 Configurations: 'specification/containerservice/resource-manager/Microsoft.C...
• 677abc2 [AutoPR sdk-resourcemanager/containerserviceaimanager/armcontainerserviceaima...
• 160eda3 Configurations: 'specification/iotoperations/resource-manager/Microsoft.IoTO...
• a441e90 [AutoPR sdk-resourcemanager/discovery/armdiscovery]-generated-from-SDK Genera...
• Additional commits viewable in compare view

Updates github.com/knadh/koanf/parsers/yaml from 1.1.0 to 1.1.1

Release notes

Sourced from github.com/knadh/koanf/parsers/yaml's releases.

v1.1.1

• 57e89cf Merge pull request #94 from knadh/fix-posflag-callbacks
• d3bad45 Merge pull request #91 from knadh/bug-report-template
• b1985ad Merge pull request #93 from rhnvrm/unit-test-issue-90
• a72baa3 Merge pull request #92 from knadh/fix-posflag-callbacks
• adc0b54 tests: add unit test for #90
• 9e87eba Fix unchanged default posflag value merging via incorrect callback.
• 2f82a14 Merge pull request #87 from mvrahden/feature/filesystem
• 6e9c0a7 Add github issue templates
• 023ecc6 Update README with fs.FS provider
• f7e28d0 fix call to Close on file descriptor
• caeef66 Merge pull request #1 from rhnvrm/feature/filesystem
• 02f42ea fix: add build constraints to maintain compat
• 149144c add fs.FS provider
• 139fe40 Merge pull request #85 from mvrahden/fix/base_test
• 7cc3416 move error assertions and make them error-type dependent
• 0a31536 fix race condition and reduce test time by half
• af2e3f4 simplify and unify test arrangements
• aa62c04 update testify to v1.7.0
• 5234867 Merge pull request #84 from mr-karan/gh_actions
• c79fbc5 feat: Replace Travis with GitHub Actions

Commits

• 57e89cf Merge pull request #94 from knadh/fix-posflag-callbacks
• d3bad45 Merge pull request #91 from knadh/bug-report-template
• b1985ad Merge pull request #93 from rhnvrm/unit-test-issue-90
• a72baa3 Merge pull request #92 from knadh/fix-posflag-callbacks
• adc0b54 tests: add unit test for #90
• 9e87eba Fix unchanged default posflag value merging via incorrect callback.
• 2f82a14 Merge pull request #87 from mvrahden/feature/filesystem
• 6e9c0a7 Add github issue templates
• 023ecc6 Update README with fs.FS provider
• f7e28d0 fix call to Close on file descriptor
• Additional commits viewable in compare view

Updates github.com/knadh/koanf/providers/posflag from 1.0.1 to 1.0.2

Commits

• See full diff in compare view

Updates github.com/knadh/koanf/providers/structs from 1.0.0 to 1.0.1

Commits

• 75e13d9 Fix multiple large int64 handling issues.
• b133504 skip disabled secret on azure kv read (#437)
• 1aba4ed deps: upgrade go-toml to v2.4.3 (#419)
• d2ffdaa Bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /providers/kiln (#427)
• 4f7edbb Bump google.golang.org/grpc from 1.56.3 to 1.82.1 in /examples (#430)
• 31dd449 fix: error on scalar/map type mismatch in MergeStrict regardless of order (#424)
• e09e4c8 fix: report full key var in MergeStrict type-mismatch error message (#418)
• 7a28d59 Exclude nats, vault providers from global workspace and fix CI test commands.
• d511690 Fix test action to use local Go toolchain for different versions.
• 308274c Fix async file provider Watch() test that would race and fail randomly.
• Additional commits viewable in compare view

Updates github.com/knadh/koanf/v2 from 2.3.5 to 2.3.6

Release notes

Sourced from github.com/knadh/koanf/v2's releases.

v2.3.6

What's Changed

• fix: error on scalar/map type mismatch in MergeStrict regardless of order by @​upuddu in knadh/koanf#424
• Bump google.golang.org/grpc from 1.56.3 to 1.82.1 in /examples by @​dependabot[bot] in knadh/koanf#430
• Bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /providers/kiln by @​dependabot[bot] in knadh/koanf#427
• deps: upgrade go-toml to v2.4.3 by @​GreyXor in knadh/koanf#419
• skip disabled secret on azure kv read by @​genlp in knadh/koanf#437

New Contributors

• @​upuddu made their first contribution in knadh/koanf#424
• @​genlp made their first contribution in knadh/koanf#437

Full Changelog: knadh/koanf@v2.3.5...v2.3.6

Commits

• 75e13d9 Fix multiple large int64 handling issues.
• b133504 skip disabled secret on azure kv read (#437)
• 1aba4ed deps: upgrade go-toml to v2.4.3 (#419)
• d2ffdaa Bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /providers/kiln (#427)
• 4f7edbb Bump google.golang.org/grpc from 1.56.3 to 1.82.1 in /examples (#430)
• 31dd449 fix: error on scalar/map type mismatch in MergeStrict regardless of order (#424)
• See full diff in compare view

Updates github.com/nats-io/nats-server/v2 from 2.14.3 to 2.14.5

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.14.5

Changelog

Refer to the 2.14 Upgrade Guide for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

Go Version

• 1.26.5

Dependencies

• github.com/klauspost/compress v1.19.2 (#8459)
• golang.org/x/crypto v0.55.0 (#8459)

Added

Leafnodes

• New dial_timeout option can be specified in the leafnode config block or for specific remotes in the configuration, allowing it to be increased above the default 1 second for high-latency links (#8427)

Fixed

General

• Fixed a deadlock that could occur in the logger when a close error occurs (#8430)

JetStream

• Fix a bug that could result in potential data loss when handling idempotent stream creates when an offline node catches up from a metalayer snapshot, caused by an incorrect update to the create time in the stream assignment (#8449)

Complete Changes

nats-io/nats-server@v2.14.4...v2.14.5

Release v2.14.4

Changelog

Refer to the 2.14 Upgrade Guide for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

Go Version

• 1.26.5 (#8435)

Dependencies

• github.com/klauspost/compress v1.19.0 (#8385)
• golang.org/x/crypto v0.54.0 (#8385)
• golang.org/x/sys v0.47.0 (#8385)
• github.com/antithesishq/antithesis-sdk-go v0.7.2-default-no-op (#8385)

... (truncated)

Commits

• d3bc045 Release v2.14.5
• 16bcbd9 Update dependencies
• ed1644a Cherry-picks for 2.14.5 (#8458)
• 618e6c9 [FIXED] Route missing after reconnect due to gossip URL mismatch
• 28c83a9 Cherry-picks for 2.14.5-RC.1 (#8450)
• 47fb6c3 [FIXED] Idempotent stream create uses same created timestamp
• 165bce1 Make leafnode tcp dialtimeout configurable
• 62b409b [FIXED] SetLoggerV2 deadlock when prev logger errors on close
• bbd6dc5 Release v2.14.4
• 7d26d07 Update to Go 1.26.5/1.25.12
• Additional commits viewable in compare view

Updates github.com/nats-io/nats.go from 1.52.0 to 1.53.1

Release notes

Sourced from github.com/nats-io/nats.go's releases.

Release v1.53.1

Changelog

This is a patch release containing no functional changes.

FIXED

• Version const and the README install line, which were not updated for v1.53.0 (#2118)

Complete Changes

nats-io/nats.go@v1.53.0...v1.53.1

Release v1.53.0

Changelog

ADDED

• JetStream:
  • WithPublishAsyncAckHandler option for JetStream async publish. Thanks @​occamist for the contribution (#2109)
  • AckFlowControlPolicy to legacy API (#2091)
• Micro:
  • micro.WithEndpointMetadataKey. Thanks @​joeriddles for the contribution (#2079)

FIXED

• Core NATS:
  • Websocket connection with path. Thanks @​joeriddles for the contribution (#2092)
  • MsgsTimeout iterator yielding a spurious (nil, nil) after a timeout. Thanks @​sueun-dev and @​c-tonneslan for the contributions (#2099, #2093)
• JetStream:
  • Data race in resetOrderedConsumer when resets overlap (#2111)
  • Avoid panic in PullSubscribe consumer create path. Thanks @​wyf027 for the contribution (#2088)
  • Honor per-request JSOpt API prefix across JetStream APIs. Thanks @​wyf027 for the contribution (#2087)
  • Add nil checks for empty JetStream API responses. Thanks @​colecschmidt for the contribution (#2073)
• KeyValue:
  • Recognize error code 10164 for replicated KV CAS conflicts (#2098)
  • Reject keys with consecutive dots in keyValid and searchKeyValid. Thanks @​c-tonneslan for the contribution (#2076)
• Micro:
  • Endpoint subject prefix over-match. Thanks @​vsaraikin for the contribution (#2105)

IMPROVED

• Performance enhancement when publishing core NATS messages with headers. Thanks @​jonchammer for the contribution (#2083)
• Migrate tests to ntf (#2082)
• Add docs.nats.io examples to main (#2106)
• Improve readme wording for JetStream consumers. Thanks @​trevorah for the contribution (#2104)

Complete Changes

nats-io/nats.go@v1.52.0...v1.53.0

Commits

• db1375f Release v1.53.1 (#2118)
• ae0af2c [IMPROVED] Migrate tests to ntf (#2082)
• 0c5d8d7 [ADDED] WithPublishAsyncAckHandler option for JetStream async publish (#2109)
• 15d96ca [FIXED] Data race in resetOrderedConsumer when resets overlap (#2111)
• f66c8e7 [FIXED] Recognize error code 10164 for replicated KV CAS conflicts (#2097) (#...
• 9d92e85 iter: don't yield a phantom (nil, nil) after MsgsTimeout's ErrTimeout (#2093)
• c68c4de [FIXED] micro: endpoint subject prefix over-match (#2105)
• e663e67 Improve example wording (#2104)
• c1a0716 Add docs.nats.io examples to main (#2106)
• 77e280d [FIXED] MsgsTimeout iterator yields spurious (nil, nil) after a timeout (#2099)
• Additional commits viewable in compare view

Updates github.com/redis/go-redis/v9 from 9.21.0 to 9.22.0

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.22.0

This is a minor release introducing two flagship (experimental) features — client-side caching and automatic pipelining — alongside support for Redis 8.10, new commands, and a large batch of stability and parser-robustness fixes. It consolidates everything shipped in 9.22.0-beta.1, so the notes below cover the full 9.21.0 → 9.22.0 upgrade.

⚠️ Two changes to be aware of when upgrading from 9.21.0:

• Default configuration values changed (#3918): read/write timeouts, retry backoff, cluster state reload interval, and TCP keep-alive defaults are now aligned with the cross-SDK configuration proposal (see the highlight below). Explicitly configured values are unaffected.
• WaitAOF return type corrected (#3888): WaitAOF now returns *IntSliceCmd, matching the two-integer reply of WAITAOF (previously *IntCmd, which failed to parse the reply at runtime). Code referencing the old return type needs a one-line update.

🚀 Highlights

Client-Side Caching (Experimental)

The standalone Client gains server-assisted client-side caching built on RESP3 CLIENT TRACKING. Enable it by setting ClientSideCacheConfig in Options (or supply your own cache via ClientSideCache — e.g. to share one cache across clients). Cacheable read results are served from a local in-process cache and invalidated automatically when the server reports a change, cutting round trips for read-heavy workloads.

The invalidation architecture is selected by ClientSideCacheStrategy; the default (and currently only) strategy is CSCStrategySharedTracking: one shared cache, every pool connection runs plain CLIENT TRACKING ON, and a background drainer applies buffered invalidations — portable (no BCAST) and consistent with the other Redis client libraries. Requirements and guardrails: RESP3 (Protocol: 3), standalone client, DB 0 only; commands that would change the connection identity (SELECT, AUTH, ...) are rejected while caching is enabled, and CSC is disabled when a credentials provider is set (fixed Username/Password work and are namespaced). See the README's client-side caching section and the runnable example.

Experimental: the API may change in a minor release.

(#3941) by @​ofekshenawa

Automatic Pipelining (Experimental)

AutoPipeliner is a background batcher that coalesces commands from many concurrent goroutines into Redis pipelines, multiplying throughput without any manual pipeline management. It comes in two faces, available on Client and ClusterClient (and configurable via Options.AutoPipelineOptions / UniversalOptions.AutoPipelineOptions):

• AutoPipeline() — the blocking face: a drop-in Cmdable where each call blocks until executed, exactly like a plain client, while concurrent callers' commands batch together under the hood (measured locally over loopback: ~1M+ SET/sec vs ~100k unpipelined; indicative, not a guarantee). Per-goroutine command order is preserved.
• AsyncAutoPipeline() — the deferred face: command calls return immediately and every typed result accessor (Val/Result/Err/...) blocks until the command has executed. Submit a window of commands, then read the results, to keep pipelines deep (~2–3M SET/sec locally; indicative).

AutoPipelineOptions controls batching: MaxBatchSize (soft target, default 200; the blocking face's preset uses 300), MaxBatchBytes (approximate payload cap so huge values flush as several bounded writes), MaxFlushDelay with optional AdaptiveDelay (delay scales down as the queue fills), and MaxConcurrentBatches (default 1 = a single ordered batch stream; raising it requires Unordered: true, so ordering is never lost by accident — Validate() rejects the combination otherwise). A usage tour and throughput comparison live in https://github.com/redis/go-redis/blob/HEAD/example/autopipeline.

Experimental: the API may change in a future release — pin your go-redis version if you adopt it.

(#3942) by @​ndyakov, with help from @​cxljs

Redis 8.10 Support

This release adds support for Redis 8.10. The README's supported-versions list now includes Redis 8.10, and CI runs the full suite against the redislabs/client-libs-test:8.10.0 image by default (#3920, #3940).

Coverage for the new commands and options that ship with Redis 8.10:

• HIMPORT (#3919) — bulk hash import via server-side fieldsets, exposed as HImportPrepare, HImportSet, HImportDiscard, and HImportDiscardAll. Fieldsets are session state scoped to a single physical connection, which does not mix well with connection pooling — so the client keeps a versioned fieldset registry and lazily replays the PREPARE on whichever pooled connection executes a SET that needs it, at most once per connection, with no extra round trip (the PREPARE is injected into the same write as the SET).
• LMOVEM / BLMOVEM (#3913) — move multiple elements between lists in one call.
• SUNIONCARD / SDIFFCARD (#3897) — cardinality of set union/difference without materializing the result.
• XREAD / XREADGROUP MAXCOUNT and MAXSIZE (#3898) — bound how much data a stream read returns.
• TS.READ (#3896), TS.QUERYLABELS (#3926), TS.NRANGE / TS.NREVRANGE (#3870) with multiple aggregators per key (#3937), and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE (#3912) — new time-series query surface.
• FT.ALIASLIST (#3925), COLLECT reducer for FT.AGGREGATE (#3886), RERANK on HNSW vector fields in FT.CREATE (#3927), and FT.HYBRID timeout warnings (#3911) — search coverage.

Cross-SDK Aligned Defaults

Default configuration values now follow the cross-SDK configuration proposal shared by all Redis client libraries (#3918):

... (truncated)

Changelog

Sourced from github.com/redis/go-redis/v9's changelog.

9.22.0 (2026-08-03)

This is a minor release introducing two flagship (experimental) features — client-side caching and automatic pipelining — alongside support for Redis 8.10, new commands, and a large batch of stability and parser-robustness fixes. It consolidates everything shipped in 9.22.0-beta.1, so the notes below cover the full 9.21.0 → 9.22.0 upgrade.

⚠️ Two changes to be aware of when upgrading from 9.21.0:

• Default configuration values changed (#3918): read/write timeouts, retry backoff, cluster state reload interval, and TCP keep-alive defaults are now aligned with the cross-SDK configuration proposal (see the highlight below). Explicitly configured values are unaffected.
• WaitAOF return type corrected (#3888): WaitAOF now returns *IntSliceCmd, matching the two-integer reply of WAITAOF (previously *IntCmd, which failed to parse the reply at runtime). Code referencing the old return type needs a one-line update.

🚀 Highlights

Client-Side Caching (Experimental)

The standalone Client gains server-assisted client-side caching built on RESP3 CLIENT TRACKING. Enable it by setting ClientSideCacheConfig in Options (or supply your own cache via ClientSideCache — e.g. to share one cache across clients). Cacheable read results are served from a local in-process cache and invalidated automatically when the server reports a change, cutting round trips for read-heavy workloads.

The invalidation architecture is selected by ClientSideCacheStrategy; the default (and currently only) strategy is CSCStrategySharedTracking: one shared cache, every pool connection runs plain CLIENT TRACKING ON, and a background drainer applies buffered invalidations — portable (no BCAST) and consistent with the other Redis client libraries. Requirements and guardrails: RESP3 (Protocol: 3), standalone client, DB 0 only; commands that would change the connection identity (SELECT, AUTH, ...) are rejected while caching is enabled, and CSC is disabled when a credentials provider is set (fixed Username/Password work and are namespaced). See the README's client-side caching section and the runnable example.

Experimental: the API may change in a minor release.

(#3941) by @​ofekshenawa

Automatic Pipelining (Experimental)

AutoPipeliner is a background batcher that coalesces commands from many concurrent goroutines into Redis pipelines, multiplying throughput without any manual pipeline management. It comes in two faces, available on Client and ClusterClient (and configurable via Options.AutoPipelineOptions / UniversalOptions.AutoPipelineOptions):

• AutoPipeline() — the blocking face: a drop-in Cmdable where each call blocks until executed, exactly like a plain client, while concurrent callers' commands batch together under the hood (measured locally over loopback: ~1M+ SET/sec vs ~100k unpipelined; indicative, not a guarantee). Per-goroutine command order is preserved.
• AsyncAutoPipeline() — the deferred face: command calls return immediately and every typed result accessor (Val/Result/Err/...) blocks until the command has executed. Submit a window of commands, then read the results, to keep pipelines deep (~2–3M SET/sec locally; indicative).

AutoPipelineOptions controls batching: MaxBatchSize (soft target, default 200; the blocking face's preset uses 300), MaxBatchBytes (approximate payload cap so huge values flush as several bounded writes), MaxFlushDelay with optional AdaptiveDelay (delay scales down as the queue fills), and MaxConcurrentBatches (default 1 = a single ordered batch stream; raising it requires Unordered: true, so ordering is never lost by accident — Validate() rejects the combination otherwise). A usage tour and throughput comparison live in https://github.com/redis/go-redis/blob/master/example/autopipeline.

Experimental: the API may change in a future release — pin your go-redis version if you adopt it.

(#3942) by @​ndyakov, with help from @​cxljs

Redis 8.10 Support

This release adds support for Redis 8.10. The README's supported-versions list now includes Redis 8.10, and CI runs the full suite against the redislabs/client-libs-test:8.10.0 image by default (#3920, #3940).

Coverage for the new commands and options that ship with Redis 8.10:

• HIMPORT (#3919) — bulk hash import via server-side fieldsets, exposed as HImportPrepare, HImportSet, HImportDiscard, and HImportDiscardAll. Fieldsets are session state scoped to a single physical connection, which does not mix well with connection pooling — so the client keeps a versioned fieldset registry and lazily replays the PREPARE on whichever pooled connection executes a SET that needs it, at most once per connection, with no extra round trip (the PREPARE is injected into the same write as the SET).
• LMOVEM / BLMOVEM (#3913) — move multiple elements between lists in one call.
• SUNIONCARD / SDIFFCARD (#3897) — cardinality of set union/difference without materializing the result.
• XREAD / XREADGROUP MAXCOUNT and MAXSIZE (#3898) — bound how much data a stream read returns.
• TS.READ (#3896), TS.QUERYLABELS (#3926), TS.NRANGE / TS.NREVRANGE (#3870) with multiple aggregators per key (#3937), and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE (#3912) — new time-series query surface.
• FT.ALIASLIST (#3925), COLLECT reducer for FT.AGGREGATE (#3886), RERANK on HNSW vector fields in FT.CREATE (#3927), and FT.HYBRID timeout warnings (#3911) — search coverage.

Cross-SDK Aligned Defaults

Default configuration values now follow the cross-SDK configuration proposal shared by all Redis client libraries (#3918):

... (truncated)

Commits

• c7f59a2 chore(release): prepare 9.22.0 (#3947)
• c994cfc feat(autopipeline): automatic command pipelining (#3942)
• 228b463 chore(deps): bump actions/stale from 10 to 11 (#3944)
• a6be850 feat(csc): add standalone client-side caching (#3941)
• 82b0213 chore(release): prepare 9.22.0-beta.1 (#3940)
• 8eb9583 fix(rediscmd): redact credential args in AppendCmd (#3939)
• 90fd088 chore(ci): point 8.10 testing at custom client-libs-test image (#3938)
• 93f961a feat(timeseries): support multiple aggregators per key in TS.NRANGE (#3937)
• 49e0041 feat(himport): HIMPORT command with lazy per-connection prepare (#3919)
• 3dd9675 fix(proto): peek push notification name without demanding 36 bytes (#3936)
• Additional commits viewable in compare view

Updates github.com/sirupsen/logrus from 1.9.4 to 1.10.0

Release notes

Sourced from github.com/sirupsen/logrus's releases.

v1.10.0

Logrus v1.10.0

This release focuses on substantial performance improvements, concurrency correctness, and better interoperability with modern Go logging APIs.

🚀 Performance

Major improvements across TextFormatter, entry handling, and common logger paths:

• ~17% lower geomean runtime across the benchmark suite
• ~27% higher geomean formatter throughput
• Common enabled logging paths are ~30–44% faster
• WithError is ~40% faster
• Chained fields are ~46% faster
• TextFormatter paths are up to ~40% faster
• Allocation counts are reduced by ~25–74% across measured TextFormatter cases, with the largest reductions in colored output

The improvements also show up in complete logger paths:

• Logger + TextFormatter is ~31% faster, with ~24% fewer allocations
• Logger + JSONFormatter is ~21% faster, with ~10% fewer allocations

JSONFormatter itself remains largely unchanged in runtime performance, with small allocation reductions.

🔄 log/slog interoperability

v1.10 adds bidirectional interoperability between Logrus and Go's log/slog:

• A Logrus slog hook can forward existing Logrus entries to an slog logger.
• hooks/slog.NewHandler implements slog.Handler, allowing log/slog records to use an existing Logrus logger and its hooks, formatter, and output.
• The handler preserves levels, fields, groups, context, record timestamps, and optionally caller information.
• Caller reporting is configured per handler, without requiring Logrus's logger-wide ReportCaller option.
• Custom slog levels can be mapped to Logrus levels.
• The hook and handler can be combined, providing a practical path for incrementally migrating from Logrus to log/slog without requiring an all-at-once transition.

This allows applications to migrate their logging API and logging backend independently: existing Logrus call sites can start using an slog backend, while new slog code can continue using an established Logrus setup.

🔒 Concurrency & Correctness

• Fix reentrant logging deadlocks, including logging from within MarshalJSON or formatter code.
• Fix generic Log, Logf, Logln, and LogFn methods unexpectedly panicking when called with PanicLevel, contrary to their documented behavior.
• Eliminate race conditions in entry and formatter paths.
• Improve locking boundaries around formatters and hooks.

➕ Added

• TextFormatter now automatically enables colors on Windows terminals with ANSI support, matching behavior on other platforms.
• Entry.Caller can now be set explicitly and is preserved across derived entries. When caller reporting is enabled, Logrus only detects and populates caller information when none was provided, allowing custom caller detection and wrapper-aware logging without adding additional caller configuration APIs.
• Add minimal, composable logging interfaces for each log level, allowing consumers to depend on narrower interfaces and making logging implementations easier to substitute or adapt.
• Expand CI verification to include TinyGo and every cross-compile target reported by go tool dist list, improving coverage across alternative toolchains and platforms.

... (truncated)

Changelog

Sourced from github.com/sirupsen/logrus's changelog.

1.10.0

Fixes:

• Fix reentrant logging deadlocks in formatter paths.
• Fix race conditions in formatter and entry handling.
• Fix generic Log, Logf, Logln, and LogFn methods unexpectedly panicking when called with PanicLevel. Use the corresponding Panic methods when panic behavior is desired.
• Improve concurrency safety around formatter and hook access.

Features:

• Add slog hook for forwarding Logrus entries to log/slog.
• Add slog.Handler for forwarding log/slog records to a Logrus logger, including levels, fields, groups, context, time, and optional caller reporting. The hook and handler can also be combined to help migrate between Logrus and log/slog.
• Add minimal, composable logging interfaces for each log level. This enables consumers to depend on narrower interfaces, making it easier to substitute or adapt logging implementations.
• Allow Entry.Caller to be set explicitly and preserve it across derived entries, enabling custom caller detection without Logrus overwriting caller information when ReportCaller is enabled.

Changed:

• Raise minimum supported Go version to 1.23.
• TextFormatter now renders []byte values as raw/quoted strings instead of slice-of-ints.
• TextFormatter now uses distinct dimmed colors for debug and trace output.
• TextFormatter now automatically enables colors on Windows terminals with ANSI support, matching the behavior on other platforms.
• Entry.HasCaller is now deprecated in favor of checking Entry.Caller directly.
• Deprecated MutexWrap, which was unintentionally exposed as public API. It remains available as an alias for compatibility but should not be used directly.

Performance:

• Significantly improve TextFormatter performance and reduce allocations.
• Optimize common Entry and Logger hot paths.
• Reduce allocations in caller reporting.
• ~17% lower geomean runtime and ~27% higher formatter throughput overall.
• Common enabled logging paths are ~30–44% faster.
• TextFormatter paths are up to ~40% faster, with allocation counts reduced by 25–74% across the measured formatter cases.

Commits

• 457e372 Merge pull request #1573 from thaJeztah/update_colors
• 6b6a3a6 formatter: differentiate debug and trace colors
• 8ebae73 Merge pull request #1572 from thaJeztah/update_logs
• f156a33 docs: clarify formatter field handling
• 84cedf9 Merge pull request #1571 from thaJeztah/slog_hookopts
• a3e1580 hooks/slog: add HookOptions
• e5b377a Merge pull request #1570 from thaJeztah/slog_leveler
• 30a5487 hooks/slog: add level adapters
• 0cee61e Merge pull request #1569 from thaJeztah/slog_noleveler
• 4069973 hooks/slog: use concrete slog.Level for hook level mapping
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.54.0 to 0.55.0

Commits

• f44d03d go.mod: update golang.org/x dependencies
• 5ed4944 crypto/internal/poly1305: provide optimised assembly for riscv64
• b07833c ssh: return window credit for discarded extended data
• d701c51 acme: fix nil pointer dereference in pebble test error reporting
• 999d053 ssh: fix parsing of GSSAPI payloads offering multiple mechanisms
• 90f76b8 ssh: reject certificate signature keys before recursing
• b53964a ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs
• 626e40f ssh: drain stderr on forwarded TCP and Unix channels
• 31914c6 x509roots/fallback: update bundle
• f2135b8 all: clean up minor issues found by staticcheck
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.82.1 to 1.83.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.0

Security

• server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
• xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

New Features

• xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
• xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
• authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
  • Special Thanks: @​hnefatl
• xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
• xds: Add support for xDS-based HTTP CONNECT proxies.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
• xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

• credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
• grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)
  • Special Thanks: @​Yusufihsangorgel

Commits

• 4c226da Change version to 1.83.0 (#9228)
• c198988 Cherrypick 9223 into v1.83.x (#9279Description has been truncated

[qltysh]

Coverage Impact

⬆️ Merging this pull request will increase total coverage on master by 0.2%.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.