chore(deps): bump the go-dependency-version-updates group across 5 directories with 13 updates

[dependabot]

Bumps the go-dependency-version-updates group with 7 updates in the /libs/common directory:

Package	From	To
github.com/aws/aws-sdk-go-v2	1.41.7	1.42.1
github.com/aws/aws-sdk-go-v2/config	1.32.18	1.32.27
github.com/aws/aws-sdk-go-v2/service/s3	1.101.0	1.104.2
github.com/ethereum/go-ethereum	1.17.3	1.17.4
github.com/redis/go-redis/v9	9.19.0	9.21.0
golang.org/x/crypto	0.52.0	0.53.0
google.golang.org/grpc	1.81.1	1.82.0

Bumps the go-dependency-version-updates group with 4 updates in the /services/auth directory: github.com/ethereum/go-ethereum, golang.org/x/crypto, google.golang.org/grpc and github.com/jackc/pgx/v5.
Bumps the go-dependency-version-updates group with 6 updates in the /services/gameplay directory:

Package	From	To
github.com/ethereum/go-ethereum	1.17.3	1.17.4
github.com/redis/go-redis/v9	9.19.0	9.21.0
google.golang.org/grpc	1.81.1	1.82.0
github.com/jackc/pgx/v5	5.9.2	5.10.0
go.temporal.io/api	1.62.12	1.63.1
go.temporal.io/sdk	1.44.0	1.45.0

Bumps the go-dependency-version-updates group with 1 update in the /services/proto directory: google.golang.org/grpc.
Bumps the go-dependency-version-updates group with 3 updates in the /services/users directory: github.com/ethereum/go-ethereum, google.golang.org/grpc and github.com/jackc/pgx/v5.

Updates github.com/aws/aws-sdk-go-v2 from 1.41.7 to 1.42.1

Commits

• b4784c1 Release 2026-07-01
• 97c0201 Regenerated Clients
• 6687238 Update endpoints model
• 995297f Update API model
• c26cfc6 Fix bump smithy-go to cover multiple issues (#3461)
• fae66b8 Set transfer manager error as the first error seen, preventing race condition...
• cf0eabd Release 2026-06-30
• ad0c091 Regenerated Clients
• 196e961 Update endpoints model
• 1529ead Update API model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.18 to 1.32.27

Commits

• b4784c1 Release 2026-07-01
• 97c0201 Regenerated Clients
• 6687238 Update endpoints model
• 995297f Update API model
• c26cfc6 Fix bump smithy-go to cover multiple issues (#3461)
• fae66b8 Set transfer manager error as the first error seen, preventing race condition...
• cf0eabd Release 2026-06-30
• ad0c091 Regenerated Clients
• 196e961 Update endpoints model
• 1529ead Update API model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.19.17 to 1.19.26

Commits

• b4784c1 Release 2026-07-01
• 97c0201 Regenerated Clients
• 6687238 Update endpoints model
• 995297f Update API model
• c26cfc6 Fix bump smithy-go to cover multiple issues (#3461)
• fae66b8 Set transfer manager error as the first error seen, preventing race condition...
• cf0eabd Release 2026-06-30
• ad0c091 Regenerated Clients
• 196e961 Update endpoints model
• 1529ead Update API model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.101.0 to 1.104.2

Commits

• b4784c1 Release 2026-07-01
• 97c0201 Regenerated Clients
• 6687238 Update endpoints model
• 995297f Update API model
• c26cfc6 Fix bump smithy-go to cover multiple issues (#3461)
• fae66b8 Set transfer manager error as the first error seen, preventing race condition...
• cf0eabd Release 2026-06-30
• ad0c091 Regenerated Clients
• 196e961 Update endpoints model
• 1529ead Update API model
• Additional commits viewable in compare view

Updates github.com/ethereum/go-ethereum from 1.17.3 to 1.17.4

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Flexible Polymer Casing (v1.17.4)

This is a maintenance release with accumulated bug fixes and improvements, and is recommended for all users. It also continues the implementation work for the upcoming Amsterdam hardfork.

One thing worth highlighting:

• Clef has been removed. The standalone clef signer has moved to https://github.com/ethereum/clef (#35097).

Fork Implementation (Amsterdam)

• EIP-7928: Block-Level Access Lists: the block access list is now constructed and verified during block execution, with the serving side of the eth/71 BAL messages implemented (#34652, #34803, #34879, #34957, #34967, #34972, #34977, #35110)
• EIP-8189: snap/2, a new state-sync protocol based on block-level access lists, has been added (#34626, #34807, #35098, #35155, #35158, #35163, #35178, #35180, #35181)
• EIP-8037: state-creation gas cost increase, has been implemented (#33601)
  • The tracing system provides a new OnGasChangeV2 hook for multi-dimensional gas (#34946)
• engine_newPayloadWithWitnessV5 has been added and the witness format now uses the canonical spec field ordering (#35009)
• The evm t8n tooling has been updated for Amsterdam, adding BAL and slot-number support and binary-trie leaf export (#34843, #35025)
• For EIP-7843, the slot number is now set for the pending block post-Amsterdam (#34792, #35036)

Geth

• Caches are now sized against the cgroup memory cap (e.g. Docker --memory) when one is set (#34947)
• A number of small command-line flag and logging issues have been fixed (#33880, #34732, #34943, #34948, #35011, #35104, #35116, #35136)
• A number of long-deprecated command-line flags have been removed (#35021)

RPC

• eth_baseFee has been added, returning the base fee of the next block (#34904, #35023)

• eth_capabilities has been added, letting clients discover which historical data a node can serve (#33886)

• debug_clearTxpool has been added to clear the transaction pool (#33347, #35130)

• State-reading methods (eth_getBalance, eth_getCode, eth_getStorageAt, etc.) now default the block parameter to latest when omitted (#35100)

• Fixes for eth_simulateV1: an incorrect "base fee too low" error code and a pre-Shanghai withdrawal regression (#34951, #34939)

• debug_setHead now propagates rewind errors instead of silently ignoring them (#35001)

• EIP-7702 transactions with a nil To address are now rejected (#35094)

• HTTP RPC responses now always set Content-Length, and a WebSocket handshake status-code bug was fixed (#35072, #35111)

• The client can now configure trace-context propagation via the traceparent header, and response writes are now traced (#35132, #35049)

GraphQL

• GraphQL request bodies are now limited to 5 MiB (#35034)
• Log-range queries with begin > 0 and end == 0 are now rejected (#35032)
• The Block.raw resolver now returns empty bytes when the block body is missing (#35027)

Core

• A global cache for JUMPDEST bitmaps speeds up EVM execution (#34850)
• EVM stack operations are now computed in place, avoiding per-operand copies (#35156)
• New code-cache hit/miss meters have been added (#34821)
• A shutdown race in snapshot generation has been fixed (#33540)

... (truncated)

Commits

• 36a7dc7 version: release go-ethereum v1.17.4
• 6b72f26 triedb/pathdb: log the expected version in obsolete-index cleanup (#35194)
• e5ff359 p2p/discover: fix waiting wrong duration (#35002)
• 7c9032d all: change reflect.Ptr to reflect.Pointer (#35176)
• 8c540cb eth/catalyst: add testing_commitBlockV1 (#34995)
• 7122ecc eth/protocols/snap: remove uncovered states before resuming (#35159)
• 0e810e4 eth, triedb, internal: add snap/2 sync progress (#35178)
• 1be5da2 eth/protocols/snap: redo the snap sync if the bal is unavailable (#35181)
• ad68ce2 eth: reserve peer slot for usable snap peer (#35180)
• cb387c9 cmd/devp2p/internal/ethtest: validate received txs, not the sent ones (#35170)
• Additional commits viewable in compare view

Updates github.com/redis/go-redis/v9 from 9.19.0 to 9.21.0

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.21.0

This is a minor release adding new features and bug fixes. There are no breaking changes; upgrading from 9.20.x is a drop-in replacement.

🚀 Highlights

Zero-copy GetToBuffer / SetFromBuffer

Two new StringCmdable methods let callers read and write Redis string values directly into and from pre-allocated byte buffers, eliminating the per-call payload allocation that Get/Set incur:

GetToBuffer(ctx, key, buf) *ZeroCopyStringCmd   // reads into buf; ZeroCopyStringCmd { Val() int; Bytes() []byte; Result() (int, error) }
SetFromBuffer(ctx, key, buf) *StatusCmd

GetToBuffer decodes the bulk reply straight into the caller-owned buf (no intermediate allocation); a buffer that is too small returns an error after draining the payload, so the connection stays aligned for the next reply. SetFromBuffer is provided for API symmetry — it dispatches to the same []byte writer path as Set(ctx, key, buf, 0) and produces byte-identical output on the wire. Available on *Client, *ClusterClient, *Ring, *Conn and Pipeliner.

(#3834) by @​ndyakov

Explicit LIMIT 0 for stream trimming

Redis treats XTRIM/XADD approximate-trim (~) LIMIT 0 as "disable the trimming effort cap entirely", which differs from omitting LIMIT (the implicit 100 * stream-node-max-entries default). The command builders previously only emitted LIMIT when limit > 0, so callers could never send an explicit LIMIT 0. Following the KeepTTL = -1 precedent, the new XTrimLimitDisabled = -1 sentinel now emits an explicit LIMIT 0; limit == 0 keeps the historical no-LIMIT behavior, so existing callers produce byte-identical commands.

(#3848) by @​TheRealMal

✨ New Features

• Zero-copy buffer string commands: new GetToBuffer / SetFromBuffer on StringCmdable and the ZeroCopyStringCmd result type, reading/writing string values into caller-owned buffers without per-call payload allocation (#3834) by @​ndyakov
• XTrimLimitDisabled sentinel: XTRIM/XADD approximate trimming can now send an explicit LIMIT 0 to disable the trim effort cap, via the new XTrimLimitDisabled = -1 sentinel (#3848) by @​TheRealMal
• PubSub health-check timeouts: channel.initHealthCheck now bounds the Ping it issues with a fresh per-check timeout context (the exported pingTimeout / reconnectTimeout) instead of context.TODO(), so a stuck health-check Ping can no longer block indefinitely (#3819) by @​abdellani
• Skip redundant UNWATCH in Tx.Close: a transaction now tracks whether a WATCH is still active (watchArmed) and only issues UNWATCH on Close when it is, removing an extra round trip on the common WATCH/.../EXEC and no-key Watch paths while never returning a connection to the pool with an active watch (#3854) by @​fcostaoliveira

🐛 Bug Fixes

• maintnotifications ModeAuto fail-open: ModeAuto now stays fail-open when the server does not support maintenance notifications — connections are retired and tracking is guarded during downgrade so the client keeps working instead of erroring (#3853) by @​terrorobe

👥 Contributors

We'd like to thank all the contributors who worked on this release!

@​abdellani, @​fcostaoliveira, @​ndyakov, @​terrorobe, @​TheRealMal

9.20.1

This is a patch release containing bug fixes only. There are no new features or breaking changes; upgrading from 9.20.0 is a drop-in replacement.

🚀 Highlights

RESP3 pub/sub message loss fixed

PeekPushNotificationName previously inspected only the bytes already buffered by bufio, so when a push frame header straddled a buffer fill boundary it could return a truncated notification name (e.g. "messa" instead of "message"). The push processor then mis-routed the frame and ReadReply silently dropped it, causing intermittent RESP3 pub/sub message loss. The peek now grows its window (36 bytes → up to 4 KiB) and reads more from the connection until the header is complete, cleanly separating incomplete prefixes from corrupt frames (including overflow-safe bulk-length handling). Fixes #3839.

... (truncated)

Changelog

Sourced from github.com/redis/go-redis/v9's changelog.

9.21.0 (2026-06-18)

This is a minor release adding new features and bug fixes. There are no breaking changes; upgrading from 9.20.x is a drop-in replacement.

🚀 Highlights

Zero-copy GetToBuffer / SetFromBuffer

Two new StringCmdable methods let callers read and write Redis string values directly into and from pre-allocated byte buffers, eliminating the per-call payload allocation that Get/Set incur:

GetToBuffer(ctx, key, buf) *ZeroCopyStringCmd   // reads into buf; ZeroCopyStringCmd { Val() int; Bytes() []byte; Result() (int, error) }
SetFromBuffer(ctx, key, buf) *StatusCmd

GetToBuffer decodes the bulk reply straight into the caller-owned buf (no intermediate allocation); a buffer that is too small returns an error after draining the payload, so the connection stays aligned for the next reply. SetFromBuffer is provided for API symmetry — it dispatches to the same []byte writer path as Set(ctx, key, buf, 0) and produces byte-identical output on the wire. Available on *Client, *ClusterClient, *Ring, *Conn and Pipeliner.

(#3834) by @​ndyakov

Explicit LIMIT 0 for stream trimming

Redis treats XTRIM/XADD approximate-trim (~) LIMIT 0 as "disable the trimming effort cap entirely", which differs from omitting LIMIT (the implicit 100 * stream-node-max-entries default). The command builders previously only emitted LIMIT when limit > 0, so callers could never send an explicit LIMIT 0. Following the KeepTTL = -1 precedent, the new XTrimLimitDisabled = -1 sentinel now emits an explicit LIMIT 0; limit == 0 keeps the historical no-LIMIT behavior, so existing callers produce byte-identical commands.

(#3848) by @​TheRealMal

✨ New Features

• Zero-copy buffer string commands: new GetToBuffer / SetFromBuffer on StringCmdable and the ZeroCopyStringCmd result type, reading/writing string values into caller-owned buffers without per-call payload allocation (#3834) by @​ndyakov
• XTrimLimitDisabled sentinel: XTRIM/XADD approximate trimming can now send an explicit LIMIT 0 to disable the trim effort cap, via the new XTrimLimitDisabled = -1 sentinel (#3848) by @​TheRealMal
• PubSub health-check timeouts: channel.initHealthCheck now bounds the Ping it issues with a fresh per-check timeout context (the exported pingTimeout / reconnectTimeout) instead of context.TODO(), so a stuck health-check Ping can no longer block indefinitely (#3819) by @​abdellani
• Skip redundant UNWATCH in Tx.Close: a transaction now tracks whether a WATCH is still active (watchArmed) and only issues UNWATCH on Close when it is, removing an extra round trip on the common WATCH/.../EXEC and no-key Watch paths while never returning a connection to the pool with an active watch (#3854) by @​fcostaoliveira

🐛 Bug Fixes

• maintnotifications ModeAuto fail-open: ModeAuto now stays fail-open when the server does not support maintenance notifications — connections are retired and tracking is guarded during downgrade so the client keeps working instead of erroring (#3853) by @​terrorobe

👥 Contributors

We'd like to thank all the contributors who worked on this release!

@​abdellani, @​fcostaoliveira, @​ndyakov, @​terrorobe, @​TheRealMal

---

Full Changelog: redis/go-redis@v9.20.1...v9.21.0

9.20.1 (2026-06-11)

This is a patch release containing bug fixes only. There are no new features or breaking changes; upgrading from 9.20.0 is a drop-in replacement.

... (truncated)

Commits

• 1551837 chore(release): 9.21.0 (#3857)
• 1cfa927 fix(maintnotifications): keep ModeAuto fail-open (#3853)
• 1f0ea0e feat(pubsub): introduce timeouts for Ping on channel.initHealthCheck (#3819)
• 5484b0b feat(tx): skip redundant UNWATCH in Tx.Close when no WATCH is active (#3854)
• bf57a51 chore(deps): bump rojopolis/spellcheck-github-actions (#3852)
• 641294c feat(streams): support explicit LIMIT 0 in XTRIM/XADD trimming via XTrimLimit...
• 74d9bb0 feat(command): add zero-copy GetToBuffer and SetFromBuffer (#3834)
• a13416b chore(release): 9.20.1 (#3847)
• 10dc44f fix(push): fix peeking when push name is truncated (#3842)
• e1a2d68 fix(ft.hybrid): Always generate vector param names if they are not provided b...
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.52.0 to 0.53.0

Commits

• 45460e0 go.mod: update golang.org/x dependencies
• d37c95e pkcs12: limit PBKDF iteration count to prevent CPU exhaustion
• e2ffffe ssh: reject incomplete gssapi-with-mic configurations
• 60e158a ssh/test: isolate CLI tests from user SSH config and agent
• 1b77d23 ssh/knownhosts: reject lines with multiple or unknown markers
• 3872a2b ssh/knownhosts: verify declared key type matches decoded key
• 9f72ecc ssh/knownhosts: treat only ASCII space and tab as whitespace
• 8f405a4 ssh: validate ECDSA curve matches expected algorithm
• bb41b3d ssh: improve DH GEX group selection using PreferredBits
• e04e721 ssh/agent: validate ed25519 private key length in Add
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.20.0 to 0.21.0

Commits

• 5071ed6 all: fix some comments to improve readability
• See full diff in compare view

Updates golang.org/x/text from 0.37.0 to 0.38.0

Commits

• f4bb632 go.mod: update golang.org/x dependencies
• See full diff in compare view

Updates google.golang.org/grpc from 1.81.1 to 1.82.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.82.0

Behavior Changes

• server: Remove support for GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment varibale. Strict incoming RPC path validation (which has been the default since v1.79.3) can no longer be disabled. (#9112)
• transport: Add environment variable to change the default max header list size from 16MB to 8KB. This may be enabled by setting GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true. This will be enabled by default in a subsequent release. (#9019)
• balancer: Load Balancing policy registry is now case-sensitive. Set GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false (and file an issue) to revert to case-insensitive behavior. (#9017)

New Features

• experimental/stats: Expose a new API, NewContextWithLabelCallback, to register a callback that is invoked when telemetry labels are added. (#8877)
  • Special Thanks: @​seth-epps
• client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (#8929)
  • Special Thanks: @​chengxilo
• server: Add environment variable GRPC_GO_SERVER_GOROUTINE_LABELS that controls setting runtime/pprof.Labels on goroutines spawned by the server. Set GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true to add the grpc.method label on goroutines spawned to handle incoming requests. (#9082)
  • Special Thanks: @​dfinkel

Bug Fixes

• xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (#9138)
• grpc: In the deprecated gzip Compressor (used via the deprecated WithCompressor dial option), enforce the MaxRecvMsgSize limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (#9114)
  • Special Thanks: @​evilgensec
• stats/opentelemetry: Record retry attempts, grpc.previous-rpc-attempts, at the call level and not the attempt level. (#8923)
• encoding: Ensure Close() is always called on readers returned from Compressor.Decompress if possible. (#9135)
• channelz: Fix the LastMessageSentTimestamp and LastMessageReceivedTimestamp fields in SocketMetrics to ensure they contain correct timestamp values. (#9109)

Commits

• bd23985 Change version to 1.82.0 (#9170)
• 0f3086d Fix minor issues not covered by PR #9137 (#9147)
• fef07fb internal: Split v3procservicepb import into pb and grpc for extproc (#9163)
• 91dd64f transport: surface subsequent data when receiving non-gRPC header (#8929)
• adc97de test/kokoro: add config for regional-td test (#9158)
• 57c9ff1 xds: ensure full-string matching for RBAC Filter rules (#9148)
• b58f32d server: Set a pprof label on new stream goroutines (#9082)
• 6c98be3 refactor(transport): extract shared stream state handling logic in `loopyWrit...
• bcaa6f4 rls: only reset backoff on recovery from TRANSIENT_FAILURE (#9137)
• 429e6e0 balancer: expose endpoint weight and hostname as experimental APIs (#9074)
• Additional commits viewable in compare view

Updates github.com/ethereum/go-ethereum from 1.17.3 to 1.17.4

Release notes

Sourced from github.com/ethereum/go-ethereum's releases.

Flexible Polymer Casing (v1.17.4)

This is a maintenance release with accumulated bug fixes and improvements, and is recommended for all users. It also continues the implementation work for the upcoming Amsterdam hardfork.

One thing worth highlighting:

• Clef has been removed. The standalone clef signer has moved to https://github.com/ethereum/clef (#35097).

Fork Implementation (Amsterdam)

• EIP-7928: Block-Level Access Lists: the block access list is now constructed and verified during block execution, with the serving side of the eth/71 BAL messages implemented (#34652, #34803, #34879, #34957, #34967, #34972, #34977, #35110)
• EIP-8189: snap/2, a new state-sync protocol based on block-level access lists, has been added (#34626, #34807, #35098, #35155, #35158, #35163, #35178, #35180, #35181)
• EIP-8037: state-creation gas cost increase, has been implemented (#33601)
  • The tracing system provides a new OnGasChangeV2 hook for multi-dimensional gas (#34946)
• engine_newPayloadWithWitnessV5 has been added and the witness format now uses the canonical spec field ordering (#35009)
• The evm t8n tooling has been updated for Amsterdam, adding BAL and slot-number support and binary-trie leaf export (#34843, #35025)
• For EIP-7843, the slot number is now set for the pending block post-Amsterdam (#34792, #35036)

Geth

• Caches are now sized against the cgroup memory cap (e.g. Docker --memory) when one is set (#34947)
• A number of small command-line flag and logging issues have been fixed (#33880, #34732, #34943, #34948, #35011, #35104, #35116, #35136)
• A number of long-deprecated command-line flags have been removed (#35021)

RPC

• eth_baseFee has been added, returning the base fee of the next block (#34904, #35023)

• eth_capabilities has been added, letting clients discover which historical data a node can serve (#33886)

• debug_clearTxpool has been added to clear the transaction pool (#33347, #35130)

• State-reading methods (eth_getBalance, eth_getCode, eth_getStorageAt, etc.) now default the block parameter to latest when omitted (#35100)

• Fixes for eth_simulateV1: an incorrect "base fee too low" error code and a pre-Shanghai withdrawal regression (#34951, #34939)

• debug_setHead now propagates rewind errors instead of silently ignoring them (#35001)

• EIP-7702 transactions with a nil To address are now rejected (#35094)

• HTTP RPC responses now always set Content-Length, and a WebSocket handshake status-code bug was fixed (#35072, #35111)

• The client can now configure trace-context propagation via the traceparent header, and response writes are now traced (#35132, #35049)

GraphQL

• GraphQL request bodies are now limited to 5 MiB (#35034)
• Log-range queries with begin > 0 and end == 0 are now rejected (#35032)
• The Block.raw resolver now returns empty bytes when the block body is missing (#35027)

Core

• A global cache for JUMPDEST bitmaps speeds up EVM execution (#34850)
• EVM stack operations are now computed in place, avoiding per-operand copies (#35156)
• New code-cache hit/miss meters have been added (#34821)
• A shutdown race in snapshot generation has been fixed (#33540)

... (truncated)

Commits

• 36a7dc7 version: release go-ethereum v1.17.4
• 6b72f26 triedb/pathdb: log the expected version in obsolete-index cleanup (#35194)
• e5ff359 p2p/discover: fix waiting wrong duration (#35002)
• 7c9032d all: change reflect.Ptr to reflect.Pointer (#35176)
• 8c540cb eth/catalyst: add testing_commitBlockV1 (#34995)
• 7122ecc eth/protocols/snap: remove uncovered states before resuming (#35159)
• 0e810e4 eth, triedb, internal: add snap/2 sync progress (#35178)
• 1be5da2 eth/protocols/snap: redo the snap sync if the bal is unavailable (#35181)
• ad68ce2 eth: reserve peer slot for usable snap peer (#35180)
• cb387c9 cmd/devp2p/internal/ethtest: validate received txs, not the sent ones (#35170)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.52.0 to 0.53.0

Commits

• 45460e0 go.mod: update golang.org/x dependencies
• d37c95e pkcs12: limit PBKDF iteration count to prevent CPU exhaustion
• e2ffffe ssh: reject incomplete gssapi-with-mic configurations
• 60e158a ssh/test: isolate CLI tests from user SSH config and agent
• 1b77d23 ssh/knownhosts: reject lines with multiple or unknown markers
• 3872a2b ssh/knownhosts: verify declared key type matches decoded key
• 9f72ecc ssh/knownhosts: treat only ASCII space and tab as whitespace
• 8f405a4 ssh: validate ECDSA curve matches expected algorithm
• bb41b3d ssh: improve DH GEX group selection using PreferredBits
• e04e721 ssh/agent: validate ed25519 private key length in Add
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.20.0 to 0.21.0

Commits

• 5071ed6 all: fix some comments to improve readability
• See full diff in compare view

Updates google.golang.org/grpc from 1.81.1 to 1.82.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.82.0

Behavior Changes

• server: Remove support for GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment varibale. Strict incoming RPC path validation (which has been the default since v1.79.3) can no longer be disabled. (#9112)
• transport: Add environment variable to change the default max header list size from 16MB to 8KB. This may be enabled by setting GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true. This will be enabled by default in a subsequent release. (#9019)
• balancer: Load Balancing policy registry is now case-sensitive. Set GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false (and file an issue) to revert to case-insensitive behavior. (#9017)

New Features

• experimental/stats: Expose a new API, NewContextWithLabelCallback, to register a callback that is invoked when telemetry labels are added. (#8877)
  • Special Thanks: @​seth-epps
• client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (#8929)
  • Special Thanks: @​chengxilo
• server: Add environment variable GRPC_GO_SERVER_GOROUTINE_LABELS that controls setting runtime/pprof.Labels on goroutines spawned by the server. Set GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true to add the grpc.method label on goroutines spawned to handle incoming requests. (#9082)
  • Special Thanks: @​dfinkel

Bug Fixes

• xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (#9138)
• grpc: In the deprecated gzip Compressor (used via the deprecated WithCompressor dial option), enforce the MaxRecvMsgSize limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (#9114)
  • Special Thanks: @​evilgensec
• stats/opentelemetry: Record retry attempts, grpc.previous-rpc-attempts, at the call level and not the attempt level. (#8923)
• encoding: Ensure Close() is always called on readers returned from Compressor.Decompress if possible. (#9135)
• channelz: Fix the LastMessageSentTimestamp and LastMessageReceivedTimestamp fields in SocketMetrics to ensure they contain correct timestamp values. (#9109)

Commits

• bd23985 Change version to 1.82.0 (#9170)
• 0f3086d Fix minor issues not covered by PR #9137 (#9147)
• fef07fb internal: Split v3procservicepb import into pb and grpc for extproc (#9163)
• 91dd64f transport: surface subsequent data when receiving non-gRPC header (#8929)
• adc97de test/kokoro: add config for regional-td test (#9158)
• 57c9ff1 xds: ensure full-string matching for RBAC Filter rules (#9148)
• b58f32d server: Set a pprof...

  Description has been truncated

[dependabot]

Superseded by #155.