Skip to content

chore(deps): bump the go-mod group across 1 directory with 14 updates#180

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/go-mod-88412a1250
Open

chore(deps): bump the go-mod group across 1 directory with 14 updates#180
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/go_modules/go-mod-88412a1250

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 1, 2026

Bumps the go-mod group with 9 updates in the / directory:

Package From To
github.com/authzed/authzed-go 1.6.0 1.8.0
github.com/authzed/spicedb 1.47.1 1.49.1
github.com/cschleiden/go-workflows 1.0.1 1.4.1
github.com/go-playground/validator/v10 10.27.0 10.30.1
github.com/google/cel-go 0.26.0 0.27.0
github.com/puzpuzpuz/xsync/v4 4.2.0 4.4.0
github.com/warpstreamlabs/bento 1.8.2 1.15.0
k8s.io/component-base 0.34.1 0.35.2
k8s.io/kubernetes 1.34.1 1.35.2

Updates github.com/authzed/authzed-go from 1.6.0 to 1.8.0

Release notes

Sourced from github.com/authzed/authzed-go's releases.

v1.8.0

What's Changed

New Contributors

Full Changelog: authzed/authzed-go@v1.7.0...v1.8.0

v1.7.0

What's Changed

New Contributors

Full Changelog: authzed/authzed-go@v1.6.0...v1.7.0

Commits
  • d8c9a1a Merge pull request #394 from authzed/dependabot/go_modules/magefiles/go-mod-m...
  • ed6f0b8 chore(deps): bump the go-mod-magefiles group across 1 directory with 3 updates
  • bdf5808 Merge pull request #393 from authzed/dependabot/go_modules/go-mod-d64280bf30
  • 8adc898 chore(deps): bump the go-mod group with 3 updates
  • 43eca72 Merge pull request #375 from ivanauth/fix/issue-142-add-api-examples
  • 2ea2f5c Merge pull request #388 from ivanauth/fix/issue-137-contributing-local-protos
  • 41234c1 Merge pull request #389 from authzed/dependabot/go_modules/go-mod-bb2d16fde3
  • 70ff9af Merge pull request #390 from authzed/dependabot/github_actions/github-actions...
  • ea4533e Merge pull request #391 from authzed/dependabot/go_modules/magefiles/go-mod-m...
  • dcb53b3 chore(deps): bump the go-mod-magefiles group
  • Additional commits viewable in compare view

Updates github.com/authzed/spicedb from 1.47.1 to 1.49.1

Release notes

Sourced from github.com/authzed/spicedb's releases.

v1.49.1

Highlights

What's Changed

Full Changelog: authzed/spicedb@v1.49.0...v1.49.1

Docker Images

This release is available at authzed/spicedb:v1.49.1, quay.io/authzed/spicedb:v1.49.1, ghcr.io/authzed/spicedb:v1.49.1

v1.49.0

Highlights

Support for self keyword added to permissions

Previously, if you wanted to represent something like "a user should be able to view themselves," this required adding a relation to the schema and then writing a relation from the user to itself. We've added support for a self keyword in permissions that represents this directly, which reduces storage requirements, removes the need for a trip to the database, and removes a relationship that needs to be synced. For more information, see the Docs and the PR: #2785

Experimental

Postgres Foreign Data Wrapper

In #2806, we added a new experimental command to SpiceDB that serves a Postgres Foreign Data Wrapper: spicedb postgres-fdw [flags]. If you configure your Postgres instance accordingly, it can speak to SpiceDB through the FDW as a proxy, allowing you to write queries like:

-- Check if user:alice has permission to view document:readme
SELECT has_permission
FROM permissions
WHERE resource_type = 'document'
  AND resource_id = 'readme'
  AND permission = 'view'
  AND subject_type = 'user'
  AND subject_id = 'alice';

You can now express checks and lookups as SELECTs and JOINs in your main application code, and you can read, write, and delete relationships using Postgres as the client. For more information, see the documentation in the repo.

Warnings
  • This feature is experimental. We'd welcome you trying it out and providing feedback, but it will likely change before its final GA'd form.
  • This feature DOES NOT solve the Dual-Write Problem. You can make updates in the context of a Postgres transaction, but Postgres's FDW protocol doesn't support a two-phase commit semantic, which means there are still failure modes where a transactional write will land in SpiceDB but not Postgres or vice-versa.

Query Planner

... (truncated)

Changelog

Sourced from github.com/authzed/spicedb's changelog.

[1.49.1] - 2026-02-06

Added

Changed

Fixed

Security

[1.49.0] - 2026-02-03

Added

  • Support for self keyword added to permissions. Previously, if you wanted to represent something like "a user should be able to view themselves," this required adding a relation to the schema and then writing a relation from the user to itself. We've added support for a self keyword in permissions that represents this directly, which reduces storage requirements, removes the need for a trip to the database, and removes a relationship that needs to be synced. For more information, see the Docs and the PR

  • Experimental Postgres Foreign Data Wrapper.

    In #2806, we added a new experimental command to SpiceDB that serves a Postgres Foreign Data Wrapper: spicedb postgres-fdw [flags]. If you configure your Postgres instance accordingly, it can speak to SpiceDB through the FDW as a proxy, allowing you to write queries like:

    -- Check if user:alice has permission to view document:readme
SELECT has_permission
FROM permissions
WHERE resource_type = 'document'
  AND resource_id = 'readme'
  AND permission = 'view'
  AND subject_type = 'user'
  AND subject_id = 'alice';

    You can now express checks and lookups as SELECTs and JOINs in your main application code, and you can read, write, and delete relationships using Postgres as the client. For more information, see the documentation in the repo.

    NOTE:

    • This feature is experimental. We'd welcome you trying it out and providing feedback, but it will likely change before its final GA'd form.
    • This feature DOES NOT solve the Dual-Write Problem. You can make updates in the context of a Postgres transaction, but Postgres's FDW protocol doesn't support a two-phase commit semantic, which means there are still failure modes where a transactional write will land in SpiceDB but not Postgres or vice-versa.

  • Query Planner

    This release includes the first experimental handle on our new Query Planner. If you run SpiceDB with the new --experimental-query-plan flag, SpiceDB will use the query planner to resolve queries. This is mostly provided for the curious; there's still work to do on statistics sources and optimizations before we expect that it will provide performance benefits across most workloads. We don't yet recommend turning on this flag in your system outside of experiments in your local or development environments. We'll continue work and let you know when it's ready for production.

... (truncated)

Commits
  • d842a97 chore: implement self in schemav2 (#2887)
  • 7f9bd27 build: add new mustcallcheck analyzer and fix instances (#2886)
  • 3b519e8 fix: make sure that use self comes out of formatter when self is used (#2885)
  • 286d6e8 fix: handle self keyword in warnings checks, and check these warnings are e...
  • 03a3a18 feat: finish LR consistency tests with the fix to the recursive iterator (#2881)
  • 208ad95 chore(deps): bump the github-actions group with 5 updates (#2870)
  • 4c9d349 fix: query both subrelation and ellipses on arrows for IterResources (#2879)
  • d753f26 chore: add metrics and tests to all cache implementations (#2874)
  • c2c3bab fix: improve LR consistency and support multiple resourcetypes (#2875)
  • fa1d7f4 fix: prevent panic on malformed cursor (#2878)
  • Additional commits viewable in compare view

Updates github.com/cschleiden/go-workflows from 1.0.1 to 1.4.1

Release notes

Sourced from github.com/cschleiden/go-workflows's releases.

v1.4.1

What's Changed

Other Changes

Full Changelog: cschleiden/go-workflows@v1.4.0...v1.4.1

v1.4.0

What's Changed

Features

Bugfixes

Other Changes

Docs

New Contributors

Full Changelog: cschleiden/go-workflows@v1.3.0...v1.4.0

v1.3.0

What's Changed

Other Changes

... (truncated)

Commits
  • 2441ef3 Bump github.com/jackc/pgx/v5 from 5.3.1 to 5.5.4
  • caa8320 Fix GitHub URL in postgres README (remove www prefix)
  • 8a92a65 Add PostgreSQL backend documentation following SQLite/MySQL pattern
  • e065cb2 fix(samples): correct database creation query syntax
  • 23b924e refactor: rename package from postgresbackend to postgres
  • f32a821 fix: update makefile
  • 0c57436 migrations: squash migrations into a single file
  • 73e15af fix: lint errors
  • f363ca7 feat: add Postgres benchmarking and testing workflows
  • 5787158 feat: add postgres backend
  • Additional commits viewable in compare view

Updates github.com/go-playground/validator/v10 from 10.27.0 to 10.30.1

Release notes

Sourced from github.com/go-playground/validator/v10's releases.

Release 10.30.1

What's Changed

New Contributors

Full Changelog: go-playground/validator@v10.30.0...v10.30.1

Release 10.30.0

What's Changed

New Contributors

Full Changelog: go-playground/validator@v10.29.0...v10.30.0

v10.29.0

What's Changed

New Contributors

... (truncated)

Commits

Updates github.com/google/cel-go from 0.26.0 to 0.27.0

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.27.0

Release Summary

This release focuses on improving developer tooling and stability. Key highlights include significant enhancements to the REPL (YAML configuration support and parse-only evaluation), the addition of cost estimation for regex operations, and improved test coverage reporting.

On the stability front, this release addresses race conditions in reference types, improves namespace resolution, and ensures formatting directives align strictly with the CEL specification.

Note: This release includes a breaking change regarding how types are handled as variables. Please review the "Breaking Changes" section below.

⚠ Breaking Changes

Remove types as variables: The logic for handling types has been relaxed to support safe rollout of feature packages which introduce new types whose names may collide with existing variables. Please review your policies if you relied on types behaving strictly as variables in previous versions. [PR #1262](google/cel-go#1262)

Features & Enhancements

REPL & Tooling

Core Library

  • Regex Costing: Added support for cost estimation and tracking within the regex library. [PR #1200](google/cel-go#1200)

  • JSON Type Exposure: Exposed CEL JSON types to assist developers in converting to native values. [PR #1261](google/cel-go#1261)

  • Policy Composition: Source information is now preserved during CEL policy composition, aiding in debugging. [PR #1253](google/cel-go#1253)

Extensibility:

  • Updated extension option factory to resolve by ID (#1249).

  • Refactored match output compiling to accept user-defined logic (#1246).

  • Exposed Match source ID to callers (#1227).

Build & Maintenance

Bug Fixes

... (truncated)

Commits
  • 450089b Preserve source information during CEL policy composition. (#1253)
  • c66b313 Remove types as variables to allow user-defined variables to shadow type decl...
  • bff3a72 Expose the CEL JSON types to assist with conversion to native values (#1261)
  • 559cbc9 Remove errant diff checked into a prior PR (#1260)
  • fe26efa Simplify the disambiguation logic to a single boolean (#1263)
  • 52280ba Clean up unused source info after checker rewrites the AST. (#1258)
  • 3cb5705 Namespace resolution fix (#1256)
  • 409bcbe Refactor match output compiling to accept user-defined logic. (#1246)
  • e9f15ea Enable two var comprehension conformance tests. (#1255)
  • 057fa1a Add parse only evaluation to REPL (#1254)
  • Additional commits viewable in compare view

Updates github.com/puzpuzpuz/xsync/v4 from 4.2.0 to 4.4.0

Release notes

Sourced from github.com/puzpuzpuz/xsync/v4's releases.

v4.4.0

  • Micro-optimize Map for integer keys #185
  • Add Map.RangeRelaxed method for faster map iteration #187
  • Add Map.DeleteMatching method for batch entry deletion #186

Read-heavy operations on Map with integer keys are now 24-29% faster due to a more efficient hash function, as well as a number of micro-optimizations.

RangeRelaxed is a much faster (~11x), lock-free alternative to Range. The downside is that the same key may be visited by RangeRelaxed more than once if it is concurrently deleted and re-inserted during the iteration. RangeRelaxed should be preferred over Range in all cases when weaker consistency is acceptable.

m := xsync.NewMap[string, int]()
m.Store("alice", 10)
m.Store("bob", 20)
m.Store("carol", 30)
m.Store("dave", 40)
// Iterate map entries and calculate sum of all values.
sum := 0
m.RangeRelaxed(func(key string, value int) bool {
sum += value
return true // continue iteration
})

DeleteMatching deletes all entries for which the delete return value of the input function is true. If the cancel return value is true, the iteration stops immediately. The function returns the number of deleted entries. The call locks a hash table bucket for the duration of evaluating the function for all entries in the bucket and performing deletions. It performs up to 20% faster than Range + Delete, yet if the percentage of the entries to-be-deleted is low, RangeRelaxed + Delete combination should be more efficient.

// Delete entries with value greater than 25.
deleted := m.DeleteMatching(func(key string, value int) (delete, cancel bool) {
	return value > 25, false
})

v4.3.0

  • Add iterator function Map.All #181
  • Make shrink resize lock-free on target buckets #180

All is similar to Range, but returns an iter.Seq2, so is compatible with Go 1.23+ iterators. All of the same caveats and behavior from Range apply to All.

m := xsync.NewMap[string, int]()
for i := range 100 {
  m.Store(strconv.Itoa(i), i)
}
// Will print all of the map entries
for key, val := range m.All() {
fmt.Printf("m[%q] = %q\n")
}

... (truncated)

Commits

Updates github.com/spf13/cobra from 1.10.1 to 1.10.2

Release notes

Sourced from github.com/spf13/cobra's releases.

v1.10.2

🔧 Dependencies

  • chore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 by @​dims in spf13/cobra#2336 - the gopkg.in/yaml.v3 package has been deprecated for some time: this should significantly cleanup dependency/supply-chains for consumers of spf13/cobra

📈 CI/CD

🔥✍🏼 Docs

🍂 Refactors

🤗 New Contributors

Full Changelog: spf13/cobra@v1.10.1...v1.10.2

Thank you to our amazing contributors!!!!! 🐍 🚀

Commits

Updates github.com/warpstreamlabs/bento from 1.8.2 to 1.15.0

Release notes

Sourced from github.com/warpstreamlabs/bento's releases.

v1.15.0

1.15.0 2026-02-08

Added

  • json schema generator tool that pr...

    Description has been truncated

@dependabot
chore(deps): bump the go-mod group across 1 directory with 14 updates
7395bdf 
Bumps the go-mod group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/authzed/authzed-go](https://github.com/authzed/authzed-go) | `1.6.0` | `1.8.0` |
| [github.com/authzed/spicedb](https://github.com/authzed/spicedb) | `1.47.1` | `1.49.1` |
| [github.com/cschleiden/go-workflows](https://github.com/cschleiden/go-workflows) | `1.0.1` | `1.4.1` |
| [github.com/go-playground/validator/v10](https://github.com/go-playground/validator) | `10.27.0` | `10.30.1` |
| [github.com/google/cel-go](https://github.com/google/cel-go) | `0.26.0` | `0.27.0` |
| [github.com/puzpuzpuz/xsync/v4](https://github.com/puzpuzpuz/xsync) | `4.2.0` | `4.4.0` |
| [github.com/warpstreamlabs/bento](https://github.com/warpstreamlabs/bento) | `1.8.2` | `1.15.0` |
| [k8s.io/component-base](https://github.com/kubernetes/component-base) | `0.34.1` | `0.35.2` |
| [k8s.io/kubernetes](https://github.com/kubernetes/kubernetes) | `1.34.1` | `1.35.2` |



Updates `github.com/authzed/authzed-go` from 1.6.0 to 1.8.0
- [Release notes](https://github.com/authzed/authzed-go/releases)
- [Commits](authzed/authzed-go@v1.6.0...v1.8.0)

Updates `github.com/authzed/spicedb` from 1.47.1 to 1.49.1
- [Release notes](https://github.com/authzed/spicedb/releases)
- [Changelog](https://github.com/authzed/spicedb/blob/main/CHANGELOG.md)
- [Commits](authzed/spicedb@v1.47.1...v1.49.1)

Updates `github.com/cschleiden/go-workflows` from 1.0.1 to 1.4.1
- [Release notes](https://github.com/cschleiden/go-workflows/releases)
- [Commits](cschleiden/go-workflows@v1.0.1...v1.4.1)

Updates `github.com/go-playground/validator/v10` from 10.27.0 to 10.30.1
- [Release notes](https://github.com/go-playground/validator/releases)
- [Commits](go-playground/validator@v10.27.0...v10.30.1)

Updates `github.com/google/cel-go` from 0.26.0 to 0.27.0
- [Release notes](https://github.com/google/cel-go/releases)
- [Commits](google/cel-go@v0.26.0...v0.27.0)

Updates `github.com/puzpuzpuz/xsync/v4` from 4.2.0 to 4.4.0
- [Release notes](https://github.com/puzpuzpuz/xsync/releases)
- [Commits](puzpuzpuz/xsync@v4.2.0...v4.4.0)

Updates `github.com/spf13/cobra` from 1.10.1 to 1.10.2
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](spf13/cobra@v1.10.1...v1.10.2)

Updates `github.com/warpstreamlabs/bento` from 1.8.2 to 1.15.0
- [Release notes](https://github.com/warpstreamlabs/bento/releases)
- [Changelog](https://github.com/warpstreamlabs/bento/blob/main/CHANGELOG.md)
- [Commits](warpstreamlabs/bento@v1.8.2...v1.15.0)

Updates `golang.org/x/sync` from 0.18.0 to 0.19.0
- [Commits](golang/sync@v0.18.0...v0.19.0)

Updates `google.golang.org/grpc` from 1.76.0 to 1.78.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.76.0...v1.78.0)

Updates `google.golang.org/protobuf` from 1.36.10 to 1.36.11

Updates `k8s.io/client-go` from 0.34.1 to 0.34.2
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](kubernetes/client-go@v0.34.1...v0.34.2)

Updates `k8s.io/component-base` from 0.34.1 to 0.35.2
- [Commits](kubernetes/component-base@v0.34.1...v0.35.2)

Updates `k8s.io/kubernetes` from 1.34.1 to 1.35.2
- [Release notes](https://github.com/kubernetes/kubernetes/releases)
- [Commits](kubernetes/kubernetes@v1.34.1...v1.35.2)

---
updated-dependencies:
- dependency-name: github.com/authzed/authzed-go
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: github.com/authzed/spicedb
  dependency-version: 1.49.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: github.com/cschleiden/go-workflows
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: github.com/go-playground/validator/v10
  dependency-version: 10.30.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: github.com/google/cel-go
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: github.com/puzpuzpuz/xsync/v4
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-mod
- dependency-name: github.com/warpstreamlabs/bento
  dependency-version: 1.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: golang.org/x/sync
  dependency-version: 0.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: google.golang.org/grpc
  dependency-version: 1.78.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-mod
- dependency-name: k8s.io/client-go
  dependency-version: 0.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-mod
- dependency-name: k8s.io/component-base
  dependency-version: 0.35.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
- dependency-name: k8s.io/kubernetes
  dependency-version: 1.35.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-mod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the area/dependencies Affects dependencies label Mar 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/dependencies Affects dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants