build(deps): bump the tools group in /tools with 5 updates by dependabot[bot] · Pull Request #6566 · mindersec/minder

dependabot · 2026-07-01T06:16:07Z

Bumps the tools group in /tools with 5 updates:

Package	From	To
github.com/bufbuild/buf	`1.70.0`	`1.71.0`
github.com/mikefarah/yq/v4	`4.53.2`	`4.53.3`
github.com/oapi-codegen/oapi-codegen/v2	`2.7.0`	`2.7.1`
github.com/openfga/cli	`0.7.15`	`0.7.16`
golang.org/x/tools	`0.45.0`	`0.46.0`

Updates github.com/bufbuild/buf from 1.70.0 to 1.71.0

Release notes

Sourced from github.com/bufbuild/buf's releases.

v1.71.0

Port new formatter and fix bugs for in-line block comment spacing.

Fix handling for an empty rpc input/output.

Changelog

Sourced from github.com/bufbuild/buf's changelog.

[v1.71.0] - 2026-06-16

Port new formatter and fix bugs for in-line block comment spacing.

Fix handling for an empty rpc input/output.

Commits

509563d Release v1.71.0 (#4583)
62f0523 Validate UUID assert not nil (#4580)
32e150f Make upgrade (#4579)
5e30bd8 Support recursive glob (.**) in bufimageutil type filters (#4571)
9c4f1ea Make upgrade (#4567)
35db15a Upgrade protocompile (#4565)
4350c36 Fix license badge in readme (#4564)
e1fe7e1 Add key for context7 (#4563)
167e8fc Add context7 MCP support (#4562)
74b0287 Disable automatic Git maintenance in cloner (#4554)
Additional commits viewable in compare view

Updates github.com/mikefarah/yq/v4 from 4.53.2 to 4.53.3

Release notes

Sourced from github.com/mikefarah/yq/v4's releases.

v4.53.3

Add --ini-preserve-quotes flag for INI round-trip quote preservation (#2728) Thanks @toller892!

Fix: reset INI decoder state on init (#2719) Thanks @xieby1!

Fix: decode properties array bracket paths (#2693) Thanks @cyphercodes!

Fix: preserve floats with trailing zero when encoding YAML to JSON (#2701) Thanks @ChrisJr404!

Fix: JSON to TOML root scope and null handling (#2689) Thanks @LovesAsuna!

Fix: reset TOML decoder finished flag on Init for multi-doc evaluation (#2704) Thanks @terminalchai!

Fix: reset TOML decoder between files when evaluating all at once (#2685) Thanks @terminalchai!

Fix: preserve TOML inline table array scope (#2694) Thanks @cyphercodes!

Fix: preserve empty TOML arrays in tables (#2686) Thanks @cyphercodes!

Fix: TOML encoder uses inline tables for YAML FlowStyle mappings (#2687)

Fix nested inline YAML merge explode (#2699) Thanks @cyphercodes!

Fix repeatString overflow test on 32-bit platforms (#2680) Thanks @jandubois!

Bumped dependencies

Changelog

Sourced from github.com/mikefarah/yq/v4's changelog.

4.53.3:

Add --ini-preserve-quotes flag for INI round-trip quote preservation (#2728) Thanks @toller892!

Fix: reset INI decoder state on init (#2719) Thanks @xieby1!

Fix: decode properties array bracket paths (#2693) Thanks @cyphercodes!

Fix: preserve floats with trailing zero when encoding YAML to JSON (#2701) Thanks @ChrisJr404!

Fix: JSON to TOML root scope and null handling (#2689) Thanks @LovesAsuna!

Fix: reset TOML decoder finished flag on Init for multi-doc evaluation (#2704) Thanks @terminalchai!

Fix: reset TOML decoder between files when evaluating all at once (#2685) Thanks @terminalchai!

Fix: preserve TOML inline table array scope (#2694) Thanks @cyphercodes!

Fix: preserve empty TOML arrays in tables (#2686) Thanks @cyphercodes!

Fix: TOML encoder uses inline tables for YAML FlowStyle mappings (#2687)

Fix nested inline YAML merge explode (#2699) Thanks @cyphercodes!

Fix repeatString overflow test on 32-bit platforms (#2680) Thanks @jandubois!

Bumped dependencies

Commits

1b9b4ac Bumping version
9b67d65 Portable bump version
f8850c0 Preparting release
c5a3423 Refining
196a99e Agent disclosure
fa99bf1 Merging agents
7111761 docs: add AGENTS.md with Cursor Cloud development instructions (#2735)
0cb1bbe Fixing test
8fc8eed Minor doc update
7620a72 fix: reset INI decoder state on init (#2719)
Additional commits viewable in compare view

Updates github.com/oapi-codegen/oapi-codegen/v2 from 2.7.0 to 2.7.1

Release notes

Sourced from github.com/oapi-codegen/oapi-codegen/v2's releases.

Security fix for Go code injection

This is a security fix for a code injection vulnerability in v2.7.0, please see:

GHSA-rjwr-m7qx-3fjr

[!NOTE] A vulnerability like this requires that it is missed in code review and that you then call the malicious method.

Using an init() function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any oapi-codegen generated code is executed.

We strongly recommend all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code.

This is also why we recommend oapi-codegen generated code is committed to source control.

We're more strict about escaping strings passed into the OpenAPI specification, so that people can't inject Go code into generated code.

The problem was that it was possible to craft a description for server URL's which would emit arbitrary Go code, so if an attacker controlled your specification, they could inject Go code into your generated code which could do something malicious.

Commits

19c6282 Improve string escaping and add tests (#2396)
See full diff in compare view

Updates github.com/openfga/cli from 0.7.15 to 0.7.16

Release notes

Sourced from github.com/openfga/cli's releases.

v0.7.16

Added

Add a size field to fga model get and size_kb to fga model validate output, reporting the protobuf-serialized size of an authorization model in KB. (#712)

Changed

replace go-multierror with stdlib, remove dep (#705) (2e9afa2)

Update bundled OpenFGA to v1.18.0

What's Changed

chore(deps): bump the dependencies group with 3 updates by @dependabot[bot] in openfga/cli#698

chore(deps): bump github.com/openfga/openfga from 1.16.0 to 1.16.1 in the dependencies group by @dependabot[bot] in openfga/cli#700

chore: skip github release to push gpg signed tag by @SoulPancake in openfga/cli#699

chore: bump go toolchain for vulnerabilities by @SoulPancake in openfga/cli#701

chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the dependencies group by @dependabot[bot] in openfga/cli#703

chore(deps): bump github.com/openfga/openfga from 1.16.1 to 1.17.1 in the dependencies group by @dependabot[bot] in openfga/cli#702

chore(deps): bump github.com/openfga/go-sdk from 0.8.1 to 0.8.2 in the dependencies group by @dependabot[bot] in openfga/cli#706

refactor: replace go-multierror with stdlib, remove dep by @SoulPancake in openfga/cli#705

chore(deps): update bundled openfga to v1.18.0 by @SoulPancake in openfga/cli#709

feat: report serialized model size in fga model get and validate by @rhamzeh in openfga/cli#712

release: v0.7.16 by @openfga-releaser-bot[bot] in openfga/cli#710

Full Changelog: openfga/cli@v0.7.15...v0.7.16

Changelog

Sourced from github.com/openfga/cli's changelog.

0.7.16 (2026-06-17)

Added

Add a size field to fga model get and size_kb to fga model validate output, reporting the protobuf-serialized size of an authorization model in KB. (#712)

Changed

replace go-multierror with stdlib, remove dep (#705) (2e9afa2)

Update bundled OpenFGA to v1.18.0

Commits

fe7f94d release: v0.7.16 (#710)
6dff890 feat: report serialized model size in fga model get and validate (#712)
baaaff4 chore(deps): update bundled openfga to v1.18.0 (#709)
2e9afa2 refactor: replace go-multierror with stdlib, remove dep (#705)
f0879ce chore(deps): bump github.com/openfga/go-sdk in the dependencies group (#706)
d1fd7d3 chore(deps): bump github.com/openfga/openfga in the dependencies group (#702)
322eb81 chore(deps): bump actions/checkout in the dependencies group (#703)
142ca19 chore: bump go toolchain for vulnerabilities (#701)
b93c55f chore: skip github release to push gpg signed tag (#699)
f3ae3b5 chore(deps): bump github.com/openfga/openfga in the dependencies group (#700)
Additional commits viewable in compare view

Updates golang.org/x/tools from 0.45.0 to 0.46.0

Commits

3d6f8df go/packages: propagate PATH in TestConfigEnvDoesNotInheritProcessEnv
47abf61 gopls: move internal/tool into gopls/internal/tool
19cebc5 go/packages/gopackages: use standard flag package instead of internal/tool
e965c10 gopls/internal/test/marker: update hover test
96efd3d gopls/internal/golang/stubmethods: support generic interfaces
83be7b7 go.mod: update golang.org/x dependencies
bf05c11 internal/typesinternal: ForEachElement: test generic methods
99df0ab go/callgraph/static: support generic methods
6942095 go/ssa: fix instantiation of generic methods on non-generic receivers
070e85d go/callgraph/rta: skip generic methods in fingerprinting
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the tools group in /tools with 5 updates: | Package | From | To | | --- | --- | --- | | [github.com/bufbuild/buf](https://github.com/bufbuild/buf) | `1.70.0` | `1.71.0` | | [github.com/mikefarah/yq/v4](https://github.com/mikefarah/yq) | `4.53.2` | `4.53.3` | | [github.com/oapi-codegen/oapi-codegen/v2](https://github.com/oapi-codegen/oapi-codegen) | `2.7.0` | `2.7.1` | | [github.com/openfga/cli](https://github.com/openfga/cli) | `0.7.15` | `0.7.16` | | [golang.org/x/tools](https://github.com/golang/tools) | `0.45.0` | `0.46.0` | Updates `github.com/bufbuild/buf` from 1.70.0 to 1.71.0 - [Release notes](https://github.com/bufbuild/buf/releases) - [Changelog](https://github.com/bufbuild/buf/blob/main/CHANGELOG.md) - [Commits](bufbuild/buf@v1.70.0...v1.71.0) Updates `github.com/mikefarah/yq/v4` from 4.53.2 to 4.53.3 - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](mikefarah/yq@v4.53.2...v4.53.3) Updates `github.com/oapi-codegen/oapi-codegen/v2` from 2.7.0 to 2.7.1 - [Release notes](https://github.com/oapi-codegen/oapi-codegen/releases) - [Commits](oapi-codegen/oapi-codegen@v2.7.0...v2.7.1) Updates `github.com/openfga/cli` from 0.7.15 to 0.7.16 - [Release notes](https://github.com/openfga/cli/releases) - [Changelog](https://github.com/openfga/cli/blob/main/CHANGELOG.md) - [Commits](openfga/cli@v0.7.15...v0.7.16) Updates `golang.org/x/tools` from 0.45.0 to 0.46.0 - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.45.0...v0.46.0) --- updated-dependencies: - dependency-name: github.com/bufbuild/buf dependency-version: 1.71.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: tools - dependency-name: github.com/mikefarah/yq/v4 dependency-version: 4.53.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: tools - dependency-name: github.com/oapi-codegen/oapi-codegen/v2 dependency-version: 2.7.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: tools - dependency-name: github.com/openfga/cli dependency-version: 0.7.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: tools - dependency-name: golang.org/x/tools dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: tools ... Signed-off-by: dependabot[bot] <support@github.com>

coveralls · 2026-07-01T06:42:16Z

coverage: 60.724%. remained the same — dependabot/go_modules/tools/tools-dbe8943ea3 into main

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 1, 2026

dependabot Bot requested a review from a team as a code owner July 1, 2026 06:16

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 1, 2026

Run make bootstrap && make gen

3ba61c3

evankanderson assigned rdimitrov Jul 3, 2026

evankanderson approved these changes Jul 3, 2026

View reviewed changes

rdimitrov approved these changes Jul 3, 2026

View reviewed changes

evankanderson merged commit 5dfabf7 into main Jul 3, 2026
27 checks passed

evankanderson deleted the dependabot/go_modules/tools/tools-dbe8943ea3 branch July 3, 2026 21:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the tools group in /tools with 5 updates#6566

build(deps): bump the tools group in /tools with 5 updates#6566
evankanderson merged 2 commits into
mainfrom
dependabot/go_modules/tools/tools-dbe8943ea3

dependabot Bot commented on behalf of github Jul 1, 2026

Uh oh!

coveralls commented Jul 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 1, 2026

v1.71.0

[v1.71.0] - 2026-06-16

v4.53.3

Security fix for Go code injection

v0.7.16

Added

Changed

What's Changed

0.7.16 (2026-06-17)

Added

Changed

Uh oh!

coveralls commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coveralls commented Jul 1, 2026 •

edited

Loading