Skip to content

build(deps): Bump github.com/spiffe/go-spiffe/v2 from 2.6.0 to 2.8.1 in /authbridge/authlib#541

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/authbridge/authlib/github.com/spiffe/go-spiffe/v2-2.8.1
Closed

build(deps): Bump github.com/spiffe/go-spiffe/v2 from 2.6.0 to 2.8.1 in /authbridge/authlib#541
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/authbridge/authlib/github.com/spiffe/go-spiffe/v2-2.8.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps github.com/spiffe/go-spiffe/v2 from 2.6.0 to 2.8.1.

Release notes

Sourced from github.com/spiffe/go-spiffe/v2's releases.

v2.8.1

Changed

  • WIT bundle JWKS entries now include "use": "wit-svid" as required by the SPIFFE WIT spec (#395)

v2.8.0

Added

  • Experimental SPIFFE Broker API protobuf definitions in the new exp/proto/spiffe/broker package (#388)

v2.7.0

Added

  • Experimental support for WIT-SVIDs, including the new exp/svid/witsvid and exp/bundle/witbundle packages and Workload API client support for fetching and watching WIT-SVIDs and WIT bundles (#385, #391)

Changed

  • X509-SVID verification now rejects leaf certificates with a SPIFFE ID that has a root path (#375)
  • Other dependency updates.
Changelog

Sourced from github.com/spiffe/go-spiffe/v2's changelog.

[2.8.1] - 2026-06-19

Changed

  • WIT bundle JWKS entries now include "use": "wit-svid" as required by the SPIFFE WIT spec (#395)

[2.8.0] - 2026-06-16

Added

  • Experimental SPIFFE Broker API protobuf definitions in the new exp/proto/spiffe/broker package (#388)

[2.7.0] - 2026-06-03

Added

  • Experimental support for WIT-SVIDs, including the new exp/svid/witsvid and exp/bundle/witbundle packages and Workload API client support for fetching and watching WIT-SVIDs and WIT bundles (#385, #391)

Changed

  • X509-SVID verification now rejects leaf certificates with a SPIFFE ID that has a root path (#375)
  • Other dependency updates.
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 22, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner June 22, 2026 23:14
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jun 22, 2026
@dependabot dependabot Bot mentioned this pull request Jun 22, 2026
Closed
@clawgenti clawgenti mentioned this pull request Jun 29, 2026
Closed
@evaline-ju

evaline-ju commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/go_modules/authbridge/authlib/github.com/spiffe/go-spiffe/v2-2.8.1 branch from 7084d31 to fe0e819 Compare June 30, 2026 15:08
@rubambiza rubambiza mentioned this pull request Jul 6, 2026
Closed
@clawgenti clawgenti mentioned this pull request Jul 9, 2026
Closed
@clawgenti

clawgenti commented Jul 9, 2026

Copy link
Copy Markdown

Dependency Update Analysis

Package: github.com/spiffe/go-spiffe/v2 (2.6.0 -> 2.8.1)
Ecosystem: pip | Age: 16 days (SLA: 14 days)
CI Status: unknown

Changelog Summary

Release notes

Sourced from github.com/spiffe/go-spiffe/v2's releases.

v2.8.1

Changed

  • WIT bundle JWKS entries now include "use": "wit-svid" as required by the SPIFFE WIT spec (#395)

v2.8.0

Added

  • Experimental SPIFFE Broker API protobuf definitions in the new exp/proto/spiffe/broker package (#388)

v2.7.0

Added

  • Experimental support for WIT-SVIDs, including the new exp/svid/witsvid and exp/bundle/witbundle packages and Workload API client support for fetching and watching WIT-SVIDs and WIT bundles (#385, #391)

Changed

  • X509-SVID verification now rejects leaf certificates with a SPIFFE ID that has a root path (#375)
  • Other dependency updates.

Risk Assessment

  • Breaking changes: None detected
  • Recommendation: Safe to merge (minor/patch, CI unknown, no breaking changes detected)

Automated analysis by Kagenti Dep Bump Fixer (scan 2026-07-09-002)

@rubambiza rubambiza mentioned this pull request Jul 13, 2026
Open
@clawgenti clawgenti mentioned this pull request Jul 13, 2026
Closed
@dependabot
build(deps): Bump github.com/spiffe/go-spiffe/v2 in /authbridge/authlib
1eee461 
Bumps [github.com/spiffe/go-spiffe/v2](https://github.com/spiffe/go-spiffe) from 2.6.0 to 2.8.1.
- [Release notes](https://github.com/spiffe/go-spiffe/releases)
- [Changelog](https://github.com/spiffe/go-spiffe/blob/main/CHANGELOG.md)
- [Commits](spiffe/go-spiffe@v2.6.0...v2.8.1)

---
updated-dependencies:
- dependency-name: github.com/spiffe/go-spiffe/v2
  dependency-version: 2.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/authbridge/authlib/github.com/spiffe/go-spiffe/v2-2.8.1 branch from fe0e819 to 1eee461 Compare July 13, 2026 19:10
@clawgenti

clawgenti commented Jul 14, 2026

Copy link
Copy Markdown

Dependency Update Analysis

Package: github.com/spiffe/go-spiffe/v2 (2.6.0 -> 2.8.1)
Ecosystem: pip | Age: 16 days (SLA: 14 days)
CI Status: unknown

Changelog Summary

Release notes

Sourced from github.com/spiffe/go-spiffe/v2's releases.

v2.8.1

Changed

  • WIT bundle JWKS entries now include "use": "wit-svid" as required by the SPIFFE WIT spec (#395)

v2.8.0

Added

  • Experimental SPIFFE Broker API protobuf definitions in the new exp/proto/spiffe/broker package (#388)

v2.7.0

Added

  • Experimental support for WIT-SVIDs, including the new exp/svid/witsvid and exp/bundle/witbundle packages and Workload API client support for fetching and watching WIT-SVIDs and WIT bundles (#385, #391)

Changed

  • X509-SVID verification now rejects leaf certificates with a SPIFFE ID that has a root path (#375)
  • Other dependency updates.

Risk Assessment

  • Breaking changes: None detected
  • Recommendation: Safe to merge (minor/patch, CI unknown, no breaking changes detected)

Automated analysis by Kagenti Dep Bump Fixer (scan 2026-07-14-002)

@pdettori pdettori mentioned this pull request Jul 15, 2026
Merged
@pdettori

pdettori commented Jul 15, 2026

Copy link
Copy Markdown
Member

Superseded by #673, which bundles this bump with the other authlib dependency updates and runs go mod tidy in the dependent envoy/proxy modules to fix the Go CI failure.

@pdettori pdettori closed this Jul 15, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@github-project-automation github-project-automation Bot moved this from New/ToDo to Done in Rossoctl Issue Prioritization Jul 15, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/authbridge/authlib/github.com/spiffe/go-spiffe/v2-2.8.1 branch July 15, 2026 23:09
pdettori added a commit to pdettori/kagenti-extensions that referenced this pull request Jul 16, 2026
@pdettori
build(deps): Bump authlib deps and tidy dependent modules
ae1f7e4 
Bundles Dependabot PRs rossoctl#638, rossoctl#639, rossoctl#670, rossoctl#541 into a single update:

- github.com/lestrrat-go/jwx/v2 2.1.6 -> 2.1.7 (rossoctl#638)
- google.golang.org/grpc 1.81.1 -> 1.82.0 (rossoctl#639)
- golang.org/x/net 0.56.0 -> 0.57.0 (rossoctl#670)
- github.com/spiffe/go-spiffe/v2 2.6.0 -> 2.8.1 (rossoctl#541)

The authbridge-envoy and authbridge-proxy modules replace authlib via a
local path directive, so bumping authlib's dependencies leaves their
go.sum stale. Dependabot only tidies the module it edits, which is why
each of the four PRs failed the envoy/proxy Go CI Lint step
(go vet with GOWORK=off: 'updates to go.mod needed; go mod tidy').
This bundle runs go mod tidy in all three modules.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

Rossoctl Issue Prioritization
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@evaline-ju @clawgenti @pdettori @rubambiza