Skip to content

chore(deps): update go-dependencies (9.5) - #8213

Merged
macdewee merged 2 commits into
9.5from
renovate/9.5-golang/go-dependencies
Nov 9, 2026
Merged

chore(deps): update go-dependencies (9.5)#8213
macdewee merged 2 commits into
9.5from
renovate/9.5-golang/go-dependencies

Conversation

@elastic-renovate-prod

@elastic-renovate-prod elastic-renovate-prod Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
github.com/fxamacker/cbor/v2 require minor v2.9.6 → v2.10.0
golang.org/x/net require minor v0.61.0 → v0.62.0
google.golang.org/grpc require minor v1.84.0 → v1.85.0

Release Notes

fxamacker/cbor (github.com/fxamacker/cbor/v2)

v2.10.0

Compare Source

v2.10 speeds up encoding by up to 2.88× and decoding by up to 1.87× with zero memory regressions (B/op, allocs/op), reduces memory use, adds the toindefarray struct tag option, and fixes bugs. The Contributing Guidelines, Security Policy, and templates were extensively updated.

Encoding sorted nested maps of dynamic JSON-like data to CBOR drops from 70 allocs/op to 1 and from 7.2 KiB/op to 4.0 KiB/op in the benchmarks below. Encoding time.Time, big.Int, Tag and Marshaler values, and decoding into time.Time, big.Int and Tag, use 1 to 2 fewer allocs/op (20% to 50% fewer).

This release does not use Go's unsafe package. Performance in user apps depends on configuration and data.

Tests were refactored and coverage increased to 97.7%. Fuzz tests (not yet public) were also extended. Internal checklists and procedures were updated to reduce potential mistakes.

Performance and Benchmarks

Across all 215 benchmarks, there are zero memory regressions (B/op, allocs/op). Just one benchmark showed a speed dip: Marshal/struct_many_flds_all_omitempty_all_empty/map is ~4-5% slower, but only when a struct has 32 fields that are both omitzero and empty (same scenario with an 8-field struct is now faster).

Benchmarks ran with Go 1.26.10 on linux/amd64 (benchstat n=10, p=0.000):

  • CBOR Speedup by Data Type: groups of different benchmarks summarized per row
  • CBOR Encoding Reflection-Free Speedup: dynamic JSON-like data types and common types
CBOR Speedup by Data Type
Unmarshal Speedup ΔSec/op
Single values (bool, int, float, byte string, text string) 1.10× to 1.51×¹ -8.87% to -33.92%¹
Epoch time, bignum, other tags 1.18× to 1.64× -15.33% to -38.91%
Arrays and maps to non-struct 1.33× to 1.87× -24.63% to -46.49%
Arrays and maps to structs 1.06× to 1.52× -5.46% to -34.40%
Real-world (COSE, CWT, SenML, WebAuthn) 1.35× to 1.64× -26.06% to -39.19%

¹ 2.54× speedup (-60.64%) when decoding into a named []byte type that has methods.

Marshal Speedup ΔSec/op
Single values (bool, int, float, byte slice, string) 1.32× to 1.55× -24.49% to -35.41%
time.Time, big.Int, Tag, Marshaler² 1.15× to 1.63× -12.94% to -38.84%
Slices and maps 1.35× to 2.88× -25.97% to -65.26%
Structs 1.57× to 2.17× -36.37% to -53.96%
Structs with omitempty fields 0.95׳ to 1.35× +5.01%³ to -25.96%
Real-world (COSE, CWT, SenML, WebAuthn) 1.12× to 1.33× -10.66% to -24.77%

² For addressable values (reached through a pointer, struct field, slice element or map value).

³ Only when every field is omitempty and empty: 7.6 ns slower for a 32-field struct, 2.37 ns faster for an 8-field struct. This is the only performance regression in all 215 benchmarks.

CBOR Encoding Reflection-Free Speedup

PR #​870 optimized common types: int, int64, uint, uint64, float64, bool, string, nil, []byte, []any, map[any]any, map[string]any, and map[string]string.

Marshal Benchmark
v2.9.6 → v2.10		 Speedup Time
ΔSec/op		 Memory
ΔB/op		 Memory
ΔAllocs/op
[]any 2.50× -607.5 ns (-60.03%) - -
map[string]any 2.60× -821.9 ns (-61.47%) - -
map[string]string 2.59× -335.9 ns (-61.34%) - -
nested_map[any]any 2.88× -16.542 µs (-65.26%) - -
nested_map[string]any 2.78× -14.201 µs (-64.01%) - -
nested_map[any]any, bw_lex 2.53× -22.36 µs (-60.54%) -3314 (-44.72%) -69 (-98.57%)
nested_map[string]any, bw_lex 2.41× -19.52 µs (-58.54%) -3323 (-44.79%) -69 (-98.57%)
  • bw_lex = SortBytewiseLexical. Memory improvements are from #​774 and #​860.

Upgrade Notes

  • Go 1.24 or newer is required (#​773). All tests (97.7% coverage) pass on Go 1.24-1.27.
  • Pointer-receiver marshal methods (user-implemented methods) are called on the original value instead of a copy when the value is addressable (#​866).
  • Marshal configured to use TagsForbidden returns an error for a big.Int outside [-2^64, 2^64-1], and EncMode creation returns an error for settings that would emit tags if TagsForbidden is also set (#​868).
  • Decoder advances past well-formed data items rejected by DecOptions value or serialization restrictions (e.g. NaN, IndefLength), and Skip skips them without an error (#​872).
  • Marshal configured to emit text-based time returns an error for time.Time outside RFC 3339 limits (#​873).

TinyGo (experimental)

TinyGo support for v2.10.0 is available in tag tinygo-beta/v2.10.0-tinygo0.42 (branch feature/cbor-tinygo-beta). It requires TinyGo 0.42.0 or newer. It is experimental and not fuzz tested. For details, see TinyGo (https://github.com/fxamacker/cbor#tinygo) in the README.

What's Changed

⭐ Features
  • feat: add toindefarray struct tag option for CBOR indefinite-length arrays by @​tdnguyenND in #​770
🚀 Optimizations
🛠 Improvements
🐞 Bug Fixes
🧪 Testing
📖 Documentation
📖 Contributing Guidelines, Security Policy, and Templates
CI / GitHub Actions
🔎 Details
Other Changes
Ported from release-2.9

Already released in v2.9.3 through v2.9.6.

🔎 Details
Dependabot Updates
🔎 Details

New Contributors

Full Changelog: fxamacker/cbor@v2.9.6...v2.10.0

grpc/grpc-go (google.golang.org/grpc)

v1.85.0: Release 1.85.0

Compare Source

New Features

  • stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#​9296)
  • metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#​9282)

Bug Fixes

  • transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#​9563)
  • server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#​9394)
  • server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#​9414)
  • server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#​9391)
  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#​9365)
  • xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#​9353)
  • client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#​9277)
  • transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#​9204)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@elastic-renovate-prod
elastic-renovate-prod Bot requested a review from a team as a code owner November 9, 2026 01:39
@elastic-renovate-prod elastic-renovate-prod Bot added automation backport-skip Skip notification from the automated backport with mergify dependency skip-changelog Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team labels Nov 9, 2026
@elastic-renovate-prod
elastic-renovate-prod Bot requested review from macdewee and a balanced review from Copilot and removed request for a team November 9, 2026 01:39
@elastic-renovate-prod

elastic-renovate-prod Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated

Details:

Package Change
google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 -> v0.0.0-20260817212433-ac3dfec99bb1

Copilot AI reviewed Nov 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The dependency updates leave NOTICE.txt and NOTICE-fips.txt stale, causing mage check:ci to fail when notice regeneration produces uncommitted changes.

1 open issue
What changed in this PR

Updates Fleet Server’s Go dependencies for the 9.5 branch without changing application code.

Changes:

  • Upgrades CBOR to v2.10.0, x/net to v0.62.0, and gRPC to v1.85.0.
  • Updates the indirect Google RPC dependency and refreshes checksums, including OpenTelemetry-related changes.
File Description
go.sum Refreshes checksums for updated dependencies and transitive versions.
go.mod Updates three direct dependencies and the indirect Google RPC dependency.

Review effort: Balanced

Comment thread go.mod Resolved
Copilot AI balanced review requested due to automatic review settings November 9, 2026 01:40
Copilot AI reviewed Nov 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues block the dependency, checksum, and license-notice updates.

1 open issue

Review effort: Balanced

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

Dependency Update Analysis

Summary: Reviewed 3 Go module bumps (github.com/fxamacker/cbor/v2, golang.org/x/net, google.golang.org/grpc); overall risk is low-to-moderate (mainly due missing upstream notes for x/net), with no repo-impacting breaking changes found.

Dependency 1: github.com/fxamacker/cbor/v2 v2.9.6 → v2.10.0

Ecosystem: Go

Check Result
Breaking changes ✅ None found for repo usage
Testable in PR ✅ Yes
Changelog highlights (v2.9.6 → v2.10.0)
  • Performance-focused release; no unsafe usage added.
  • Upgrade notes include stricter behavior for TagsForbidden, time range validation, and decoder restriction handling.
  • Go minimum is 1.24+ (repo is on Go 1.26.10).
  • No explicit CVE/GHSA entries in release notes.
Usage in this repository
  • internal/pkg/file/cbor/decode.go:10 imports github.com/fxamacker/cbor/v2.
  • API used: fxcbor.NewDecoder(...), Decoder.Decode(&p) for chunk decoding.
Compatibility assessment

Current usage is basic decode flow (no custom EncMode/DecOptions, no TagsForbidden tuning), so noted upstream behavioral tightenings do not conflict with observed usage.

Dependency 2: golang.org/x/net v0.61.0 → v0.62.0

Ecosystem: Go

Check Result
Breaking changes ✅ None found for repo usage
Testable in PR ✅ Yes
Changelog highlights (v0.61.0 → v0.62.0)

Upstream release-note body was unavailable after MCP tag/release lookups (no GitHub release for this tag); local metadata confirms only the version bump.
No CVE/GHSA claims were available from fetched metadata.

Usage in this repository
  • internal/pkg/limit/listener_test.go:14 imports golang.org/x/net/nettest.
  • API used: nettest.NewLocalListener("tcp") in tests.
Compatibility assessment

Observed usage is test-only helper API (nettest) and remains low blast radius. No repository usage indicates dependency on unstable/internal x/net behavior.

Dependency 3: google.golang.org/grpc v1.84.0 → v1.85.0

Ecosystem: Go

Check Result
Breaking changes ✅ None found for repo usage
Testable in PR ✅ Yes
Changelog highlights (v1.84.0 → v1.85.0)
  • New metadata/stats helpers.
  • Multiple transport/server bug fixes (including HTTP/2 stream handling and authority/header validation correctness).
  • No explicit CVE/GHSA entries in release notes.
Usage in this repository
  • internal/pkg/server/agent_integration_test.go:32-33 imports grpc packages.
  • APIs used include grpc.WithTransportCredentials(...) and grpc.NewServer(...) in integration-test control server setup.
Compatibility assessment

Repo usage is integration-test focused and relies on stable server/client setup APIs, which are not reported as removed/changed in the release notes.

Labels Applied

  • oblt-aw/ai/merge-ready — applied (low-to-moderate risk, no breaking repo usage found, and PR-context testability is available).

What is this? | From workflow: Observability Agentic Workflow — Pull Request

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

@github-actions

github-actions Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

Automerge skipped

Automerge skipped this pull request because the update-beats collection is not enabled for this repository.

To allow automerge for this kind of update, enable the matching collection under Automerge on the Control Plane Dashboard (the oblt-aw/dashboard issue). See Automerge dependency collections for what each collection covers.

See Opt in or opt out for how to enable or disable Automerge collections on the Control Plane Dashboard.

Collections currently enabled for automerge: github-actions, pre-commit, vm-images

Changed files considered:

  • NOTICE-fips.txt
  • NOTICE.txt
  • go.mod
  • go.sum
  • testing/go.mod
  • testing/go.sum

@github-actions

github-actions Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

TL;DR

Run check-ci failed because Go module files were out of sync in the testing module (go fix under multiple test tags hit go: updates to go.mod needed). Update/tidy module files (especially under testing/) and rerun CI.

Remediation

  • In the PR branch, run:
    • go mod tidy
    • cd testing && go mod tidy
  • Commit any resulting go.mod / go.sum changes, then rerun Buildkite (check-ci).
Investigation details

Root Cause

check:ci runs Check.Fix, which executes go fix repeatedly, including in testing/ for 4 tag sets (e2e, cloude2e, requirefips,e2e, requirefips,cloude2e) in magefile.go (Check.Fix, around lines 642-656). The failing log shows the same module-sync error repeated 4 times, matching those runs.

Evidence

Verification

  • Local verification commands: not run (this workflow is investigative/read-only for CI failure triage).

Follow-up

  • This failed build is for commit e26355d...; PR metadata now shows a newer head commit. If module-sync changes were already added after that commit, a rerun on latest head should confirm the fix.

What is this? | From workflow: Observability Agentic Workflow — Status

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

@github-actions

github-actions Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

Dependency review finished without posting an analysis comment.

If you expected a review, push a new commit to this pull request (or close and reopen it) to try again.

Workflow run: https://github.com/elastic/fleet-server/actions/runs/42546745832

@macdewee
macdewee merged commit 32693f8 into 9.5 Nov 9, 2026
36 checks passed
@macdewee
macdewee deleted the renovate/9.5-golang/go-dependencies branch November 9, 2026 10:12
andrzej-stencel added a commit that referenced this pull request Nov 9, 2026
@andrzej-stencel @cursoragent
Merge branch '9.5' into mergify/bp/9.5/pr-8192
62c152b 
Resolved conflicts with #8213 by taking 9.5's go.mod, go.sum, testing/go.mod, testing/go.sum and NOTICE files, then re-pinning github.com/elastic/beats/v7 to the same 9.5 commit, running go mod tidy in both modules and mage check:notice.

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@macdewee macdewee macdewee approved these changes

Assignees

No one assigned

Labels

automation backport-skip Skip notification from the automated backport with mergify dependency oblt-aw/ai/merge-ready skip-changelog Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@macdewee