fix(deps): update osv-scanner minor (#2427)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | |---|---|---|---|---|---| | [deps.dev/api/v3](https://redirect.github.com/google/deps.dev) | `v3.0.0-20251127011616-f763ce91ff53` → `v3.0.0-20251219105704-58e32bc05c71` |  |  | require | patch | | [deps.dev/api/v3alpha](https://redirect.github.com/google/deps.dev) | `f763ce9` → `58e32bc` |  |  | require | digest | | [deps.dev/util/maven](https://redirect.github.com/google/deps.dev) | `f763ce9` → `58e32bc` |  |  | require | digest | | [deps.dev/util/resolve](https://redirect.github.com/google/deps.dev) | `f763ce9` → `58e32bc` |  |  | require | digest | | [deps.dev/util/semver](https://redirect.github.com/google/deps.dev) | `f763ce9` → `58e32bc` |  |  | require | digest | | [github.com/BurntSushi/toml](https://redirect.github.com/BurntSushi/toml) | `v1.5.0` → `v1.6.0` |  |  | require | minor | | [github.com/gkampitakis/go-snaps](https://redirect.github.com/gkampitakis/go-snaps) | `v0.5.18` → `v0.5.19` |  |  | require | patch | | [github.com/goccy/go-yaml](https://redirect.github.com/goccy/go-yaml) | `v1.19.0` → `v1.19.1` |  |  | require | patch | | [github.com/jedib0t/go-pretty/v6](https://redirect.github.com/jedib0t/go-pretty) | `v6.7.7` → `v6.7.8` |  |  | require | patch | | [github.com/modelcontextprotocol/go-sdk](https://redirect.github.com/modelcontextprotocol/go-sdk) | `v1.1.0` → `v1.2.0` |  |  | require | minor | | [github.com/ossf/osv-schema/bindings/go](https://redirect.github.com/ossf/osv-schema) | `c18cb69` → `88c4875` |  |  | require | digest | | [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) | `v1.77.0` → `v1.78.0` |  |  | require | minor | | [osv.dev/bindings/go](https://redirect.github.com/google/osv.dev) | `bdb4de0` → `f5c9699` |  |  | require | digest | --- ### Release Notes <details> <summary>BurntSushi/toml (github.com/BurntSushi/toml)</summary> ### [`v1.6.0`](https://redirect.github.com/BurntSushi/toml/releases/tag/v1.6.0) [Compare Source](https://redirect.github.com/BurntSushi/toml/compare/v1.5.0...v1.6.0) TOML 1.1 is now enabled by default. The TOML changelog has an overview of changes: <https://github.com/toml-lang/toml/blob/main/CHANGELOG.md> Also two small fixes: - Encode large floats as exponent syntax so that round-tripping things like `5e+22` is correct. - Using duplicate array keys would not give an error: ``` arr = [1] arr = [2] ``` This will now correctly give a "Key 'arr' has already been defined" error. </details> <details> <summary>gkampitakis/go-snaps (github.com/gkampitakis/go-snaps)</summary> ### [`v0.5.19`](https://redirect.github.com/gkampitakis/go-snaps/releases/tag/v0.5.19) [Compare Source](https://redirect.github.com/gkampitakis/go-snaps/compare/0.5.18...v0.5.19) ##### What's Changed - fix: use backticks for inline snaps when appropriate by [@​gkampitakis](https://redirect.github.com/gkampitakis) in [#​149](https://redirect.github.com/gkampitakis/go-snaps/pull/149) **Full Changelog**: <https://github.com/gkampitakis/go-snaps/compare/0.5.18...v0.5.19> </details> <details> <summary>goccy/go-yaml (github.com/goccy/go-yaml)</summary> ### [`v1.19.1`](https://redirect.github.com/goccy/go-yaml/releases/tag/v1.19.1): 1.19.1 [Compare Source](https://redirect.github.com/goccy/go-yaml/compare/v1.19.0...v1.19.1) #### What's Changed - Fix decoding of integer keys of map type by [@​goccy](https://redirect.github.com/goccy) in [#​829](https://redirect.github.com/goccy/go-yaml/pull/829) - Support line comment for flow sequence or flow map by [@​goccy](https://redirect.github.com/goccy) in [#​834](https://redirect.github.com/goccy/go-yaml/pull/834) **Full Changelog**: <https://github.com/goccy/go-yaml/compare/v1.19.0...v1.19.1> </details> <details> <summary>jedib0t/go-pretty (github.com/jedib0t/go-pretty/v6)</summary> ### [`v6.7.8`](https://redirect.github.com/jedib0t/go-pretty/releases/tag/v6.7.8) [Compare Source](https://redirect.github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8) #### What's Changed - progress: SortByIndex for better control of sorting by [@​jedib0t](https://redirect.github.com/jedib0t) in [#​398](https://redirect.github.com/jedib0t/go-pretty/pull/398) - progress: address race conditions in render/stop/trackers; fixes 399 by [@​jedib0t](https://redirect.github.com/jedib0t) in [#​401](https://redirect.github.com/jedib0t/go-pretty/pull/401) **Full Changelog**: <https://github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8> </details> <details> <summary>modelcontextprotocol/go-sdk (github.com/modelcontextprotocol/go-sdk)</summary> ### [`v1.2.0`](https://redirect.github.com/modelcontextprotocol/go-sdk/releases/tag/v1.2.0) [Compare Source](https://redirect.github.com/modelcontextprotocol/go-sdk/compare/v1.1.0...v1.2.0) ***This release is equivalent to v1.2.0-pre.2. Thank you to those who tested the prerelease.*** This release adds partial support for the [2025-11-25 version](https://modelcontextprotocol.io/specification/2025-11-25/changelog) of the MCP spec and fixes some bugs in the streamable transports. It also includes some minor new APIs, changes to contributing flows, and small bugfixes. #### Contributing changes - CONTRIBUTING.md is updated to remove the ad-hoc antitrust policy ([#​651](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/651)), and add a dependency update policy ([#​635](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/635)). - An example server (`examples/server/conformance`) is added for the new conformance tests at modelcontextprotocol/conformance. Test can be run with `scripts/conformance.sh` ([#​650](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/650)). #### Partial support for the 2025-11-25 spec The following SEPs from the 2025-11-25 spec are now supported. Please see [#​725](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/725) for the proposed API additions included to support these SEPs. - SEP-973: icons and metadata ([#​570](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/570)) - SEP-986: tool name validation ([#​640](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/640)) - SEP-1024: elicitation defaults ([#​644](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/644)) - SEP-1036: URL mode elicitation ([#​646](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/646)) - SEP-1699: SSE polling ([#​663](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/663)) - SEP-1330: elicitation enum improvements ([#​676](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/676)) #### Other API additions - Common error codes are now available through the sentinel `jsonrpc.Error` ([#​452](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/452)) - OAuth 2.0 Protected Resource Metadata support ([#​643](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/643)) - `ClientCapabilities.RootsV2` and RootCapabilities are added to work around an API bug ([#​607](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/607)) - `Capabilities` fields are added to `ServerOptions` and `ClientOptions`, to simplify capability configuration ([#​706](https://redirect.github.com/modelcontextprotocol/go-sdk/issues/706)) #### Streamable fixes Several bug fixes are included for the streamable transports: - mcp: relax SSE connection response handling in non-strict mode by [@​zhxie](https://redirect.github.com/zhxie) in [#​611](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/611) - Fix: Skip non-message SSE events in processStream by [@​raphaelmansuy](https://redirect.github.com/raphaelmansuy) in [#​637](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/637) - mcp: better handling for streamable context cancellation by [@​findleyr](https://redirect.github.com/findleyr) in [#​677](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/677) - mcp: don't break the streamable client connection for transient errors by [@​findleyr](https://redirect.github.com/findleyr) in [#​723](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/723) #### Other notable bugfixes - fix: handle Windows CRLF in MCP client by [@​isfzhang](https://redirect.github.com/isfzhang) in [#​665](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/665) - auth, mcp: add UserID to TokenInfo for session hijacking prevention by [@​findleyr](https://redirect.github.com/findleyr) in [#​695](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/695) - internal/docs: document UserID for session hijacking prevention by [@​findleyr](https://redirect.github.com/findleyr) in [#​697](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/697) - mcp: allow re-using connections in more cases by [@​howardjohn](https://redirect.github.com/howardjohn) in [#​709](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/709) - oauthex: validate URL schemes in auth server metadata and DCR by [@​findleyr](https://redirect.github.com/findleyr) in [#​712](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/712) - mcp: debounce server change notifications by [@​findleyr](https://redirect.github.com/findleyr) in [#​717](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/717) - oauthex: fix content type check in getJSON by [@​nikolavp](https://redirect.github.com/nikolavp) in [#​721](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/721) #### New Contributors - [@​zhxie](https://redirect.github.com/zhxie) made their first contribution in [#​611](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/611) - [@​SpringMT](https://redirect.github.com/SpringMT) made their first contribution in [#​614](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/614) - [@​raphaelmansuy](https://redirect.github.com/raphaelmansuy) made their first contribution in [#​637](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/637) - [@​markus-kusano](https://redirect.github.com/markus-kusano) made their first contribution in [#​644](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/644) - [@​isfzhang](https://redirect.github.com/isfzhang) made their first contribution in [#​665](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/665) - [@​orius123](https://redirect.github.com/orius123) made their first contribution in [#​643](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/643) - [@​howardjohn](https://redirect.github.com/howardjohn) made their first contribution in [#​709](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/709) - [@​nikolavp](https://redirect.github.com/nikolavp) made their first contribution in [#​721](https://redirect.github.com/modelcontextprotocol/go-sdk/pull/721) **Full Changelog**: <https://github.com/modelcontextprotocol/go-sdk/compare/v1.1.0...v1.2.0> </details> <details> <summary>grpc/grpc-go (google.golang.org/grpc)</summary> ### [`v1.78.0`](https://redirect.github.com/grpc/grpc-go/releases/tag/v1.78.0): Release 1.78.0 [Compare Source](https://redirect.github.com/grpc/grpc-go/compare/v1.77.0...v1.78.0) ##### Behavior Changes - client: Reject target URLs containing unbracketed colons in the hostname in Go version 1.26+. ([#​8716](https://redirect.github.com/grpc/grpc-go/issues/8716)) - Special Thanks: [@​neild](https://redirect.github.com/neild) ##### New Features - stats/otel: Add backend service label to wrr metrics as part of A89. ([#​8737](https://redirect.github.com/grpc/grpc-go/issues/8737)) - stats/otel: Add subchannel metrics (without the disconnection reason) to eventually replace the pickfirst metrics. ([#​8738](https://redirect.github.com/grpc/grpc-go/issues/8738)) - client: Wait for all pending goroutines to complete when closing a graceful switch balancer. ([#​8746](https://redirect.github.com/grpc/grpc-go/issues/8746)) - Special Thanks: [@​twz123](https://redirect.github.com/twz123) ##### Bug Fixes - transport/client : Return status code `Unknown` on malformed grpc-status. ([#​8735](https://redirect.github.com/grpc/grpc-go/issues/8735)) - client: Add `experimental.AcceptCompressors` so callers can restrict the `grpc-accept-encoding` header advertised for a call. ([#​8718](https://redirect.github.com/grpc/grpc-go/issues/8718)) - Special Thanks: [@​iblancasa](https://redirect.github.com/iblancasa) - xds: Fix a bug in `StringMatcher` where regexes would match incorrectly when ignore\_case is set to true. ([#​8723](https://redirect.github.com/grpc/grpc-go/issues/8723)) - xds/resolver: - Drop previous route resources and report an error when no matching virtual host is found. - Only log LDS/RDS configuration errors following a successful update and retain the last valid resource to prevent transient failures. ([#​8711](https://redirect.github.com/grpc/grpc-go/issues/8711)) - client: - Change connectivity state to CONNECTING when creating the name resolver (as part of exiting IDLE). - Change connectivity state to TRANSIENT\_FAILURE if name resolver creation fails (as part of exiting IDLE). - Change connectivity state to IDLE after idle timeout expires even when current state is TRANSIENT\_FAILURE. - Fix a bug that resulted in `OnFinish` call option not being invoked for RPCs where stream creation failed. ([#​8710](https://redirect.github.com/grpc/grpc-go/issues/8710)) - xdsclient: Fix a race in the xdsClient that could lead to resource-not-found errors. ([#​8627](https://redirect.github.com/grpc/grpc-go/issues/8627)) ##### Performance Improvements - mem: Round up to nearest 4KiB for pool allocations larger than 1MiB. ([#​8705](https://redirect.github.com/grpc/grpc-go/issues/8705)) - Special Thanks: [@​cjc25](https://redirect.github.com/cjc25) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 6am on monday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/google/osv-scanner). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi41OS4wIiwidXBkYXRlZEluVmVyIjoiNDIuNjkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
M
Mend Renovate committed
c8a2deaeb4af786ba4e12c0557df804cfd37d1d8
Parent: cc37ac7
Committed by GitHub <noreply@github.com>
on 1/8/2026, 12:29:28 AM