Skip to content

chore(deps): bump the dependencies group across 1 directory with 2 updates #547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Aug 2, 2025
Merged

chore(deps): bump the dependencies group across 1 directory with 2 updates #547

merged 1 commit into from
Aug 2, 2025

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 28, 2025

Bumps the dependencies group with 2 updates in the / directory: github.com/openfga/openfga and github.com/spf13/pflag.

Updates github.com/openfga/openfga from 1.9.0 to 1.9.2

Release notes

Sourced from github.com/openfga/openfga's releases.

v1.9.2

Changed

  • Update ReverseExpand to use a LinkedList to track its relation stack for performance. #2542
  • Update ReverseExpand to use a intersection and exclusion handler to fast path check calls. #2543
  • Deduplicate queries more effectively in ReverseExpand. #2567
  • Update go version to 1.24.5 #2577

Fixed

  • Shared iterator race condition and deadlock. #2544
  • Fixed bug in how experimental ReverseExpand is handling Intersection nodes. #2556
  • Migration command now respects logging configuration options. #2541
  • Fixed message in log and slight refactor in list objects intersection/exclusion. #2566
  • Shadow list objects' check resolver should use its own cache. #2574
  • Improve performance for list objects intersection/exclusion with enable-list-objects-optimizations flag. #2569

Full Changelog

  • 04404e7f83215fb4f45ffa71a65cccbf1f4456a7 Fix migrate command logging options (#2565)
  • db65b2a6620c8bb3ca489f0d83299828a5ad4a9f Fix: experimental reverse_expand must traverse all DirectEdges from Intersection (#2556)
  • 5de6f1d521cc8eb34437422ced55a6e27540bbcc Log main and shadow ListObjects query latencies (#2539)
  • 37d5ee1c6c1d6d0565874c098806920f736bca41 Update changelog to prep for 1.9.1 release (#2580)
  • 3ab5a75689378e53a49acfae2dbf039ebd62cf0a Update changelog to prep for 1.9.2 release (#2582)
  • dbbb217a244be237e4af1fa422206bd51cb614b4 Update stack funcs to use values, not pointers (#2555)
  • 56215007c5475061271f453965e53a1d9d2f4c20 chore(deps): bump the dependencies group with 2 updates (#2546)
  • d4a72c4e834aa5b96690db21571a63cbf78ea7a2 chore(deps): bump the dependencies group with 2 updates (#2576)
  • 8b3f0edbdf851ddd8c73b10f704eb5f1aac2890a chore: add datastore_query_count to shadow list objects logger (#2562)
  • 2c4e7ab4e0affecc72b14511fa6d4a1641a234bc chore: shared iterator benchmark cleanup (#2552)
  • 11ac7e4a249a39492b67ea823cf25b7144b7ec52 chore: update go version to 1.24.5 (#2577)
  • 8e38786e21ae116d85f1f018cddf927cfec4591b feat: add list objects intersection exclusion (#2543)
  • 336306ef64acc5bccdd6ef7458e866f180ba36f7 feat: list objects weighted graph vs non-weighted graph count (#2524)
  • b8c9b630e66596ef291a929a71e9c95d9144357c feat: shadow list objects resolver should use its own cache (#2574)
  • 6a8123602861ab1fb8745076c89918aec5961bb0 fix data race around wait group in shared iterator (#2561)
  • 741ebe915b73763de691769d2a763a1f5e199d46 fix: Don't run shadow ListObjects query for request weight=∞ (#2572)
  • 547880795dcf7639a8a2f9f1c786857456487f52 fix: Reduce number of DB queries needed in ReverseExpand (#2567)
  • 0b36242be8ec4891572e486fc903b3483310a9bc fix: add shared iterator count decrement when the timer evicts the iterator (#2550)
  • 1301ec14e4f83f4b0759d7fdeffd6e860fcb5d40 fix: list objects intersection exclusion improvements (#2566)
  • 12596fcb7f980b2a65f3398adb064690bab2e2c8 fix: race condition in throttler test (#2545)
  • 29d6dbcc11018082b96a5473d1111300ebd62db6 fix: shared iterator race and deadlock (#2544)
  • db462b6d0dbf84cc5a9997d0e68211ed405326d4 fix: update shadow list objects env var config (#2547)
  • 1db4baee564fcd65fb46ee6b6e7595290e4ae3f7 fix: use pool per intersection/exclusion so as not to block (#2569)
  • 516be813eac61463d1bb1a98880daea1e86c4c53 perf: create per datastore operation caches for shared iterators (#2549)
  • 791b0f8f8bcb6847d6a4cd35b303ba78a9a34a37 perf: improve cloning performance of shared iterator (#2551)
  • 48be31a2325b3b683ef45890d7415a699a2a8f26 perf: shared iterator performance refactor (#2553)
  • 8522c0d3d32cd1e9f8259dc41ea178c29998885c reduce the time that an await mutex lock is held in the shared iterator (#2557)
  • e6038fd62466a6a289dbb4c85affbc2ff04e6916 refactor: use a linked list in ReverseExpand instead of copying slices (#2542)
  • e383258a3d99330d6d3775a3205675b9e573e2bf short circuit iteratorsToUserset (#2568)
  • ca1182c6e1016cd36ebb50ac0d3777c0c114912b validate that shadow mode is executed when main context cancelled (#2548)
Changelog

Sourced from github.com/openfga/openfga's changelog.

[1.9.2] - 2025-07-24

Added

  • Add list_objects_optimization_count metric to list objects requests. #2524

Changed

  • Update ReverseExpand to use a LinkedList to track its relation stack for performance. #2542
  • Update ReverseExpand to use a intersection and exclusion handler to fast path check calls. #2543
  • Deduplicate queries more effectively in ReverseExpand. #2567
  • Update go version to 1.24.5 #2577

Fixed

  • Shared iterator race condition and deadlock. #2544
  • Fixed bug in how experimental ReverseExpand is handling Intersection nodes. #2556
  • Migration command now respects logging configuration options. #2541
  • Fixed message in log and slight refactor in list objects intersection/exclusion. #2566
  • Shadow list objects' check resolver should use its own cache. #2574
  • Improve performance for list objects intersection/exclusion with enable-list-objects-optimizations flag. #2569

[1.9.1] - 2025-07-22

Changed

  • WARNING: This is an incorrect version and should not be used. Please upgrade to version v1.9.2 and do not use its companion docker image with the sha: sha256:71212e9aa2f26cd74287babf7eb92743b8510960388ff0b5ac68d89a23728898
Commits
  • 3ab5a75 Update changelog to prep for 1.9.2 release (#2582)
  • 37d5ee1 Update changelog to prep for 1.9.1 release (#2580)
  • 1db4bae fix: use pool per intersection/exclusion so as not to block (#2569)
  • 741ebe9 fix: Don't run shadow ListObjects query for request weight=∞ (#2572)
  • 11ac7e4 chore: update go version to 1.24.5 (#2577)
  • b8c9b63 feat: shadow list objects resolver should use its own cache (#2574)
  • d4a72c4 chore(deps): bump the dependencies group with 2 updates (#2576)
  • 04404e7 Fix migrate command logging options (#2565)
  • 5478807 fix: Reduce number of DB queries needed in ReverseExpand (#2567)
  • e383258 short circuit iteratorsToUserset (#2568)
  • Additional commits viewable in compare view

Updates github.com/spf13/pflag from 1.0.6 to 1.0.7

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.0.7

What's Changed

New Contributors

Full Changelog: spf13/pflag@v1.0.6...v1.0.7

Commits
  • f9cbdd9 Merge pull request #348 from max-frank/add-time-flag-support
  • e3be2eb Reduce duplication by forwarding to sibling functions
  • 7cc25e3 Don't export TimeValue (yet)
  • d15848d Remove unnecessary time test stderr dev null redirect
  • c5ce22e Use time.Time for expectations in time flag tests
  • 1992c5a Add support for time.Time flags
  • 1c62fb2 Merge pull request #431 from LeGEC/430-fix-usage-message-for-func-flags
  • 1a4b5b2 fix discrepancy in order of arguments for Func() and BoolFunc() #433
  • 4730aa0 fix help message for Func and BoolFunc flags #430
  • f4c97c2 minor: fix typos in comments
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the dependencies group across 1 directory with 2 up…
951347b 
…dates

Bumps the dependencies group with 2 updates in the / directory: [github.com/openfga/openfga](https://github.com/openfga/openfga) and [github.com/spf13/pflag](https://github.com/spf13/pflag).


Updates `github.com/openfga/openfga` from 1.9.0 to 1.9.2
- [Release notes](https://github.com/openfga/openfga/releases)
- [Changelog](https://github.com/openfga/openfga/blob/main/CHANGELOG.md)
- [Commits](openfga/openfga@v1.9.0...v1.9.2)

Updates `github.com/spf13/pflag` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/spf13/pflag/releases)
- [Commits](spf13/pflag@v1.0.6...v1.0.7)

---
updated-dependencies:
- dependency-name: github.com/openfga/openfga
  dependency-version: 1.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: github.com/spf13/pflag
  dependency-version: 1.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 28, 2025
@dependabot dependabot bot requested a review from a team as a code owner July 28, 2025 17:40
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 28, 2025
@coderabbitai coderabbitai
Copy link
Contributor

coderabbitai bot commented Jul 28, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Explain this complex logic.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai explain this code block.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and explain its main purpose.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Join our Discord community for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@socket-security Socket Security
Copy link

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedgithub.com/​openfga/​openfga@​v1.9.0 ⏵ v1.9.283 +110010010070
Updatedgithub.com/​spf13/​pflag@​v1.0.6 ⏵ v1.0.79710010010080

View full report

@socket-security Socket Security
Copy link

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert (click for details)
Warn High
github.com/openfga/openfga@v1.9.2 has a License Policy Violation.

License: CC-BY-4.0 (NOTICE)

License: CC-BY-SA-4.0 (NOTICE)

License: GPL-2.0-only (NOTICE)

License: GPL-2.0-or-later (NOTICE)

License: MPL-2.0 (NOTICE)

License: MPL-2.0 (NOTICE)

License: CC-BY-SA-4.0 (NOTICE)

License: MPL-2.0 (NOTICE)

From: go.mod → golang/github.com/openfga/openfga@v1.9.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/openfga/openfga@v1.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@rhamzeh rhamzeh added this pull request to the merge queue Aug 2, 2025
Merged via the queue into main with commit d9df07f Aug 2, 2025
20 checks passed
@rhamzeh rhamzeh deleted the dependabot/go_modules/dependencies-d8692367a3 branch August 2, 2025 16:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rhamzeh rhamzeh rhamzeh approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@rhamzeh