fix(deps): update go dependencies

[GiteaBot]

This PR contains the following updates:

Package	Change	Age	Confidence
gitea.dev/sdk	v1.1.0 → v1.2.0
github.com/aws/aws-sdk-go-v2/credentials	v1.19.24 → v1.19.25
github.com/aws/aws-sdk-go-v2/service/codecommit	v1.34.4 → v1.34.5
github.com/klauspost/compress	v1.18.6 → v1.19.0
github.com/klauspost/cpuid/v2	v2.3.0 → v2.4.0
github.com/minio/minio-go/v7	v7.2.0 → v7.2.1
github.com/urfave/cli/v3	v3.10.0 → v3.10.1
gitlab.com/gitlab-org/api/client-go/v2	v2.42.0 → v2.44.0
google.golang.org/grpc	v1.81.1 → v1.82.0
xorm.io/xorm	v1.3.11 → v1.4.1

---

Release Notes

klauspost/compress (github.com/klauspost/compress)

v1.19.0

Compare Source

What's Changed

• zstd: Add true concurrent stream encoding by @​klauspost in #​1136
• zstd: arm64 decoder asm by @​lizthegrey in #​1160
• zstd: avoid unused BuildDict encoder allocation by @​snissn in #​1147
• flate: Add inflate checkpoints by @​klauspost in #​1154
• snappy/s2: Limit length of varint in decodedLen by @​eustas in #​1148
• gzhttp: match qvalue parameter case-insensitively (RFC 7231) by @​z9z in #​1149
• zip: add NameDecoder callback for legacy encoding rewrite by @​SAY-5 in #​1150
• huff0: Allow building tables from histogram. by @​klauspost in #​1155
• huff0: Allow building table from oversized histogram. by @​klauspost in #​1156
• s2sx: Clean symlink targets by @​klauspost in #​1163

New Contributors

• @​snissn made their first contribution in #​1147
• @​eustas made their first contribution in #​1148
• @​z9z made their first contribution in #​1149
• @​SAY-5 made their first contribution in #​1150
• @​HNO3Miracle made their first contribution in #​1165

Full Changelog: klauspost/compress@v1.18.6...v1.19.0

v1.18.7

Compare Source

• Fix s2.NewDict OOB read.

Security release without other changes.

Full Changelog: klauspost/compress@v1.18.6...v1.18.7

klauspost/cpuid (github.com/klauspost/cpuid/v2)

v2.4.0

Compare Source

What's Changed

• Add riscv64 CPU feature detection by @​mengzhuo in #​173
• Add arm64 go feature id by @​klauspost in #​175
• Add AVX512BMM by @​klauspost in #​170
• Add FRED detection by @​riptl in #​172
• Upgrade CI to 1.26, fix arm64 noasm by @​klauspost in #​174
• Apply go fix by @​klauspost in #​176

New Contributors

• @​riptl made their first contribution in #​172
• @​mengzhuo made their first contribution in #​173

Full Changelog: klauspost/cpuid@v2.3.0...v2.4.0

minio/minio-go (github.com/minio/minio-go/v7)

v7.2.1

Compare Source

urfave/cli (github.com/urfave/cli/v3)

v3.10.1

Compare Source

What's Changed

• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2371
• fix: align gfmrun example counter with actual runnable count by @​dearchap in #​2369
• v3: yield the version flag's -v alias to a user-defined flag by @​c-tonneslan in #​2330
• fix: keep completion subcommand order deterministic in help output by @​suzuki-shunsuke in #​2374
• fix: allow DefaultCommand to handle its own flags by @​lihan3238 in #​2322

New Contributors

• @​lihan3238 made their first contribution in #​2322

Full Changelog: urfave/cli@v3.10.0...v3.10.1

gitlab-org/api/client-go (gitlab.com/gitlab-org/api/client-go/v2)

v2.44.0

Compare Source

2.44.0

🚀 Features

• feat: support renew application secret api endpoint (!2934) by BoxBoxJason

🔄 Other Changes

• chore(deps): update docker docker tag to v29.6.0 (!2930) by GitLab Dependency Bot
• test(workitems): split t.Run() sub-tests into individual parent test functions (!2929) by Patrick Rice

2.44.0 (2026-06-29)

Features

• support renew application secret api endpoint (576fa15)

v2.43.0

Compare Source

2.43.0

🚀 Features

• Support discussion_id field in commit and snippet comment webhook (!2920) by vntw

🔄 Other Changes

• test(workitems): replace schema validation with exact query files (!2928) by Patrick Rice

2.43.0 (2026-06-25)

grpc/grpc-go (google.golang.org/grpc)

v1.82.0: Release 1.82.0

Compare Source

Behavior Changes

• server: Remove support for GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment varibale. Strict incoming RPC path validation (which has been the default since v1.79.3) can no longer be disabled. (#​9112)
• transport: Add environment variable to change the default max header list size from 16MB to 8KB. This may be enabled by setting GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true. This will be enabled by default in a subsequent release. (#​9019)
• balancer: Load Balancing policy registry is now case-sensitive. Set GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false (and file an issue) to revert to case-insensitive behavior. (#​9017)

New Features

• experimental/stats: Expose a new API, NewContextWithLabelCallback, to register a callback that is invoked when telemetry labels are added. (#​8877)
  • Special Thanks: @​seth-epps
• client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (#​8929)
  • Special Thanks: @​chengxilo
• server: Add environment variable GRPC_GO_SERVER_GOROUTINE_LABELS that controls setting runtime/pprof.Labels on goroutines spawned by the server. Set GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true to add the grpc.method label on goroutines spawned to handle incoming requests. (#​9082)
  • Special Thanks: @​dfinkel

Bug Fixes

• xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (#​9138)
• grpc: In the deprecated gzip Compressor (used via the deprecated WithCompressor dial option), enforce the MaxRecvMsgSize limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (#​9114)
  • Special Thanks: @​evilgensec
• stats/opentelemetry: Record retry attempts, grpc.previous-rpc-attempts, at the call level and not the attempt level. (#​8923)
• encoding: Ensure Close() is always called on readers returned from Compressor.Decompress if possible. (#​9135)
• channelz: Fix the LastMessageSentTimestamp and LastMessageReceivedTimestamp fields in SocketMetrics to ensure they contain correct timestamp values. (#​9109)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Monday (* * * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[GiteaBot]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.