chore: update dependencies (#599) - #601
Conversation
Bump all outdated direct and indirect dependencies to their latest releases via 'go get -u ./...' + 'go mod tidy'. No CVEs currently apply (govulncheck clean). Notable bumps: privacybydesign/gabi to latest (revocation witness-randomizer race fix, go-fix modernizations), go.etcd.io/bbolt 1.4.3 -> 1.5.0, mr-tron/base58 1.1.3 -> 1.3.0, gorm 1.31.1 -> 1.31.2, minio/sha256-simd 0.1.1 -> 1.0.1, plus a batch of minor/patch indirect bumps. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![dobby-coder[bot]](https://avatars.githubusercontent.com/in/3365457?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict: APPROVE. Posted as a COMMENT review only because GitHub blocks a bot from approving its own PR — treat this as a clean sign-off, not a withheld approval.
Rules Dobby 2 — final gatekeeper review ✅
Ran a per-rule compliance sweep (all ~/dobby-memory/rules/*.md + repos/irmago/*.md) against the diff via parallel sub-agents, and merged the result with Review Dobby 2's findings.
Rule check: all rules compliant. This is a dependency-only diff (go.mod/go.sum/CHANGELOG.md, no source/logic changes). Conventional-commit title, Closes #599 on its own line, opened as DRAFT, gofmt/go vet/go build clean, go mod tidy stable.
On Review Dobby 2's one finding (process nit: the two same-import-path "major" bumps — bbolt 1.4.3→1.5.0, minio/sha256-simd 0.1.1→1.0.1 — and the gabi pseudo-version were combined with the minor/patch batch rather than split into separate PRs):
- The spawn instruction explicitly asked for a single PR that closes #599, which supersedes the issue body's suggestion to split.
go get -u ./...stays within-major, so these were swept in one shot; everything builds, vets, and the crypto paths (gabi,base58) test clean.- The
gabibump was verified safe: only dep/CI bumps,go fixmodernizations, and a revocation witness-randomizer race fix — no core disclosure/issuance API changes. - Repo memory (
dep-update-notes.md) records this exact batch as acceptable.
Not blocking. No changes requested. The internal/sessiontest/keyshare/myirma suites need docker-compose services unavailable in the build env and are correctly deferred to CI, which is the gate before this leaves draft.
Re-run `go get -u ./...` + `go mod tidy` on top of current master.
The gabi pin moves from 86ec39902d64 (2026-06-23) to 1d483a24028f
(2026-07-30), picking up the x/crypto + x/sys CVE batch and four
crypto-adjacent hardening fixes on top of the revocation
witness-randomizer race fix the branch already carried.
Ten other direct dependencies released newer versions since the branch
was first cut (chi, gocron/v2, jwx/v3, x/crypto, x/sync, x/term, x/text,
gorm.io/driver/{postgres,sqlserver}).
The `go` directive moves 1.26.0 -> 1.26.4 and the separate `toolchain`
line drops: gabi now declares `go 1.26.4`, so irmago has to match.
go build, go vet, gofmt, go mod verify and govulncheck are clean, and
`go mod tidy` is stable.
1 participant
Closes #599
What
Resolves the dependency updates tracked in #599. All outdated direct and indirect dependencies are bumped to their latest releases via
go get -u ./...+go mod tidy.CVEs
None currently apply. The issue's security section reported no known CVEs, and this was re-verified against current
main:govulncheckis clean and no advisory affects the pinned versions. So there is no security batch — this PR is purely the minor/patch/major maintenance updates.Notable bumps
github.com/privacybydesign/gabi20221212...20260623...go fixmodernizations, and a revocation witness-randomizer race fix (NewProofCommitno longer mutates a shared randomizer). No API signature changes; irmago builds and vets clean against it.go.etcd.io/bboltv1.4.3v1.5.01); API-compatible, builds clean.github.com/mr-tron/base58v1.1.3v1.3.0gorm.io/gormv1.31.1v1.31.2github.com/minio/sha256-simdv0.1.1v1.0.1Plus a batch of minor/patch indirect bumps (
cespare/xxhash/v2,fsnotify,go-sql-driver/mysql,go-viper/mapstructure/v2,lestrrat-go/dsig,lestrrat-go/httprc/v3,mattn/go-{colorable,isatty},microsoft/go-mssqldb,multiformats/go-multihash,pelletier/go-toml/v2,sagikazarmark/locafero,templexxx/{cpu,xorsimd},timshannon/bolthold,go.uber.org/atomic, …).go mod tidydropped the now-unusedsourcegraph/concand pulled the transitive deps required by the bumped modules (blake3,cpuid/v2,go-varint,shopspring/decimal).Verification
go build ./...— clean (incl. theeudi/storage/db/sqlciphercgo package)go vet ./eudi/... ./irma/irmaclient/... ./client/...— cleangofmt -l .— emptygo mod verify— all modules verified;go mod tidyis stable (no diff)go test ./eudi/... ./client/...— all pass (exercises the SD-JWT / proof crypto paths)The keyshare / myirma /
sessiontestsuites require the docker-compose services (Postgres, Redis, SMTP) that aren't available in the build environment, so those are deferred to CI.Draft until CI confirms the service-backed test suites pass.