Skip to content

build(deps): Bump the gomod group across 3 directories with 4 updates - #158

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/proto-clients/spicedb-go-proto/gomod-8e9e9a65dc
Open

build(deps): Bump the gomod group across 3 directories with 4 updates#158
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/proto-clients/spicedb-go-proto/gomod-8e9e9a65dc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the gomod group with 3 updates in the /proto-clients/spicedb-go-proto directory: github.com/grpc-ecosystem/grpc-gateway/v2, google.golang.org/genproto/googleapis/api and google.golang.org/genproto/googleapis/rpc.
Bumps the gomod group with 1 update in the /spicedb-gen directory: github.com/authzed/spicedb.
Bumps the gomod group with 1 update in the /spicedb-go directory: google.golang.org/genproto/googleapis/rpc.

Updates github.com/grpc-ecosystem/grpc-gateway/v2 from 2.31.0 to 2.32.0

Release notes

Sourced from github.com/grpc-ecosystem/grpc-gateway/v2's releases.

v2.32.0

What's Changed

New Contributors

Full Changelog: grpc-ecosystem/grpc-gateway@v2.31.0...v2.32.0

Commits
  • 9b13706 Gate strict ** matching from #7412 behind strict_deep_wildcard generator ...
  • e2bc4bb chore(deps): update googleapis digest to a6f4580 (#7526)
  • 796f2c3 chore(deps): update googleapis digest to d7dd444 (#7525)
  • 4f04466 chore(deps): update golang.org/x/exp digest to f0251eb (#7524)
  • a62432a chore(deps): update golang.org/x/exp digest to 2ab7f3c (#7519)
  • 596056e chore(deps): update googleapis digest to b6efa15 (#7520)
  • 52de616 chore(deps): update googleapis digest to 0b2e1ee (#7518)
  • 14c1da7 fix(deps): update google.golang.org/genproto/googleapis/api digest to 4341edf...
  • 9b863f4 chore(deps): update googleapis digest to f5f34cc (#7514)
  • 04c1457 chore(deps): update goreleaser/goreleaser-action digest to a4f02ab (#7515)
  • Additional commits viewable in compare view

Updates google.golang.org/genproto/googleapis/api from 0.0.0-20260921155816-b14227669459 to 0.0.0-20261012220534-4341edf3f941

Commits

Updates google.golang.org/genproto/googleapis/rpc from 0.0.0-20260918162117-cecb64721679 to 0.0.0-20261005182115-fad411399dd8

Commits

Updates google.golang.org/genproto/googleapis/rpc from 0.0.0-20260918162117-cecb64721679 to 0.0.0-20261005182115-fad411399dd8

Commits

Updates github.com/authzed/spicedb from 1.56.2 to 1.57.0

Release notes

Sourced from github.com/authzed/spicedb's releases.

v1.57.0

What's Changed

Added

  • Experimental: --experimental-full-relation-cache=enabled turns on the full relation cache. It caches the complete relationship set of a hot object#relation at one revision and serves reads from it, including empty answers, with no datastore query. Off by default. (authzed/spicedb#3392)
  • Datastore: datastore.SortKeyRevision, an optional extension to datastore.Revision for revision types that are totally ordered. Its AppendSortKey returns an order-preserving, prefix-free byte encoding of the revision, suitable as a key — or as one field of a composite key — in an ordered key/value store; String() offers neither property, being a variable-width decimal. Implemented for the hybrid logical clock, timestamp and transaction ID revision types. Postgres revisions are backed by transaction snapshots and are only partially ordered, so they deliberately do not implement it, and a type assertion is how a consumer discovers that. Supersedes ByteSortable(), which reports the same capability but cannot supply the encoding that satisfies it. (authzed/spicedb#3319)
  • New spicedb datastore delete-relationships command for bulk-deleting relationships matching a filter, in committed batches. On CockroachDB the deletion advances a primary-key cursor so each batch resumes where the previous one stopped, rather than rescanning the MVCC tombstones left by prior batches — the behavior that degrades a repeated DELETE ... LIMIT n loop to a full scan per batch on a large table. Other engines fall back to a slower non-cursored loop. Every filter flag is required, with <any> as an explicit match-anything token, so a forgotten flag cannot widen a deletion. The underlying capability is exposed on the datastore interface (options.WithCursoredDelete, options.WithDeleteAfter, and DeleteRelationshipsResult.Cursor).
  • The DeleteRelationships API now supports resumable, cursored batch deletion. When optional_limit and optional_allow_partial_deletions are set, the response returns an after_result_cursor; passing it back as optional_cursor on the next call resumes the deletion after the last relationship removed, which on CockroachDB avoids rescanning already-deleted relationships. Datastores that cannot resume a cursored deletion return an error when a cursor is supplied; without a cursor they transparently fall back to the existing non-cursored partial deletion.

Fixed

  • Watch: a relationship filter whose subject filter asks for subjects with no relation (optional_relation with an empty relation) also matched subjects with a relation, such as group:eng#member, so Watch sent updates that the same filter excludes when reading relationships. Watch now applies the same subject relation rules as the datastores. (authzed/spicedb#3400)
  • Remote dispatch: a hedged Check dispatch that is canceled, or whose deadline passes, before any dispatcher answers now returns the context's error instead of check dispatch has timed out. Clients now receive Canceled or DeadlineExceeded rather than Unknown. (authzed/spicedb#3398)
  • ReadRelationships/DeleteRelationships: a relationship filter whose resource relation is a permission now returns a clear InvalidArgument error explaining that relationships cannot be filtered on a permission, instead of an opaque "does not have type information" error (ReadRelationships) or silently matching nothing (DeleteRelationships). A subject filter's relation may still legally reference a permission. (authzed/spicedb#3415)
  • LookupSubjects: avoid quadratic exclusion-list copying when subtracting many concrete subjects from a wildcard.
  • Remote dispatch: canceled LookupResources and LookupSubjects streams now return an error instead of reporting success with incomplete results, preventing partial results from being cached and replayed. (authzed/spicedb#3380)
  • Remote dispatch: a LookupResources2 request whose cursor is locked to a secondary dispatcher now returns Canceled or DeadlineExceeded when canceled or timed out before the secondary returns any results, instead of an Unknown "no dispatcher returned results" error. (authzed/spicedb#3397)
  • Remote dispatch: when a secondary dispatcher failed before the primary had started its hedging delay, the primary still waited out the full delay instead of running immediately. It now skips the delay. (authzed/spicedb#3399)
  • Postgres: DeleteRelationships with a limit no longer takes time proportional to how many relationships share a subject. The rows to soft-delete were selected by their seven key columns and then re-found by the UPDATE, which on a large table resolves through the by-subject index and walks every entry for that subject before filtering; a batch of 1000 could take seconds for a widely-shared subject, or exceed a deadline entirely for a wildcard one. The UPDATE now keys on the physical row address (tableoid, ctid), as the garbage collector already did, so each row is fetched directly. (authzed/spicedb#3309)
  • MemDB/Datastore: a revision reported with no validity is no longer kept by the optimized revision cache, and we fixed an issue where MemDB's reported validity caused a stale value to be cached. (authzed/spicedb#3374)
  • MemDB: requests made shortly after startup could fail with object definition not found, or return no results, even though the schema and relationships had already been written. MemDB now advertises its head revision in that case, so committed data is never hidden behind the datastore's own creation. (authzed/spicedb#3366)
  • MySQL: fixed a crash in the watch API. When reading transaction metadata hit an error part-way through iterating the result rows, that error was dropped and the watch was handed an empty result with no error, which then dereferenced a nil value and took the whole process down with it. The error is now returned to the caller. (authzed/spicedb#3358)
  • Postgres: fixed connections being handed to queries already broken, which surfaced as timeout: read tcp ...: i/o timeout against a perfectly healthy database, most often under load and shortly after startup. Creating a datastore gave the connection pool the same context it used to bound its own startup checks, and then cancelled it on return - but filling the pool happens on a background goroutine that keeps using that context, so the cancellation landed part-way through opening connections. pgx responds to a cancelled context by setting an immediate deadline on the connection it is working on, and those connections still entered the pool. Pool warm-up now runs on a context of its own, so finishing startup no longer cancels it. The startup checks keep their own 30-second bound. (authzed/spicedb#3333)
  • Datastore: the wait between transaction retries is now capped at 10 seconds. It previously doubled without limit (25ms, 50ms, 100ms, …), which made --datastore-max-tx-retries an exponential wall-clock budget rather than a count of attempts: at the default of 10 the waits total about 25 seconds, but at 15 they total 14 minutes and at 20 over seven hours. (authzed/spicedb#3353)
  • Caches: when the amount of available memory could not be determined - for example an AWS ECS task whose memory limit never reaches the cgroup - the fallback used for percent-based budgets was 256KiB rather than the intended 256MiB. A cache configured for 70% of available memory was sized at roughly 183KiB instead of roughly 180MiB. (authzed/spicedb#3329)
  • Shutdown: on SIGINT or SIGTERM, SpiceDB now reports NOT_SERVING on its gRPC health service and keeps its listeners open for --grpc-shutdown-drain-delay before draining. This gives load balancers and Kubernetes readiness probes time to stop routing to the instance, so new requests do not fail with Unavailable (connection refused) in the window between the signal and the endpoint update. (authzed/spicedb#3295, authzed/spicedb#3314)
  • Dispatch: --dispatch-upstream-timeout was ignored; dispatches to other nodes always used a hardcoded 60s timeout. Lowering it now works, so an unresponsive node no longer holds up checks for a full minute. No change on the 60s default. (authzed/spicedb#3304)

Security

  • Build with Go 1.26.9 and golang.org/x/net v0.60.0, which fix GO-2026-6612, GO-2026-6613 and GO-2026-6617 in the HTTP/2 and net/http code that the gRPC and HTTP servers use. The container images also update grpc_health_probe to v0.4.59, which is built with the same fixes. (authzed/spicedb#3407)

Docker Images

This release is available at authzed/spicedb:v1.57.0, quay.io/authzed/spicedb:v1.57.0, ghcr.io/authzed/spicedb:v1.57.0

Changelog

Sourced from github.com/authzed/spicedb's changelog.

[1.57.0] - 2026-10-20

Added

  • Experimental: --experimental-full-relation-cache=enabled turns on the full relation cache. It caches the complete relationship set of a hot object#relation at one revision and serves reads from it, including empty answers, with no datastore query. Off by default. (authzed/spicedb#3392)
  • Datastore: datastore.SortKeyRevision, an optional extension to datastore.Revision for revision types that are totally ordered. Its AppendSortKey returns an order-preserving, prefix-free byte encoding of the revision, suitable as a key — or as one field of a composite key — in an ordered key/value store; String() offers neither property, being a variable-width decimal. Implemented for the hybrid logical clock, timestamp and transaction ID revision types. Postgres revisions are backed by transaction snapshots and are only partially ordered, so they deliberately do not implement it, and a type assertion is how a consumer discovers that. Supersedes ByteSortable(), which reports the same capability but cannot supply the encoding that satisfies it. (authzed/spicedb#3319)
  • New spicedb datastore delete-relationships command for bulk-deleting relationships matching a filter, in committed batches. On CockroachDB the deletion advances a primary-key cursor so each batch resumes where the previous one stopped, rather than rescanning the MVCC tombstones left by prior batches — the behavior that degrades a repeated DELETE ... LIMIT n loop to a full scan per batch on a large table. Other engines fall back to a slower non-cursored loop. Every filter flag is required, with <any> as an explicit match-anything token, so a forgotten flag cannot widen a deletion. The underlying capability is exposed on the datastore interface (options.WithCursoredDelete, options.WithDeleteAfter, and DeleteRelationshipsResult.Cursor).
  • The DeleteRelationships API now supports resumable, cursored batch deletion. When optional_limit and optional_allow_partial_deletions are set, the response returns an after_result_cursor; passing it back as optional_cursor on the next call resumes the deletion after the last relationship removed, which on CockroachDB avoids rescanning already-deleted relationships. Datastores that cannot resume a cursored deletion return an error when a cursor is supplied; without a cursor they transparently fall back to the existing non-cursored partial deletion.

Fixed

  • Watch: a relationship filter whose subject filter asks for subjects with no relation (optional_relation with an empty relation) also matched subjects with a relation, such as group:eng#member, so Watch sent updates that the same filter excludes when reading relationships. Watch now applies the same subject relation rules as the datastores. (authzed/spicedb#3400)
  • Remote dispatch: a hedged Check dispatch that is canceled, or whose deadline passes, before any dispatcher answers now returns the context's error instead of check dispatch has timed out. Clients now receive Canceled or DeadlineExceeded rather than Unknown. (authzed/spicedb#3398)
  • ReadRelationships/DeleteRelationships: a relationship filter whose resource relation is a permission now returns a clear InvalidArgument error explaining that relationships cannot be filtered on a permission, instead of an opaque "does not have type information" error (ReadRelationships) or silently matching nothing (DeleteRelationships). A subject filter's relation may still legally reference a permission. (authzed/spicedb#3415)
  • LookupSubjects: avoid quadratic exclusion-list copying when subtracting many concrete subjects from a wildcard.
  • Remote dispatch: canceled LookupResources and LookupSubjects streams now return an error instead of reporting success with incomplete results, preventing partial results from being cached and replayed. (authzed/spicedb#3380)
  • Remote dispatch: a LookupResources2 request whose cursor is locked to a secondary dispatcher now returns Canceled or DeadlineExceeded when canceled or timed out before the secondary returns any results, instead of an Unknown "no dispatcher returned results" error. (authzed/spicedb#3397)
  • Remote dispatch: when a secondary dispatcher failed before the primary had started its hedging delay, the primary still waited out the full delay instead of running immediately. It now skips the delay. (authzed/spicedb#3399)
  • Postgres: DeleteRelationships with a limit no longer takes time proportional to how many relationships share a subject. The rows to soft-delete were selected by their seven key columns and then re-found by the UPDATE, which on a large table resolves through the by-subject index and walks every entry for that subject before filtering; a batch of 1000 could take seconds for a widely-shared subject, or exceed a deadline entirely for a wildcard one. The UPDATE now keys on the physical row address (tableoid, ctid), as the garbage collector already did, so each row is fetched directly. (authzed/spicedb#3309)
  • MemDB/Datastore: a revision reported with no validity is no longer kept by the optimized revision cache, and we fixed an issue where MemDB's reported validity caused a stale value to be cached. (authzed/spicedb#3374)
  • MemDB: requests made shortly after startup could fail with object definition not found, or return no results, even though the schema and relationships had already been written. MemDB now advertises its head revision in that case, so committed data is never hidden behind the datastore's own creation. (authzed/spicedb#3366)
  • MySQL: fixed a crash in the watch API. When reading transaction metadata hit an error part-way through iterating the result rows, that error was dropped and the watch was handed an empty result with no error, which then dereferenced a nil value and took the whole process down with it. The error is now returned to the caller. (authzed/spicedb#3358)
  • Postgres: fixed connections being handed to queries already broken, which surfaced as timeout: read tcp ...: i/o timeout against a perfectly healthy database, most often under load and shortly after startup. Creating a datastore gave the connection pool the same context it used to bound its own startup checks, and then cancelled it on return - but filling the pool happens on a background goroutine that keeps using that context, so the cancellation landed part-way through opening connections. pgx responds to a cancelled context by setting an immediate deadline on the connection it is working on, and those connections still entered the pool. Pool warm-up now runs on a context of its own, so finishing startup no longer cancels it. The startup checks keep their own 30-second bound. (authzed/spicedb#3333)
  • Datastore: the wait between transaction retries is now capped at 10 seconds. It previously doubled without limit (25ms, 50ms, 100ms, …), which made --datastore-max-tx-retries an exponential wall-clock budget rather than a count of attempts: at the default of 10 the waits total about 25 seconds, but at 15 they total 14 minutes and at 20 over seven hours. (authzed/spicedb#3353)
  • Caches: when the amount of available memory could not be determined - for example an AWS ECS task whose memory limit never reaches the cgroup - the fallback used for percent-based budgets was 256KiB rather than the intended 256MiB. A cache configured for 70% of available memory was sized at roughly 183KiB instead of roughly 180MiB. (authzed/spicedb#3329)
  • Shutdown: on SIGINT or SIGTERM, SpiceDB now reports NOT_SERVING on its gRPC health service and keeps its listeners open for --grpc-shutdown-drain-delay before draining. This gives load balancers and Kubernetes readiness probes time to stop routing to the instance, so new requests do not fail with Unavailable (connection refused) in the window between the signal and the endpoint update. (authzed/spicedb#3295, authzed/spicedb#3314)
  • Dispatch: --dispatch-upstream-timeout was ignored; dispatches to other nodes always used a hardcoded 60s timeout. Lowering it now works, so an unresponsive node no longer holds up checks for a full minute. No change on the 60s default. (authzed/spicedb#3304)

Security

  • Build with Go 1.26.9 and golang.org/x/net v0.60.0, which fix GO-2026-6612, GO-2026-6613 and GO-2026-6617 in the HTTP/2 and net/http code that the gRPC and HTTP servers use. The container images also update grpc_health_probe to v0.4.59, which is built with the same fixes. (authzed/spicedb#3407)
Commits
  • 320e3f4 fix: return a clear error when filtering relationships on a permission
  • a1dad93 feat: add an experimental full relation cache
  • c498131 chore: bump Go to 1.26.9, golang.org/x/net to v0.60.0 and grpc_health_probe t...
  • ee99672 fix: apply ellipsis-only subject filters in Watch like the datastores (#3400)
  • 3d20073 fix: don't lose a hedging delay cancellation that arrives before the sleep (#...
  • f8b7116 fix: return context error when a cursor-locked hedged dispatch is canceled (#...
  • 28b40c1 fix: return context error when a hedged check dispatch is canceled (#3398)
  • 983ff47 test(datasets): clarify batched subtraction semantics
  • 3bd393c perf(datasets): batch wildcard exclusions in subject set subtraction
  • dbc1601 perf(postgres): key limited relationship deletes on (tableoid, ctid) (#3309)
  • Additional commits viewable in compare view

Updates google.golang.org/genproto/googleapis/rpc from 0.0.0-20260918162117-cecb64721679 to 0.0.0-20261005182115-fad411399dd8

Commits

Updates google.golang.org/genproto/googleapis/rpc from 0.0.0-20260918162117-cecb64721679 to 0.0.0-20261005182115-fad411399dd8

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): Bump the gomod group across 3 directories with 4 updates
b72cc34 
Bumps the gomod group with 3 updates in the /proto-clients/spicedb-go-proto directory: [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway), [google.golang.org/genproto/googleapis/api](https://github.com/googleapis/go-genproto) and [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto).
Bumps the gomod group with 1 update in the /spicedb-gen directory: [github.com/authzed/spicedb](https://github.com/authzed/spicedb).
Bumps the gomod group with 1 update in the /spicedb-go directory: [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto).


Updates `github.com/grpc-ecosystem/grpc-gateway/v2` from 2.31.0 to 2.32.0
- [Release notes](https://github.com/grpc-ecosystem/grpc-gateway/releases)
- [Commits](grpc-ecosystem/grpc-gateway@v2.31.0...v2.32.0)

Updates `google.golang.org/genproto/googleapis/api` from 0.0.0-20260921155816-b14227669459 to 0.0.0-20261012220534-4341edf3f941
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260918162117-cecb64721679 to 0.0.0-20261005182115-fad411399dd8
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260918162117-cecb64721679 to 0.0.0-20261005182115-fad411399dd8
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `github.com/authzed/spicedb` from 1.56.2 to 1.57.0
- [Release notes](https://github.com/authzed/spicedb/releases)
- [Changelog](https://github.com/authzed/spicedb/blob/main/CHANGELOG.md)
- [Commits](authzed/spicedb@v1.56.2...v1.57.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260918162117-cecb64721679 to 0.0.0-20261005182115-fad411399dd8
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260918162117-cecb64721679 to 0.0.0-20261005182115-fad411399dd8
- [Commits](https://github.com/googleapis/go-genproto/commits)

---
updated-dependencies:
- dependency-name: github.com/grpc-ecosystem/grpc-gateway/v2
  dependency-version: 2.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: google.golang.org/genproto/googleapis/api
  dependency-version: 0.0.0-20261012220534-4341edf3f941
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-version: 0.0.0-20261005182115-fad411399dd8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-version: 0.0.0-20261005182115-fad411399dd8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/authzed/spicedb
  dependency-version: 1.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-version: 0.0.0-20261005182115-fad411399dd8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-version: 0.0.0-20261005182115-fad411399dd8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 28, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants