chore(deps): update golang-dependencies (main)

[mender-test-bot]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/aws/aws-sdk-go-v2	v1.42.1 → v1.43.2			require	minor
github.com/aws/aws-sdk-go-v2/config	v1.32.30 → v1.32.33			require	patch
github.com/aws/aws-sdk-go-v2/credentials	v1.19.29 → v1.19.32			require	patch
github.com/aws/aws-sdk-go-v2/service/iot	v1.76.1 → v1.77.2			require	minor
github.com/aws/aws-sdk-go-v2/service/iotdataplane	v1.34.1 → v1.35.2			require	minor
github.com/aws/aws-sdk-go-v2/service/s3	v1.105.1 → v1.106.2			require	minor
github.com/aws/smithy-go	v1.27.3 → v1.27.5			require	patch
github.com/nats-io/nats-server/v2	v2.14.3 → v2.14.4			require	patch

---

Release Notes

aws/smithy-go (github.com/aws/smithy-go)

v1.27.5

Compare Source

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.27.5
  • Bug Fix: Fix a performance issue in awsQuery with large response payloads.

v1.27.4

Compare Source

nats-io/nats-server (github.com/nats-io/nats-server/v2)

v2.14.4

Compare Source

Changelog

Refer to the 2.14 Upgrade Guide for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

Go Version

• 1.26.5 (#​8435)

Dependencies

• github.com/klauspost/compress v1.19.0 (#​8385)
• golang.org/x/crypto v0.54.0 (#​8385)
• golang.org/x/sys v0.47.0 (#​8385)
• github.com/antithesishq/antithesis-sdk-go v0.7.2-default-no-op (#​8385)

Improved

JetStream

• The Raft transport layer has been decoupled, improves testing but does not change server behaviour (#​8181)
• The disk concurrency semaphore has been increased to 4096 slots, up from the previous CPU-scaled count (#​8336)
• The disk concurrency semaphore can now be configured with the max_concurrent_io option in the jetstream config block (#​8336)
• Filestore underlying block cache buffers are now recycled to the pool when the weak reference is collected by the GC, which should smooth out memory usage with some usage patterns (#​8395)
• Calculating and looking up sequences in delete maps for file-backed streams with large numbers of interior deletes is now faster and holds locks for less time (#​8403)
• Inserts, iterations and deletes in AVL sequence sets are now faster in many cases, which speeds up the tracking of interior deletes (#​8406)
• Stream snapshots now attempt to determine the correct encode buffer size up front, avoiding many unnecessary allocations on streams with large numbers of interior deletes (#​8405)
• Reduced memory usage of the structure that is used to track subjects within a stream (#​8412)

Fixed

General

• allow_non_tls will no longer log an incorrect message at startup claiming that TLS is required (#​8420)
• Combining no_auth_user with auth callouts will no longer skip authentication checks when no CONNECT message is sent
• JWT validation no longer crashes the server with whitespace-only permissions
• Several paths that enforce the permissions of queue subscriptions no longer treat the whole permission as a subject literal
• Several JetStream and MQTT endpoints now correctly guard against null values in JSON
• Fixed an authentication bypass with TLS verify_and_map authenticating users with blank passwords

Monitoring

• The healthz endpoint will now skip and no longer report on expired JWT accounts (#​8379, thanks to @​ByapakSigdel)
• The varz endpoint will now correctly report JetStream limits after they were changed via a config reload (#​8394)

JetStream

• Malformed cluster replicated acks or delivered updates are now correctly rejected by the decoder (#​8284, thanks to @​uwezkhan)
• Malformed cluster replicated skip or reset updates are now correctly rejected by the decoder (#​8345, thanks to @​uwezkhan)
• Empty cluster replicated entries are now correctly ignored (#​8347, thanks to @​uwezkhan)
• Decoded AVL sequence set node counts are now validated correctly on 32-bit systems (#​8355, thanks to @​uwezkhan)
• Stale error responses on source or mirror creation are now dropped by recreating the subscription (#​8356)
• Oversized cluster replicated messages are now validated correctly on 32-bit systems (#​8357, thanks to @​uwezkhan)
• Raft elections now correctly ignore votes from removed peers (#​8353)
• Filestore blocks with unsynced or truncated key files are now removed and counted as lost data instead of failing to recover altogether (#​8365)
• Filestore encryption key files are now synced to disk more aggressively (#​8366)
• Raft now handles the append entry iterator returning no more entries correctly (#​8372)
• Fixed string ownership when handling the expected last sequence per subject in a batch (#​8377)
• Fixed a race condition between concurrent message removals via limits that could unexpectedly disable writes into a filestore (#​8378)
• Fixed a bug in the filestore which could prevent some filestore block cache references from being weakened correctly, which could result in unexpected memory usage and GC pressure (#​8380)
• Attempting to update the consumer storage type now correctly returns an error (#​8382)
• Stream publish checks will now correctly reject messages that exceed the maximum store size before proposal (#​8389)
• Fixed a race condition between storing messages in the filestore and block compactions (#​8400)
• The filestore no longer skips sparse delete blocks when processing deletes from a snapshot (#​8404)
• The consumer reset endpoint responses are no longer dropped when sent through a service import (#​8407)
• Creating a clustered consumer immediately after creating a clustered stream should no longer respond with a stream not found error (#​8410)
• Raft proposals now require the term to be passed down from JetStream, preventing situations where stale proposals from a previous term could make changes in a new term after a fast election (#​8370)
• Replicated streams that were recreated while a node was down are no longer treated as an update by a returning node processing a snapshot, avoiding stale Raft groups from continuing to run and unexpected behaviour with consumers (#​8413)
• Stream snapshot endpoints now more strictly check the reply subject for validity

MQTT

• Packet identifiers for QoS1 and QoS2 are now issued by a monotonic counter, avoiding accidental ID reuse (#​8358, thanks to @​nberlee)
• Pending QoS1 and QoS2 deliveries should no longer leak when the subscription is downgraded to QoS0 (#​8359, thanks to @​nberlee)
• QoS2 messages released on a resumed sessions should no longer lose their QoS or packet ID (#​8414)
• MQTT clients can no longer subscribe to $MQTT.> subjects, closing a potential permission bypass

Complete Changes

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 10pm on Monday,before 6am on Tuesday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[mender-test-bot]

ℹ️ Artifact update notice

File name: backend/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 15 additional dependencies were updated

Details:

Package	Change
github.com/antithesishq/antithesis-sdk-go	v0.7.0-default-no-op -> v0.7.2-default-no-op
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.7.14 -> v1.7.15
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	v1.18.30 -> v1.18.33
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.4.30 -> v1.4.33
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.7.30 -> v2.7.33
github.com/aws/aws-sdk-go-v2/internal/v4a	v1.4.31 -> v1.4.34
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	v1.13.13 -> v1.13.14
github.com/aws/aws-sdk-go-v2/service/internal/checksum	v1.9.23 -> v1.9.26
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.13.30 -> v1.13.33
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	v1.19.31 -> v1.19.34
github.com/aws/aws-sdk-go-v2/service/signin	v1.4.1 -> v1.5.2
github.com/aws/aws-sdk-go-v2/service/sso	v1.32.1 -> v1.33.2
github.com/aws/aws-sdk-go-v2/service/ssooidc	v1.37.1 -> v1.38.2
github.com/aws/aws-sdk-go-v2/service/sts	v1.44.1 -> v1.45.2
github.com/klauspost/compress	v1.18.6 -> v1.19.0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!