fix(deps): bump the external group across 1 directory with 2 updates by dependabot[bot] · Pull Request #3746 · opentdf/platform

dependabot · 2026-07-10T17:53:11Z

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

github-actions · 2026-07-10T17:53:27Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:

❌ 1 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 1 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

protocol/go/go.mod

Name	Version	Vulnerability	Severity
golang.org/x/net	0.53.0	Go Net HTML parser is vulnerable to denial of service	moderate

License Issues

protocol/go/go.mod

Package	Version	License	Issue Type
buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go	1.36.11-20260709200747-435963d16310.1	Null	Unknown License

Denied Licenses:
GPL-2.0, AGPL-1.0, AGPL-1.0-or-later, AGPL-1.0-only, AGPL-3.0, AGPL-3.0-only, AGPL-3.0-or-later, GPL-1.0, GPL-1.0+, GPL-1.0-only, GPL-1.0-or-later, CNRI-Python-GPL-Compatible, GPL-2.0+, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0-with-GCC-exception, GPL-2.0-with-autoconf-exception, GPL-2.0-with-bison-exception, GPL-2.0-with-classpath-exception, GPL-2.0-with-font-exception, GPL-3.0, GPL-3.0+, GPL-3.0-only, GPL-3.0-or-later, GPL-3.0-with-GCC-exception, GPL-3.0-with-autoconf-exception, LGPL-2.0, LGPL-2.0+, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1, LGPL-2.1+, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0, LGPL-3.0+, LGPL-3.0-only, LGPL-3.0-or-later, LGPLLR, NGPL

Excluded from license check:
pkg:githubactions/SonarSource/sonarqube-scan-action

OpenSSF Scorecard

Package

Version

Score

Details

gomod/golang.org/x/net

0.53.0

Unknown

gomod/buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go

1.36.11-20260709200747-435963d16310.1

Unknown

gomod/golang.org/x/sys

0.43.0

Unknown

gomod/golang.org/x/text

0.36.0

Unknown

gomod/google.golang.org/genproto/googleapis/rpc

0.0.0-20260414002931-afd174a4e478

🟢 7.1

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	27 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Code-Review	🟢 10	all changesets reviewed
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Branch-Protection	🟢 8	branch protection is not maximal on development and all release branches
SAST	🟢 3	SAST tool is not run on all commits -- score normalized to 3

gomod/google.golang.org/grpc

1.82.1

🟢 7.7

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 9	security policy file detected
Maintained	🟢 10	30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
SAST	🟢 7	SAST tool detected but not run on all commits

Scanned Files

protocol/go/go.mod

github-actions · 2026-07-10T17:59:19Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	231.276358ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	115.22608ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	429.045683ms
Throughput	233.08 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	47.483074952s
Average Latency	473.155333ms
Throughput	105.30 requests/second

github-actions · 2026-07-10T18:08:58Z

github-actions · 2026-07-13T17:59:11Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	213.667362ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.932115ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	414.839361ms
Throughput	241.06 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	46.027050876s
Average Latency	458.570323ms
Throughput	108.63 requests/second

github-actions · 2026-07-13T18:09:30Z

github-actions · 2026-07-15T17:58:36Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	208.974298ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	111.785404ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	474.242184ms
Throughput	210.86 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.829058808s
Average Latency	447.180323ms
Throughput	111.53 requests/second

github-actions · 2026-07-15T18:09:46Z

github-actions · 2026-07-16T17:57:40Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	119.088257ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	63.214736ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	280.671311ms
Throughput	356.29 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	29.543431925s
Average Latency	294.550063ms
Throughput	169.24 requests/second

github-actions · 2026-07-16T18:07:39Z

--- updated-dependencies: - dependency-name: buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go dependency-version: 1.36.11-20260709200747-435963d16310.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: external - dependency-name: google.golang.org/grpc dependency-version: 1.82.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: external ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-07-17T17:57:49Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	120.400193ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	62.954106ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	277.329818ms
Throughput	360.58 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	28.82590146s
Average Latency	286.848064ms
Throughput	173.46 requests/second

github-actions · 2026-07-17T18:00:07Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-07-17T18:07:40Z

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 10, 2026

dependabot Bot requested review from a team as code owners July 10, 2026 17:53

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 10, 2026

dependabot Bot requested a review from a team as a code owner July 10, 2026 17:53

dependabot Bot added the go Pull requests that update Go code label Jul 10, 2026

github-actions Bot added the size/xs label Jul 10, 2026

dependabot Bot force-pushed the dependabot/go_modules/protocol/go/external-fc2cfe8847 branch from 706cba9 to 5cd036a Compare July 13, 2026 17:53

dependabot Bot force-pushed the dependabot/go_modules/protocol/go/external-fc2cfe8847 branch from 5cd036a to a55ce08 Compare July 15, 2026 17:53

dependabot Bot force-pushed the dependabot/go_modules/protocol/go/external-fc2cfe8847 branch from a55ce08 to 876e0b3 Compare July 16, 2026 17:53

dependabot Bot force-pushed the dependabot/go_modules/protocol/go/external-fc2cfe8847 branch from 876e0b3 to 0c3b781 Compare July 17, 2026 17:53

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Vulnerabilities

protocol/go/go.mod

License Issues

protocol/go/go.mod

OpenSSF Scorecard

Scanned Files

Uh oh!

github-actions Bot commented Jul 10, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 10, 2026

X-Test Results

Uh oh!

github-actions Bot commented Jul 13, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 13, 2026

X-Test Results

Uh oh!

github-actions Bot commented Jul 15, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 15, 2026

X-Test Results

Uh oh!

github-actions Bot commented Jul 16, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 16, 2026

X-Test Results

Uh oh!

github-actions Bot commented Jul 17, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jul 17, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions Bot commented Jul 17, 2026

X-Test Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading