Bump the gomod-minor-updates group across 1 directory with 6 updates

[dependabot]

Bumps the gomod-minor-updates group with 5 updates in the / directory:

Package	From	To
cloud.google.com/go/pubsub	1.50.2	1.51.0
github.com/gopacket/gopacket	1.7.0	1.7.1
golang.org/x/crypto	0.53.0	0.55.0
google.golang.org/grpc	1.82.0	1.83.0
google.golang.org/protobuf	1.36.11	1.36.12

Updates cloud.google.com/go/pubsub from 1.50.2 to 1.51.0

Release notes

Sourced from cloud.google.com/go/pubsub's releases.

pubsub: v1.51.0

1.51.0 (2026-07-15)

Features

• o11y: Regenerate clients for LRO tracing (#20107) (779074e)

bigtable: v1.51.0

1.51.0 (2026-07-23)

Features

• bigtable: Add ChainInterceptors and RetryingVRpc for vRPC pipeline (#20185) (c7a832a)
• bigtable: Add ClientConfigurationManager (#19986) (3a8f927)
• bigtable: Add debug tag counter (recordDebugTag / assertDebugTag) (#20114) (3c97590)
• bigtable: Add lazyPool helper for on-demand session pool opening (#20182) (f6ae3fb)
• bigtable: Add PeakEwma continuous time-decay latency tracker (#20187) (9d124ef)
• bigtable: Add PoolSizer for server-driven session pool capacity (#20189) (57ebbeb)
• bigtable: Add session package with SessionClient + SessionTableAPI interfaces (#20180) (4b82fd2)
• bigtable: Add Session primitives (AttemptOutcome, vRPC ctx, msgtype) (#20116) (e1011e2)
• bigtable: Add Session state enum (#19981) (0748972)
• bigtable: Add SessionThrottler / AdaptiveSessionThrottler for OpenSession pacing (#20184) (02e3c6d)
• bigtable: Add SessionThrottler / AdaptiveSessionThrottler for OpenSession pacing (#20184) (29be83e)
• bigtable: Add sessionTracer for per-Session lifecycle + vRPC metrics (#20190) (a466345)
• bigtable: Enable new auth library and JWT for instance admin client (#20013) (21c4a44)
• bigtable: Modularize channel priming behind a ChannelPrimer interface (#20027) (5214ab7)
• bigtable: Modularize Direct Access compatibility check (#19987) (a25e93d)
• o11y: Regenerate clients for LRO tracing (#20107) (779074e)

Bug Fixes

• bigtable: Default cluster/zone in toOtelMetricAttrs to avoid Monitoring reject (#20178) (14493f4)
• bigtable: Eliminate stats-handler MD race in internal/metrics tracer (#20158) (c387066)

Commits

• 24439fa chore(main): release pubsub 1.51.0 (#20162)
• baca5e1 chore(main): release pubsublite 1.10.0 (#20135)
• 07020a7 chore(main): release firestore 1.24.0 (#20132)
• 6395ba5 feat: update API sources and regenerate (#20159)
• 198e9fb chore(main): release datastore 1.25.0 (#20143)
• 994535e chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /agentplatform...
• 900dd46 feat: new productregistry v1 (#20156)
• 100358a feat(maps): onboard isochrones v1 api (#20155)
• 83772f5 fix(spanner): roll back read-write transaction before retrying caller-returne...
• 1eb96d0 feat: Onboard Vertex Model Garden to GenAI Python SDK: Add list_custom_model_...
• Additional commits viewable in compare view

Updates github.com/gopacket/gopacket from 1.7.0 to 1.7.1

Release notes

Sourced from github.com/gopacket/gopacket's releases.

v1.7.1

Security release. All versions up to and including v1.7.0 are affected — upgrade is recommended for anyone decoding untrusted packets or capture files.

Security fixes

Crafted input caused runtime panics (out-of-bounds slice/index, or unsigned underflow producing an inverted range) in a number of layers/ decoders. Each is now bounded against the buffer, returning a decode error and setting SetTruncated() instead of crashing.

Advisory	Area
CVE-2026-65819	TLS, DHCPv4, sFlow, IPSecAH, VRRPv2, Diameter, GTPv1U, ERSPAN, LCM, RadioTap, Dot11IE — the fix for this shipped in no prior release
GHSA-6h9g-cjv3-pg2c	TCP MPTCP options — on the ordinary Ethernet→IP→TCP path, so any consumer decoding untrusted TCP was exposed
GHSA-25xj-ggj7-jqgf	SIP header folding (port-auto-selected, single UDP datagram)
GHSA-cxrr-2gv2-m94w	EtherIP, AGUEVar0, UDPLite, MPLS, EthernetCTP, PFLog, LinuxSLL, LinuxSLL2, PktapV1, Prism, PPP, FDDI

Note on exposure: gopacket.NewPacket with default options and DecodingLayerParser with IgnorePanic: false both recover, so those callers previously saw a decode error rather than a crash. A process crash landed on a direct DecodeFromBytes call, IgnorePanic: true, or SkipDecodeRecovery: true.

The GHSA-cxrr decoders split by trust model: the first five carry remote-attacker-controlled bytes, while PFLog, LinuxSLL/SLL2, PktapV1, Prism, PPP and FDDI are written by the host's own capture stack, making a crafted pcap from an untrusted source the realistic input rather than a packet off the wire.

Other fixes

• Protocol decoder length checks across arp, ipsec, pppoe, rudp, sctp and vrrp (#163)
• MDNS name serialization fix (#157)
• Regression tests for DNS decodeSVCB truncated SvcParams, and for every advisory above

Credits

CVE-2026-65819 reported by @​mosajjal (Fenko). The three GHSAs above reported by zx (Jace) (@​manus-use) and validated by @​FoxhoundAI.

Commits

• 2220269 test(layers): add regression tests for the decoder panic advisories
• de853ae layers:various: add length checks to twelve link and tunnel decoders
• 888f295 layers/sip: reject a header continuation line before any header
• 7cfad9e layers/tcp: bound MPTCP option length before subtype dispatch
• f87e843 build(deps): bump actions/setup-go from 6 to 7 (#164)
• 1c51bb8 test(dns): add regression test for decodeSVCB truncated-SvcParams panic
• f8b2b11 fix MDNS name serialization (#157)
• b772f56 layers:various: add protocol decoder length checks (#163)
• 210f25f Merge commit from fork
• See full diff in compare view

Updates golang.org/x/crypto from 0.53.0 to 0.55.0

Commits

• f44d03d go.mod: update golang.org/x dependencies
• 5ed4944 crypto/internal/poly1305: provide optimised assembly for riscv64
• b07833c ssh: return window credit for discarded extended data
• d701c51 acme: fix nil pointer dereference in pebble test error reporting
• 999d053 ssh: fix parsing of GSSAPI payloads offering multiple mechanisms
• 90f76b8 ssh: reject certificate signature keys before recursing
• b53964a ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs
• 626e40f ssh: drain stderr on forwarded TCP and Unix channels
• 31914c6 x509roots/fallback: update bundle
• f2135b8 all: clean up minor issues found by staticcheck
• Additional commits viewable in compare view

Updates google.golang.org/api from 0.287.0 to 0.287.1

Release notes

Sourced from google.golang.org/api's releases.

v0.287.1

0.287.1 (2026-07-07)

Documentation

• Remove old TODO file (#3645) (9d7a6b8)

Changelog

Sourced from google.golang.org/api's changelog.

0.287.1 (2026-07-07)

Documentation

• Remove old TODO file (#3645) (9d7a6b8)

Commits

• 93d63e8 chore(main): release 0.287.1 (#3646)
• 9d7a6b8 docs: remove old TODO file (#3645)
• 576018f chore(all): update all (#3644)
• cc70265 chore(deps): bump golang.org/x/net in /internal/kokoro/discogen (#3642)
• 9858f66 chore: downgrade go version in go.work (#3641)
• 3cb00c0 chore: downgrade min Go version (#3640)
• See full diff in compare view

Updates google.golang.org/grpc from 1.82.0 to 1.83.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.0

Security

• server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
• xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

New Features

• xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
• xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
• authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
  • Special Thanks: @​hnefatl
• xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
• xds: Add support for xDS-based HTTP CONNECT proxies.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
• xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

• credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
• grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)
  • Special Thanks: @​Yusufihsangorgel

Release 1.82.2

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)
  • Special Thanks: @​winklemad

Release 1.82.1

Security

• server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.

Commits

• 4c226da Change version to 1.83.0 (#9228)
• c198988 Cherrypick 9223 into v1.83.x (#9279)
• 8ce3ebf Cherrypick PR 9255 into v1.83.x (#9263)
• e393849 Cherry-pick recent changes from master (#9240)
• 2a112a8 authz: add onPolicyUpdate callback to authz file watcher (#9142)
• 1a80fca vet: adds a check to disallow usage of regex.Compile in xDS code (#9216)
• 26ffdb3 [tls] Add safety check in custom cert verification that peer cert chain is no...
• 5013974 internal/grpcsync: add ScheduleAndWait to CallbackSerializer (#9162)
• bd58bc0 internal/transport: increase test timeout locally in TestAccountCheckWindowSi...
• 484f150 httpfilter/extproc: add check to ensure that response trailer mode must be SE...
• Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions