chore(deps): bump the go-minor-patch group with 6 updates

[dependabot]

Bumps the go-minor-patch group with 6 updates:

Package	From	To
github.com/danielgtaylor/huma/v2	2.38.0	2.39.1
github.com/go-chi/chi/v5	5.3.0	5.3.1
github.com/mark3labs/mcp-go	0.57.0	0.58.0
golang.org/x/sync	0.21.0	0.22.0
google.golang.org/grpc	1.82.1	1.83.0
google.golang.org/protobuf	1.36.11	1.36.12

Updates github.com/danielgtaylor/huma/v2 from 2.38.0 to 2.39.1

Release notes

Sourced from github.com/danielgtaylor/huma/v2's releases.

v2.39.1

Overview

A patch release: correctness fixes for resolvers, validation, and response handling, plus a dependency refresh.

Response Status Visible to Middleware Again

WithContext context propagation in v2.39.0 copied the response status by value, so middleware that called WithContext and then read Status() after next() always saw 0 instead of the status the handler set, breaking access logging and telemetry. The status is now shared by every context copy across all adapters, restoring the pre-2.39 invariant while keeping context propagation intact. (#1081)

Resolvers & Defaults in Arrays and Maps

• Nested resolvers now run for fixed-size arrays ([2]Item), not just slices (#1076)
• A resolver on a named collection type (e.g. type Coords [2]float64) no longer panics, and is no longer conflated with a resolver on its element type, which previously ran the element's resolver twice and the collection's never (#1082)
• Values reached through a map are now written back after being walked, so applying a default no longer panics with reflect: reflect.Value.Set using unaddressable value and resolver mutations are no longer silently discarded (#1082)

Stricter email and uri Formats

Validation for two string formats is tighter, so payloads that previously passed may now return 422:

• email / idn-email accept an addr-spec only; full mailbox forms with a display name (Name <user@example.com>) are rejected
• uri / iri require an absolute URI with a non-empty scheme, while relative references remain valid under uri-reference / iri-reference (#1068)

Validation Robustness

• An unresolvable schema $ref during Validate now reports expected schema $ref to resolve: ... instead of panicking on a nil dereference, covering discriminators and map[string]any / map[any]any values (#1065)
• Named numeric slice parameters (e.g. type IDs []int64) are built with their declared element type and validated with item, length, and uniqueness constraints intact (#1074)

Other Fixes

• Resolver errors that wrap a HeadersError now contribute their headers to the response, matching the handler error path (#1070)
• A nil interface response body no longer panics in the schema link transformer (#1072)
• Dependencies updated (#1066)

What's Changed

• fix: do not panic on unresolved schema $ref during Validate by @​baiyuxi930826 in danielgtaylor/huma#1065
• chore: update dependencies by @​wolveix in danielgtaylor/huma#1066
• fix: tighten format email and uri validation by @​baiyuxi930826 in danielgtaylor/huma#1068
• fix: preserve wrapped resolver error metadata by @​ggmolly in danielgtaylor/huma#1070
• fix: handle nil interface response bodies by @​ggmolly in danielgtaylor/huma#1072
• fix: parse named numeric slice parameters by @​ggmolly in danielgtaylor/huma#1074
• fix: share response status across WithContext copies by @​wolveix in danielgtaylor/huma#1081
• fix: run nested resolvers in fixed arrays by @​ggmolly in danielgtaylor/huma#1076
• fix: distinguish collection and element matches when walking input by @​wolveix in danielgtaylor/huma#1082

New Contributors

• @​baiyuxi930826 made their first contribution in danielgtaylor/huma#1065
• @​ggmolly made their first contribution in danielgtaylor/huma#1070

Full Changelog: danielgtaylor/huma@v2.39.0...v2.39.1

... (truncated)

Commits

• 198225e fix: distinguish collection and element matches when walking input (#1082)
• 5961f0a fix: run nested resolvers in fixed arrays (#1076)
• 85aad8f fix: share response status across WithContext copies (#1081)
• 22a3cb0 fix: parse named numeric slice parameters (#1074)
• ac9959c fix: handle nil interface response bodies (#1072)
• b659c74 fix: preserve wrapped resolver error metadata (#1070)
• 14aea2f fix: tighten format email and uri validation (#1068)
• bba0d54 chore: update dependencies (#1066)
• e114668 fix: do not panic on unresolved schema $ref during Validate (#1065)
• d6f2a37 feat(form-data): handle unmarshalling and validation of non-file JSON form da...
• Additional commits viewable in compare view

Updates github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.1

What's Changed

• Honor Discard() in httpFancyWriter.ReadFrom by @​DucMinhNe in go-chi/chi#1110
• Tidy build directives by @​JRaspass in go-chi/chi#1113
• feat(middleware): add text/xml and application/xml to default compressible types by @​VojtechVitek in go-chi/chi#1127
• Fix defaultLogEntry.Panic not respecting NoColor setting by @​doganarif in go-chi/chi#1050
• middleware: document printPrettyStack and harden NoColor panic test by @​VojtechVitek in go-chi/chi#1131
• feat(mux): support http QUERY method ietf rfc10008 by @​VojtechVitek in go-chi/chi#1132
• ci: pin GitHub Actions to full commit SHAs by @​XananasX7 in go-chi/chi#1116

New Contributors

• @​DucMinhNe made their first contribution in go-chi/chi#1110
• @​doganarif made their first contribution in go-chi/chi#1050
• @​XananasX7 made their first contribution in go-chi/chi#1116

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

Commits

• 8b258c7 ci: pin GitHub Actions to full commit SHAs (#1116)
• caf87e6 feat(mux): support http QUERY method ietf rfc10008 (#1132)
• 7fcb8a2 middleware: document printPrettyStack and harden NoColor panic test (#1131)
• 878fe71 Fix defaultLogEntry.Panic not respecting NoColor setting (#1050)
• d7b767b feat(middleware): add text/xml and application/xml to default compressible ty...
• 3b50c7c Tidy build directives (#1113)
• 2b9fca2 Honor Discard() in httpFancyWriter.ReadFrom (#1110)
• See full diff in compare view

Updates github.com/mark3labs/mcp-go from 0.57.0 to 0.58.0

Release notes

Sourced from github.com/mark3labs/mcp-go's releases.

Release v0.58.0

What's Changed

• fix(server): return 200 for HEAD requests instead of 404 by @​suxiaohun in mark3labs/mcp-go#937
• [mcp] document exported helper functions by @​zbarsky-openai in mark3labs/mcp-go#940
• fix(server): deliver request-scoped elicitation on the originating POST SSE stream by @​Yusufihsangorgel in mark3labs/mcp-go#933
• docs: bump CONTRIBUTING Go prerequisite to match go.mod (1.23 → 1.25) by @​kobihikri in mark3labs/mcp-go#929
• fix: rewrite draft-07 definitions refs when adopting them as $defs by @​WilliamAGH in mark3labs/mcp-go#950
• fix(server): flush final SSE response in handlePost by @​vinayaksachdeva in mark3labs/mcp-go#945
• Fix #943: refuse unsupported subscribe requests by @​Abdullah-Builds in mark3labs/mcp-go#946
• fix(mcp): preserve schema tags on nested fields by @​ychampion in mark3labs/mcp-go#920

New Contributors

• @​zbarsky-openai made their first contribution in mark3labs/mcp-go#940
• @​kobihikri made their first contribution in mark3labs/mcp-go#929
• @​WilliamAGH made their first contribution in mark3labs/mcp-go#950
• @​vinayaksachdeva made their first contribution in mark3labs/mcp-go#945
• @​Abdullah-Builds made their first contribution in mark3labs/mcp-go#946
• @​ychampion made their first contribution in mark3labs/mcp-go#920

Full Changelog: mark3labs/mcp-go@v0.57.0...v0.58.0

Commits

• 9740d3a fix(mcp): preserve schema tags on nested fields (#920)
• 8897dc8 Fix #943: refuse unsupported subscribe requests (#946)
• 8c04c05 fix(server): flush final SSE response in handlePost (#945)
• d4651c3 fix: rewrite draft-07 definitions refs when adopting them as $defs (#950)
• c8cc0d7 docs: CONTRIBUTING says Go 1.23, but go.mod requires 1.25.5 (#929)
• 28271e8 fix(server): deliver request-scoped elicitation on the originating POST SSE s...
• d7c7b06 [mcp] document exported helper functions (#940)
• 4ff6c3b fix(server): return 200 for HEAD requests instead of 404 (#937)
• See full diff in compare view

Updates golang.org/x/sync from 0.21.0 to 0.22.0

Commits

• 1eb64d4 semaphore: panic on negative weights
• See full diff in compare view

Updates google.golang.org/grpc from 1.82.1 to 1.83.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.83.0

Security

• server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
• xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

New Features

• xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
• xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
• authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
  • Special Thanks: @​hnefatl
• xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
• xds: Add support for xDS-based HTTP CONNECT proxies.
  • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
• xds: Add support for contains_match in route header matchers. (#9223)

Bug Fixes

• credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
• grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)
  • Special Thanks: @​Yusufihsangorgel

Commits

• 4c226da Change version to 1.83.0 (#9228)
• c198988 Cherrypick 9223 into v1.83.x (#9279)
• 8ce3ebf Cherrypick PR 9255 into v1.83.x (#9263)
• e393849 Cherry-pick recent changes from master (#9240)
• 2a112a8 authz: add onPolicyUpdate callback to authz file watcher (#9142)
• 1a80fca vet: adds a check to disallow usage of regex.Compile in xDS code (#9216)
• 26ffdb3 [tls] Add safety check in custom cert verification that peer cert chain is no...
• 5013974 internal/grpcsync: add ScheduleAndWait to CallbackSerializer (#9162)
• bd58bc0 internal/transport: increase test timeout locally in TestAccountCheckWindowSi...
• 484f150 httpfilter/extproc: add check to ensure that response trailer mode must be SE...
• Additional commits viewable in compare view

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions