chore(deps): bump the go-dependencies group across 1 directory with 5 updates by dependabot[bot] · Pull Request #1017 · smart-mcp-proxy/mcpproxy-go

dependabot · 2026-08-21T19:24:19Z

Bumps the go-dependencies group with 4 updates in the / directory: github.com/evanw/esbuild, github.com/mark3labs/mcp-go, github.com/stretchr/testify and golang.org/x/mod.

Updates github.com/evanw/esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from github.com/evanw/esbuild's releases.

v0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
 let x
 bar(x ||= {})

... (truncated)

Changelog

Sourced from github.com/evanw/esbuild's changelog.

0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
 let x

... (truncated)

Commits

609683d publish 0.28.2 to npm
11b1fe4 add to release notes
ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
04627b6 fix #4498: async TLA checks need a worklist
5c15177 disable gopls in the go folder
fc2ee9b css: adjust parser to allow --foo: {...}
209db54 release notes for css nesting bugfix
c625d31 fix #4497: preserve nested ampersands during minification (#4500)
34474e2 better isolation of current part in js parser
07f6e8c fix #4507: import assignment tree-shaking bug
Additional commits viewable in compare view

Updates github.com/mark3labs/mcp-go from 0.57.0 to 0.58.0

Release notes

Sourced from github.com/mark3labs/mcp-go's releases.

Release v0.58.0

What's Changed

fix(server): return 200 for HEAD requests instead of 404 by @suxiaohun in mark3labs/mcp-go#937

[mcp] document exported helper functions by @zbarsky-openai in mark3labs/mcp-go#940

fix(server): deliver request-scoped elicitation on the originating POST SSE stream by @Yusufihsangorgel in mark3labs/mcp-go#933

docs: bump CONTRIBUTING Go prerequisite to match go.mod (1.23 → 1.25) by @kobihikri in mark3labs/mcp-go#929

fix: rewrite draft-07 definitions refs when adopting them as $defs by @WilliamAGH in mark3labs/mcp-go#950

fix(server): flush final SSE response in handlePost by @vinayaksachdeva in mark3labs/mcp-go#945

Fix #943: refuse unsupported subscribe requests by @Abdullah-Builds in mark3labs/mcp-go#946

fix(mcp): preserve schema tags on nested fields by @ychampion in mark3labs/mcp-go#920

New Contributors

@zbarsky-openai made their first contribution in mark3labs/mcp-go#940

@kobihikri made their first contribution in mark3labs/mcp-go#929

@WilliamAGH made their first contribution in mark3labs/mcp-go#950

@vinayaksachdeva made their first contribution in mark3labs/mcp-go#945

@Abdullah-Builds made their first contribution in mark3labs/mcp-go#946

@ychampion made their first contribution in mark3labs/mcp-go#920

Full Changelog: mark3labs/mcp-go@v0.57.0...v0.58.0

Commits

9740d3a fix(mcp): preserve schema tags on nested fields (#920)
8897dc8 Fix #943: refuse unsupported subscribe requests (#946)
8c04c05 fix(server): flush final SSE response in handlePost (#945)
d4651c3 fix: rewrite draft-07 definitions refs when adopting them as $defs (#950)
c8cc0d7 docs: CONTRIBUTING says Go 1.23, but go.mod requires 1.25.5 (#929)
28271e8 fix(server): deliver request-scoped elicitation on the originating POST SSE s...
d7c7b06 [mcp] document exported helper functions (#940)
4ff6c3b fix(server): return 200 for HEAD requests instead of 404 (#937)
See full diff in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

Change yaml library to go.yaml.in/yaml/v3 by @harryzcy in stretchr/testify#1935

change yaml library to go.yaml.in/yaml/v3 by @boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

@harryzcy made their first contribution in stretchr/testify#1935

@boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

Change yaml library to go.yaml.in/yaml/v3 by @harryzcy in stretchr/testify#1935

change yaml library to go.yaml.in/yaml/v3 by @boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

@harryzcy made their first contribution in stretchr/testify#1935

@boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

assert: make *AssertionFunc types just aliases by @dolmen in stretchr/testify#1563

Fixes

mock: avoid panic when expected type is nil in Arguments.Diff by @mutaiib in stretchr/testify#1775

mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @brackendawson in stretchr/testify#1786

suite: validate method signatures and continue execution for valid tests by @vyas-git in stretchr/testify#1665

assert.PanicsWithError: report error message by @olivergondza in stretchr/testify#1400

assert: IsIncreasing et al can return false w/out failing by @brackendawson in stretchr/testify#1787

add type to error message of assert.Same by @egawata in stretchr/testify#1792

mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @brackendawson in stretchr/testify#1795

assert: truncate very long objects in test failure messages by @brackendawson in stretchr/testify#1646

assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @nghiack7 in stretchr/testify#1888

suite: prevent panic when SetupTest skips with HandleStats by @blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

CI: test also with Go 1.23 by @dolmen in stretchr/testify#1783

Vendor unmaintained github.com/pmezard/go-difflib by @brackendawson in stretchr/testify#1708

Promote ccoVeille to maintainer by @brackendawson in stretchr/testify#1784

build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in stretchr/testify#1790

assert.YAMLEq: Document mutlidoc behavior by @brackendawson in stretchr/testify#1791

_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @dolmen in stretchr/testify#1782

doc: remove ineffective inline code blocks by @brackendawson in stretchr/testify#1714

Tag generated assertions as non-generated in new .gitattributes by @ubunatic in stretchr/testify#1815

... (truncated)

Commits

959dbda Merge pull request #1935 from harryzcy/yaml-update
9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
001eb79 Merge pull request #1905 from Kentzo/patch-1
ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
f8c01f3 mock: Mock.Return does not exist anymore
12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
a11649e assert: make *AssertionFunc type just aliases
dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
098f8d7 _codegen: use strings.Builder
Additional commits viewable in compare view

Updates golang.org/x/mod from 0.38.0 to 0.40.0

Commits

d3398d0 go.mod: update golang.org/x dependencies
57549bf sumdb: ignore unrelated hashes in Lookup
96f62ae sumdb/tlog: fix TileHashReader authentication bypass
13be902 go.mod: update golang.org/x dependencies
See full diff in compare view

Updates golang.org/x/text from 0.40.0 to 0.41.0

Commits

acdba66 go.mod: update golang.org/x dependencies
02aa981 secure/precis: fix short destination buffer handling in Nickname profile
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… updates Bumps the go-dependencies group with 4 updates in the / directory: [github.com/evanw/esbuild](https://github.com/evanw/esbuild), [github.com/mark3labs/mcp-go](https://github.com/mark3labs/mcp-go), [github.com/stretchr/testify](https://github.com/stretchr/testify) and [golang.org/x/mod](https://github.com/golang/mod). Updates `github.com/evanw/esbuild` from 0.28.1 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.28.1...v0.28.2) Updates `github.com/mark3labs/mcp-go` from 0.57.0 to 0.58.0 - [Release notes](https://github.com/mark3labs/mcp-go/releases) - [Commits](mark3labs/mcp-go@v0.57.0...v0.58.0) Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.1) Updates `golang.org/x/mod` from 0.38.0 to 0.40.0 - [Commits](golang/mod@v0.38.0...v0.40.0) Updates `golang.org/x/text` from 0.40.0 to 0.41.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.40.0...v0.41.0) --- updated-dependencies: - dependency-name: github.com/evanw/esbuild dependency-version: 0.28.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/mark3labs/mcp-go dependency-version: 0.58.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/stretchr/testify dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/mod dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: golang.org/x/text dependency-version: 0.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions

Auto-approved by dependabot-auto-merge: version-update:semver-minor (github.com/evanw/esbuild, github.com/mark3labs/mcp-go, github.com/stretchr/testify, golang.org/x/mod, golang.org/x/text). Merge fires only when all required checks are green.

cloudflare-workers-and-pages · 2026-08-21T19:26:08Z

Deploying mcpproxy-docs with Cloudflare Pages

Latest commit:	`150856b`
Status:	✅ Deploy successful!
Preview URL:	https://0a95b236.mcpproxy-docs.pages.dev
Branch Preview URL:	https://dependabot-go-modules-go-dep-rbq5.mcpproxy-docs.pages.dev

View logs

codecov-commenter · 2026-08-21T19:32:29Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

github-actions · 2026-08-21T19:42:40Z

📦 Build Artifacts

Workflow Run: View Run
Branch: dependabot/go_modules/go-dependencies-d8748a0fa9

Available Artifacts

archive-darwin-amd64 (29 MB)
archive-darwin-arm64 (26 MB)
archive-linux-amd64 (17 MB)
archive-linux-arm64 (15 MB)
archive-windows-amd64 (29 MB)
archive-windows-arm64 (25 MB)
frontend-dist-pr (0 MB)
installer-dmg-darwin-amd64 (23 MB)
installer-dmg-darwin-arm64 (20 MB)

How to Download

Option 1: GitHub Web UI (easiest)

Go to the workflow run page linked above
Scroll to the bottom "Artifacts" section
Click on the artifact you want to download

Option 2: GitHub CLI

gh run download 32518301257 --repo smart-mcp-proxy/mcpproxy-go

Note: Artifacts expire in 14 days.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 21, 2026

github-actions Bot approved these changes Aug 21, 2026

View reviewed changes

github-actions Bot enabled auto-merge (squash) August 21, 2026 19:24

Navigation Menu

Uh oh!

chore(deps): bump the go-dependencies group across 1 directory with 5 updates - #1017

chore(deps): bump the go-dependencies group across 1 directory with 5 updates#1017
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-dependencies-d8748a0fa9

dependabot Bot commented on behalf of github Aug 21, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 21, 2026

Uh oh!

codecov-commenter commented Aug 21, 2026

Uh oh!

github-actions Bot commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 21, 2026

v0.28.2

0.28.2

Release v0.58.0

What's Changed

New Contributors

v1.12.1

What's Changed

New Contributors

What's Changed

New Contributors

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 21, 2026

Deploying mcpproxy-docs with Cloudflare Pages

Uh oh!

codecov-commenter commented Aug 21, 2026

Codecov Report

Uh oh!

github-actions Bot commented Aug 21, 2026

📦 Build Artifacts

Available Artifacts

How to Download

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant