Skip to content

chore: bump Go dependencies - #2814

Merged
dunglas merged 3 commits into
mainfrom
chore/bump-deps-2026-11-05
Nov 5, 2026
Merged

dunglas merged 3 commits into
mainfrom
chore/bump-deps-2026-11-05

Conversation

@dunglas

@dunglas dunglas commented Nov 5, 2026

Copy link
Copy Markdown
Member

Updates the root and caddy modules, including Caddy 2.11.9, Mercure 1.1.6, Vulcain 1.4.6 and golang.org/x/net 0.62.0.

  • quic-go is held at v0.64.1: v0.65.0 removes h3qlog.DefaultConnectionTracer, which Caddy 2.11.9 still uses.
  • Caddy 2.11.9 makes the last entry of first_exist_fallback match even when the file doesn't exist. php_server relied on the existence check on Unix, so without an index.php it now reached PHP ("No input file specified.") instead of returning Caddy's 404 and falling through. It now uses first_exist, like Windows and the php-server command already did.
  • caddy/go.mod now requires Go 1.27.3, because mercure/caddy, vulcain/caddy and slackhq/nebula do. go get adds that patch release back, so the lint rule from ci: build with the latest Go patch release #2776 can't hold. The setup-go action now requests 1.27 with check-latest instead of reading go.mod, so every workflow builds with the latest 1.27 patch release whatever go.mod requires, as in chore: bump dependencies dunglas/mercure#1470.

Caddy 2.11.9 makes the last entry of first_exist_fallback match even when
the file doesn't exist. Until now the glob checked its existence on Unix,
so a php_server without an index.php returned Caddy's 404 and let requests
fall through. Use first_exist everywhere to keep that behavior, as Windows
and the php-server command already do.
quic-go is held at v0.64.1: v0.65.0 removes an API Caddy 2.11.9 uses.
go 1.27.3 in caddy/go.mod (required by dependencies) would make setup-go
pin that exact release again. Request the 1.27 line with check-latest
instead, and drop the lint rule that forbade patch releases in go.mod.
@dunglas
dunglas merged commit 91d5c08 into main Nov 5, 2026
45 checks passed
@dunglas
dunglas deleted the chore/bump-deps-2026-11-05 branch November 5, 2026 08:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant