chore(deps): bump the go_modules group across 1 directory with 3 updates

[dependabot]

Bumps the go_modules group with 2 updates in the / directory: github.com/projectcontour/contour and go.mongodb.org/mongo-driver.

Updates github.com/projectcontour/contour from 1.31.6 to 1.33.5

Release notes

Sourced from github.com/projectcontour/contour's releases.

v1.33.5

We are delighted to present version v1.33.5 of Contour, our layer 7 HTTP reverse proxy for Kubernetes clusters.

• All Changes
• Installing/Upgrading
• Compatible Kubernetes Versions

All Changes

Security fix for GHSA-g3xr-5w5j-w4q4

Fixes a bug where configuring fallback certificate with JWT verification in HTTPProxy allowed requests without TLS SNI or with unrecognized SNI to bypass JWT verification. Contour now rejects this invalid configuration.

Other Changes

• Bumps Go to 1.25.10 https://go.dev/doc/devel/release#go1.25.minor
• Bumps golang.org/x/net to v0.55.0 CVE-2026-39821

Installing and Upgrading

For a fresh install of Contour, consult the getting started documentation.

To upgrade an existing Contour installation, please consult the upgrade documentation.

Compatible Kubernetes Versions

Contour v1.33.5 is tested against Kubernetes 1.32 through 1.34.

Are you a Contour user? We would love to know!

If you're using Contour and want to add your organization to our adopters list, please visit this page. If you prefer to keep your organization name anonymous but still give us feedback into your usage and scenarios for Contour, please post on this GitHub thread.

v1.33.4

We are delighted to present version v1.33.4 of Contour, our layer 7 HTTP reverse proxy for Kubernetes clusters.

• All Changes
• Installing/Upgrading
• Compatible Kubernetes Versions

All Changes

Security fix for CVE-2026-41246

This release fixes CVE-2026-41246, a Lua code injection vulnerability in Contour's Cookie Rewriting feature.

An attacker with RBAC permissions to create or modify HTTPProxy resources could craft a malicious cookieRewritePolicies[].pathRewrite.value that results in arbitrary code execution in the Envoy proxy. Since Envoy runs as shared infrastructure, the injected code could read Envoy's xDS client credentials from the filesystem or cause denial of service for other tenants sharing the Envoy instance.

The fix removes the use of text/template for generating Lua code entirely. User-provided values are now passed as structured data via Envoy's filterContext and read by a static Lua script at runtime.

Note: This release requires Envoy 1.35.0 or later.

... (truncated)

Commits

• 2713ad0 Update Contour Docker image to v1.33.5.
• 4cb1dcb HTTPProxy: reject fallback certificate combined with JWT verification
• 9b74896 release-1.33: Bump to go 1.25.10 (#7565)
• 9115d51 release-1.33: bump to golang.org/x/net v0.55.0 (#7561)
• cd950d0 build(deps): bump the k8s-dependencies group with 4 updates (#7548)
• d420a7f build(deps): bump the k8s-dependencies group with 4 updates (#7517)
• afb42aa release-1.33: Bump to go 1.25.9 (#7524)
• 6eb0daf Update Contour Docker image to v1.33.4.
• d1e24f0 release-1.33: Bump to Envoy v1.35.10
• 72793e0 remove templating from misdirected request Lua script
• Additional commits viewable in compare view

Updates go.mongodb.org/mongo-driver from 1.17.2 to 1.17.7

Release notes

Sourced from go.mongodb.org/mongo-driver's releases.

MongoDB Go Driver 1.17.7

The MongoDB Go Driver Team is pleased to release version 1.17.7 of the official MongoDB Go Driver.

Release Highlights

This release removes the deprecation notice from options.MergeClientOptions and fixes buffer handling in GSSAPI error description and username functions.

What's Changed

🐛 Fixed

• GODRIVER-3770 Fix buffer handling in GSSAPI error description and username functions by @​prestonvasquez in mongodb/mongo-go-driver#2291

📝 Other Changes

• Add more visible deprecation banner to the 1.17 readme by @​alcaeus in mongodb/mongo-go-driver#2233
• GODRIVER-3770 Remove libasan from gssapi tests in CI by @​prestonvasquez in mongodb/mongo-go-driver#2293
• GODRIVER-3766 Remove deprecation notice for MergeClientOptions by @​tadjik1 in mongodb/mongo-go-driver#2294

Full Changelog: mongodb/mongo-go-driver@v1.17.6...v1.17.7

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. Questions and inquiries can be asked on the MongoDB Developer Community. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 1.17.6

The MongoDB Go Driver Team is pleased to release version 1.17.6 of the official MongoDB Go Driver.

[!NOTE] Due to a bug in the Go Driver release automation, there is no 1.17.5 release.

Release Highlights

This release makes various maintainability improvements to the Go Driver development and release automation.

What's Changed

📝 Other Changes

• GODRIVER-3560 Use lambda-specific arn for FaaS by @​prestonvasquez in mongodb/mongo-go-driver#2093
• Use a pinned Go version for golangci-lint. by @​matthewdale in mongodb/mongo-go-driver#2151
• Disable merge-up from release/1.17 by @​alcaeus in mongodb/mongo-go-driver#2202

Full Changelog: mongodb/mongo-go-driver@v1.17.4...v1.17.6

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 1.17.4

... (truncated)

Commits

• eb01e7e BUMP v1.17.7
• 3c55093 GODRIVER-3766 Remove deprecation notice for MergeClientOptions (#2294)
• f6163bf GODRIVER-3770 Remove libasan from gssapi tests in CI (#2293)
• 6798963 GODRIVER-3770 Fix buffer handling in GSSAPI error description and username fu...
• c1e9575 Add more visible deprecation banner to the 1.17 readme (#2233)
• d2fa0ab BUMP v1.17.6
• f1d540b BUMP v1.17.5
• b879028 GODRIVER-3654 Don't test v1 branches against latest server. (#2188)
• 21f47d4 Allow ignore-for-release label to satisfy label checker (#2203)
• 8708ca8 Disable merge-up from release/1.17 (#2202)
• Additional commits viewable in compare view

Updates golang.org/x/net from 0.54.0 to 0.55.0

Commits

• 7770ec4 go.mod: update golang.org/x dependencies
• 4ece7b6 html: escape greater-than symbol in doctype identifiers
• 08be507 html: improve Noah's Ark clause performance
• a8fb2fe html: properly render fostered elements in foreign content
• 0dc5b7a html: properly check namespace in "in body" any other end tag
• a452f3c html: ignore duplicate attributes during tokenization
• f865199 quic: fix appendMaxDataFrame erroneously accumulating sentLimit
• 210ed3c quic: establish a "happened-before" relationship between stream write and read
• ad8140e quic: fix buffer slicing when handling overlapping stream data
• 23ee2ef http2: avoid API changes when built with go1.27
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml