fix(deps): update module go.temporal.io/api to v1.44.1 [security]

[SatisfactoryModdingBot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
go.temporal.io/api	v1.37.0 -> v1.44.1

---

Unencrypted transmission in Temporal api-go library

CVE-2025-1243 / GHSA-q9w6-cwj4-gf4p

More information

Details

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data Converter transformations (e.g. encryption) applied. This is an issue only when using the UpdateWorkflowExecution APIs (released on 13th January 2025) with a proxy leveraging the api-go library before version 1.44.1.

Other data fields were correctly sent to Data Converter. This issue does not impact the Data Converter server. Data was encrypted in transit. Temporal Cloud services are not impacted.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-1243
• https://github.com/temporalio/api-go/commit/dad8b169ada911d3778e070484d1ae78a58bd22b
• https://github.com/temporalio/api-go
• https://github.com/temporalio/api-go/releases/tag/v1.44.1
• https://temporal.io/blog/announcing-a-new-operation-workflow-update

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

temporalio/api-go (go.temporal.io/api)

v1.44.1

Compare Source

What's Changed

• Fix update.Response getting skipped by the proxy by @​Quinn-With-Two-Ns in https://github.com/temporalio/api-go/pull/209

Full Changelog: temporalio/api-go@v1.44.0...v1.44.1

v1.44.0

Compare Source

What's Changed

• GHA check sdk-go compatibility by @​rodrigozhou in https://github.com/temporalio/api-go/pull/200
• GHA to create release by @​rodrigozhou in https://github.com/temporalio/api-go/pull/170
• Remove disabling UTF-8 validation hack by @​dnr in https://github.com/temporalio/api-go/pull/205
• [GHA] Set types for workflow_call inputs by @​rodrigozhou in https://github.com/temporalio/api-go/pull/207
• [GHA][check-sdk-compat] Set staticcheck config to ignore deprecated symbols check by @​rodrigozhou in https://github.com/temporalio/api-go/pull/208

Full Changelog: temporalio/api-go@v1.43.2...v1.44.0

v1.43.2

Compare Source

What's Changed

• Update Cloud API by @​nikki-dag in https://github.com/temporalio/api-go/pull/201
• Fix proxy manipulation of single payload fields by @​bergundy in https://github.com/temporalio/api-go/pull/202

New Contributors

• @​nikki-dag made their first contribution in https://github.com/temporalio/api-go/pull/201

Full Changelog: temporalio/api-go@v1.43.1...v1.43.2

v1.43.1

Compare Source

What's Changed

• Add NamespaceUnavailable serviceerror by @​bergundy in https://github.com/temporalio/api-go/pull/194
• Add Failure to QueryFailure serviceerror by @​bergundy in https://github.com/temporalio/api-go/pull/199

Full Changelog: temporalio/api-go@v1.43.0...v1.43.1

v1.43.0

Compare Source

Full Changelog: temporalio/api-go@v1.42.0...v1.43.0

v1.42.0

Compare Source

What's Changed

• Sync to latest API Cloud to include Export by @​alice-yin in https://github.com/temporalio/api-go/pull/190

New Contributors

• @​alice-yin made their first contribution in https://github.com/temporalio/api-go/pull/190

Full Changelog: temporalio/api-go@v1.41.0...v1.42.0

v1.41.0

Compare Source

Full Changelog: temporalio/api-go@v1.40.0...v1.41.0

v1.40.0

Compare Source

What's Changed

• Fix issue with parents not reset during payload visiting by @​cretz in https://github.com/temporalio/api-go/pull/175
• Remove automatic dependency upgrade on proto update by @​cretz in https://github.com/temporalio/api-go/pull/176
• Visit "Any" types in payload visitor by @​cretz in https://github.com/temporalio/api-go/pull/177
• Add unimplemented gRPC server embeds to mock servers by @​cretz in https://github.com/temporalio/api-go/pull/179
• Update Cloud APIs by @​shivam-ajmera in https://github.com/temporalio/api-go/pull/180
• Visit OperatorService methods in interceptor by @​bergundy in https://github.com/temporalio/api-go/pull/182
• Update protos with account get/update operations by @​ennyjfrick in https://github.com/temporalio/api-go/pull/181

New Contributors

• @​shivam-ajmera made their first contribution in https://github.com/temporalio/api-go/pull/180
• @​ennyjfrick made their first contribution in https://github.com/temporalio/api-go/pull/181

Full Changelog: temporalio/api-go@v1.39.0...v1.40.0

v1.39.0

Compare Source

Full Changelog: temporalio/api-go@v1.38.0...v1.39.0

v1.38.0

Compare Source

Full Changelog: temporalio/api-go@v1.37.0...v1.38.0

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[SatisfactoryModdingBot]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
google.golang.org/grpc	v1.65.0 -> v1.66.0
google.golang.org/genproto/googleapis/api	v0.0.0-20240814211410-ddb44dafa142 -> v0.0.0-20240827150818-7e3bb234dfed
google.golang.org/genproto/googleapis/rpc	v0.0.0-20240814211410-ddb44dafa142 -> v0.0.0-20240827150818-7e3bb234dfed

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 19.52%. Comparing base (f82f620) to head (62dd4eb).

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff            @@
##           staging     #108   +/-   ##
========================================
  Coverage    19.52%   19.52%           
========================================
  Files          256      256           
  Lines        69885    69885           
========================================
  Hits         13648    13648           
  Misses       53664    53664           
  Partials      2573     2573           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.