build(deps): Bump the gomod group with 2 updates

[dependabot]

Bumps the gomod group with 2 updates: github.com/perses/perses and github.com/perses/spec.

Updates github.com/perses/perses from 0.54.0-beta.3 to 0.54.0-rc.1

Release notes

Sourced from github.com/perses/perses's releases.

0.54.0-rc.1 / 2026-07-21

This release candidate is mainly here to revert the schema endpoint feature that was introduced in 0.54.0-rc.0. We revert it because it implies to upgrade cuelang to v0.17 which includes some regression that impacts the dashboard migration. See perses/perses#4272 for more information.

Core & UI

• [BreakingChange] Revert " Exposing complete dashboard and plugin CUE schema endpoint" (#4279)
• [BUGFIX] Fix health error with SQL database (#4274)

Plugins improvements

• perses/plugins#736
• perses/plugins#737

0.54.0-rc.0 / 2026-07-16

Core & UI

• [SECURITY] Unvalidated project parameter enables filesystem path traversal (CVE-2026-63199) (75e5471040cc)
• [SECURITY] Missing authorization in datasource proxy allows cross-scope secret disclosure (2368c9ef4eb0a)
• [FEATURE] Exposing complete dashboard and plugin CUE schema endpoint (#4031)
• [ENHANCEMENT] Plugin: prevent path injection when extracting the plugins file (#4230)
• [ENHANCEMENT] Updated migrateQuery to catch ambiguous plugin matches during migration (#4139)
• [BUGFIX] Accept temperature and date units in go-sdk Format validation (#4266)
• [BUGFIX] CUE: fix wrong collapse value (#4183)
• [BUGFIX] Apply default AuthorizerDenyTTL in kubernetes authz provider (#4246)
• [BUGFIX] Plugin: skip migrate.cue whose package is not migrate (#4260)
• [BUGFIX] Schema: validate dev variable plugins against the variables tree (#4250)
• [BUGFIX] Accept bits/decbits/sek/sgd/usd units in go-sdk Format validation (#4259)
• [BUGFIX] Return the mkdir error when creating the CLI config directory (#4256)
• [BUGFIX] Config: fix SQL max_allowed_packet YAML tag (#4248)
• [BUGFIX] Config: fix Plugin.Verify lowercasing to not prepend empty strings (#4247)
• [BUGFIX] Plugin: return the real error when reading a plugin package.json fails (#4257)
• [BUGFIX] Plugin: report the real error when a dev plugin package fails to load (#4255)
• [BUGFIX] Use provider HTTP client for OAuth device code token exchange (#4245)
• [BUGFIX] Honor datasource TLS config when fetching OAuth token (#4249)
• [BUGFIX] Escape LIKE metacharacters in name-prefix filter (#4244)
• [BUGFIX] Allow client to auto-refresh token (#4236)
• [BUGFIX] Reject users with both native and oauth providers (#4187)
• [BUGFIX] CLI describe: return service.New error instead of a nil err (#4239)
• [BUGFIX] Set PERSES_CLI env on the Windows plugin dev server (#4241)
• [BUGFIX] Auth: fake latency when user does not exist (#4232)
• [BUGFIX] Discovery: fix k8s service discovery when no port is declared (#4231)
• [DOC] Add native provider authentication bash and CLI snippets (#4254)
• [DOC] Fix typo in Dashboard API docs (#4253)
• [DOC] Fix broken Go SDK examples in http-proxy.md (#4243)
• [DOC] Fix stale panel group defaults in go-sdk doc (#4240)
• [DOC] Fix dialog JSDoc @​param names to match props (#4242)
• [DOC] Fix invalid time.minutes in go-sdk RefreshInterval example (#4237)
• [DOC] Fix TimeseriesChart import path in query builder example (#4238)

... (truncated)

Changelog

Sourced from github.com/perses/perses's changelog.

0.54.0-rc.1 / 2026-07-21

This release candidate is mainly here to revert the schema endpoint feature that was introduced in 0.54.0-rc.0. We revert it because it implies to upgrade cuelang to v0.17 which includes some regression that impacts the dashboard migration. See perses/perses#4272 for more information.

Core & UI

• [BreakingChange] Revert " Exposing complete dashboard and plugin CUE schema endpoint" (#4279)
• [BUGFIX] Fix health error with SQL database (#4274)

Plugins improvements

• perses/plugins#736
• perses/plugins#737

0.54.0-rc.0 / 2026-07-16

Core & UI

• [SECURITY] Unvalidated project parameter enables filesystem path traversal (CVE-2026-63199) (75e5471040cc)
• [SECURITY] Missing authorization in datasource proxy allows cross-scope secret disclosure (2368c9ef4eb0a)
• [FEATURE] Exposing complete dashboard and plugin CUE schema endpoint (#4031)
• [ENHANCEMENT] Plugin: prevent path injection when extracting the plugins file (#4230)
• [ENHANCEMENT] Updated migrateQuery to catch ambiguous plugin matches during migration (#4139)
• [BUGFIX] Accept temperature and date units in go-sdk Format validation (#4266)
• [BUGFIX] CUE: fix wrong collapse value (#4183)
• [BUGFIX] Apply default AuthorizerDenyTTL in kubernetes authz provider (#4246)
• [BUGFIX] Plugin: skip migrate.cue whose package is not migrate (#4260)
• [BUGFIX] Schema: validate dev variable plugins against the variables tree (#4250)
• [BUGFIX] Accept bits/decbits/sek/sgd/usd units in go-sdk Format validation (#4259)
• [BUGFIX] Return the mkdir error when creating the CLI config directory (#4256)
• [BUGFIX] Config: fix SQL max_allowed_packet YAML tag (#4248)
• [BUGFIX] Config: fix Plugin.Verify lowercasing to not prepend empty strings (#4247)
• [BUGFIX] Plugin: return the real error when reading a plugin package.json fails (#4257)
• [BUGFIX] Plugin: report the real error when a dev plugin package fails to load (#4255)
• [BUGFIX] Use provider HTTP client for OAuth device code token exchange (#4245)
• [BUGFIX] Honor datasource TLS config when fetching OAuth token (#4249)
• [BUGFIX] Escape LIKE metacharacters in name-prefix filter (#4244)
• [BUGFIX] Allow client to auto-refresh token (#4236)
• [BUGFIX] Reject users with both native and oauth providers (#4187)
• [BUGFIX] CLI describe: return service.New error instead of a nil err (#4239)
• [BUGFIX] Set PERSES_CLI env on the Windows plugin dev server (#4241)
• [BUGFIX] Auth: fake latency when user does not exist (#4232)
• [BUGFIX] Discovery: fix k8s service discovery when no port is declared (#4231)
• [DOC] Add native provider authentication bash and CLI snippets (#4254)
• [DOC] Fix typo in Dashboard API docs (#4253)
• [DOC] Fix broken Go SDK examples in http-proxy.md (#4243)
• [DOC] Fix stale panel group defaults in go-sdk doc (#4240)
• [DOC] Fix dialog JSDoc @​param names to match props (#4242)

... (truncated)

Commits

• 3537cf7 Release v0.54.0-rc.1 (#4280)
• 0e6337b Merge pull request #4278 from perses/nexucis/migration-non-reg
• cdfd6b1 Revert "[FEATURE] Exposing complete dashboard and plugin CUE schema endpoint ...
• e834471 [BUGFIX/BREAKINGCHANGE] Fix health error with SQL database (#4274)
• 0523a3b [ignore] add no reg migration test
• 06886ac [IGNORE] fix vulnerable dependencies (#4275)
• e000eeb Merge pull request #4262 from perses/release/v0.54
• 8a64dc1 Release v0.54.0-rc.0 (#4263)
• a03a078 Merge branch 'main' into release/v0.54
• 049d951 [BUGFIX] accept temperature and date units in go-sdk Format validation (#4266)
• Additional commits viewable in compare view

Updates github.com/perses/spec from 0.2.0-beta.9 to 0.2.0-rc.0

Release notes

Sourced from github.com/perses/spec's releases.

v0.2.0-rc.0

What's Changed

• [IGNORE] fix vulnerable dependencies by @​jgbernalp in perses/spec#57
• Release v0.2.0-rc.0 by @​Nexucis in perses/spec#58

Full Changelog: perses/spec@v0.2.0-beta.9...v0.2.0-rc.0

Commits

• a3f9a08 Release v0.2.0-rc.0 (#58)
• 9ad4c31 [IGNORE] fix vulnerable dependencies (#57)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.