Bump the all-dependencies group with 2 updates

[dependabot]

Bumps the all-dependencies group with 2 updates: go.sia.tech/coreutils and go.sia.tech/renterd/v2.

Updates go.sia.tech/coreutils from 0.20.0 to 0.21.0

Release notes

Sourced from go.sia.tech/coreutils's releases.

0.21.0 (2026-02-04)

Breaking Changes

Changed block pruning to an active decision for integrators rather than a passive option

This fixes a race condition on some nodes when chain subscribers are slow where blocks would be removed from the store before they could be indexed.

Fixes

• Enable StreamResetPartialDelivery when listening for QUIC connections.
• Use custom sectorBuffer rather than bytes.Buffer in handleRPCWriteSector.

0.20.1 (2026-01-05)

Fixes

• Fix a race in the goroutine spun up by NewEphemeralContractor.
• Fixed an issue where fully connected peers could get stuck on a stale chain after a reorg.

Changelog

Sourced from go.sia.tech/coreutils's changelog.

0.21.0 (2026-02-04)

Breaking Changes

Changed block pruning to an active decision for integrators rather than a passive option

This fixes a race condition on some nodes when chain subscribers are slow where blocks would be removed from the store before they could be indexed.

Fixes

• Enable StreamResetPartialDelivery when listening for QUIC connections.
• Use custom sectorBuffer rather than bytes.Buffer in handleRPCWriteSector.

0.20.1 (2026-01-05)

Fixes

• Fix a race in the goroutine spun up by NewEphemeralContractor.
• Fixed an issue where fully connected peers could get stuck on a stale chain after a reorg.

Commits

• b6a8ece Merge pull request #389 from SiaFoundation/release
• fe20297 chore: prepare release 0.21.0
• 830daa8 Merge pull request #392 from SiaFoundation/chris/fix-webtransport
• 95df8ef configure server and add test
• f333847 logging
• 0bf8d9d changeset
• 1ecfe59 Enable StreamResetPartialDelivery in QUIC server
• f6fb6cc Merge pull request #393 from SiaFoundation/nate/pruning
• 6e66275 fix comment
• c427e24 Use block separately
• Additional commits viewable in compare view

Updates go.sia.tech/renterd/v2 from 2.8.0-beta.1 to 2.8.0-beta.2

Release notes

Sourced from go.sia.tech/renterd/v2's releases.

v2.8.0-beta.2

Features

Add support for instant syncing

New users can sync instantly using renterd --instant. When instant syncing, the renterd node initializes using a Utreexo-based checkpoint and can immediately validate blocks from that point forward without replaying the whole chain state. The state is extremely compact and committed in block headers, making this initialization both quick and secure.

Learn more

The wallet is required to only have v2 history to use instant syncing.

Fixes

• Reduce memory pressure when fetching contract roots for pruning.
• Update core dependency to v0.19.0 and coreutils dependency v0.20.0.

Commits

• aec799b docs: delete changelog
• 811a0fa docs: add changelog
• 3791940 node: reset chain state on instant sync
• 5ca3d3b chore(deps): bump github.com/gabriel-vasile/mimetype
• 80ce389 chore(deps): bump the all-dependencies group with 2 updates
• e67e9dd chore(deps): bump the all-dependencies group with 3 updates
• 8de6918 update benchmark
• e7b982c insert size
• 2ec01cc update randSeletByScore
• cb20f1d cleanup
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	go.sia.tech/​renterd/​v2@​v2.8.0-beta.1 ⏵ v2.8.1
	go.sia.tech/​coreutils@​v0.20.0 ⏵ v0.21.0	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: golang go.sia.tech/renterd/v2 is 98.0% likely obfuscated Confidence: 0.98 Location: Package overview From: go.mod → golang/go.sia.tech/renterd/v2@v2.8.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/go.sia.tech/renterd/v2@v2.8.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report