chore(deps): bump the go-deps group with 2 updates

.github/dependabot.yml

@@ -1,7 +1,12 @@
 version: 2
 updates:
+  # One entry for both Go modules. examples/ replaces the kit with ../, so
+  # a bump in the root module must land in examples/go.mod in the same PR
+  # or the examples tidy check fails.
   - package-ecosystem: gomod
-    directory: /
+    directories:
+      - /
+      - /examples
     schedule:
       interval: weekly
       day: monday
@@ -19,25 +24,6 @@ updates:
         patterns:
           - "*"
 
-  - package-ecosystem: gomod
-    directory: /examples
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 5
-    groups:
-      go-deps-examples:
-        applies-to: version-updates
-        patterns:
-          - "*"
-        update-types:
-          - minor
-          - patch
-      go-deps-examples-security:
-        applies-to: security-updates
-        patterns:
-          - "*"
-
   - package-ecosystem: github-actions
     directory: /
     schedule:

CHANGELOG.md

@@ -5,6 +5,41 @@ All notable changes to **go-github-kit** are documented in this file.
 The format is based on [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.9.1] - 2026-09-20
+
+Maintenance release. Bumps `golang.org/x/oauth2` and `golang.org/x/time`
+in the root module and brings `examples/` in step. No library source or
+public API changes since 1.9.0.
+
+Neither bump changes behaviour for consumers. `oauth2` v0.37.0 carries one
+code change, an endpoint rename in its `google` subpackage, which the kit
+does not import; the kit uses only the core `oauth2` package for
+`WithToken` and `WithTokenSource`. `x/time` v0.16.0 has no code change.
+Both modules now declare `go 1.26.0`, below the kit's own `go 1.27` floor
+set in 1.9.0, so the consumer floor is unchanged.
+
+### Dependencies
+
+- `golang.org/x/oauth2` v0.36.0 to v0.37.0.
+- `golang.org/x/time` v0.15.0 to v0.16.0.
+
+### Examples
+
+- `examples/go.mod` follows the root module: `golang.org/x/oauth2` v0.37.0
+  (direct) and `golang.org/x/time` v0.16.0 (indirect). The examples module
+  replaces the kit with `../`, so a root bump that is not mirrored here
+  fails the examples tidy check in CI; that is what blocked the Dependabot
+  PR for this bump, and why the two modules move together in this release.
+
+### CI
+
+- `.github/dependabot.yml`: the two `gomod` entries for `/` and
+  `/examples` are merged into one entry listing both `directories`, so
+  a version bump lands in both go.mod files in a single grouped PR.
+  Group names are unchanged. Dependabot does not bump indirect
+  requirements on its own, so a root-only dependency that examples sees
+  transitively may still need a manual `go mod tidy` in `examples/`.
+
 ## [1.9.0] - 2026-09-01
 
 Maintenance release. Moves the module to Go 1.27, applies `go fix ./...`,
@@ -907,6 +942,7 @@ and rotating PATs alike.
 - `golang.org/x/oauth2` v0.36.0
 - `golang.org/x/time` v0.15.0
 
+[1.9.1]: https://github.com/pcanilho/go-github-kit/releases/tag/v1.9.1
 [1.9.0]: https://github.com/pcanilho/go-github-kit/releases/tag/v1.9.0
 [1.8.0]: https://github.com/pcanilho/go-github-kit/releases/tag/v1.8.0
 [1.7.0]: https://github.com/pcanilho/go-github-kit/releases/tag/v1.7.0

examples/go.mod

@@ -19,7 +19,7 @@ require (
 	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/shurcooL/graphql v0.0.0-20240915155400-7ee5256398cf // indirect
-	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/time v0.16.0 // indirect
 )
 
 replace github.com/pcanilho/go-github-kit => ../

examples/go.sum

@@ -21,5 +21,5 @@ github.com/shurcooL/graphql v0.0.0-20240915155400-7ee5256398cf h1:o1uxfymjZ7jZ4M
 github.com/shurcooL/graphql v0.0.0-20240915155400-7ee5256398cf/go.mod h1:9dIRpgIY7hVhoqfe0/FcYp0bpInZaT7dc3BYOprrIUE=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
 golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
+golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=

go.mod

@@ -7,6 +7,6 @@ toolchain go1.27.0
 require (
 	github.com/gofri/go-github-ratelimit/v2 v2.0.2
 	github.com/hashicorp/golang-lru/v2 v2.0.7
-	golang.org/x/oauth2 v0.36.0
-	golang.org/x/time v0.15.0
+	golang.org/x/oauth2 v0.37.0
+	golang.org/x/time v0.16.0
 )

go.sum

@@ -2,7 +2,7 @@ github.com/gofri/go-github-ratelimit/v2 v2.0.2 h1:gS8wAS1jTmlWGdTjAM7KIpsLjwY1S0
 github.com/gofri/go-github-ratelimit/v2 v2.0.2/go.mod h1:YBQt4gTbdcbMjJFT05YFEaECwH78P5b0IwrnbLiHGdE=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
+golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
+golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
+golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=