Bump the all-deps group across 1 directory with 2 updates

[dependabot]

Bumps the all-deps group with 2 updates in the / directory: github.com/devilcove/configuration and github.com/nats-io/nats-server/v2.

Updates github.com/devilcove/configuration from 0.1.1 to 0.1.2

Commits

• ac5c89e create config file/dir on save
• 88198e4 lint updates
• 1b62281 Merge branch 'master' into dependabot/go_modules/all-deps-3f6d5969e9
• ab2b9c2 adjust for removaal of yaml.ParserError
• a895b0e Bump go.yaml.in/yaml/v4 in the all-deps group
• See full diff in compare view

Updates github.com/nats-io/nats-server/v2 from 2.12.4 to 2.12.5

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.12.5

Changelog

Refer to the 2.12 Upgrade Guide for backwards compatibility notes with 2.11.x.

Go Version

• 1.25.8

Dependencies

• github.com/nats-io/nkeys v0.4.15 (#7797)
• github.com/klauspost/compress v1.18.4 (#7812)
• golang.org/x/sys v0.42.0 (#7923)
• github.com/antithesishq/antithesis-sdk-go v0.6.0-default-no-op (#7835)
• golang.org/x/crypto v0.48.0 (#7874)
• github.com/nats-io/nats.go v1.49.0 (#7835)
• golang.org/x/time v0.15.0 (#7923)

CVEs

• Fixes CVE-2026-29785 (affects systems with leafnode compression enabled)
• Fixes CVE-2026-27889 (affects systems with WebSockets enabled)

Added

JetStream

• The stream snapshot/backup endpoint now accepts the window_size parameter, to allow improving flow control over slow or unreliable connections (#7839)

Improved

General

• max_conns in the server configuration can now be configured to 0 (zero) to reject all incoming client connections (#7877)

JetStream

• "Catchup for stream" log lines are now more consistent (#7784)
• Raft now only accepts forwarded proposals if caught up as the new leader, limiting potentially unbounded log growth (#7809)
• Raft now correctly refuses concurrent membership changes if forwarded a peer removal from another node (#7809)
• The max_consumers limit of a stream can now be updated after stream creation (#7724)
• The pending messages and bytes are now included in consumer unpin responses (#7815)
• Stream backups/snapshots are now streamed to clients with improved flow control, which should improve throughput and robustness, particularly over unreliable links, reducing the chance of backups failing due to flow control errors (#7828)
• Orphaned stream and consumer checks are now aligned with the metalayer snapshot logic (#7826)
• Wildcard filtering when loading messages is now considerably faster in the memory store (#7840, #7855)
• Metalayer snapshots now take place asynchronously when possible, such that JS API operations are not blocked while the snapshot is taking place (#7827, #7846)
  • This behaviour can be disabled by setting meta_compact_sync: true in the jetstream configuration block
• Consumers with a single subject filter no longer incorrectly use the multi-filter message lookups (#7856)
• The check for colliding stream subjects is now faster (#7870)

... (truncated)

Commits

• 0f6c831 Release v2.12.5
• d9cce39 Update dependencies
• 44d8abd Fix TestMonitorWebsocket
• 55db52b Update to Go 1.25.8
• 358cdc4 Fix int32 overflow of JWT account and user limits
• a1488de Fix panic on LS protocol when compression enabled
• cadc948 Fix panic on X-Forwarded-For empty slice (shouldn't be possible from the wire)
• 6cf715d Fix panic in WebSocket when reading an empty compressed buffer
• 667d14d Fix panic in WebSocket on extremely large payload length
• d82c4b7 Fix panic on title case on empty error message
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions