Repository navigation
Update minor Go package updates - #59
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
Bot
force-pushed
the
renovate/minor-go-package-updates
branch
5 times, most recently
from
May 13, 2026 03:37
b9f1631 to
0765032
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/minor-go-package-updates
branch
11 times, most recently
from
May 20, 2026 21:26
b06b3e0 to
5e868a4
Compare
renovate
Bot
force-pushed
the
renovate/minor-go-package-updates
branch
9 times, most recently
from
May 27, 2026 04:08
92e5575 to
95d3412
Compare
renovate
Bot
force-pushed
the
renovate/minor-go-package-updates
branch
3 times, most recently
from
May 28, 2026 12:42
4fcafcb to
be84f81
Compare
renovate
Bot
force-pushed
the
renovate/minor-go-package-updates
branch
14 times, most recently
from
June 11, 2026 07:15
c4451f6 to
7204eb1
Compare
renovate
Bot
force-pushed
the
renovate/minor-go-package-updates
branch
12 times, most recently
from
June 19, 2026 00:02
96049b6 to
ee15712
Compare
renovate
Bot
force-pushed
the
renovate/minor-go-package-updates
branch
2 times, most recently
from
June 21, 2026 12:58
839a8fb to
c8eb012
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.14.3→v0.15.0v1.9.3→v1.10.1v2.11.4→v2.14.0v5.9.2→v5.11.0v1.2.18→v1.3.0v1.2.18→v1.3.0v1.2.18→v1.3.0v3.0.4→v3.0.5v0.43.0→v0.52.0v1.31.1→v1.31.2v0.7.0→v0.8.2v1.50.0→v1.60.1v0.9.2→v0.12.0Release Notes
go-critic/go-critic (github.com/go-critic/go-critic)
v0.15.0Compare Source
What's Changed
New Contributors
Additional kudos for @stefanb
Full Changelog: go-critic/go-critic@v0.14.4...v0.15.0
v0.14.4Compare Source
What's Changed
Full Changelog: go-critic/go-critic@v0.14.3...v0.14.4
go-sql-driver/mysql (github.com/go-sql-driver/mysql)
v1.10.1Compare Source
Fix
Config.FormatDSN()droppingAddrwhenNetis empty.It now uses the default
tcpnetwork so configs with onlyAddrround-trip correctly. (#1770)Fix typed-nil
json.RawMessagewithinterpolateParams=truebeing interpolated as an empty string.It is now interpolated as SQL
NULL, matching server-side prepared statements. (#1782)Add MariaDB 11.8 and 12.3 to the test matrix. (#1774)
v1.10.0Compare Source
Fix
getSystemVar("max_allowed_packet")potentially returned wrong value. (#1754)This affects only when
maxAllowedPacket=0is set.Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0. (#1756)
While older versions have reported CVEs, they do not affect go-mysql.
Update Go versions to 1.24-1.26. (#1763)
Enhance interpolateParams to correctly handle placeholders. (#1732)
The question mark (?) within strings and comments will no longer be treated as a placeholder.
golangci/golangci-lint (github.com/golangci/golangci-lint/v2)
v2.14.0Compare Source
Released on 2026-09-24
bodyclose: from73d1f95to857993a(new directivehandled)exhaustive: from 0.12.0 to 0.13.0exhaustruct_v5: from 5.0.3 to 5.2.0 (new option:allow-empty-blank-assignments)go-check-sumtype: from 0.3.1 toae6904dgocritic: from 0.14.4 to 0.15.0gofumpt: from 0.11.0 to 0.12.0gomoddirectives: from 0.9.0 to 0.10.0gosec: from 2.28.0 to 2.29.0 (re-enableG407)govet-modernize: from 0.49.0 to 0.50.0loggercheck: from 0.11.0 to 0.12.0revive: from 1.15.0 to 1.17.0 (new rules:marshal-receiver,multiline-if-init,use-slices-concat)tagliatelle: from 0.7.2 to 0.8.0fatcontext: from 0.10.0 to 0.10.1flock: from 0.13.0 to 0.13.1godoclint: from 0.11.2 to 0.11.4protogetter: from 0.3.21 to 1.0.1recvcheck: from 0.3.0 to 0.3.1tagalign: from 1.4.3 to 1.4.4v2.13.2Compare Source
Released on 2026-08-28
iface: from 1.5.0 to 1.5.1staticcheck: from 0.8.0 to 0.8.1unparam: from3f964bcto2fa3d84canonicalheader: from v1.1.2 to a temporary forkv2.13.1Compare Source
Released on 2026-08-20
ginkgolinter: from 0.23.1 to 0.24.0gofmt: fromd62b90etoe84e050staticcheck: from 0.8.0-rc.1 to 0.8.0wsl_v5: from 5.8.0 to 5.9.0v2.13.0Compare Source
Released on 2026-08-19
dupword: from 0.1.7 to 0.1.8 (new optionskip-raw-strings)errcheck: from 1.10.0 to 1.20.0exhaustruct_v5: from 4.0.0 to 5.0.2 (new configuration)exhaustruct: deprecated and replaced byexhaustruct_v5fatcontext: from 0.9.0 to 0.10.0 (new options:check-loops,check-function-literals)goconst: from 1.10.0 to 1.11.0 (new options:ignore-map-keys,exclude-types)gofumpt: from 0.9.2 to 0.11.0 (new options:extra.group-params,extra.clothe-returns,extra.balance-calls)gomoddirectives: from 0.8.0 to 0.9.0 (new option:replace-allow-all)gosec: from 2.26.1 to 2.27.1govet-modernize: from 0.44.0 to 0.49.0 (fmtappendfis removed. New analyzersatomictypes,embedlit,errorsastype,importcomment,reflecttypeassert,slicesclip, andslicesbackward.waitgroupis renamedwaitgroupgo)iface: from 1.4.3 to 1.5.0 (new analyzer:unusedmethod)noinlineerr: from 1.0.5 to 1.0.6nonamedreturns: from 1.0.6 to 1.0.8 (new option:allow-unused-named-returns)recvcheck: from 0.2.0 to 0.3.0 (new default exclusions)unparam: from5beb8c8to3f964bcclickhouse-go-linter: from 1.2.0 to 1.2.1errname: from 1.1.1 to 1.1.2exhaustruct_v5: from 5.0.2 to 5.0.3funcorder: add missingFunctionfieldginkgolinter: from 0.23.0 to 0.23.1gocheckcompilerdirectives: from 1.3.0 to 1.4.0gocritic: from 0.14.3 to 0.14.4gomoddirectives: add missingIgnoreForbiddenfieldiface: from 1.4.2 to 1.4.3mirror: from 1.3.0 to 1.3.3nilnil: from 1.1.1 to 1.1.2protogetter: from 0.3.20 to 0.3.21v2.12.2Compare Source
Released on 2026-05-06
gomodguard_v2: fix blocked configurationgomodguard_v2: from 2.1.0 to 2.1.3iface: from 1.4.1 to 1.4.2v2.12.1Compare Source
Released on 2026-05-01
gomodguard_v2: fix panic with migration suggestioninstall.shscript (if you are still using an URL based on the branchmaster, please update to usehttps://golangci-lint.run/install.sh)v2.12.0Compare Source
Released on 2026-05-01
clickhouselintlinter https://github.com/ClickHouse/clickhouse-go-linterdupl: fromf665c8dtoc99c5cf(extended detection)funcorder: from 0.5.0 to 0.6.0 (new option:function)goconst: add an option to ignore strings from testsgoconst: from 1.8.2 to 1.10.0 (extended detection)gomodguard_v2: from 1.4.1 to 2.1.0 (major version with new configuration)gosec: from619ce21to 2.28.0 (new checks:G124,G708,G709,G710)govet: addinlineanalyzermakezero: from 2.1.0 to 2.2.1 (support slice type aliases)paralleltest: exposecheckcleanupoptionsloglint: from 0.11.1 to 0.12.0 (new options:allowed-keys,custom-funcs)wsl_v5: from 5.6.0 to 5.8.0 (new option:cuddle-max-statements; new checks:after-decl,after-defer,after-expr,after-go,cuddle-group)forbidigo: from 2.3.0 to 2.3.1godot: from 1.5.4 to 1.5.6govet-modernize: from 0.43.0 to 0.44.0ireturn: from 0.4.0 to 0.4.1rowserrcheck: from 1.1.1 toc5f79b8customcommandjackc/pgx (github.com/jackc/pgx/v5)
v5.11.0Compare Source
This release adds direct PostgreSQL type scanning through
database/sqlon Go 1.27, improves compatibility withlibpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for
connection-string and date/time behavior changes that may affect existing applications.
Features
driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to bescanned directly into Go values without
pgtype.Map.SQLScanner. Existingdatabase/sqlscalar conversions andsql.Scannerbehavior are preserved. The minimum supported Go version remains 1.25.Rows.TypeMapto expose the type map used to decode rows, including rows created byRowsFromResultReaderthat have no underlying
Conn. Custom implementations ofRows, including mocks, must add this method.Config.MaxProtocolMessageBodyLento configure the maximum incoming protocol message body size(carter-ya)
ErrReadOnlyConnection,ErrReadWriteConnection,ErrPrimaryConnection, andErrStandbyConnectionsentinel errors for
target_session_attrsvalidation, allowing callers to useerrors.Is(Adrian-Stefan Mares)pool_ping_timeoutin connection strings to configureConfig.PingTimeout. The default is zero;zero and negative durations mean no timeout (1991santhu)
Changes
Name-based row-to-struct mapping now matches explicit
dbtags case-insensitively, with exact matches takingprecedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)
pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service
file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory
defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these
now use
$HOMErather than the OS account's home directory (Mohamed MAACHE)pgtype:
date,timestampandtimestamptztext values are now parsed and written by a hand-written parser andencoder for PostgreSQL's ISO date/time format instead of
time.Parseandtime.Format. Go's layout language cannotexpress a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x
faster for
timestampandtimestamptz. Bug fixes:timestampandtimestamptzno longer silently move February 29 of a BC leap year to March 1 when encoding.time.Date(-4712, 2, 29, ...)was written as4713-03-01 BCand is now written as4713-02-29 BC. Thisaffected ordinary four-digit BC years, not only extended-range ones.
datewas never affected.timestampandtimestamptzcan now scan BC leap days.4713-02-29 BCpreviously failed withday out of range.datecould already scan them.10000-01-02 03:04:05previously failed to parse, sotimestampandtimestamptzvalues at the high end of PostgreSQL's range were unreadable over the simple protocol and in anyother text-format result.
time.Timearguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six
fractional digits, so this only affects values from other sources.
Behavior changes:
datenow rejects impossible dates instead of normalizing them.2024-02-30returned2024-03-01and2024-13-01returned2025-01-01; both are now errors.timestampandtimestamptzalready rejected them.text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range
is checked in both formats so that whether a value is accepted does not depend on
QueryExecMode.timestamptzalso rejects time zone displacements outside PostgreSQL's signed 32-bit seconds range, while acceptingthe wider offsets emitted for POSIX time zones, such as
+16.timestamptzvalues scanned from the text format are now returned intime.Local, or inScanLocationwhen it isset, matching what the binary format has always returned. Previously the text path kept whatever location
time.Parsederived from the offset the server sent, so the same value scanned in the two formats could report adifferent
Location()andZone(). The instant is unchanged, but everything that renders the location changeswith it:
Timestamptz.MarshalJSONnow writes the client's offset rather than the server's, so a value the serversent as
+05:30marshals as2024-01-01T13:34:05-08:00on a UTC-8 client instead of2024-01-02T03:04:05+05:30,and
DecodeDatabaseSQLValuehandsdatabase/sqlatime.Timein that same location. Set the codec'sScanLocationtotime.UTCto pin the location regardless of the client's zone.pgconn: connection URIs (
postgres://...) are now parsed by a new parser designed to exactly match libpq's URIparser behavior instead of
net/url,making pgx accept and reject exactly the same URIs as libpq (verified by differential fuzzing against libpq itself).
Most connection strings are unaffected. Edge-case behavior changes, all matching libpq:
+in query values is literal, no longer decoded as a space.%00is rejected.%20).#is ordinary data, not a fragment delimiter.@before any/(previously the last@).ssl=trueis accepted as an alias forsslmode=requirein URIs (JDBC compatibility). A repeatedsslkeyfollows the same last-occurrence-wins rule as other repeated parameters, even across the rewrite to
sslmode. Ifthe final
sslvalue is nottrue, an independent explicitsslmoderemains in effect.postgres://h1,h2:5433/dbnow means h1:5432 andh2:5433 (previously both hosts got port 5433). A port list that is neither a single port nor exactly one port per
host is an error (
could not match N port numbers to M hosts), also for keyword/value connection strings.postgres://::1/dbwas previously accepted as host::1; it is now read as an empty host followed by port:1and fails with an invalid port error. Write it aspostgres://[::1]/db.h1,,h2) get the default host instead of being dropped. Likewise, an empty host ina keyword/value string (
host=) now means the default host -- typically the Unix socket directory -- where itpreviously meant a TCP connection to an empty hostname.
?port=in a URI orport=in a keyword/value string) now means the default port 5432 for theaffected hosts; previously it was an invalid port error. Like any connection-string port, a present-but-empty port
takes precedence over
PGPORT.net/urlrejected any URI containing one. The exception is a literal NUL byte, which is still rejected, as
net/urldid.(libpq never sees one -- C strings end at the first NUL -- but in Go a raw NUL could otherwise pass through into
the NUL-delimited startup message and inject extra parameters.)
Unlike libpq, unrecognized URI query parameters are still accepted (they become runtime parameters or pgx-specific
options). Parse error messages avoid quoting the unredacted connection string and redact recognizable password
fields on a best-effort basis. Invalid connection strings can be structurally ambiguous, so password redaction
cannot be guaranteed for every malformed input.
pgconn: keyword/value connection strings (
host=... user=...) now match libpq's parser exactly, the same treatmentthe URI parser received above and verified the same way, by differential fuzzing against libpq itself. Most
connection strings are unaffected. Behavior changes, all matching libpq:
\\and\'wereunescaped and every other backslash was kept. A value containing a backslash must now escape it, as libpq
requires:
sslcert=C:\path\to\certreads asC:pathtocertand has to be writtensslcert=C:\\path\\to\\cert.This mainly affects Windows certificate and key paths, which previously came through intact without doubling.
there; it was previously rejected with
invalid backslash. Inside a quoted value the escaped terminator leavesthe string unterminated, which is still an error.
missing "=" after "us" in connection info string) instead of becomingpart of the key. Whitespace around the
=is unaffected. This most often shows up with an unquoted valuecontaining a space:
application_name=my app host=xpreviously set neither parameter and sentapp hostto theserver as a runtime parameter, and now fails to parse.
As with URIs, unrecognized keywords are still accepted where libpq rejects them, and an empty
user=is stilldropped so that
PGUSERand the OS user still apply.Fixes
BeginorBeginTx(Victor Alejandro Sanz Ararat)
TraceQueryEndwhenExecfails while deallocating invalidated cached statements (Chris Bandy)completed, avoiding leaked prepared statements and unnecessary cleanup errors (Eliran Ben-Zikri)
LoadTypesoverwriting scalar codecs such asboxandpointwith an incorrectArrayCodec(Arsen Ozhetov)FETCHstatements,including batch and pipeline execution (water)
Batch.ExecStatementis mixed with other batch commands; preserve field descriptions for empty resultsand return a nil result from
Pipeline.GetResultson errorMaxConnLifetimevalues as unlimited instead of immediately expiring connections(Aurelien Pillevesse)
ArrayCodec.Delimiter, including the semicolon delimiterused by
box[].LoadTypeandLoadTypesnow load the delimiter from PostgreSQL (Sueun Cho)string bounds from unbounded ranges (Sueun Cho)
Numeric.ScanScientificand accept scientific notation inNumeric.UnmarshalJSON; reject out-of-range scientific exponents and preserve the original input in parse errors(Sueun Cho)
"Infinity"and"-Infinity"instead of encoding it as zero(Vladimir Saraikin)
Numericwith a nilIntas zero inInt64Value, and return errors when converting NaN orinfinity to an integer instead of panicking (Vladimir Saraikin)
whose digit count, weight, or scale cannot fit the wire format, while accepting the full unsigned digit-count range.
instead of panicking when a pointer-to-pointer scan destination is nil (Rangel Reale)
data. This includes fixes for panics on malformed records and truncated multiranges (Vladimir Saraikin), and
validation of
bit/varbitbit lengths against the actual data (g3m0sis).fields, and text arrays whose dimensions and element counts disagree
separator counts; valid hstores may still contain any number of pairs (AshSgDe29071999)
slice bounds out of range.host='a\-- and the shorter='\, reachable throughpgx.ParseConfigandpgxpool.ParseConfig-- now returnunterminated quoted string in connection info string, libpq's own message forthe same input. The unquoted branch has been guarded since
be69c1c; the quoted branch carried the same unguardedincrement since the parser was ported from pgx v3. Found by fuzzing (Maxim Korotkov)
passwordandsslpasswordvalues suppliedas URI query parameters; previously only the userinfo password was redacted. Redaction matches keys the way the
parser does -- percent-encoded spellings such as
pass%77ord=are recognized -- and masks the entire raw value, soa password containing a space cannot leak its tail into the error message. Credentials stranded outside the
userinfo by a malformed URI are masked whole, and invalid-port errors no longer embed the offending text (which in
a malformed URI can be a mislaid password). Redaction of invalid connection strings is necessarily best effort:
their structure may be ambiguous, so some malformed inputs can still expose password text in an error.
ParseConfigOptions.ConnStringAllowedKeysno longer exempts an explicitly supplied empty port (?port=ina URI or
port=in a keyword/value string) from the allow-list. Only the implied all-empty port list of amulti-host URI without ports (
postgres://h1,h2/db) is exempt. An explicit empty port shadowsPGPORTeven thoughit is empty, so it must be allowed like any other user-supplied key. The URI-only
ssl=truealias is accepted wheneither
sslorsslmodeis allowed, and everyssl/sslmodespelling written in the URI is validated --including occurrences superseded by later repeated parameters.
asyncCloseso context cancellation produces a TCP FIN instead of RST, avoiding "connection reset by peer" on the server / proxy (Sean Chittenden at CrowdStrike, Inc.)StartupMessage.Encoderejects a NUL byte in any parameter name or value instead of writing it. Thestartup message body is a run of NUL-delimited strings whose length is data-driven, so a NUL in a value ends that
parameter and everything after it is read by the server as further parameters -- an
application_nameofx\x00user\x00adminchanged the role the connection logged in as. libpq cannot reach this state because itsparameters are NUL-terminated C strings.
Connectnow fails with nothing written to the wire, which coverssettings that bypass connection string parsing: service files and direct assignment to
Config.RuntimeParams,Config.User, orConfig.Database.ParseConfig, as URIs already were.v5.10.0Compare Source
uptrace/bun (github.com/uptrace/bun)
v1.3.0Compare Source
Please refer to CHANGELOG.md for details
yaml/go-yaml (go.yaml.in/yaml/v3)
v3.0.5Compare Source
go-gorm/gorm (gorm.io/gorm)
v1.31.2Compare Source
Changes
dominikh/go-tools (honnef.co/go/tools)
v0.8.2Compare Source
v0.8.1Compare Source
v0.8.0Compare Source
cznic/sqlite (modernc.org/sqlite)
v1.60.1Compare Source
v1.60.0Compare Source
v1.59.0Compare Source
v1.58.0Compare Source
v1.57.0Compare Source
v1.56.0Compare Source
v1.55.0Compare Source
v1.54.0Compare Source
v1.53.0Compare Source
v1.52.0Compare Source
v1.51.0Compare Source
v1.50.1Compare Source
mvdan/gofumpt (mvdan.cc/gofumpt)
v0.12.0Compare Source
This release is based on Go 1.27's gofmt, and requires Go 1.26 or later.
A standard library import carrying a doc or inline comment is no longer moved
into the top import group, as the comment stayed behind and ended up detached
at the bottom of the group. See #289.
Moving a standard library import up no longer leaves an empty line where it
used to be, which split the remaining imports into extra groups. See #225.
A copyright header or package doc no longer makes gofumpt treat a single-line
first declaration as multi-line, adding an empty line after it.
An assignment whose right-hand side is separated by a comment is now left
alone, as merging the lines produced output which gofmt would change back.
v0.11.0Compare Source
Like v0.10.0, this release is based on Go 1.26's gofmt, and requires Go 1.25 or later.
The multi-line function call rule introduced in v0.10.0 proved controversial,
so it is now the extra rule
balance_calls, disabled by default.It is also narrowed to only place the closing parenthesis on its own line
when the opening parenthesis ends a line. See #74.
Avoid crashing when compiled with tinygo for Wasm, which lacks recover support,
by detecting commented-out code without the parser's bailout panic. See #230.
Produce stable output in a single pass when a lone var declaration is adjacent
to a single-element var group, which previously required a second run. See #355.
Keep the parentheses around an expression which begins with a composite literal
of the form
T{...}, such as(s{}.Foo()), as they are required when theexpression starts an
if,for, orswitchclause. See #356.v0.10.0Compare Source
This release is based on Go 1.26's gofmt, and requires Go 1.25 or later.
A new rule is introduced to drop unnecessary parentheses around expressions
where the inner expression is unambiguous on its own, such as
f((3)).Parentheses are kept where they are useful, such as on binary expressions. See #44.
A new rule is introduced to require multi-line function calls to match
the opening and closing parenthesis in terms of the use of newlines. See #74.
The
-extraflag now accepts a comma-separated list of rule names to enableindividual extra rules, rather than enabling all of them at once. See #339.
The following changes are included as well:
go.modfiles without amoduledirective - #350Configuration
📅 Schedule: (in timezone Australia/Sydney)
* * * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.