Bump the go-minor-and-patch group across 1 directory with 9 updates by dependabot[bot] · Pull Request #34 · SamsonNegedu/selfhostly

dependabot · 2026-11-01T22:39:57Z

Bumps the go-minor-and-patch group with 9 updates in the / directory:

Package	From	To
github.com/compose-spec/compose-go/v2	`2.10.1`	`2.16.2`
github.com/gin-gonic/gin	`1.9.1`	`1.12.0`
github.com/go-pkgz/auth	`1.25.2`	`1.27.1`
github.com/shirou/gopsutil/v3	`3.24.1`	`3.24.5`
github.com/spf13/pflag	`1.0.9`	`1.0.10`
golang.org/x/net	`0.60.0`	`0.62.0`
golang.org/x/sync	`0.23.0`	`0.24.0`
golang.org/x/term	`0.46.0`	`0.47.0`
modernc.org/sqlite	`1.28.0`	`1.61.0`

Updates github.com/compose-spec/compose-go/v2 from 2.10.1 to 2.16.2

Release notes

Sourced from github.com/compose-spec/compose-go/v2's releases.

v2.16.2

What's Changed

types: resolve the environment of pre_start hooks by @ndeloof in compose-spec/compose-go#938

types: resolve the labels of pre_start hooks by @glours in compose-spec/compose-go#939

chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in compose-spec/compose-go#941

chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in compose-spec/compose-go#940

types: add use_service_name_alias to service networks by @glours in compose-spec/compose-go#943

feat: add the umask service attribute by @ndeloof in compose-spec/compose-go#942

Full Changelog: compose-spec/compose-go@v2.16.1...v2.16.2

v2.16.1

What's Changed

override: fix two merge regressions introduced in v2.15.0 by @glours in compose-spec/compose-go#937

Full Changelog: compose-spec/compose-go@v2.16.0...v2.16.1

v2.16.0

⚠️ Breaking change (Go API)

types.ServiceConfig now embeds types.ContainerSpec and types.WorkloadSpec, shared with the new jobs element and pre_start init containers. Field access is unchanged (svc.Image), but struct literals must now set moved fields through the embedded structs, and code walking ServiceConfig with reflection will see these two embedded structs instead of a flat list of fields:
types.ServiceConfig{Name: "web", ContainerSpec: types.ContainerSpec{Image: "nginx"}}
ServiceConfig.PreStart is now a []types.PreStartHook (was []types.ServiceHook), which embeds a full ContainerSpec; Image and PerReplica are no longer fields of ServiceHook.

The order of keys in the YAML and JSON produced for a service also changes (service-level keys first, then container-level, then workload-level ones). The content is the same, but expected files compared as text need to be regenerated.

What's Changed

loader: detect unsupported compose-file attributes by @glours in compose-spec/compose-go#927

fix(transform): honor ignoreParseError in ssh and ulimits parsers by @glours in compose-spec/compose-go#928

Jobs by @ndeloof in compose-spec/compose-go#866

fix: type=image volume source is always a docker image reference by @ndeloof in compose-spec/compose-go#929

fix: an explicit working dir must survive a remote resource loader by @ndeloof in compose-spec/compose-go#930

fix: reject non-mapping entries under networks and models by @glours in compose-spec/compose-go#932

fix: allow disabled services as build additional contexts by @Shubham-Padkonde in compose-spec/compose-go#931

loader: promote x-* extensions adopted by the specification by @ndeloof in compose-spec/compose-go#935

New Contributors

@Shubham-Padkonde made their first contribution in compose-spec/compose-go#931

Full Changelog: compose-spec/compose-go@v2.15.0...v2.16.0

v2.15.0

What's Changed

Bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in compose-spec/compose-go#905

... (truncated)

Commits

ddbe099 feat: add the umask service attribute
5515644 types: add ServiceNameAliasEnabled helper on ServiceNetworkConfig
3aaa230 types: add use_service_name_alias to service networks
79c7069 chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2
08a1af1 chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2
bd828ea types: resolve the labels of pre_start hooks
c53b350 types: resolve the environment of pre_start hooks
32d8d5d override: share the by-key compaction and reject null ipam config items
7ed4d72 override: pin the merge of KEY=VALUE entries that are not interpolated
be0aa2f override: compact repeated keys and keep empty lists in KEY=VALUE merge
Additional commits viewable in compare view

Updates github.com/gin-gonic/gin from 1.9.1 to 1.12.0

Release notes

Sourced from github.com/gin-gonic/gin's releases.

v1.12.0

Changelog

Features

192ac89eefc1c30f7c97ae48a9ffb1c6f1c8c8bc: feat(binding): add support for encoding.UnmarshalText in uri/query binding (#4203) (@takanuva15)

53410d2e07054369e0960fbe2eed97e1b9966f12: feat(context): add GetError and GetErrorSlice methods for error retrieval (#4502) (@raju-mechatronics)

acc55e049e33b401e810dbd8c0d6dcb6b3ba2b05: feat(context): add Protocol Buffers support to content negotiation (#4423) (@1911860538)

38e765119241d990705169bedb5002a29ae0cbd1: feat(context): implemented Delete method (@Spyder01)

771dcc6476d7bc6abb9ec0235ecefa4d38fe6fb0: feat(gin): add option to use escaped path (#4420) (@ldesauw)

4dec17afdff48e8018c83618fbbe69fceeb2b41d: feat(logger): color latency (#4146) (@wsyqn6)

d7776de7d444935ea4385999711bd6331a98fecb: feat(render): add bson protocol (#4145) (@laurentcau)

Bug fixes

b917b14ff9d189f16a7492be79d123a47806ee19: fix(binding): empty value error (#2169) (@guonaihong)

c3d1092b3b48addf6f9cd00fe274ec3bd14650eb: fix(binding): improve empty slice/array handling in form binding (#4380) (@1911860538)

9914178584e42458ff7d23891463a880f58c9d86: fix(context): ClientIP handling for multiple X-Forwarded-For header values (#4472) (@Nurysso)

2a794cd0b0faa7d829291375b27a3467ea972b0d: fix(debug): version mismatch (#4403) (@zeek0x)

c3d5a28ed6d3849da820195b6774d212bcc038a9: fix(gin): close os.File in RunFd to prevent resource leak (#4422) (@1911860538)

5fad976b372e381312f8de69f0969f1284d229d3: fix(gin): literal colon routes not working with engine.Handler() (#4415) (@pawannn)

63dd3e60cab89c27fb66bce1423bd268d52abad1: fix(recover): suppress http.ErrAbortHandler in recover (#4336) (@MondayCha)

5c00df8afadd06cc5be530dde00fe6d9fa4a2e4a: fix(render): write content length in Data.Render (#4206) (@dengaleev)

234a6d4c00cb77af9852aca0b8289745d5529b4b: fix(response): refine hijack behavior for response lifecycle (#4373) (@appleboy)

472d086af2acd924cb4b9d7be0525f7d790f69bc: fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535) (@veeceey)

8e07d37c63e5536eb25f4af4c91eabeee4011fba: fix: Correct typos, improve documentation clarity, and remove dead code (#4511) (@mahanadh)

Enhancements

ba093d19477b896ac89a7fc3246af23d290b8e26: chore(binding): upgrade bson dependency to mongo-driver v2 (#4549) (@BobDu)

b2b489dbf4826c2c630717a77fd5e42774625410: chore(context): always trust xff headers from unix socket (#3359) (@WeidiDeng)

ecb3f7b5e2f3915bf1db240ed5eee572f8dbea36: chore(deps): upgrade golang.org/x/crypto to v0.45.0 (#4449) (@appleboy)

af6e8b70b8261bb0c99ad094fe552ab92991620a: chore(deps): upgrade quic-go to v0.57.1 (@appleboy)

db309081bc5c137b2aa15701ef53f7f19788da25: chore(logger): allow skipping query string output (#4547) (@USA-RedDragon)

26c3a628655cad2388380cb8102d6ce7d4875f3b: chore(response): prevent Flush() panic when http.Flusher (#4479) (@Twacqwq)

5dd833f1f26de0eb30eae47b17e05ced2482dc41: chore: bump minimum Go version to 1.24 and update workflows (#4388) (@appleboy)

Refactor

39858a0859c914bd26948fa950477e11bd8d3823: refactor(binding): use maps.Copy for cleaner map handling (#4352) (@russcoss)

c0048f645ee945c4db30593afdea10123e2c30a6: refactor(context): omit the return value names (#4395) (@wanghaolong613)

915e4c90d28ec4cffc6eb146e208ab5a65eac772: refactor(context): replace hardcoded localhost IPs with constants (#4481) (@pauloappbr)

414de60574449457f3192a7a1d5528940db2836d: refactor(context): using maps.Clone (#4333) (@cuiweixie)

59e9d4a794f12c4f9a6c7bed441b9644e5f6d99b: refactor(ginS): use sync.OnceValue to simplify engine function (#4314) (@1911860538)

3ab698dc5110af1977d57226e4995c57dd34c233: refactor(recovery): smart error comparison (#4142) (@zeek0x)

d1a15347b1e45a8ee816193d3578a93bfd73b70f: refactor(utils): move util functions to utils.go (#4467) (@zeek0x)

e3118cc378d263454098924ebbde7e8d1dd2e904: refactor: for loop can be modernized using range over int (#4392) (@wanghaolong613)

488f8c3ffa579a8d19beb2bae95ff8ef36b3d53f: refactor: replace magic numbers with named constants in bodyAllowedForStatus (#4529) (@veeceey)

9968c4bf9d5a99edc3eee2c068a4c9160ece8915: refactor: use b.Loop() to simplify the code and improve performance (#4389) (@reddaisyy)

a85ef5ce4d0cda8834c59c855068ed48b51192d1: refactor: use b.Loop() to simplify the code and improve performance (#4432) (@efcking)

Build process updates

61b67de522a189b568aced4c5c16917c558e3387: ci(bot): increase frequency and group updates for dependencies (#4367) (@appleboy)

fb27ef26c2fdfe25344b4c039d8a53551f9e912c: ci(lint): refactor test assertions and linter configuration (#4436) (@appleboy)

93ff771e6dbf10e432864b30f3719ac5c84a4d4a: ci(sec): improve type safety and server organization in HTTP middleware (#4437) (@appleboy)

e88fc8927a52b74f55bec0351604a56ac0aa1c51: ci(sec): schedule Trivy security scans to run daily at midnight UTC (#4439) (@appleboy)

5e5ff3ace496a31b138b0820136a146bfb5de0ef: ci: replace vulnerability scanning workflow with Trivy integration (#4421) (@appleboy)

00900fb3e1ea9dde33985a0e4f6afec793d5e786: ci: update CI workflows and standardize Trivy config quotes (#4531) (@appleboy)

ae3f524974fc4f55d18c9e7fae4614503c015226: ci: update Go version support to 1.25+ across CI and docs (#4550) (@appleboy)

... (truncated)

Changelog

Sourced from github.com/gin-gonic/gin's changelog.

Gin v1.12.0

Features

feat(render): add bson protocol (#4145)

feat(context): add GetError and GetErrorSlice methods for error retrieval (#4502)

feat(binding): add support for encoding.UnmarshalText in uri/query binding (#4203)

feat(gin): add option to use escaped path (#4420)

feat(context): add Protocol Buffers support to content negotiation (#4423)

feat(context): implemented Delete method (#38e7651)

feat(logger): color latency (#4146)

Enhancements

perf(tree): reduce allocations in findCaseInsensitivePath (#4417)

perf(recovery): optimize line reading in stack function (#4466)

perf(path): replace regex with custom functions in redirectTrailingSlash (#4414)

perf(tree): optimize path parsing using strings.Count (#4246)

chore(logger): allow skipping query string output (#4547)

chore(context): always trust xff headers from unix socket (#3359)

chore(response): prevent Flush() panic when the underlying ResponseWriter does not implement http.Flusher (#4479)

refactor(recovery): smart error comparison (#4142)

refactor(context): replace hardcoded localhost IPs with constants (#4481)

refactor(utils): move util functions to utils.go (#4467)

refactor(binding): use maps.Copy for cleaner map handling (#4352)

refactor(context): using maps.Clone (#4333)

refactor(ginS): use sync.OnceValue to simplify engine function (#4314)

refactor: replace magic numbers with named constants in bodyAllowedForStatus (#4529)

refactor: for loop can be modernized using range over int (#4392)

Bug Fixes

fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535)

fix(render): write content length in Data.Render (#4206)

fix(context): ClientIP handling for multiple X-Forwarded-For header values (#4472)

fix(binding): empty value error (#2169)

fix(recover): suppress http.ErrAbortHandler in recover (#4336)

fix(gin): literal colon routes not working with engine.Handler() (#4415)

fix(gin): close os.File in RunFd to prevent resource leak (#4422)

fix(response): refine hijack behavior for response lifecycle (#4373)

fix(binding): improve empty slice/array handling in form binding (#4380)

fix(debug): version mismatch (#4403)

fix: correct typos, improve documentation clarity, and remove dead code (#4511)

Build process updates / CI

ci: update Go version support to 1.25+ across CI and docs (#4550)

chore(binding): upgrade bson dependency to mongo-driver v2 (#4549)

Gin v1.11.0

... (truncated)

Commits

73726dc docs: update documentation to reflect Go version changes (#4552)
e292e5c docs: document and finalize Gin v1.12.0 release (#4551)
ae3f524 ci: update Go version support to 1.25+ across CI and docs (#4550)
38534e2 chore(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#4548)
472d086 fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535)
fb25834 test(context): use http.StatusContinue constant instead of magic number 100 (...
6f1d5fe test(render): add comprehensive error handling tests (#4541)
5c00df8 fix(render): write content length in Data.Render (#4206)
db30908 chore(logger): allow skipping query string output (#4547)
ba093d1 chore(binding): upgrade bson dependency to mongo-driver v2 (#4549)
Additional commits viewable in compare view

Updates github.com/go-pkgz/auth from 1.25.2 to 1.27.1

Release notes

Sourced from github.com/go-pkgz/auth's releases.

Version 1.27.1

Verify login now accepts only a signed handshake token that carries this provider's name. Before, LoginHandler accepted any token with a user::address handshake signed with the service secret. That included handshake tokens an application issues for its own purposes, which are not login confirmations, and confirmations issued by another verify provider. A session token, which has no handshake, caused a nil dereference. All of these now get a 403.

One behaviour change. An application that mints its own handshake tokens and sends them to the verify login endpoint has to set the provider name on them. Tokens from the provider's own confirmation request already carry it.

The login error paths no longer log the token. Six error branches of LoginHandler passed the raw request to the error response, which logs the URL with ?token= in it. An expired session token sent as ?token= was logged in full, and it stays usable as a cookie because the auth middleware refreshes expired tokens. A handler built without a confirmation store logged a confirmation link that could still be redeemed.

Also in this release: the provider tests fail with the address when a test server port is taken, where before they failed later on a client timeout that did not name the cause.

Full detail on the token check in #319.

Version 1.27.0

The Telegram provider no longer hard-codes https://api.telegram.org. NewTelegramAPIWithBaseURL takes the base, and every request goes through it, avatar downloads included. An empty base falls back to the public API.

Moving a token-bearing URL off a constant is what the rest of the change is for: the bot token travels in the request path, and the answers now come from a host the library does not control. The base is validated, error text is scrubbed of the token in raw and encoded forms, a success response has to match Telegram's own username shape, and redirects are refused by default because Go copies the previous URL into Referer.

One behaviour change. A caller that relied on the default redirect policy now gets an error on a redirect. A caller-supplied CheckRedirect remains in force.

Also in this release: the Apple public-key test no longer binds a shared port, and the Telegram tests no longer race or depend on order.

Full detail in #316.

Version 1.26.0

EmailParams gains HELOHost, which sets the hostname the sender announces in the SMTP greeting. Left empty it stays localhost, so existing configurations are unchanged. A relay enforcing reject_non_fqdn_helo_hostname or reject_unknown_helo_hostname refuses the default greeting, and the verification message never leaves.

Verification email delivery is now bound to the request context. TimeOut covered the connection setup only, so a server that accepted the connection and then stalled held the login request for as long as it liked. The send now ends when the request does. Sender implementations that do not offer SendContext keep working through the existing Send.

Also updates dependencies across the root, v2 and example modules, and sets explicit GITHUB_TOKEN permissions in the workflows.

Version 1.25.7

Avatar storage on GridFS destroyed data. Every Put created a new revision under the same filename, so old avatars accumulated, Remove deleted only the newest one and left the avatar readable, and ID could return a stale revision. Cleanup now removes only revisions older than the upload that just completed, so two concurrent uploads for the same user cannot delete each other's file.

Apple public keys are now cached rather than fetched on every login, refreshed when a token names an unknown key so rotation still works, and reused for up to 12 hours if the key service is unreachable. A non-2xx response or an empty key set is rejected instead of being cached as valid.

The post-auth redirect uses 303 instead of 307. Apple's form_post callback arrives as a POST, and a method-preserving redirect replayed it onto the target page, which a static file server answers with 405. This changes the status for the oauth1, oauth2 and verify providers as well.

Two documented parameters now work: session is honoured by the direct and verify providers, and aud is accepted alongside site on the verify confirmation request. Apple no longer forces a persistent cookie when a session-only login was requested. For the direct and verify providers any non-zero sess value now means session-only, where previously only sess=1 did.

The avatar route returns 404 when no avatar store is configured, instead of dereferencing a nil proxy.

Dependencies: go-pkgz/email v0.8.0 and go-pkgz/rest v1.24.0. CI moves to go 1.26 and golangci-lint v2.12.

Version 1.25.6

The GitHub provider can now derive the local user id from the immutable numeric account id instead of the mutable login. This is opt-in and off by default, since enabling it changes the id of every existing GitHub user. Separately, the OAuth1 and OAuth2 callbacks no longer skip the user info HTTP status check, which previously let an error response map every failed login onto one shared user id.

Changes since v1.25.5

#301 opt-in github numeric user id, reject non-2xx user info

#298 bump golang.org/x/image from 0.39.0 to 0.41.0

Full Changelog: go-pkgz/auth@v1.25.5...v1.25.6

... (truncated)

Commits

cecb18d test: fail on a taken port when the provider tests start their servers
2062119 fix: keep the token out of the log in the later verify login error branches
6c9fe1f docs: pin the Go toolchain in the AGENTS.md lint commands
cbd5fe6 docs: say what the verify login check requires
ddd9562 fix: keep the token out of the log when verify login rejects it early
b4cbc19 Accept only this provider's own confirmation tokens in verify login
5f6d12c fix: remove the data race and the order dependence in the telegram tests
d9c7fd3 Make the Telegram API base URL configurable, and close what that opens (#316)
5653bd4 fix: stop TestApplePublicKey_Fetch flaking on a shared port
28916b2 add revmux review profile for the repo
Additional commits viewable in compare view

Updates github.com/shirou/gopsutil/v3 from 3.24.1 to 3.24.5

Release notes

Sourced from github.com/shirou/gopsutil/v3's releases.

v3.24.5

What's Changed

cpu

Improve AIX Support by @Dylan-M in shirou/gopsutil#1651

process

Add fallback for lsof output by @MDrakos in shirou/gopsutil#1640

[process][openbsd]: add cwd on openbsd. by @shirou in shirou/gopsutil#1649

Other Changes

remove duplicate code in mktypes.sh by @zhanluxianshen in shirou/gopsutil#1646

add arm/arm64 category for github pr label. by @zhanluxianshen in shirou/gopsutil#1647

New Contributors

@zhanluxianshen made their first contribution in shirou/gopsutil#1646

@MDrakos made their first contribution in shirou/gopsutil#1640

@Dylan-M made their first contribution in shirou/gopsutil#1651

Full Changelog: shirou/gopsutil@v3.24.4...v3.24.5

v3.24.4

What's Changed

net

Update net_openbsd.go to correctly parse netstat output on obsd by @amarinderca in shirou/gopsutil#1621

chore: fix some typos in comments by @camcui in shirou/gopsutil#1624

New Contributors

@amarinderca made their first contribution in shirou/gopsutil#1621

@camcui made their first contribution in shirou/gopsutil#1624

Full Changelog: shirou/gopsutil@v3.24.3...v3.24.4

v3.24.3

What's Changed

disk

chore: fix typo by @majorteach in shirou/gopsutil#1615

host

[host][linux]: fix utmp size on linux/arm64 by @shirou in shirou/gopsutil#1603

load

Total Processes in MiscStat Corrected by @eric1234 in shirou/gopsutil#1612

process

[process][freebsd]: re-generate types on freebsd arm64 by @shirou in shirou/gopsutil#1609

New Contributors

@majorteach made their first contribution in shirou/gopsutil#1615

@eric1234 made their first contribution in shirou/gopsutil#1612

... (truncated)

Commits

4336530 Merge pull request #1649 from shirou/feat/add_process_cwd_openbsd
cb52f7a Merge pull request #1651 from Dylan-M/aix_support
125da53 Update the README charts with the AIX information
ff4ae36 Remove extraneous development note comments
df9c9bf Update min version in the readme to match new required min version.
1d7b4a3 Revert accidental change of go version in go.mod (wasn't supposed to commit).
9bf502f Fix logic errors, syntax errors, and typos
b133d60 Ignore host_aix_ppc64 for now
b4d95a4 Raise minimum go version to 1.18 (required by changes) and run go mod tidy
0917790 Remove inappropriate package addition
Additional commits viewable in compare view

Updates github.com/spf13/pflag from 1.0.9 to 1.0.10

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.0.10

What's Changed

fix deprecation comment for (FlagSet.)ParseErrorsWhitelist by @thaJeztah in spf13/pflag#447

remove uses of errors.Is, which requires go1.13, move go1.16/go1.21 tests to separate file by @thaJeztah in spf13/pflag#448

New Contributors

@thaJeztah made their first contribution in spf13/pflag#447

Full Changelog: spf13/pflag@v1.0.9...v1.0.10

Commits

0491e57 Merge pull request #448 from thaJeztah/fix_go_version
72abab1 Merge pull request #447 from thaJeztah/fix_deprecation_comment
7e4dfb1 Test on Go 1.12
18a9d17 move Func, BoolFunc, tests as they require go1.21
c5b9e98 remove uses of errors.Is, which requires go1.13
45a4873 fix deprecation comment for (FlagSet.)ParseErrorsWhitelist
See full diff in compare view

Updates golang.org/x/net from 0.60.0 to 0.62.0

Commits

3de643d html: check all ancestor namespace transitions when rendering raw text
05c76ee ipv4, ipv6: avoid slice bounds panics on empty batch or BPF filter
dad306f ipv6: avoid out-of-bounds panic in ICMPFilter
9c0565a ipv4: fix TTL control message parsing on big-endian Linux and Solaris
9425eb3 internal/socket, ipv4, ipv6: avoid panic on empty control message on non-Unix
4b10404 ipv4, ipv6: avoid nil parse function call in ControlMessage.Parse
afcf8cd ipv4: fix several missing bounds checks
4af4fce html: avoid quadratic complexity when coalescing text nodes
7e56200 quic: per-path connection ids
c1d31df go.mod: update golang.org/x dependencies
Additional commits viewable in compare view

Updates golang.org/x/sync from 0.23.0 to 0.24.0

Commits

36f2d70 errgroup: modernize the usage of closures in goroutines
See full diff in compare view

Updates golang.org/x/term from 0.46.0 to 0.47.0

Commits

0851034 go.mod: update golang.org/x dependencies
See full diff in compare view

Updates modernc.org/sqlite from 1.28.0 to 1.61.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

2026-10-31 v1.61.1:

Prepared statements are no longer parsed and planned again on every execution. Since v1.61.0, SQLite 3.54 expired a cached statement that has a col = ? term in a join or an ORDER BY query whenever the driver cleared its bindings after a run, so a statement prepared with db.Prepare or tx.Prepare cost about twice what it did in v1.60.1. Integer bindings now stay in place between executions, so a parameter bound to 0 or 1 does not re-prepare it either. Resolves [GitLab issue #264](https://gitlab.com/cznic/sqlite/-/issues/264). See [GitLab merge request #147](https://gitlab.com/cznic/sqlite/-/merge_requests/147), thanks Roman Khafizianov (@requilence)!

Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!

Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.

Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!

The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.

Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

2026-10-21 v1.61.0:

Upgrade to SQLite 3.54.1, re-vendoring lib/ from modernc.org/libsqlite3 v1.15.2 and vec/ from modernc.org/libsqlite_vec v0.7.0; sqlite-vec stays v0.1.9. The pinned modernc.org/libc becomes v1.79.0; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

Add _time_format=string_no_monotonic, opt-in: times are written in the default layout but without Go's monotonic clock reading, the m=+... suffix, so a scanned time matches its row again when bound in WHERE col = ?. The default is unchanged. Resolves [GitLab issue #259](https://gitlab.com/cznic/sqlite/-/issues/259). See [GitLab merge request #142](https://gitlab.com/cznic/sqlite/-/merge_requests/142), thanks 不插电 (@r27153733)!

Each release tag now gets a signed provenance document, linked from its GitLab release; VERIFYING.md says what it proves and how to check one. Tooling only. See [GitLab merge request #141](https://gitlab.com/cznic/sqlite/-/merge_requests/141).

Add an opt-in SQLite authorizer per connection: AuthorizerRegisterer, reached through sql.Conn.Raw or installed on every pooled connection from RegisterConnectionHook; existing connections are unchanged. Resolves [GitLab issue #256](https://gitlab.com/cznic/sqlite/-/issues/256). See [GitLab merge request #139](https://gitlab.com/cznic/sqlite/-/merge_requests/139), thanks Tedla Brandsema (@TedlaBrandsema)!

Closing a connection now forgets the pre-update, commit and rollback hooks registered on it; their entries used to linger after Close.

With a shared cache, BeginTx now waits for a lock another connection holds instead of failing at once with SQLITE_LOCKED_SHAREDCACHE (262), as executing BEGIN IMMEDIATE did; Commit and Rollback wait likewise while another connection changes the schema. busy_timeout does not bound the wait; the call's context does. See [GitLab merge request #143](https://gitlab.com/cznic/sqlite/-/merge_requests/143), thanks Ian Chechin!

PrepareContext and BeginTx with a context that is already done now return the context's error, as ExecContext and QueryContext do. See [GitLab merge request #143](https://gitlab.com/cznic/sqlite/-/merge_requests/143), thanks Ian Chechin!

A context that is done before a statement starts running, for example while its arguments are being bound, now stops the statement within 1000 VM steps. SQLite discarded that interrupt, so a long statement ran to completion and only then returned the context's error. See [GitHub pull request #9](modernc-org/sqlite#9), thanks Chris Gianelloni (@wolf31o2)!

A statement waiting for a lock under busy_timeout now stops waiting once its context is done, with the context's error, instead of sleeping on until the timeout; the wait's retry schedule and its bound are otherwise unchanged, and so is a call without a deadline. PrepareContext ended this way returns the context's error too, where it returned SQLITE_BUSY. Resolves [GitLab issue #262](https://gitlab.com/cznic/sqlite/-/issues/262), thanks SirLouen!

2026-09-29 v1.60.1:

Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

2026-09-28 v1.60.0:

A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!

Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.

make vendor now writes vendor.json, the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries; the test suite fails when they no longer match. Tooling only. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).

vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.

Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.

The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.

Document three limits of the pluggable page cache on RegisterPageCache and Cache: it cannot be combined with modernc.org/sqlite/vec, PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines. Documentation only.

Document in the package documentation that state set on a pooled connection is inherited by the next caller to borrow it, and that a connection reached through sql.Conn.Raw is not safe for concurrent use. Documentation only.

Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so ...
Description has been truncated

Bumps the go-minor-and-patch group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/compose-spec/compose-go/v2](https://github.com/compose-spec/compose-go) | `2.10.1` | `2.16.2` | | [github.com/gin-gonic/gin](https://github.com/gin-gonic/gin) | `1.9.1` | `1.12.0` | | [github.com/go-pkgz/auth](https://github.com/go-pkgz/auth) | `1.25.2` | `1.27.1` | | [github.com/shirou/gopsutil/v3](https://github.com/shirou/gopsutil) | `3.24.1` | `3.24.5` | | [github.com/spf13/pflag](https://github.com/spf13/pflag) | `1.0.9` | `1.0.10` | | [golang.org/x/net](https://github.com/golang/net) | `0.60.0` | `0.62.0` | | [golang.org/x/sync](https://github.com/golang/sync) | `0.23.0` | `0.24.0` | | [golang.org/x/term](https://github.com/golang/term) | `0.46.0` | `0.47.0` | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.28.0` | `1.61.0` | Updates `github.com/compose-spec/compose-go/v2` from 2.10.1 to 2.16.2 - [Release notes](https://github.com/compose-spec/compose-go/releases) - [Commits](compose-spec/compose-go@v2.10.1...v2.16.2) Updates `github.com/gin-gonic/gin` from 1.9.1 to 1.12.0 - [Release notes](https://github.com/gin-gonic/gin/releases) - [Changelog](https://github.com/gin-gonic/gin/blob/master/CHANGELOG.md) - [Commits](gin-gonic/gin@v1.9.1...v1.12.0) Updates `github.com/go-pkgz/auth` from 1.25.2 to 1.27.1 - [Release notes](https://github.com/go-pkgz/auth/releases) - [Commits](go-pkgz/auth@v1.25.2...v1.27.1) Updates `github.com/shirou/gopsutil/v3` from 3.24.1 to 3.24.5 - [Release notes](https://github.com/shirou/gopsutil/releases) - [Commits](shirou/gopsutil@v3.24.1...v3.24.5) Updates `github.com/spf13/pflag` from 1.0.9 to 1.0.10 - [Release notes](https://github.com/spf13/pflag/releases) - [Commits](spf13/pflag@v1.0.9...v1.0.10) Updates `golang.org/x/net` from 0.60.0 to 0.62.0 - [Commits](golang/net@v0.60.0...v0.62.0) Updates `golang.org/x/sync` from 0.23.0 to 0.24.0 - [Commits](golang/sync@v0.23.0...v0.24.0) Updates `golang.org/x/term` from 0.46.0 to 0.47.0 - [Commits](golang/term@v0.46.0...v0.47.0) Updates `modernc.org/sqlite` from 1.28.0 to 1.61.0 - [Release notes](https://gitlab.com/cznic/sqlite/tags) - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.28.0...v1.61.0) --- updated-dependencies: - dependency-name: github.com/compose-spec/compose-go/v2 dependency-version: 2.16.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: github.com/gin-gonic/gin dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: github.com/go-pkgz/auth dependency-version: 1.27.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: github.com/shirou/gopsutil/v3 dependency-version: 3.24.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-and-patch - dependency-name: github.com/spf13/pflag dependency-version: 1.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-and-patch - dependency-name: golang.org/x/net dependency-version: 0.62.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/sync dependency-version: 0.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/term dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: modernc.org/sqlite dependency-version: 1.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

SamsonNegedu · 2026-11-01T22:46:27Z

Bundled into #35 with the other Dependabot updates, to save CI minutes.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 1, 2026

SamsonNegedu mentioned this pull request Nov 1, 2026

chore(deps): bundle all open Dependabot updates #35

Merged

SamsonNegedu closed this Nov 1, 2026

Navigation Menu

Repository navigation

Bump the go-minor-and-patch group across 1 directory with 9 updates - #34

Bump the go-minor-and-patch group across 1 directory with 9 updates#34
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-and-patch-05a1763764

dependabot Bot commented on behalf of github Nov 1, 2026

Uh oh!

SamsonNegedu commented Nov 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 1, 2026

v2.16.2

What's Changed

v2.16.1

What's Changed

v2.16.0

⚠️ Breaking change (Go API)

What's Changed

New Contributors

v2.15.0

What's Changed

v1.12.0

Changelog

Features

Bug fixes

Enhancements

Refactor

Build process updates

Gin v1.12.0

Features

Enhancements

Bug Fixes

Build process updates / CI

Gin v1.11.0

Version 1.27.1

Version 1.27.0

Version 1.26.0

Version 1.25.7

Version 1.25.6

Changes since v1.25.5

v3.24.5

What's Changed

cpu

process

Other Changes

New Contributors

v3.24.4

What's Changed

net

New Contributors

v3.24.3

What's Changed

disk

host

load

process

New Contributors

v1.0.10

What's Changed

New Contributors

Changelog

Uh oh!

SamsonNegedu commented Nov 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant