You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We were planning on having 0.4.0 be the next version released but (1) some of that work isn't quite ready yet and (2) we have a good set of minor fixes, dependency upgrades, and one fix that would actually be better on a 0.3.x release: #500.
I cherry-picked the following commits from main onto maint-0.3 in order:
3de7421 fix: try to enable vt or disable colors on startup on Windows (#383)
b383f44 test(install): cover downgrade by reinstalling an older version (#390)
43cb615 chore(go): bump golang.org/x/crypto from 0.46.0 to 0.52.0 (#412)
9b0e171 chore(go): bump golang.org/x/sys from 0.45.0 to 0.47.0 in the golang-org-x group across 1 directory (#411)
5970583 chore(go): bump charm.land/bubbles/v2 from 2.0.0 to 2.1.0 (#407)
cdfa95d chore(go): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.22 (#404)
195081d chore(go): bump github.com/golang-jwt/jwt/v5 from 5.3.0 to 5.3.1 (#405)
d2596ca chore(go): bump github.com/pelletier/go-toml/v2 from 2.2.4 to 2.4.2 (#406)
3b98e72 chore: bump go toolchain to 1.26.5 (#413)
bad5d71 test: add regression test for go-toml 2.4.x (#415)
a08576c chore(go): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 (#416)
fef359a chore(go): bump github.com/cli/oauth from 1.2.1 to 1.2.2 (#417)
089d24b chore(go): bump github.com/ProtonMail/gopenpgp/v3 from 3.3.0 to 3.4.1 (#419)
85383de chore(go): bump github.com/charmbracelet/x/ansi from 0.11.6 to 0.11.7 (#420)
fcf0d39 chore(go): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 (#418)
1608d20 chore(go): bump charm.land/bubbletea/v2 from 2.0.2 to 2.0.8 (#427)
ac4f0bd chore(go): bump charm.land/lipgloss/v2 from 2.0.2 to 2.0.5 (#429)
533913c chore(go): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 (#428)
daeb820 chore: update fallback driver docs URLs (#435)
bf9d60b chore(go): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 (#443)
52fd087 fix(windows): work around garbled control codes like we do on unix (#448)
0abaa4f chore(go): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#453)
701af26 chore(go): bump github.com/charmbracelet/x/ansi from 0.11.7 to 0.11.8 (#469)
36a338d chore(go): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 (#470)
efc7dd9 chore(go): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6 (#471)
d843f4d chore(go): bump charm.land/bubbletea/v2 from 2.0.8 to 2.0.9 (#479)
d85580c chore(go): bump charm.land/bubbles/v2 from 2.1.1 to 2.2.1 (#478)
e0dcc73 chore: fixes for goreleaser 2.18.0 (#486)
f3e83e9 chore(go): bump golang.org/x/sys from 0.47.0 to 0.48.0 in the golang-org-x group across 1 directory (#493)
ffc6e2e fix: reject unsupported lockfile versions (#500)
These all applied cleanly except for bad5d71 which I had to edit since it included tests from the configurable driver registries work that'll land on 0.4.0. I filtered out feat, docs, and ci commits.
This all looks good to me. And looking at the branch looks good, my only comment/question is that #493 raised the minimum go version for the package from 1.25.0 to 1.26.0.
In practice, this would only matter for someone who was using dbc as an importable library as opposed to using the binary directly. For that use case, bumping that minimum go version is a bit much for a patch version (it would be fine in 0.4.0). So we should consider how much we care about that and whether we should leave #493 out of the 0.3.1 release or not.
Good catch on that, I see how it snuck into the cherry picks. I was able to rebase again and drop these:
drop 23b9e27 chore(go): bump golang.org/x/sys from 0.47.0 to 0.48.0
drop 3efa579 chore: bump go toolchain to go1.26.6
Bumping golang.org/x/sys 0.48.0 requires bumping the minimum go version to >=1.26.0 but we don't need to bump it to address any govulncheck results.
I also edited 2f2d659 chore: bump go toolchain to 1.26.5 (#413) to bump to 1.26.13 instead of 1.26.5 so now govulncheck is clean,
$ GOTOOLCHAIN=go1.25.13 govulncheck ./...
=== Symbol Results ===
No vulnerabilities found.
Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 4
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
I noticed we don't have a good way to run the tests on a maint branch so I created #507 which we can cherry-pick onto the maint branch. Once that's done, it should trigger CI and we can cut a release after that.
Signing the Windows MSI failed with this cryptic error,
output=
│ jsign: Failed to load the keystore /tmp/DigiCert One Signing Manager Tools/smtools-linux-x64/pkcs11properties.cfg
│ java.security.KeyStoreException: Unable to load the PKCS11 keystore /tmp/DigiCert One Signing Manager Tools/smtools-linux-x64/pkcs11properties.cfg
│ at net.jsign.KeyStoreType.getKeystore(KeyStoreType.java:653)
│ at net.jsign.KeyStoreBuilder.build(KeyStoreBuilder.java:285)
│ at net.jsign.SignerHelper.build(SignerHelper.java:327)
│ at net.jsign.SignerHelper.sign(SignerHelper.java:450)
│ at net.jsign.SignerHelper.execute(SignerHelper.java:305)
│ at net.jsign.JsignCLI.execute(JsignCLI.java:213)
│ at net.jsign.JsignCLI.main(JsignCLI.java:57)
│ Caused by: java.io.IOException: load failed
│ at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.engineLoad(P11KeyStore.java:781)
│ at java.base/java.security.KeyStore.load(KeyStore.java:1493)
│ at net.jsign.KeyStoreType.getKeystore(KeyStoreType.java:650)
│ ... 6 more
│ Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_FUNCTION_FAILED
│ at jdk.crypto.cryptoki/sun.security.pkcs11.wrapper.PKCS11.C_FindObjectsInit(Native Method)
│ at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.findObjects(P11KeyStore.java:2676)
│ at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.mapLabels(P11KeyStore.java:2291)
│ at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.engineLoad(P11KeyStore.java:771)
│ ... 8 more
│ Try `jsign --help' for more information.
Activity
amoeba commentedon Sep 29, 2026
I created the
maint-0.3from the v0.3.0 tag and created a 0.3.1 milestone.I cherry-picked the following commits from main onto maint-0.3 in order:
These all applied cleanly except for
bad5d71which I had to edit since it included tests from the configurable driver registries work that'll land on 0.4.0. I filtered outfeat,docs, andcicommits.zeroshade commentedon Sep 29, 2026
This all looks good to me. And looking at the branch looks good, my only comment/question is that #493 raised the minimum go version for the package from 1.25.0 to 1.26.0.
In practice, this would only matter for someone who was using dbc as an importable library as opposed to using the binary directly. For that use case, bumping that minimum go version is a bit much for a patch version (it would be fine in 0.4.0). So we should consider how much we care about that and whether we should leave #493 out of the 0.3.1 release or not.
Otherwise this all looks good to me!
amoeba commentedon Sep 30, 2026
Good catch on that, I see how it snuck into the cherry picks. I was able to rebase again and drop these:
Bumping
golang.org/x/sys0.48.0 requires bumping the minimum go version to >=1.26.0 but we don't need to bump it to address any govulncheck results.I also edited
2f2d659 chore: bump go toolchain to 1.26.5 (#413)to bump to 1.26.13 instead of 1.26.5 so now govulncheck is clean,amoeba commentedon Sep 30, 2026
I noticed we don't have a good way to run the tests on a maint branch so I created #507 which we can cherry-pick onto the maint branch. Once that's done, it should trigger CI and we can cut a release after that.
amoeba commentedon Sep 30, 2026
Cherry picked as 500f37c and both test workflows are green:
I'll tag an RC.
amoeba commentedon Sep 30, 2026
RC tagged, GHA run: https://github.com/columnar-tech/dbc/actions/runs/36756983687.
amoeba commentedon Sep 30, 2026
Signing the Windows MSI failed with this cryptic error,
amoeba commentedon Oct 1, 2026
The above error was an out of sync secrets config which @zeroshade fixed.
dbc 0.3.1 is now released, see https://github.com/columnar-tech/dbc/releases/tag/v0.3.1. Post-release tasks including publishing to winget and npm are done.