Bump the go-deps group across 1 directory with 21 updates by dependabot[bot] · Pull Request #3930 · google/trillian

dependabot · 2026-09-18T14:23:35Z

Bumps the go-deps group with 21 updates in the / directory:

Package	From	To
cloud.google.com/go/spanner	`1.91.0`	`1.95.1`
github.com/apache/beam/sdks/v2	`2.72.0`	`2.76.0`
github.com/fullstorydev/grpcurl	`1.9.3`	`1.9.4`
github.com/go-sql-driver/mysql	`1.10.0`	`1.10.1`
github.com/jackc/pgx/v5	`5.10.0`	`5.11.0`
github.com/prometheus/client_golang	`1.23.2`	`1.24.1`
github.com/prometheus/client_model	`0.6.2`	`0.6.3`
go.etcd.io/etcd/client/v3	`3.6.14`	`3.7.1`
go.etcd.io/etcd/etcdctl/v3	`3.6.14`	`3.7.1`
go.etcd.io/etcd/server/v3	`3.6.14`	`3.7.1`
golang.org/x/sync	`0.22.0`	`0.23.0`
golang.org/x/sys	`0.47.0`	`0.48.0`
golang.org/x/tools	`0.48.0`	`0.50.0`
google.golang.org/api	`0.279.0`	`0.291.0`
google.golang.org/genproto	`0.0.0-20260319201613-d00831a3d3e7`	`0.0.0-20260523011958-0a33c5d7ca68`
google.golang.org/genproto/googleapis/api	`0.0.0-20260526163538-3dc84a4a5aaa`	`0.0.0-20260630182238-925bb5da69e7`
google.golang.org/genproto/googleapis/rpc	`0.0.0-20260526163538-3dc84a4a5aaa`	`0.0.0-20260825221802-da73d73af1c5`
google.golang.org/protobuf	`1.36.11`	`1.36.12`
k8s.io/apimachinery	`0.35.5`	`0.37.0`
k8s.io/client-go	`0.35.5`	`0.37.0`
k8s.io/utils	`0.0.0-20260210185600-b8788abfbbc2`	`0.0.0-20260626114624-be93311217bd`

Updates cloud.google.com/go/spanner from 1.91.0 to 1.95.1

Release notes

Sourced from cloud.google.com/go/spanner's releases.

spanner: v1.95.1

1.95.1 (2026-09-10)

Bug Fixes

spanner/spansql: Support ARRAY of PROTO types in DDL (#20463) (5fe6a28)

spanner: v1.95.0

1.95.0 (2026-08-24)

Features

spanner: Penalize channels that returned Unavailable or ResourceExhausted in the dynamic channel pool picker (#20390) (e1feec4)

spanner: Support caller-owned OpenTelemetry client metrics (#20388) (f1e77ce)

Bug Fixes

spanner: Stop leaking endpointLatencyRegistry cleanup goroutine (#20416) (95bbcc7), refs #14488

spanner: v1.94.0

1.94.0 (2026-07-28)

Features

spanner: Implement OPAQUE login authentication for Spanner Omni (#20085) (1c073b8)

Bug Fixes

spanner/spannertest: Add support for UUID column type (#20164) (bbfeb3f)

spanner: Excise a stale test reference to old genproto paths (#20245) (2063c07)

Commits

78076a8 chore(main): release spanner 1.95.1 (#20501)
e8737c3 chore(main): release bigtable 1.57.0 (#20485)
015b73c test(bigtable): fakeStream.Recv observes ctx.Done to fix pool-Close deadlock ...
2bfdb5d fix(bigtable): keep single-key ReadRows on the streaming classic path (#20506)
95479e9 feat: update API sources and regenerate (#20502)
1c940ce chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.2 in /ftp (#20492)
93af903 chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /support (#...
fd29470 chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.2 in /webrisk (#...
70b9796 chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /trace (#20...
5ada576 chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /video (#20...
Additional commits viewable in compare view

Updates github.com/apache/beam/sdks/v2 from 2.72.0 to 2.76.0

Release notes

Sourced from github.com/apache/beam/sdks/v2's releases.

Beam 2.76.0 release

We are happy to present the new 2.76.0 release of Beam. This release includes both improvements and new functionality. See the download page for this release.

For more information on changes in 2.76.0, check out the detailed release notes.

Highlights

Added a full Iceberg batch and streaming changelog source (CDC) (#38831)

(Java) Added per-element OpenTelemetry trace propagation across stages in the Dataflow Streaming Runner. Enable it with --experiments=enable_otel_defaults,element_metadata_supported,disable_portable_worker. Cloud Trace incurs additional cost. (#33176)

(Java) Added OpenTelemetry header propagation support for both reads and writes in KafkaIO and PubSubIO. (#33176)

(Java) Added OpenTelemetry tracing support for SpannerIO change streams (#33176)

(Python) JmsIO (IBM MQ, ActiveMQ, and other providers) is now supported in Python via cross-language (#30716).

I/Os

Upgraded Iceberg dependency to 1.11.0 (Java) (#38925).

Add ArrowFlight IO (Java) (#20116).

Added a Delta Lake batch changelog source (CDC) (#39492)

New Features / Improvements

Added GroupIntoBatches transform and the standard beam:coder:sharded_key:v1 coder to the Go SDK, along with beam.Coder.IsDeterministic, beam.PCollection.WindowingStrategy, and coder.RegisterDeterministicCoder for opt-in deterministic custom coders (Go) (#19868).

TriggerStateMachineRunner changes from BitSetCoder to SentinelBitSetCoder to encode finished bitset. SentinelBitSetCoder and BitSetCoder are state compatible. Both coders can decode encoded bytes from the other coder (#38139).

(Python) Removed the envoy-data-plane (and transitive betterproto) dependency; EnvoyRateLimiter now uses a small vendored protobuf definition instead, resolving dependency conflicts for downstream projects (#37854).

(Java) Supported acknowledge mode for JmsIO (#39253).

(Python) Staged files directory is now automatically added to sys.path on the Python SDK worker at startup. This makes Python files provided via the '--files_to_stage' pipeline option importable in the pipeline code and makes it easier to initialize Python SDK harness at startup via the --beam_plugins pipeline option. For more information, see the Staging Individual Files section of the dependency management docs. This behavior can be disabled by passing the '--experiments=no_staged_dir_in_sys_path' pipeline option (#39431).

(Python) Added equal_to_approx, an assert_that matcher that compares numeric pipeline outputs with a configurable tolerance (#18028).

(Python) Timestamp now supports variable subsecond precision, up to nanoseconds. The portable beam:logical_type:timestamp:v1 logical type now maps to Python's Timestamp (#39344).

(Python) Added UnboundedSource, an interface for reading an infinite stream of records with checkpointing, watermark reporting, and bundle finalization. Read one with beam.io.Read (#19137).

(Python) Added Watch, a transform that polls a growing set of outputs for each input element, deduplicates outputs across poll rounds, and stops per a user-supplied termination condition (#21521).

(Python) Added support to analyze core dumps created after python worker segmentation faults with pystack (or gdb if installed) using the --profiler_agent=coredump pipeline option. (#39484).

(Python) Added Sample.Any, the Python equivalent of Java's Sample.any, which returns up to n arbitrary elements from a PCollection (#18552).

Breaking Changes

(Python) Removed google-perftools from the SDK container images. Users who wish to use --profiler_agent=tcmalloc should install google-perftools APT package in their custom container images separately (#39323).

... (truncated)

Changelog

Sourced from github.com/apache/beam/sdks/v2's changelog.

[2.76.0] - 2026-08-31

Highlights

Added a full Iceberg batch and streaming changelog source (CDC) (#38831)

(Java) Added per-element OpenTelemetry trace propagation across stages in the Dataflow Streaming Runner. Enable it with --experiments=enable_otel_defaults,element_metadata_supported,disable_portable_worker. Cloud Trace incurs additional cost. (#33176)

(Java) Added OpenTelemetry header propagation support for both reads and writes in KafkaIO and PubSubIO. (#33176)

(Java) Added OpenTelemetry tracing support for SpannerIO change streams (#33176)

(Python) JmsIO (IBM MQ, ActiveMQ, and other providers) is now supported in Python via cross-language (#30716).

I/Os

Upgraded Iceberg dependency to 1.11.0 (Java) (#38925).

Add ArrowFlight IO (Java) (#20116).

Added a Delta Lake batch changelog source (CDC) (#39492)

New Features / Improvements

Added GroupIntoBatches transform and the standard beam:coder:sharded_key:v1 coder to the Go SDK, along with beam.Coder.IsDeterministic, beam.PCollection.WindowingStrategy, and coder.RegisterDeterministicCoder for opt-in deterministic custom coders (Go) (#19868).

TriggerStateMachineRunner changes from BitSetCoder to SentinelBitSetCoder to encode finished bitset. SentinelBitSetCoder and BitSetCoder are state compatible. Both coders can decode encoded bytes from the other coder (#38139).

(Python) Removed the envoy-data-plane (and transitive betterproto) dependency; EnvoyRateLimiter now uses a small vendored protobuf definition instead, resolving dependency conflicts for downstream projects (#37854).

(Java) Supported acknowledge mode for JmsIO (#39253).

(Python) Staged files directory is now automatically added to sys.path on the Python SDK worker at startup. This makes Python files provided via the '--files_to_stage' pipeline option importable in the pipeline code and makes it easier to initialize Python SDK harness at startup via the --beam_plugins pipeline option. For more information, see the Staging Individual Files section of the dependency management docs. This behavior can be disabled by passing the '--experiments=no_staged_dir_in_sys_path' pipeline option (#39431).

(Python) Added equal_to_approx, an assert_that matcher that compares numeric pipeline outputs with a configurable tolerance (#18028).

(Python) Timestamp now supports variable subsecond precision, up to nanoseconds. The portable beam:logical_type:timestamp:v1 logical type now maps to Python's Timestamp (#39344).

(Python) Added UnboundedSource, an interface for reading an infinite stream of records with checkpointing, watermark reporting, and bundle finalization. Read one with beam.io.Read (#19137).

(Python) Added Watch, a transform that polls a growing set of outputs for each input element, deduplicates outputs across poll rounds, and stops per a user-supplied termination condition (#21521).

(Python) Added support to analyze core dumps created after python worker segmentation faults with pystack (or gdb if installed) using the --profiler_agent=coredump pipeline option. (#39484).

Breaking Changes

(Python) Removed google-perftools from the SDK container images. Users who wish to use --profiler_agent=tcmalloc should install google-perftools APT package in their custom container images separately (#39323).

[IcebergIO] Reading a timestamptz column will now return a Timestamp.MICROS Beam logical type to preserve microseconds (the old Beam Schema.FieldType#DATETIME primitive type truncates past milliseconds). This may break the following use cases when a timestamptz column is present:

Existing streaming read pipelines.

Managed Iceberg batch reads when upgraded from an older SDK.

Python reads.

Use pipeline option --updateCompatibilityVersion=2.75.0 (or any older version) to keep the old behavior (#39344).

... (truncated)

Commits

3862626 Set version for 2.76.0 RC4
2c478dc Merge pull request #39838 from apache/cp-39837
f8e3f18 Cherrypick #39837
b8429d1 Merge pull request #39719 from ahmedabu98/cp39645
9007148 Merge pull request #39832 from parveensania/cherrypick-pr39646
7c8159c Retrigger checks
b4877ce Make primary channel failover timeout configurable (#39646)
63850b7 Require google-cloud-bigtable>=2.42.0 and test write error surfacing (#39820)...
161ea0b Fix stale broken cluster connection in CassandraIO (#39788) (#39803)
e6c61df improve documentation
Additional commits viewable in compare view

Updates github.com/fullstorydev/grpcurl from 1.9.3 to 1.9.4

Release notes

Sourced from github.com/fullstorydev/grpcurl's releases.

v1.9.4

What's Changed

Dependencies

Bump golang.org/x/net from 0.33.0 to 0.36.0 in the go_modules group by @dependabot[bot] in fullstorydev/grpcurl#511

Bump google.golang.org/protobuf from 1.36.5 to 1.36.6 by @dependabot[bot] in fullstorydev/grpcurl#515

Bump golang.org/x/net from 0.36.0 to 0.38.0 in the go_modules group by @dependabot[bot] in fullstorydev/grpcurl#517

Bump golang.org/x/oauth2 from 0.14.0 to 0.27.0 in the go_modules group by @dependabot[bot] in fullstorydev/grpcurl#520

Bump google.golang.org/protobuf from 1.36.6 to 1.36.7 by @dependabot[bot] in fullstorydev/grpcurl#525

Bump google.golang.org/protobuf from 1.36.7 to 1.36.8 by @dependabot[bot] in fullstorydev/grpcurl#527

Bump google.golang.org/protobuf from 1.36.8 to 1.36.10 by @dependabot[bot] in fullstorydev/grpcurl#535

Bump github.com/jhump/protoreflect from 1.17.0 to 1.18.0 by @dependabot[bot] in fullstorydev/grpcurl#545

Bump golang.org/x/net from 0.49.0 to 0.55.0 in the go_modules group across 1 directory by @dependabot[bot] in fullstorydev/grpcurl#569

Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @dependabot[bot] in fullstorydev/grpcurl#576

Changes

snap by @PietroPasotti in fullstorydev/grpcurl#512

Set GOWORK=off and GOPATHS=-trimpath when building by @gpassini in fullstorydev/grpcurl#513

Restore Unix socket support by @zhyuri in fullstorydev/grpcurl#498

Snap: strict confinement, stable grade and docs by @PietroPasotti in fullstorydev/grpcurl#514

test: Update TLS error checks for Go 1.25 compatibility by @mikelolasagasti in fullstorydev/grpcurl#522

feat: add arm snap build by @PietroPasotti in fullstorydev/grpcurl#534

refactor: use slices.Contains to simplify code by @vastonus in fullstorydev/grpcurl#536

refactor: use strings.Builder to improve performance by @rifeplight in fullstorydev/grpcurl#537

update lead version to Go 1.25 by @dragonsinth in fullstorydev/grpcurl#543

Add Windows Arm64 release by @kpreisser in fullstorydev/grpcurl#542

refactor: remove obsolete // +build tag by @cuoguojida in fullstorydev/grpcurl#560

Bump google.golang.org/grpc to v1.79.3 (CVE-2026-33186 + 3 transitive CVEs) by @shreyas-sriram in fullstorydev/grpcurl#559

Bump google.golang.org/grpc from 1.66.2 to 1.80.0 by @olegbonar in fullstorydev/grpcurl#556

Add support for TLS 1.3 by @bcleenders in fullstorydev/grpcurl#564

Fast-fail on connection errors by @bcleenders in fullstorydev/grpcurl#567

fix xds credentials being silently ignored by @erikjoh in fullstorydev/grpcurl#566

docs: fix typo "foor" -> "foo" in README example by @maxtaran2010 in fullstorydev/grpcurl#571

Fix flaky TLS test by waiting for dial outcome before closing connection by @bcleenders in fullstorydev/grpcurl#572

Fix path traversal attack in -proto-out-dir by @bcleenders in fullstorydev/grpcurl#573

remove old SA1019 lint:ignore by @dragonsinth in fullstorydev/grpcurl#574

go mod update by @dragonsinth in fullstorydev/grpcurl#578

remove old SA1019 lint:ignore by @dragonsinth in fullstorydev/grpcurl#577

fix: preserve wrapped request and descriptor errors by @ginavalent in fullstorydev/grpcurl#579

update release to cut and upload via gh actions by @SamKirsch10 in fullstorydev/grpcurl#580

New Contributors

@PietroPasotti made their first contribution in fullstorydev/grpcurl#512

@zhyuri made their first contribution in fullstorydev/grpcurl#498

@mikelolasagasti made their first contribution in fullstorydev/grpcurl#522

@vastonus made their first contribution in fullstorydev/grpcurl#536

@rifeplight made their first contribution in fullstorydev/grpcurl#537

@kpreisser made their first contribution in fullstorydev/grpcurl#542

@cuoguojida made their first contribution in fullstorydev/grpcurl#560

@shreyas-sriram made their first contribution in fullstorydev/grpcurl#559

... (truncated)

Commits

cf21d4a update release to cut and upload via gh actions (#580)
8568146 fix: preserve wrapped request and descriptor errors (#579)
7884ecb remove old SA1019 lint:ignore (#577)
aba598c go mod update (#578)
4bb0f33 Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#576)
5f2d0c2 remove old SA1019 lint:ignore (#574)
6be36ba Fix path traversal attack in -proto-out-dir (#573)
353acfe Fix flaky TLS test by waiting for dial outcome before closing connection (#572)
04bf23b docs: fix typo "foor" -> "foo" in README example (#571)
1a48043 Bump golang.org/x/net in the go_modules group across 1 directory (#569)
Additional commits viewable in compare view

Updates github.com/go-sql-driver/mysql from 1.10.0 to 1.10.1

Release notes

Sourced from github.com/go-sql-driver/mysql's releases.

v1.10.1

What's Changed

dsn: default Net to tcp in NewConfig so Addr-only configs round-trip by @c-tonneslan in go-sql-driver/mysql#1770

Add LTS MariaDB 11.8 and 12.3 into the testing matrix by @pgporada in go-sql-driver/mysql#1774

Bump actions/checkout from 6 to 7 in the all-dependencies group by @dependabot[bot] in go-sql-driver/mysql#1777

ci: pin actions by @methane in go-sql-driver/mysql#1778

Bump the all-dependencies group with 3 updates by @dependabot[bot] in go-sql-driver/mysql#1779

Bump the all-dependencies group with 3 updates by @dependabot[bot] in go-sql-driver/mysql#1780

Interpolate typed-nil json.RawMessage as NULL by @oha-4 in go-sql-driver/mysql#1782

Bump actions/setup-go from 6.5.0 to 7.0.0 in the all-dependencies group by @dependabot[bot] in go-sql-driver/mysql#1783

Bump the all-dependencies group across 1 directory with 5 updates by @dependabot[bot] in go-sql-driver/mysql#1791

Bump the all-dependencies group with 3 updates by @dependabot[bot] in go-sql-driver/mysql#1794

Bump the all-dependencies group with 5 updates by @dependabot[bot] in go-sql-driver/mysql#1795

Bump the all-dependencies group with 3 updates by @dependabot[bot] in go-sql-driver/mysql#1796

codeql: remove custom workflow by @methane in go-sql-driver/mysql#1799

doc: clarify timeTruncate units and when to use it by @milanobrtlik in go-sql-driver/mysql#1792

release v1.10.1 by @methane in go-sql-driver/mysql#1801

New Contributors

@c-tonneslan made their first contribution in go-sql-driver/mysql#1770

@oha-4 made their first contribution in go-sql-driver/mysql#1782

@milanobrtlik made their first contribution in go-sql-driver/mysql#1792

Full Changelog: go-sql-driver/mysql@v1.10.0...v1.10.1

Changelog

Sourced from github.com/go-sql-driver/mysql's changelog.

v1.10.1 (2026-09-02)

Fix Config.FormatDSN() dropping Addr when Net is empty. It now uses the default tcp network so configs with only Addr round-trip correctly. (#1770)

Fix typed-nil json.RawMessage with interpolateParams=true being interpolated as an empty string. It is now interpolated as SQL NULL, matching server-side prepared statements. (#1782)

Add MariaDB 11.8 and 12.3 to the test matrix. (#1774)

Commits

7ca26e8 release v1.10.1 (#1801)
87dcb95 doc: clarify timeTruncate units and when to use it (#1792)
1d9c421 codeql: remove custom workflow (#1799)
532b8e5 Bump the all-dependencies group with 3 updates (#1796)
fe209cc Bump the all-dependencies group with 5 updates (#1795)
03d76c7 Bump the all-dependencies group with 3 updates (#1794)
c426bd9 Bump the all-dependencies group across 1 directory with 5 updates (#1791)
416cd99 Bump actions/setup-go from 6.5.0 to 7.0.0 in the all-dependencies group (#1783)
b96d415 Interpolate typed-nil json.RawMessage as NULL (#1782)
dec193d Bump the all-dependencies group with 3 updates (#1780)
Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0

Release notes

Sourced from github.com/jackc/pgx/v5's releases.

v5.11.0

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.

Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.

pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)

pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)

pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.

timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.

Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.

time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.

Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

Behavior changes:

date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.

All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range

... (truncated)

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.11.0 (September 7, 2026)

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.

Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.

pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)

pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)

pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.

timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.

Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.

time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.

Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

Behavior changes:

date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.

All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the

... (truncated)

Commits

5e583fa Update changelog for v5.11.0
3927116 Apply gofumpt formatting required by lint
eb07165 Quote filesystem paths in development connection strings
cf5938f Allow unsigned digit counts in binary numeric encoding
3930cf5 Accept PostgreSQL POSIX timezone offsets in text timestamps
93261be Prefer exact db tag matches when mapping rows to structs
e8d8ad1 Merge pull request #2647 from sueun-dev/fix-range-text-quoting-20260906
01d2fd3 Merge pull request #2644 from eliranbz/fix-failed-prepare-deallocation
9b7e3be Merge pull request #2645 from ash2k/move-channel
76d78f5 Merge pull request #2643 from AshSgDe29071999/fix/hstore-pairs-estimate-clamp
Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005

[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030

[BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971

[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889

[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917

[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by @dependabot[bot] in prometheus/client_golang#1839

build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by @dependabot[bot] in prometheus/client_golang#1838

prometheus/collectors: use godoc link for runtime/metrics supported metrics by @xieyuschen in prometheus/client_golang#1844

Fix doc typo by @torrca in prometheus/client_golang#1849

Merge release-1.23 into main by @vesari in prometheus/client_golang#1851

build(deps): bump githu...
Description has been truncated

Bumps the go-deps group with 21 updates in the / directory: | Package | From | To | | --- | --- | --- | | [cloud.google.com/go/spanner](https://github.com/googleapis/google-cloud-go) | `1.91.0` | `1.95.1` | | [github.com/apache/beam/sdks/v2](https://github.com/apache/beam) | `2.72.0` | `2.76.0` | | [github.com/fullstorydev/grpcurl](https://github.com/fullstorydev/grpcurl) | `1.9.3` | `1.9.4` | | [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.10.0` | `1.10.1` | | [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.10.0` | `5.11.0` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` | | [github.com/prometheus/client_model](https://github.com/prometheus/client_model) | `0.6.2` | `0.6.3` | | [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.6.14` | `3.7.1` | | [go.etcd.io/etcd/etcdctl/v3](https://github.com/etcd-io/etcd) | `3.6.14` | `3.7.1` | | [go.etcd.io/etcd/server/v3](https://github.com/etcd-io/etcd) | `3.6.14` | `3.7.1` | | [golang.org/x/sync](https://github.com/golang/sync) | `0.22.0` | `0.23.0` | | [golang.org/x/sys](https://github.com/golang/sys) | `0.47.0` | `0.48.0` | | [golang.org/x/tools](https://github.com/golang/tools) | `0.48.0` | `0.50.0` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.279.0` | `0.291.0` | | [google.golang.org/genproto](https://github.com/googleapis/go-genproto) | `0.0.0-20260319201613-d00831a3d3e7` | `0.0.0-20260523011958-0a33c5d7ca68` | | [google.golang.org/genproto/googleapis/api](https://github.com/googleapis/go-genproto) | `0.0.0-20260526163538-3dc84a4a5aaa` | `0.0.0-20260630182238-925bb5da69e7` | | [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20260526163538-3dc84a4a5aaa` | `0.0.0-20260825221802-da73d73af1c5` | | google.golang.org/protobuf | `1.36.11` | `1.36.12` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.35.5` | `0.37.0` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.35.5` | `0.37.0` | | [k8s.io/utils](https://github.com/kubernetes/utils) | `0.0.0-20260210185600-b8788abfbbc2` | `0.0.0-20260626114624-be93311217bd` | Updates `cloud.google.com/go/spanner` from 1.91.0 to 1.95.1 - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md) - [Commits](googleapis/google-cloud-go@spanner/v1.91.0...spanner/v1.95.1) Updates `github.com/apache/beam/sdks/v2` from 2.72.0 to 2.76.0 - [Release notes](https://github.com/apache/beam/releases) - [Changelog](https://github.com/apache/beam/blob/master/CHANGES.md) - [Commits](apache/beam@v2.72.0...v2.76.0) Updates `github.com/fullstorydev/grpcurl` from 1.9.3 to 1.9.4 - [Release notes](https://github.com/fullstorydev/grpcurl/releases) - [Commits](fullstorydev/grpcurl@v1.9.3...v1.9.4) Updates `github.com/go-sql-driver/mysql` from 1.10.0 to 1.10.1 - [Release notes](https://github.com/go-sql-driver/mysql/releases) - [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md) - [Commits](go-sql-driver/mysql@v1.10.0...v1.10.1) Updates `github.com/jackc/pgx/v5` from 5.10.0 to 5.11.0 - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.10.0...v5.11.0) Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.23.2...v1.24.1) Updates `github.com/prometheus/client_model` from 0.6.2 to 0.6.3 - [Release notes](https://github.com/prometheus/client_model/releases) - [Commits](prometheus/client_model@v0.6.2...v0.6.3) Updates `go.etcd.io/etcd/client/v3` from 3.6.14 to 3.7.1 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.14...v3.7.1) Updates `go.etcd.io/etcd/etcdctl/v3` from 3.6.14 to 3.7.1 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.14...v3.7.1) Updates `go.etcd.io/etcd/server/v3` from 3.6.14 to 3.7.1 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.14...v3.7.1) Updates `golang.org/x/sync` from 0.22.0 to 0.23.0 - [Commits](golang/sync@v0.22.0...v0.23.0) Updates `golang.org/x/sys` from 0.47.0 to 0.48.0 - [Commits](golang/sys@v0.47.0...v0.48.0) Updates `golang.org/x/tools` from 0.48.0 to 0.50.0 - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.48.0...v0.50.0) Updates `google.golang.org/api` from 0.279.0 to 0.291.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.279.0...v0.291.0) Updates `google.golang.org/genproto` from 0.0.0-20260319201613-d00831a3d3e7 to 0.0.0-20260523011958-0a33c5d7ca68 - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/genproto/googleapis/api` from 0.0.0-20260526163538-3dc84a4a5aaa to 0.0.0-20260630182238-925bb5da69e7 - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260526163538-3dc84a4a5aaa to 0.0.0-20260825221802-da73d73af1c5 - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12 Updates `k8s.io/apimachinery` from 0.35.5 to 0.37.0 - [Commits](kubernetes/apimachinery@v0.35.5...v0.37.0) Updates `k8s.io/client-go` from 0.35.5 to 0.37.0 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.35.5...v0.37.0) Updates `k8s.io/utils` from 0.0.0-20260210185600-b8788abfbbc2 to 0.0.0-20260626114624-be93311217bd - [Commits](https://github.com/kubernetes/utils/commits) --- updated-dependencies: - dependency-name: cloud.google.com/go/spanner dependency-version: 1.95.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/apache/beam/sdks/v2 dependency-version: 2.76.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fullstorydev/grpcurl dependency-version: 1.9.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/go-sql-driver/mysql dependency-version: 1.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/prometheus/client_model dependency-version: 0.6.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: go.etcd.io/etcd/client/v3 dependency-version: 3.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: go.etcd.io/etcd/etcdctl/v3 dependency-version: 3.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: go.etcd.io/etcd/server/v3 dependency-version: 3.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/sys dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/tools dependency-version: 0.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: google.golang.org/api dependency-version: 0.291.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: google.golang.org/genproto dependency-version: 0.0.0-20260523011958-0a33c5d7ca68 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: google.golang.org/genproto/googleapis/api dependency-version: 0.0.0-20260630182238-925bb5da69e7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20260825221802-da73d73af1c5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: k8s.io/apimachinery dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: k8s.io/client-go dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: k8s.io/utils dependency-version: 0.0.0-20260626114624-be93311217bd dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dpebot · 2026-09-18T14:23:47Z

/gcbrun

phbnf · 2026-09-18T14:35:11Z

@dependabot rebase

dependabot · 2026-09-18T14:35:24Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 18, 2026

dependabot Bot requested a review from a team as a code owner September 18, 2026 14:23

dependabot Bot requested a review from AlCutter September 18, 2026 14:23

dependabot Bot closed this Sep 18, 2026

dependabot Bot deleted the dependabot/go_modules/go-deps-89877b8109 branch September 18, 2026 14:35

Navigation Menu

Repository navigation

Bump the go-deps group across 1 directory with 21 updates - #3930

Bump the go-deps group across 1 directory with 21 updates#3930
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/go-deps-89877b8109

dependabot Bot commented on behalf of github Sep 18, 2026 •

edited

Loading

Uh oh!

dpebot commented Sep 18, 2026

Uh oh!

phbnf commented Sep 18, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

spanner: v1.95.1

1.95.1 (2026-09-10)

Bug Fixes

spanner: v1.95.0

1.95.0 (2026-08-24)

Features

Bug Fixes

spanner: v1.94.0

1.94.0 (2026-07-28)

Features

Bug Fixes

Beam 2.76.0 release

Highlights

I/Os

New Features / Improvements

Breaking Changes

[2.76.0] - 2026-08-31

Highlights

I/Os

New Features / Improvements

Breaking Changes

v1.9.4

What's Changed

Dependencies

Changes

New Contributors

v1.10.1

What's Changed

New Contributors

v1.10.1 (2026-09-02)

v5.11.0

Features

Changes

5.11.0 (September 7, 2026)

Features

Changes

v1.24.1 / 2026-07-23

What's Changed

v1.24.0 - 2026-07-20

Changes

Uh oh!

dpebot commented Sep 18, 2026

Uh oh!

phbnf commented Sep 18, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Sep 18, 2026 •

edited

Loading