Bump the go-deps group across 1 directory with 20 updates AND bump go to 1.26 AND regenerate protos AND bump golangci-lint in tests AND tighter master election lease filtering AND migrate to etcd/server in tests by dependabot[bot] · Pull Request #3931 · google/trillian

dependabot · 2026-09-18T14:36:11Z

Bumps the go-deps group with 20 updates in the / directory:

Package	From	To
cloud.google.com/go/spanner	`1.91.0`	`1.95.1`
github.com/apache/beam/sdks/v2	`2.72.0`	`2.76.0`
github.com/fullstorydev/grpcurl	`1.9.3`	`1.9.4`
github.com/go-sql-driver/mysql	`1.10.0`	`1.10.1`
github.com/jackc/pgx/v5	`5.10.0`	`5.11.0`
github.com/prometheus/client_golang	`1.23.2`	`1.24.1`
github.com/prometheus/client_model	`0.6.2`	`0.6.3`
go.etcd.io/etcd/client/v3	`3.6.14`	`3.7.1`
go.etcd.io/etcd/etcdctl/v3	`3.6.14`	`3.7.1`
go.etcd.io/etcd/server/v3	`3.6.14`	`3.7.1`
golang.org/x/sync	`0.22.0`	`0.23.0`
golang.org/x/sys	`0.47.0`	`0.48.0`
golang.org/x/tools	`0.48.0`	`0.50.0`
google.golang.org/api	`0.279.0`	`0.291.0`
google.golang.org/genproto	`0.0.0-20260319201613-d00831a3d3e7`	`0.0.0-20260523011958-0a33c5d7ca68`
google.golang.org/genproto/googleapis/rpc	`0.0.0-20260803160001-6ac0973c030d`	`0.0.0-20260825221802-da73d73af1c5`
google.golang.org/protobuf	`1.36.11`	`1.36.12`
k8s.io/apimachinery	`0.35.5`	`0.37.0`
k8s.io/client-go	`0.35.5`	`0.37.0`
k8s.io/utils	`0.0.0-20260210185600-b8788abfbbc2`	`0.0.0-20260626114624-be93311217bd`

Updates cloud.google.com/go/spanner from 1.91.0 to 1.95.1

Release notes

Sourced from cloud.google.com/go/spanner's releases.

spanner: v1.95.1

1.95.1 (2026-09-10)

Bug Fixes

spanner/spansql: Support ARRAY of PROTO types in DDL (#20463) (5fe6a28)

spanner: v1.95.0

1.95.0 (2026-08-24)

Features

spanner: Penalize channels that returned Unavailable or ResourceExhausted in the dynamic channel pool picker (#20390) (e1feec4)

spanner: Support caller-owned OpenTelemetry client metrics (#20388) (f1e77ce)

Bug Fixes

spanner: Stop leaking endpointLatencyRegistry cleanup goroutine (#20416) (95bbcc7), refs #14488

spanner: v1.94.0

1.94.0 (2026-07-28)

Features

spanner: Implement OPAQUE login authentication for Spanner Omni (#20085) (1c073b8)

Bug Fixes

spanner/spannertest: Add support for UUID column type (#20164) (bbfeb3f)

spanner: Excise a stale test reference to old genproto paths (#20245) (2063c07)

Commits

78076a8 chore(main): release spanner 1.95.1 (#20501)
e8737c3 chore(main): release bigtable 1.57.0 (#20485)
015b73c test(bigtable): fakeStream.Recv observes ctx.Done to fix pool-Close deadlock ...
2bfdb5d fix(bigtable): keep single-key ReadRows on the streaming classic path (#20506)
95479e9 feat: update API sources and regenerate (#20502)
1c940ce chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.2 in /ftp (#20492)
93af903 chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /support (#...
fd29470 chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.2 in /webrisk (#...
70b9796 chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /trace (#20...
5ada576 chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /video (#20...
Additional commits viewable in compare view

Updates github.com/apache/beam/sdks/v2 from 2.72.0 to 2.76.0

Release notes

Sourced from github.com/apache/beam/sdks/v2's releases.

Beam 2.76.0 release

We are happy to present the new 2.76.0 release of Beam. This release includes both improvements and new functionality. See the download page for this release.

For more information on changes in 2.76.0, check out the detailed release notes.

Highlights

Added a full Iceberg batch and streaming changelog source (CDC) (#38831)

(Java) Added per-element OpenTelemetry trace propagation across stages in the Dataflow Streaming Runner. Enable it with --experiments=enable_otel_defaults,element_metadata_supported,disable_portable_worker. Cloud Trace incurs additional cost. (#33176)

(Java) Added OpenTelemetry header propagation support for both reads and writes in KafkaIO and PubSubIO. (#33176)

(Java) Added OpenTelemetry tracing support for SpannerIO change streams (#33176)

(Python) JmsIO (IBM MQ, ActiveMQ, and other providers) is now supported in Python via cross-language (#30716).

I/Os

Upgraded Iceberg dependency to 1.11.0 (Java) (#38925).

Add ArrowFlight IO (Java) (#20116).

Added a Delta Lake batch changelog source (CDC) (#39492)

New Features / Improvements

Added GroupIntoBatches transform and the standard beam:coder:sharded_key:v1 coder to the Go SDK, along with beam.Coder.IsDeterministic, beam.PCollection.WindowingStrategy, and coder.RegisterDeterministicCoder for opt-in deterministic custom coders (Go) (#19868).

TriggerStateMachineRunner changes from BitSetCoder to SentinelBitSetCoder to encode finished bitset. SentinelBitSetCoder and BitSetCoder are state compatible. Both coders can decode encoded bytes from the other coder (#38139).

(Python) Removed the envoy-data-plane (and transitive betterproto) dependency; EnvoyRateLimiter now uses a small vendored protobuf definition instead, resolving dependency conflicts for downstream projects (#37854).

(Java) Supported acknowledge mode for JmsIO (#39253).

(Python) Staged files directory is now automatically added to sys.path on the Python SDK worker at startup. This makes Python files provided via the '--files_to_stage' pipeline option importable in the pipeline code and makes it easier to initialize Python SDK harness at startup via the --beam_plugins pipeline option. For more information, see the Staging Individual Files section of the dependency management docs. This behavior can be disabled by passing the '--experiments=no_staged_dir_in_sys_path' pipeline option (#39431).

(Python) Added equal_to_approx, an assert_that matcher that compares numeric pipeline outputs with a configurable tolerance (#18028).

(Python) Timestamp now supports variable subsecond precision, up to nanoseconds. The portable beam:logical_type:timestamp:v1 logical type now maps to Python's Timestamp (#39344).

(Python) Added UnboundedSource, an interface for reading an infinite stream of records with checkpointing, watermark reporting, and bundle finalization. Read one with beam.io.Read (#19137).

(Python) Added Watch, a transform that polls a growing set of outputs for each input element, deduplicates outputs across poll rounds, and stops per a user-supplied termination condition (#21521).

(Python) Added support to analyze core dumps created after python worker segmentation faults with pystack (or gdb if installed) using the --profiler_agent=coredump pipeline option. (#39484).

(Python) Added Sample.Any, the Python equivalent of Java's Sample.any, which returns up to n arbitrary elements from a PCollection (#18552).

Breaking Changes

(Python) Removed google-perftools from the SDK container images. Users who wish to use --profiler_agent=tcmalloc should install google-perftools APT package in their custom container images separately (#39323).

... (truncated)

Changelog

Sourced from github.com/apache/beam/sdks/v2's changelog.

[2.76.0] - 2026-08-31

Highlights

Added a full Iceberg batch and streaming changelog source (CDC) (#38831)

(Java) Added per-element OpenTelemetry trace propagation across stages in the Dataflow Streaming Runner. Enable it with --experiments=enable_otel_defaults,element_metadata_supported,disable_portable_worker. Cloud Trace incurs additional cost. (#33176)

(Java) Added OpenTelemetry header propagation support for both reads and writes in KafkaIO and PubSubIO. (#33176)

(Java) Added OpenTelemetry tracing support for SpannerIO change streams (#33176)

(Python) JmsIO (IBM MQ, ActiveMQ, and other providers) is now supported in Python via cross-language (#30716).

I/Os

Upgraded Iceberg dependency to 1.11.0 (Java) (#38925).

Add ArrowFlight IO (Java) (#20116).

Added a Delta Lake batch changelog source (CDC) (#39492)

New Features / Improvements

Added GroupIntoBatches transform and the standard beam:coder:sharded_key:v1 coder to the Go SDK, along with beam.Coder.IsDeterministic, beam.PCollection.WindowingStrategy, and coder.RegisterDeterministicCoder for opt-in deterministic custom coders (Go) (#19868).

TriggerStateMachineRunner changes from BitSetCoder to SentinelBitSetCoder to encode finished bitset. SentinelBitSetCoder and BitSetCoder are state compatible. Both coders can decode encoded bytes from the other coder (#38139).

(Python) Removed the envoy-data-plane (and transitive betterproto) dependency; EnvoyRateLimiter now uses a small vendored protobuf definition instead, resolving dependency conflicts for downstream projects (#37854).

(Java) Supported acknowledge mode for JmsIO (#39253).

(Python) Staged files directory is now automatically added to sys.path on the Python SDK worker at startup. This makes Python files provided via the '--files_to_stage' pipeline option importable in the pipeline code and makes it easier to initialize Python SDK harness at startup via the --beam_plugins pipeline option. For more information, see the Staging Individual Files section of the dependency management docs. This behavior can be disabled by passing the '--experiments=no_staged_dir_in_sys_path' pipeline option (#39431).

(Python) Added equal_to_approx, an assert_that matcher that compares numeric pipeline outputs with a configurable tolerance (#18028).

(Python) Timestamp now supports variable subsecond precision, up to nanoseconds. The portable beam:logical_type:timestamp:v1 logical type now maps to Python's Timestamp (#39344).

(Python) Added UnboundedSource, an interface for reading an infinite stream of records with checkpointing, watermark reporting, and bundle finalization. Read one with beam.io.Read (#19137).

(Python) Added Watch, a transform that polls a growing set of outputs for each input element, deduplicates outputs across poll rounds, and stops per a user-supplied termination condition (#21521).

(Python) Added support to analyze core dumps created after python worker segmentation faults with pystack (or gdb if installed) using the --profiler_agent=coredump pipeline option. (#39484).

Breaking Changes

(Python) Removed google-perftools from the SDK container images. Users who wish to use --profiler_agent=tcmalloc should install google-perftools APT package in their custom container images separately (#39323).

[IcebergIO] Reading a timestamptz column will now return a Timestamp.MICROS Beam logical type to preserve microseconds (the old Beam Schema.FieldType#DATETIME primitive type truncates past milliseconds). This may break the following use cases when a timestamptz column is present:

Existing streaming read pipelines.

Managed Iceberg batch reads when upgraded from an older SDK.

Python reads.

Use pipeline option --updateCompatibilityVersion=2.75.0 (or any older version) to keep the old behavior (#39344).

... (truncated)

Commits

3862626 Set version for 2.76.0 RC4
2c478dc Merge pull request #39838 from apache/cp-39837
f8e3f18 Cherrypick #39837
b8429d1 Merge pull request #39719 from ahmedabu98/cp39645
9007148 Merge pull request #39832 from parveensania/cherrypick-pr39646
7c8159c Retrigger checks
b4877ce Make primary channel failover timeout configurable (#39646)
63850b7 Require google-cloud-bigtable>=2.42.0 and test write error surfacing (#39820)...
161ea0b Fix stale broken cluster connection in CassandraIO (#39788) (#39803)
e6c61df improve documentation
Additional commits viewable in compare view

Updates github.com/fullstorydev/grpcurl from 1.9.3 to 1.9.4

Release notes

Sourced from github.com/fullstorydev/grpcurl's releases.

v1.9.4

What's Changed

Dependencies

Bump golang.org/x/net from 0.33.0 to 0.36.0 in the go_modules group by @dependabot[bot] in fullstorydev/grpcurl#511

Bump google.golang.org/protobuf from 1.36.5 to 1.36.6 by @dependabot[bot] in fullstorydev/grpcurl#515

Bump golang.org/x/net from 0.36.0 to 0.38.0 in the go_modules group by @dependabot[bot] in fullstorydev/grpcurl#517

Bump golang.org/x/oauth2 from 0.14.0 to 0.27.0 in the go_modules group by @dependabot[bot] in fullstorydev/grpcurl#520

Bump google.golang.org/protobuf from 1.36.6 to 1.36.7 by @dependabot[bot] in fullstorydev/grpcurl#525

Bump google.golang.org/protobuf from 1.36.7 to 1.36.8 by @dependabot[bot] in fullstorydev/grpcurl#527

Bump google.golang.org/protobuf from 1.36.8 to 1.36.10 by @dependabot[bot] in fullstorydev/grpcurl#535

Bump github.com/jhump/protoreflect from 1.17.0 to 1.18.0 by @dependabot[bot] in fullstorydev/grpcurl#545

Bump golang.org/x/net from 0.49.0 to 0.55.0 in the go_modules group across 1 directory by @dependabot[bot] in fullstorydev/grpcurl#569

Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @dependabot[bot] in fullstorydev/grpcurl#576

Changes

snap by @PietroPasotti in fullstorydev/grpcurl#512

Set GOWORK=off and GOPATHS=-trimpath when building by @gpassini in fullstorydev/grpcurl#513

Restore Unix socket support by @zhyuri in fullstorydev/grpcurl#498

Snap: strict confinement, stable grade and docs by @PietroPasotti in fullstorydev/grpcurl#514

test: Update TLS error checks for Go 1.25 compatibility by @mikelolasagasti in fullstorydev/grpcurl#522

feat: add arm snap build by @PietroPasotti in fullstorydev/grpcurl#534

refactor: use slices.Contains to simplify code by @vastonus in fullstorydev/grpcurl#536

refactor: use strings.Builder to improve performance by @rifeplight in fullstorydev/grpcurl#537

update lead version to Go 1.25 by @dragonsinth in fullstorydev/grpcurl#543

Add Windows Arm64 release by @kpreisser in fullstorydev/grpcurl#542

refactor: remove obsolete // +build tag by @cuoguojida in fullstorydev/grpcurl#560

Bump google.golang.org/grpc to v1.79.3 (CVE-2026-33186 + 3 transitive CVEs) by @shreyas-sriram in fullstorydev/grpcurl#559

Bump google.golang.org/grpc from 1.66.2 to 1.80.0 by @olegbonar in fullstorydev/grpcurl#556

Add support for TLS 1.3 by @bcleenders in fullstorydev/grpcurl#564

Fast-fail on connection errors by @bcleenders in fullstorydev/grpcurl#567

fix xds credentials being silently ignored by @erikjoh in fullstorydev/grpcurl#566

docs: fix typo "foor" -> "foo" in README example by @maxtaran2010 in fullstorydev/grpcurl#571

Fix flaky TLS test by waiting for dial outcome before closing connection by @bcleenders in fullstorydev/grpcurl#572

Fix path traversal attack in -proto-out-dir by @bcleenders in fullstorydev/grpcurl#573

remove old SA1019 lint:ignore by @dragonsinth in fullstorydev/grpcurl#574

go mod update by @dragonsinth in fullstorydev/grpcurl#578

remove old SA1019 lint:ignore by @dragonsinth in fullstorydev/grpcurl#577

fix: preserve wrapped request and descriptor errors by @ginavalent in fullstorydev/grpcurl#579

update release to cut and upload via gh actions by @SamKirsch10 in fullstorydev/grpcurl#580

New Contributors

@PietroPasotti made their first contribution in fullstorydev/grpcurl#512

@zhyuri made their first contribution in fullstorydev/grpcurl#498

@mikelolasagasti made their first contribution in fullstorydev/grpcurl#522

@vastonus made their first contribution in fullstorydev/grpcurl#536

@rifeplight made their first contribution in fullstorydev/grpcurl#537

@kpreisser made their first contribution in fullstorydev/grpcurl#542

@cuoguojida made their first contribution in fullstorydev/grpcurl#560

@shreyas-sriram made their first contribution in fullstorydev/grpcurl#559

... (truncated)

Commits

cf21d4a update release to cut and upload via gh actions (#580)
8568146 fix: preserve wrapped request and descriptor errors (#579)
7884ecb remove old SA1019 lint:ignore (#577)
aba598c go mod update (#578)
4bb0f33 Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#576)
5f2d0c2 remove old SA1019 lint:ignore (#574)
6be36ba Fix path traversal attack in -proto-out-dir (#573)
353acfe Fix flaky TLS test by waiting for dial outcome before closing connection (#572)
04bf23b docs: fix typo "foor" -> "foo" in README example (#571)
1a48043 Bump golang.org/x/net in the go_modules group across 1 directory (#569)
Additional commits viewable in compare view

Updates github.com/go-sql-driver/mysql from 1.10.0 to 1.10.1

Release notes

Sourced from github.com/go-sql-driver/mysql's releases.

v1.10.1

What's Changed

dsn: default Net to tcp in NewConfig so Addr-only configs round-trip by @c-tonneslan in go-sql-driver/mysql#1770

Add LTS MariaDB 11.8 and 12.3 into the testing matrix by @pgporada in go-sql-driver/mysql#1774

Bump actions/checkout from 6 to 7 in the all-dependencies group by @dependabot[bot] in go-sql-driver/mysql#1777

ci: pin actions by @methane in go-sql-driver/mysql#1778

Bump the all-dependencies group with 3 updates by @dependabot[bot] in go-sql-driver/mysql#1779

Bump the all-dependencies group with 3 updates by @dependabot[bot] in go-sql-driver/mysql#1780

Interpolate typed-nil json.RawMessage as NULL by @oha-4 in go-sql-driver/mysql#1782

Bump actions/setup-go from 6.5.0 to 7.0.0 in the all-dependencies group by @dependabot[bot] in go-sql-driver/mysql#1783

Bump the all-dependencies group across 1 directory with 5 updates by @dependabot[bot] in go-sql-driver/mysql#1791

Bump the all-dependencies group with 3 updates by @dependabot[bot] in go-sql-driver/mysql#1794

Bump the all-dependencies group with 5 updates by @dependabot[bot] in go-sql-driver/mysql#1795

Bump the all-dependencies group with 3 updates by @dependabot[bot] in go-sql-driver/mysql#1796

codeql: remove custom workflow by @methane in go-sql-driver/mysql#1799

doc: clarify timeTruncate units and when to use it by @milanobrtlik in go-sql-driver/mysql#1792

release v1.10.1 by @methane in go-sql-driver/mysql#1801

New Contributors

@c-tonneslan made their first contribution in go-sql-driver/mysql#1770

@oha-4 made their first contribution in go-sql-driver/mysql#1782

@milanobrtlik made their first contribution in go-sql-driver/mysql#1792

Full Changelog: go-sql-driver/mysql@v1.10.0...v1.10.1

Changelog

Sourced from github.com/go-sql-driver/mysql's changelog.

v1.10.1 (2026-09-02)

Fix Config.FormatDSN() dropping Addr when Net is empty. It now uses the default tcp network so configs with only Addr round-trip correctly. (#1770)

Fix typed-nil json.RawMessage with interpolateParams=true being interpolated as an empty string. It is now interpolated as SQL NULL, matching server-side prepared statements. (#1782)

Add MariaDB 11.8 and 12.3 to the test matrix. (#1774)

Commits

7ca26e8 release v1.10.1 (#1801)
87dcb95 doc: clarify timeTruncate units and when to use it (#1792)
1d9c421 codeql: remove custom workflow (#1799)
532b8e5 Bump the all-dependencies group with 3 updates (#1796)
fe209cc Bump the all-dependencies group with 5 updates (#1795)
03d76c7 Bump the all-dependencies group with 3 updates (#1794)
c426bd9 Bump the all-dependencies group across 1 directory with 5 updates (#1791)
416cd99 Bump actions/setup-go from 6.5.0 to 7.0.0 in the all-dependencies group (#1783)
b96d415 Interpolate typed-nil json.RawMessage as NULL (#1782)
dec193d Bump the all-dependencies group with 3 updates (#1780)
Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0

Release notes

Sourced from github.com/jackc/pgx/v5's releases.

v5.11.0

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.

Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.

pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)

pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)

pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.

timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.

Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.

time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.

Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

Behavior changes:

date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.

All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range

... (truncated)

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.11.0 (September 7, 2026)

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.

Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.

pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)

pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)

pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.

timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.

Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.

time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.

Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

Behavior changes:

date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.

All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the

... (truncated)

Commits

5e583fa Update changelog for v5.11.0
3927116 Apply gofumpt formatting required by lint
eb07165 Quote filesystem paths in development connection strings
cf5938f Allow unsigned digit counts in binary numeric encoding
3930cf5 Accept PostgreSQL POSIX timezone offsets in text timestamps
93261be Prefer exact db tag matches when mapping rows to structs
e8d8ad1 Merge pull request #2647 from sueun-dev/fix-range-text-quoting-20260906
01d2fd3 Merge pull request #2644 from eliranbz/fix-failed-prepare-deallocation
9b7e3be Merge pull request #2645 from ash2k/move-channel
76d78f5 Merge pull request #2643 from AshSgDe29071999/fix/hstore-pairs-estimate-clamp
Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005

[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030

[BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971

[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889

[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917

[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by @dependabot[bot] in prometheus/client_golang#1839

build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by @dependabot[bot] in prometheus/client_golang#1838

prometheus/collectors: use godoc link for runtime/metrics supported metrics by @xieyuschen in prometheus/client_golang#1844

Fix doc typo by @torrca in prometheus/client_golang#1849

Merge release-1.23 into main by @vesari in prometheus/client_golang#1851

build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by @dependabot[bot] in

Bumps the go-deps group with 20 updates in the / directory: | Package | From | To | | --- | --- | --- | | [cloud.google.com/go/spanner](https://github.com/googleapis/google-cloud-go) | `1.91.0` | `1.95.1` | | [github.com/apache/beam/sdks/v2](https://github.com/apache/beam) | `2.72.0` | `2.76.0` | | [github.com/fullstorydev/grpcurl](https://github.com/fullstorydev/grpcurl) | `1.9.3` | `1.9.4` | | [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.10.0` | `1.10.1` | | [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.10.0` | `5.11.0` | | [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` | | [github.com/prometheus/client_model](https://github.com/prometheus/client_model) | `0.6.2` | `0.6.3` | | [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.6.14` | `3.7.1` | | [go.etcd.io/etcd/etcdctl/v3](https://github.com/etcd-io/etcd) | `3.6.14` | `3.7.1` | | [go.etcd.io/etcd/server/v3](https://github.com/etcd-io/etcd) | `3.6.14` | `3.7.1` | | [golang.org/x/sync](https://github.com/golang/sync) | `0.22.0` | `0.23.0` | | [golang.org/x/sys](https://github.com/golang/sys) | `0.47.0` | `0.48.0` | | [golang.org/x/tools](https://github.com/golang/tools) | `0.48.0` | `0.50.0` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.279.0` | `0.291.0` | | [google.golang.org/genproto](https://github.com/googleapis/go-genproto) | `0.0.0-20260319201613-d00831a3d3e7` | `0.0.0-20260523011958-0a33c5d7ca68` | | [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20260803160001-6ac0973c030d` | `0.0.0-20260825221802-da73d73af1c5` | | google.golang.org/protobuf | `1.36.11` | `1.36.12` | | [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.35.5` | `0.37.0` | | [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.35.5` | `0.37.0` | | [k8s.io/utils](https://github.com/kubernetes/utils) | `0.0.0-20260210185600-b8788abfbbc2` | `0.0.0-20260626114624-be93311217bd` | Updates `cloud.google.com/go/spanner` from 1.91.0 to 1.95.1 - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md) - [Commits](googleapis/google-cloud-go@spanner/v1.91.0...spanner/v1.95.1) Updates `github.com/apache/beam/sdks/v2` from 2.72.0 to 2.76.0 - [Release notes](https://github.com/apache/beam/releases) - [Changelog](https://github.com/apache/beam/blob/master/CHANGES.md) - [Commits](apache/beam@v2.72.0...v2.76.0) Updates `github.com/fullstorydev/grpcurl` from 1.9.3 to 1.9.4 - [Release notes](https://github.com/fullstorydev/grpcurl/releases) - [Commits](fullstorydev/grpcurl@v1.9.3...v1.9.4) Updates `github.com/go-sql-driver/mysql` from 1.10.0 to 1.10.1 - [Release notes](https://github.com/go-sql-driver/mysql/releases) - [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md) - [Commits](go-sql-driver/mysql@v1.10.0...v1.10.1) Updates `github.com/jackc/pgx/v5` from 5.10.0 to 5.11.0 - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.10.0...v5.11.0) Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.23.2...v1.24.1) Updates `github.com/prometheus/client_model` from 0.6.2 to 0.6.3 - [Release notes](https://github.com/prometheus/client_model/releases) - [Commits](prometheus/client_model@v0.6.2...v0.6.3) Updates `go.etcd.io/etcd/client/v3` from 3.6.14 to 3.7.1 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.14...v3.7.1) Updates `go.etcd.io/etcd/etcdctl/v3` from 3.6.14 to 3.7.1 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.14...v3.7.1) Updates `go.etcd.io/etcd/server/v3` from 3.6.14 to 3.7.1 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.14...v3.7.1) Updates `golang.org/x/sync` from 0.22.0 to 0.23.0 - [Commits](golang/sync@v0.22.0...v0.23.0) Updates `golang.org/x/sys` from 0.47.0 to 0.48.0 - [Commits](golang/sys@v0.47.0...v0.48.0) Updates `golang.org/x/tools` from 0.48.0 to 0.50.0 - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.48.0...v0.50.0) Updates `google.golang.org/api` from 0.279.0 to 0.291.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.279.0...v0.291.0) Updates `google.golang.org/genproto` from 0.0.0-20260319201613-d00831a3d3e7 to 0.0.0-20260523011958-0a33c5d7ca68 - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20260803160001-6ac0973c030d to 0.0.0-20260825221802-da73d73af1c5 - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12 Updates `k8s.io/apimachinery` from 0.35.5 to 0.37.0 - [Commits](kubernetes/apimachinery@v0.35.5...v0.37.0) Updates `k8s.io/client-go` from 0.35.5 to 0.37.0 - [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md) - [Commits](kubernetes/client-go@v0.35.5...v0.37.0) Updates `k8s.io/utils` from 0.0.0-20260210185600-b8788abfbbc2 to 0.0.0-20260626114624-be93311217bd - [Commits](https://github.com/kubernetes/utils/commits) --- updated-dependencies: - dependency-name: cloud.google.com/go/spanner dependency-version: 1.95.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/apache/beam/sdks/v2 dependency-version: 2.76.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/fullstorydev/grpcurl dependency-version: 1.9.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/go-sql-driver/mysql dependency-version: 1.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/prometheus/client_model dependency-version: 0.6.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: go.etcd.io/etcd/client/v3 dependency-version: 3.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: go.etcd.io/etcd/etcdctl/v3 dependency-version: 3.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: go.etcd.io/etcd/server/v3 dependency-version: 3.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/sync dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/sys dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/tools dependency-version: 0.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: google.golang.org/api dependency-version: 0.291.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: google.golang.org/genproto dependency-version: 0.0.0-20260523011958-0a33c5d7ca68 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20260825221802-da73d73af1c5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps - dependency-name: k8s.io/apimachinery dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: k8s.io/client-go dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: k8s.io/utils dependency-version: 0.0.0-20260626114624-be93311217bd dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-deps ... Signed-off-by: dependabot[bot] <support@github.com>

dpebot · 2026-09-18T14:36:24Z

/gcbrun

dpebot · 2026-09-18T14:53:46Z

/gcbrun

dpebot · 2026-09-18T15:43:19Z

/gcbrun

dpebot · 2026-09-18T15:52:18Z

/gcbrun

Validate that incoming lease watch events match the target election lease name (`e.lock.LeaseMeta.Name`) before updating observed mastership records. ### Background: client-go v0.35.5 -> v0.37.0 Transition In client-go <= v0.35.5, the fake client's `tracker.Watch` implementation (testing/fixture.go) was a stub that never replayed pre-existing objects: https://github.com/kubernetes/client-go/blob/v0.35.5/testing/fixture.go#L356-L372 In client-go v0.37.0, resource version tracking was introduced to simulate informer list-and-watch replay: https://github.com/kubernetes/client-go/blob/v0.37.0/testing/fixture.go#L403-L456 When `ListOptions` are provided with an empty `ResourceVersion` (as used by `election.go`'s `FieldSelector` watch), the v0.37.0 fake client enables `addExisting = true` with `addFromRV = 0`, replaying all existing namespace objects. However, the fake client only filters by namespace and completely ignores `FieldSelector`. Because subtests in `TestElection/RunElectionClose` share the same clientset and namespace, leases from earlier subtests ("master", "master-error") were replayed to the "not-master" watcher. Without checking `lease.Name`, "not-master" adopted the previous lease holder ("testID"), mistakenly assumed it was leader, and failed during `Close()` when attempting to resign an uninitialized lease. ### Why This Change is Safe & Has Zero Impact on Production 1. Zero Production Impact: In production, Trillian watches real kube-apiserver using `FieldSelector: metadata.name=<name>`. The Kubernetes API contract guarantees server-side filtering, so kube-apiserver never sends foreign leases down the watch. In production, `lease.Name == e.lock.LeaseMeta.Name` is always true for all received events. 2. Defensive Safety: If a malformed stream, proxy, or unexpected `watch.Deleted` event for another lease ever reaches the client, this check prevents Trillian from mistakenly zeroing its leadership record. 3. Behavior Preserved: Matching events execute the exact same record update logic as before. Verified: - go test -v -count=1 ./util/election2/k8s (PASS) - go test -race -count=5 ./util/election2/k8s (PASS) - go test ./util/election2/... (PASS)

dpebot · 2026-09-21T11:46:55Z

/gcbrun

phbnf · 2026-09-21T12:26:04Z

Tests failed.

running go test -timeout=20m ./...
?   	github.com/google/trillian	[no test files]
ok  	github.com/google/trillian/client	18.521s
ok  	github.com/google/trillian/client/backoff	4.740s
ok  	github.com/google/trillian/client/rpcflags	13.486s
ok  	github.com/google/trillian/cmd	1.110s
ok  	github.com/google/trillian/cmd/createtree	5.394s
?   	github.com/google/trillian/cmd/deletetree	[no test files]
?   	github.com/google/trillian/cmd/internal/provider	[no test files]
?   	github.com/google/trillian/cmd/internal/serverutil	[no test files]
?   	github.com/google/trillian/cmd/trillian_log_server	[no test files]
?   	github.com/google/trillian/cmd/trillian_log_signer	[no test files]
ok  	github.com/google/trillian/cmd/updatetree	1.572s
ok  	github.com/google/trillian/crypto/keys	1.186s
ok  	github.com/google/trillian/crypto/keys/der	1.114s
ok  	github.com/google/trillian/crypto/keys/pem	1.112s
ok  	github.com/google/trillian/crypto/keys/pkcs11	1.514s
?   	github.com/google/trillian/crypto/keys/testonly	[no test files]
?   	github.com/google/trillian/crypto/keyspb	[no test files]
?   	github.com/google/trillian/docs/claimantmodel/experimental/cmd/render	[no test files]
ok  	github.com/google/trillian/docs/claimantmodel/experimental/cmd/render/internal	1.425s
?   	github.com/google/trillian/docs/merkletree/treetex	[no test files]
?   	github.com/google/trillian/docs/storage/commit_log	[no test files]
ok  	github.com/google/trillian/docs/storage/commit_log/signer	1.509s
?   	github.com/google/trillian/docs/storage/commit_log/simelection	[no test files]
ok  	github.com/google/trillian/docs/storage/commit_log/simkafka	1.300s
?   	github.com/google/trillian/experimental/batchmap	[no test files]
?   	github.com/google/trillian/experimental/batchmap/cmd/build	[no test files]
?   	github.com/google/trillian/experimental/batchmap/cmd/verify	[no test files]
?   	github.com/google/trillian/extension	[no test files]
ok  	github.com/google/trillian/integration	52.238s
ok  	github.com/google/trillian/integration/admin	13.528s
ok  	github.com/google/trillian/integration/format	13.815s
ok  	github.com/google/trillian/integration/quota	10.709s
?   	github.com/google/trillian/integration/storagetest	[no test files]
ok  	github.com/google/trillian/log	4.033s
ok  	github.com/google/trillian/merkle/coniks	1.053s
ok  	github.com/google/trillian/merkle/smt	18.803s
ok  	github.com/google/trillian/merkle/smt/node	1.046s
ok  	github.com/google/trillian/monitoring	1.068s
ok  	github.com/google/trillian/monitoring/prometheus	1.084s
?   	github.com/google/trillian/monitoring/testonly	[no test files]
ok  	github.com/google/trillian/quota	1.099s
ok  	github.com/google/trillian/quota/cacheqm	1.066s
ok  	github.com/google/trillian/quota/crdbqm	83.324s
?   	github.com/google/trillian/quota/etcd	[no test files]
ok  	github.com/google/trillian/quota/etcd/etcdqm	2.894s
ok  	github.com/google/trillian/quota/etcd/quotaapi	53.848s
?   	github.com/google/trillian/quota/etcd/quotapb	[no test files]
ok  	github.com/google/trillian/quota/etcd/storage	4.122s
?   	github.com/google/trillian/quota/etcd/storagepb	[no test files]
ok  	github.com/google/trillian/quota/mysqlqm	8.200s
ok  	github.com/google/trillian/quota/postgresqlqm	1.125s
?   	github.com/google/trillian/quota/redis/redisqm	[no test files]
?   	github.com/google/trillian/quota/redis/redistb	[no test files]
ok  	github.com/google/trillian/server	1.855s
ok  	github.com/google/trillian/server/admin	1.152s
ok  	github.com/google/trillian/server/errors	1.017s
ok  	github.com/google/trillian/server/interceptor	2.161s
ok  	github.com/google/trillian/storage	1.081s
ok  	github.com/google/trillian/storage/cache	1.455s
ok  	github.com/google/trillian/storage/cloudspanner	5.482s
?   	github.com/google/trillian/storage/cloudspanner/spannerpb	[no test files]
ok  	github.com/google/trillian/storage/crdb	74.874s
ok  	github.com/google/trillian/storage/memory	1.030s
ok  	github.com/google/trillian/storage/mysql	8.984s
?   	github.com/google/trillian/storage/mysql/mysqlpb	[no test files]
ok  	github.com/google/trillian/storage/postgresql	1.086s
?   	github.com/google/trillian/storage/postgresql/testdbpgx	[no test files]
?   	github.com/google/trillian/storage/storagepb	[no test files]
ok  	github.com/google/trillian/storage/testdb	1.071s
?   	github.com/google/trillian/storage/testonly	[no test files]
?   	github.com/google/trillian/storage/tree	[no test files]
?   	github.com/google/trillian/testonly	[no test files]
ok  	github.com/google/trillian/testonly/flagsaver	1.033s
?   	github.com/google/trillian/testonly/integration	[no test files]
?   	github.com/google/trillian/testonly/integration/etcd	[no test files]
ok  	github.com/google/trillian/testonly/matchers	1.025s
?   	github.com/google/trillian/testonly/mdm	[no test files]
?   	github.com/google/trillian/testonly/mdm/mdmtest	[no test files]
?   	github.com/google/trillian/testonly/setup	[no test files]
?   	github.com/google/trillian/testonly/tmock	[no test files]
ok  	github.com/google/trillian/trees	1.109s
ok  	github.com/google/trillian/types	1.083s
?   	github.com/google/trillian/types/internal/tls	[no test files]
?   	github.com/google/trillian/util	[no test files]
ok  	github.com/google/trillian/util/clock	2.502s
ok  	github.com/google/trillian/util/election	3.077s
?   	github.com/google/trillian/util/election2	[no test files]
ok  	github.com/google/trillian/util/election2/etcd	3.656s
E0918 16:18:51.410838   31646 election.go:119] Failed to update lock optimistically: lease not initialized, call get or create first, falling back to slow path
--- FAIL: TestElection (4.27s)
    --- FAIL: TestElection/RunElectionClose (0.16s)
        --- FAIL: TestElection/RunElectionClose/not-master (0.00s)
            tests.go:241: Close(): failed to release lock: lease not initialized, call get or create first, want <nil>
            tests.go:248: expected context done
FAIL
FAIL	github.com/google/trillian/util/election2/k8s	4.365s
ok  	github.com/google/trillian/util/election2/testonly	2.452s
FAIL

I had to modify k8s/election.go with Gemini's help due to fix this, due a change in how k8s test work between v.0.35.0 and v.037.0. See the commit description for more details. I know very little about Kubernetes but I spent a bit of time looking into Trillian and Kubernete code, plus prompting Gemini about this. This change looks ok to me: it is ensuring that the lease name is stable, which seems ok. The name is in the Election object, so I see no reason why a lease with a different name should be processed when returned.

Another fix is possible without changing k8s/elections.go, and only changing k8s/election_test.go", where re-implement [fake.NewClientset](https://github.com/kubernetes/client-go/blob/master/kubernetes/fake/clientset_generated.go#L210) such that it also filters by metadata.name`, emulating what a real server would do.

Update tools.go to track go.etcd.io/etcd/server/v3 instead of the root go.etcd.io/etcd/v3 module, prune orphaned v3.6.14 test dependencies, and build the etcd binary directly in run_integration.sh. ### History & Context 1. In etcd v3.5 (PR etcd-io/etcd#12417), the server entrypoint moved to `go.etcd.io/etcd/server/v3`. The root module `go.etcd.io/etcd/v3` was reduced to an internal stub (`dummy.go`, package main_test) importing internal test harnesses (`etcdutl/v3` and `tests/v3`). 2. When Trillian adopted etcd v3 (PR #2376), `tools/tools.go` tracked `go.etcd.io/etcd/v3` rather than `server/v3`. `go install go.etcd.io/etcd/v3` in CI produced no binary (due to package main_test), causing `functions.sh` to silently fall back to `--force_master`. 3. In this PR's dependency bump, Dependabot upgraded `server/v3`, `client/v3`, and `api/v3` to v3.7.1 and `raft/v3` to v3.7.0, but left `etcd/v3` at v3.6.14. This dragged in `etcdutl/v3@v3.6.14`, which failed to compile against the breaking API changes in `raft/v3@v3.7.0` (NodeId, Commit *uint64) and `api/v3@v3.7.1` (protobuf migration removing Unmarshal). ### Fix - `tools/tools.go`: track `go.etcd.io/etcd/server/v3` instead of `etcd/v3`. - `go.mod`: `go mod tidy` drops `etcd/v3 v3.6.14` and its incompatible test deps, cleanly aligning all etcd dependencies at v3.7.1. - `integration/cloudbuild/run_integration.sh`: compile the server binary via `go build -o "${ETCD_DIR}/etcd" go.etcd.io/etcd/server/v3` (avoiding Go's default name `server`), restoring real etcd integration testing in CI.

dpebot · 2026-09-21T12:27:03Z

/gcbrun

phbnf · 2026-09-21T12:28:29Z

Then,I got:

go.etcd.io/etcd/etcdutl/v3/snapshot

/go/pkg/mod/go.etcd.io/etcd/etcdutl/v3@v3.6.14/snapshot/v3_snapshot.go:175:15: kv.Unmarshal undefined (type mvccpb.KeyValue has no field or method Unmarshal)

/go/pkg/mod/go.etcd.io/etcd/etcdutl/v3@v3.6.14/snapshot/v3_snapshot.go:329:27: cannot use hardstate.Commit (variable of type *uint64) as uint64 value in argument to s.updateCIndex

/go/pkg/mod/go.etcd.io/etcd/etcdutl/v3@v3.6.14/snapshot/v3_snapshot.go:329:45: cannot use hardstate.Term (variable of type *uint64) as uint64 value in argument to s.updateCIndex

/go/pkg/mod/go.etcd.io/etcd/etcdutl/v3@v3.6.14/snapshot/v3_snapshot.go:523:39: cannot use uint64(m.ID) (value of type uint64) as *uint64 value in struct literal

/go/pkg/mod/go.etcd.io/etcd/etcdutl/v3@v3.6.14/snapshot/v3_snapshot.go:523:64: cannot use uint64(s.cl.ID()) (value of type uint64) as *uint64 value in struct literal

/go/pkg/mod/go.etcd.io/etcd/etcdutl/v3@v3.6.14/snapshot/v3_snapshot.go:524:23: md.Marshal undefined (type *etcdserverpb.Metadata has no field or method Marshal)

/go/pkg/mod/go.etcd.io/etcd/etcdutl/v3@v3.6.14/snapshot/v3_snapshot.go:548:13: cannot use raftpb.ConfChangeAddNode (constant 0 of int32 type raftpb.ConfChangeType) as *raftpb.ConfChangeType value in struct literal

/go/pkg/mod/go.etcd.io/etcd/etcdutl/v3@v3.6.14/snapshot/v3_snapshot.go:549:4: unknown field NodeID in struct literal of type raftpb.ConfChange, but does have NodeId

/go/pkg/mod/go.etcd.io/etcd/etcdutl/v3@v3.6.14/snapshot/v3_snapshot.go:552:16: cc.Marshal undefined (type raftpb.ConfChange has no field or method Marshal)

/go/pkg/mod/go.etcd.io/etcd/etcdutl/v3@v3.6.14/snapshot/v3_snapshot.go:557:11: cannot use raftpb.EntryConfChange (constant 1 of int32 type raftpb.EntryType) as *raftpb.EntryType value in struct literal

/go/pkg/mod/go.etcd.io/etcd/etcdutl/v3@v3.6.14/snapshot/v3_snapshot.go:557:11: too many errors

# go.etcd.io/etcd/tests/v3/framework/integration

/go/pkg/mod/go.etcd.io/etcd/tests/v3@v3.6.14/framework/integration/cluster.go:299:4: m.DiscoveryURL undefined (type *Member has no field or method DiscoveryURL)

/go/pkg/mod/go.etcd.io/etcd/tests/v3@v3.6.14/framework/integration/cluster.go:737:27: undefined: config.V2_DEPR_DEFAULT

/go/pkg/mod/go.etcd.io/etcd/tests/v3@v3.6.14/framework/integration/cluster.go:974:11: m.Server.SyncTicker undefined (type *etcdserver.EtcdServer has no field or method SyncTicker)

+ docker-compose -p b11f6370cebc -f ./integration/cloudbuild/docker-compose.mysql.yml -f ./integration/cloudbuild/docker-compose.network.yml down

Cloud Build failed during go install go.etcd.io/etcd/v3 with compilation errors in etcdutl/v3@v3.6.14 (kv.Unmarshal undefined, unknown field NodeID in raftpb.ConfChange).

In etcd v3.5 (etcd#12417), the server moved toserver/v3, while root etcd/v3 became an internal test stub. Trillian (#2376) tracked etcd/v3 in tools.go. When Dependabot bumped submodules to v3.7.1 and raft/v3 to v3.7.0, etcd/v3 was left pinned at v3.6.14, forcing incompatible 3.6 test packages to compile against 3.7 raft and protobuf types.

Fix:

  1. Updated `tools.go` to import `go.etcd.io/etcd/server/v3`.
  2. Ran `go mod tidy` to prune the orphaned 3.6.14 root and test dependencies.
  3. Updated `run_integration.sh` to compile `${ETCD_DIR}/etcd` via `go build -o "${ETCD_DIR}/etcd" go.etcd.

io/etcd/server/v3(Go's defaultgo installnames the binaryserver`).

dpebot · 2026-09-21T12:39:59Z

/gcbrun

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Sep 18, 2026

dependabot Bot requested a review from a team as a code owner September 18, 2026 14:36

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 18, 2026

dependabot Bot requested a review from phbnf September 18, 2026 14:36

dependabot Bot added the go Pull requests that update Go code label Sep 18, 2026

re-introduce toolchain directive

5dba161

regenerate protos

84c4905

phbnf changed the title ~~Bump the go-deps group across 1 directory with 20 updates~~ Bump the go-deps group across 1 directory with 20 updates AND bump go to 1.26 Sep 18, 2026

phbnf added 2 commits September 18, 2026 15:50

use golangci-lint v2.10.1 in test_pgdb and test_crdb

4686085

README and CHANGELOG

70842ea

phbnf changed the title ~~Bump the go-deps group across 1 directory with 20 updates AND bump go to 1.26~~ Bump the go-deps group across 1 directory with 20 updates AND bump go to 1.26 AND regenerate protos AND bump golangci-lint in tests Sep 18, 2026

CHANGELOG.md

a76d49c

AlCutter approved these changes Sep 21, 2026

View reviewed changes

phbnf approved these changes Sep 21, 2026

View reviewed changes

phbnf merged commit 0d6fa8f into master Sep 21, 2026
20 checks passed

phbnf deleted the dependabot/go_modules/go-deps-96d16a61b7 branch September 21, 2026 13:26

Navigation Menu

Repository navigation

Bump the go-deps group across 1 directory with 20 updates AND bump go to 1.26 AND regenerate protos AND bump golangci-lint in tests AND tighter master election lease filtering AND migrate to etcd/server in tests - #3931

Bump the go-deps group across 1 directory with 20 updates AND bump go to 1.26 AND regenerate protos AND bump golangci-lint in tests AND tighter master election lease filtering AND migrate to etcd/server in tests#3931
phbnf merged 8 commits into
masterfrom
dependabot/go_modules/go-deps-96d16a61b7

dependabot Bot commented on behalf of github Sep 18, 2026

Uh oh!

dpebot commented Sep 18, 2026

Uh oh!

dpebot commented Sep 18, 2026

Uh oh!

dpebot commented Sep 18, 2026

Uh oh!

dpebot commented Sep 18, 2026

Uh oh!

dpebot commented Sep 21, 2026

Uh oh!

phbnf commented Sep 21, 2026

Uh oh!

dpebot commented Sep 21, 2026

Uh oh!

phbnf commented Sep 21, 2026

Uh oh!

dpebot commented Sep 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot Bot commented on behalf of github Sep 18, 2026

spanner: v1.95.1

1.95.1 (2026-09-10)

Bug Fixes

spanner: v1.95.0

1.95.0 (2026-08-24)

Features

Bug Fixes

spanner: v1.94.0

1.94.0 (2026-07-28)

Features

Bug Fixes

Beam 2.76.0 release

Highlights

I/Os

New Features / Improvements

Breaking Changes

[2.76.0] - 2026-08-31

Highlights

I/Os

New Features / Improvements

Breaking Changes

v1.9.4

What's Changed

Dependencies

Changes

New Contributors

v1.10.1

What's Changed

New Contributors

v1.10.1 (2026-09-02)

v5.11.0

Features

Changes

5.11.0 (September 7, 2026)

Features

Changes

v1.24.1 / 2026-07-23

What's Changed

v1.24.0 - 2026-07-20

Changes

Uh oh!

dpebot commented Sep 18, 2026

Uh oh!

dpebot commented Sep 18, 2026

Uh oh!

dpebot commented Sep 18, 2026

Uh oh!

dpebot commented Sep 18, 2026

Uh oh!

dpebot commented Sep 21, 2026

Uh oh!

phbnf commented Sep 21, 2026

Uh oh!

dpebot commented Sep 21, 2026

Uh oh!

phbnf commented Sep 21, 2026

Uh oh!

dpebot commented Sep 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants