[dependabot]

Bumps the go-modules group with 2 updates in the / directory: github.com/a-h/templ and modernc.org/sqlite.

Updates github.com/a-h/templ from 0.3.1020 to 0.3.1070

Release notes

Sourced from github.com/a-h/templ's releases.

v0.3.1070

Changelog

• edf2b02ae483d199a5dc17875428959d2175e35a chore(deps): bump DeterminateSystems/determinate-nix-action from 3.20.0 to 3.21.2 (#1423)
• 04abee5364c6fab2bde8c00d215fdcb630ad6a94 chore(deps): bump DeterminateSystems/determinate-nix-action from 3.21.2 to 3.21.5 (#1429)
• 7e1935b076d4e361d40fcfe632bcc62837e35c83 chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 (#1417)
• 3500646a08051246cd29312bc8775312c046770f chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 (#1422)
• 2575493476725961dab5f554bb22a2bcae17993b chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 (#1399)
• 1ddec4e9c18e1883dc019a7f6d6812f9df4683ee chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 (#1426)
• a6baa06495a4a2a00fd65d9a35f1f9440e5d28cb chore(deps): bump ko-build/setup-ko from 0.9 to 0.10 (#1427)
• 14fa33df209e82a3920ca1054b40e1d9741304d4 chore(deps): bump nixbuild/nix-quick-install-action from 34 to 35 (#1418)
• 928fa20e2c59468c8a23c6b10f975cd1d8b51ff8 chore: bump Go version in dev flake from 1.25.6 to 1.25.9
• afd5d4f771bdf632fa8e30498224d2f75c5afd2c chore: bump deps
• 9a16fdd1d41bc90d977e5ef83550825f50b9879a chore: bump dev tooling dependencies
• e5d17907e087bfcc5fcf7f5c0e0208221c71c7f0 chore: bump docusaurus version
• 5bb04257b33a0ca3ab5a461d30423f29c6a447b9 chore: bump go deps
• 992ad3efaae14de9108732da766675475f334630 chore: bump gofiber in example
• e8952a21b4ff1d536e214c4f541a91d5fd3499c0 chore: bump npm deps
• c735c4bcfba0fdd510629f77381639f1c1c72c67 chore: bump version
• 145dca149653f1708fb4a72fa43984cdb44c7b03 chore: bump versions in examples
• a302b1a1ea834091eeb81c5c4992810064e6ab44 chore: fix linter warnings (#1425)
• 75b2f2ef22d165c86f17398019173976c02ed348 chore: switch to pinned github actions commits
• 07dfb6e0c7c47f56c6e8ed6601ecd65b18e210dc chore: update CI/CD pipleline
• e512269cb3e3896c14cecfba7717c80b4101ed88 chore: update github actions to latest versions
• d6182bca7dfaeaf1140748eea2b523459b853918 chore: upgrade npm deps
• 3eb1420ade2633ca1cef6b21205f0de97dbf29db feat(lsp): add experimental support for Go files (#1384)
• f8c98a42d9a5081b41224f260e2ff14108bb752e feat: add .templignore_fmt and .templignore_generate support
• 5b940560063e36faca687a33ab45fb47e9a81fa1 feat: add dependabot check to pin github workflow versions
• 2720f8eb30515e739fcd6f2d9fcf9a2f338dca5b feat: add prettier formatting to LSP (#1381)
• d6fde35e7eee4ad8e3d7a2cf3eeb6d7d7e6ddca1 feat: add ranges to DocType nodes (#1424)
• c0ab59e1e5e951dce2cdb7d1d274ea3c8eb9f437 feat: apply prettier to constant attribute values, closes #1263
• a42729f98e74f26fc0cd8c96cad3c92ac89386cd feat: notify gopls templ version, see #1376
• b757ca212259260a58223fec9f36fe6e86b638b1 feat: support Go comments within HTML tag attributes (#1251)
• 06f022cda52f1703b964e74af15e1a0e2d245ab2 feat: track element tag ranges (#1398)
• 3e1cc6845be7d868f84f0431c724a441fcdcc2a3 feat: update the -cmd flag on templ generate --watch to support shell commands
• 82a7b90efe4972cef488faa683c294f2580b55f7 fix: JavaScript function name validation (#1400)
• a4b4479011f3264383242735fbe085a67d953105 fix: add version and switch to flake output using pname (#1430)
• bec9b04ef4e1e8960c20e3ea0b232183425ba8cb fix: broken tests due to Go version upgrade
• f32707bfb19ffa1a566e0110d6b6c2165f8dc0a3 fix: ensure version cli tool has template
• 598b81e9f23df32055e42a5ea15bb04c37e56e6f fix: failure to parse large templ files (#1395)
• 965ce82ff651b1f53e273c4c70d8d61bdf98f58e fix: live reload should forward SIGINT/SIGTERM to child process groups - fixes #1323 (#1391)
• e2b1a743073a9b4785a9182058c32de4a8549ab0 fix: narrow ResolveAttributeValue to stringable | ComponentScript types (#1407)
• 47936f9e707195f026d413db07da6a9943679c7b fix: parse unquoted attributes on non-self-closing elements, fixes #1372
• 4dcddeda0c9ef97970324d246c781aea8250b29a fix: prevent data-templ-depth divs leaking into script content, fixes #1277
• 9be08d89915847149a1058a5ad6f28e5180e7123 fix: render templ component expressions within text ranges, fixes #693
• 205eb60cd3a519cd8d13988f78764fa1264189d2 fix: security recommendations by zizmor
• f8e3a1b4efb329e94e4831e3ad494bbc2086b756 fix: support map[templ.CSSClass]bool to choose whether to include a class
• bccd8d1a961e45dbefc7012477554d308f61b340 fix: use prettierd if available, fixes #1319

Commits

• 07dfb6e chore: update CI/CD pipleline
• 145dca1 chore: bump versions in examples
• f32707b fix: ensure version cli tool has template
• f5a9c52 docs: add templ-components to component libraries (#1447)
• 6f0deaf docs: fix dockerfile in installation section (#1396)
• 6c7c699 docs: templUI becomes shadcn-templ (#1440)
• 82a7b90 fix: JavaScript function name validation (#1400)
• bec9b04 fix: broken tests due to Go version upgrade
• 205eb60 fix: security recommendations by zizmor
• e512269 chore: update github actions to latest versions
• Additional commits viewable in compare view

Updates modernc.org/sqlite from 1.60.1 to 1.61.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

• 2026-10-21 v1.61.1:

  • Prepared statements are no longer parsed and planned again on every execution. Since v1.61.0, SQLite 3.54 expired a cached statement that has a col = ? term in a join or an ORDER BY query whenever the driver cleared its bindings after a run, so a statement prepared with db.Prepare or tx.Prepare cost about twice what it did in v1.60.1. Integer bindings now stay in place between executions, so a parameter bound to 0 or 1 does not re-prepare it either. Resolves [GitLab issue #264](https://gitlab.com/cznic/sqlite/-/issues/264). See [GitLab merge request #147](https://gitlab.com/cznic/sqlite/-/merge_requests/147), thanks Roman Khafizianov (@​requilence)!
  • Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!
  • Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.
  • Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!
  • The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.
  • Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

• 2026-10-21 v1.61.0:

  • Upgrade to SQLite 3.54.1, re-vendoring lib/ from modernc.org/libsqlite3 v1.15.2 and vec/ from modernc.org/libsqlite_vec v0.7.0; sqlite-vec stays v0.1.9. The pinned modernc.org/libc becomes v1.79.0; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Add _time_format=string_no_monotonic, opt-in: times are written in the default layout but without Go's monotonic clock reading, the m=+... suffix, so a scanned time matches its row again when bound in WHERE col = ?. The default is unchanged. Resolves [GitLab issue #259](https://gitlab.com/cznic/sqlite/-/issues/259). See [GitLab merge request #142](https://gitlab.com/cznic/sqlite/-/merge_requests/142), thanks 不插电 (@​r27153733)!
  • Each release tag now gets a signed provenance document, linked from its GitLab release; VERIFYING.md says what it proves and how to check one. Tooling only. See [GitLab merge request #141](https://gitlab.com/cznic/sqlite/-/merge_requests/141).
  • Add an opt-in SQLite authorizer per connection: AuthorizerRegisterer, reached through sql.Conn.Raw or installed on every pooled connection from RegisterConnectionHook; existing connections are unchanged. Resolves [GitLab issue #256](https://gitlab.com/cznic/sqlite/-/issues/256). See [GitLab merge request #139](https://gitlab.com/cznic/sqlite/-/merge_requests/139), thanks Tedla Brandsema (@​TedlaBrandsema)!
  • Closing a connection now forgets the pre-update, commit and rollback hooks registered on it; their entries used to linger after Close.
  • With a shared cache, BeginTx now waits for a lock another connection holds instead of failing at once with SQLITE_LOCKED_SHAREDCACHE (262), as executing BEGIN IMMEDIATE did; Commit and Rollback wait likewise while another connection changes the schema. busy_timeout does not bound the wait; the call's context does. See [GitLab merge request #143](https://gitlab.com/cznic/sqlite/-/merge_requests/143), thanks Ian Chechin!
  • PrepareContext and BeginTx with a context that is already done now return the context's error, as ExecContext and QueryContext do. See [GitLab merge request #143](https://gitlab.com/cznic/sqlite/-/merge_requests/143), thanks Ian Chechin!
  • A context that is done before a statement starts running, for example while its arguments are being bound, now stops the statement within 1000 VM steps. SQLite discarded that interrupt, so a long statement ran to completion and only then returned the context's error. See [GitHub pull request #9](modernc-org/sqlite#9), thanks Chris Gianelloni (@​wolf31o2)!
  • A statement waiting for a lock under busy_timeout now stops waiting once its context is done, with the context's error, instead of sleeping on until the timeout; the wait's retry schedule and its bound are otherwise unchanged, and so is a call without a deadline. PrepareContext ended this way returns the context's error too, where it returned SQLITE_BUSY. Resolves [GitLab issue #262](https://gitlab.com/cznic/sqlite/-/issues/262), thanks SirLouen!

• 2026-09-29 v1.60.1:

  • Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

• 2026-09-28 v1.60.0:

  • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
  • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.
  • make vendor now writes vendor.json, the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries; the test suite fails when they no longer match. Tooling only. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).
  • vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.
  • Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.
  • The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.
  • Document three limits of the pluggable page cache on RegisterPageCache and Cache: it cannot be combined with modernc.org/sqlite/vec, PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines. Documentation only.
  • Document in the package documentation that state set on a pooled connection is inherited by the next caller to borrow it, and that a connection reached through sql.Conn.Raw is not safe for concurrent use. Documentation only.
  • Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so anything after a ; runs too. Recommended for any application whose DSN is not a compile-time constant.
  • Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof, which have always worked in a DSN starting with file:, and the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257). Documentation only.
  • Add SECURITY.md, the vulnerability reporting policy: three private channels, what is in scope, that only the latest release is supported, and how a confirmed report is disclosed, including an entry in the Go vulnerability database so govulncheck reports it. IRP.md, linked from it, is the maintainers' incident response plan. Documentation only.
  • Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Documentation only.
  • Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries with all seventeen license texts in full, and a Software Bill of Materials, sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), explained in SBOM.md. Both cover what a module-graph tool cannot see: the transpiled SQLite and sqlite-vec C, and the upstreams modernc.org/libc carries, musl among them. Documentation only.

• 2026-09-15 v1.59.0:

  • Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, memmove, memset, memcmp and strlen with native Go, cutting CPU time on query-heavy workloads by up to a third; see the new Performance section below. As always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does; see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call, removing the last driver-side allocation per invocation. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return. Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).
  • Add regression tests pinning the identity and the pooling of that context. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!
  • Add a Performance section to the package documentation: measured CPU-time ratios of this driver against the same SQLite compiled from C, where the gap comes from, and the two consequences for applications — index the columns that ORDER BY, GROUP BY and WHERE use, and bound the database/sql pool with SetMaxOpenConns.

• 2026-09-01 v1.58.0:

  • Upgrade to SQLite 3.53.4. It carries upstream's own fix for the journal-rollback data-corruption bug, so the local super-journal patch v1.56.0 introduced is dropped; recovery behavior is unchanged. Also bumps the pinned modernc.org/libc to v1.75.6; as always, downstream modules must pin the same version this one does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

... (truncated)

Commits

• 4df1ebe sqlite, conn, stmt, tx: end a busy_timeout wait when the call's context is done
• 44ae8d4 update dependencies, make vendor: SQLite 3.54.1, libc v1.79.0
• 570dc56 CHANGELOG.md: context cancellation before a statement starts (GitHub PR #9)
• 4eacffe sqlite, conn: keep one cancellation flag per connection
• 4926b7a Merge GitHub pull request #9 'fix/context-cancellation'
• 3587a68 fix: preserve cancellation before SQLite execution
• fd37819 Merge branch 'tx-shared-cache-wait' into 'master'
• 75b4e62 conn: watch the context only while waiting for a shared-cache lock
• 5856ee8 tx, conn: wait for a shared-cache lock in BeginTx, Commit and Rollback, and e...
• 0fc3f90 conn: forget the pre-update, commit and rollback hooks on Close
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions