chore(deps)(deps): bump the go-minor-and-patch group across 1 directory with 12 updates by dependabot[bot] · Pull Request #730 · PerpetualSoftware/pad

dependabot · 2026-06-15T13:28:21Z

Bumps the go-minor-and-patch group with 9 updates in the / directory:

Package	From	To
github.com/JohannesKaufmann/html-to-markdown/v2	`2.5.1`	`2.5.2`
github.com/go-chi/chi/v5	`5.2.5`	`5.3.0`
github.com/jackc/pgx/v5	`5.9.2`	`5.10.0`
github.com/mark3labs/mcp-go	`0.52.0`	`0.55.0`
github.com/pb33f/libopenapi	`0.36.3`	`0.38.1`
github.com/redis/go-redis/v9	`9.19.0`	`9.21.0`
golang.org/x/crypto	`0.51.0`	`0.53.0`
golang.org/x/image	`0.41.0`	`0.43.0`
modernc.org/sqlite	`1.50.0`	`1.53.0`

Updates github.com/JohannesKaufmann/html-to-markdown/v2 from 2.5.1 to 2.5.2

Release notes

Sourced from github.com/JohannesKaufmann/html-to-markdown/v2's releases.

v2.5.2

Changelog

290df46a279e3d7d9011dbbb199658dfcb5ec272 add FAQ for character encoding

61d55bd668974b20e7f70c191453963aa4bbaea0 remove firecrawl banner

19162a2494780c1ff28f55e4fc552b7bd2f62c9f update version

Commits

290df46 add FAQ for character encoding
61d55bd remove firecrawl banner
19162a2 update version
See full diff in compare view

Updates github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.0

What's Changed

Use strings.ReplaceAll where applicable by @JRaspass in go-chi/chi#1046

Propagate inline middlewares across mounted subrouters by @LukasJenicek in go-chi/chi#1049

add go 1.26 to ci by @pkieltyka in go-chi/chi#1052

Remove last uses of io/ioutil by @JRaspass in go-chi/chi#1054

Simplify chi.walk with slices.Concat by @JRaspass in go-chi/chi#1053

Apply the stringscutprefix modernizer by @JRaspass in go-chi/chi#1051

Bump minimum Go to 1.23, always use request.Pattern by @JRaspass in go-chi/chi#1048

middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee by @alliasgher in go-chi/chi#1085

Fix typo in Route doc comment by @gouwazi in go-chi/chi#1073

fix: set Request.Pattern from RoutePattern() by @leno23 in go-chi/chi#1097

feat: middleware.ClientIP, a replacement for middleware.RealIP by @VojtechVitek in go-chi/chi#967

New Contributors

@LukasJenicek made their first contribution in go-chi/chi#1049

@alliasgher made their first contribution in go-chi/chi#1085

@gouwazi made their first contribution in go-chi/chi#1073

@leno23 made their first contribution in go-chi/chi#1097

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

@VojtechVitek submitted PR #967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:

GHSA-9g5q-2w5x-hmxf — IP spoofing via XFF in RemoteAddr resolution (convto)

GHSA-rjr7-jggh-pgcp — RealIP allows IP spoofing via unvalidated XFF (rezmoss)

GHSA-3fxj-6jh8-hvhx — IP spoofing in middleware.RealIP (Saku0512, Critical / 9.3)

It also addresses issues outlined at:

go-chi/chi#708

https://adam-p.ca/blog/2022/03/x-forwarded-for/

go-chi/chi#711

go-chi/chi#453

go-chi/chi#908

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your infrastructure, read the result with one of the two accessors:
// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
</tr></table> 

... (truncated)

Commits

3b17157 feat: middleware.ClientIP, a replacement for middleware.RealIP (#967)
818fdcf fix: set Request.Pattern from RoutePattern() (#1097)
f975af0 Fix typo in Route doc comment (#1073)
4ef87ea middleware: fix httpFancyWriter.ReadFrom double-counting bytes with Tee (#1085)
a54874f Bump minimum Go to 1.23, always use request.Pattern (#1048)
3328d4d Apply the stringscutprefix modernizer (#1051)
be60b2e Simplify chi.walk with slices.Concat (#1053)
a36a925 Remove last uses of io/ioutil (#1054)
7d93ee3 add go 1.26 to ci (#1052)
903cff2 Propagate inline middlewares across mounted subrouters (#1049)
Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.10.0 (June 3, 2026)

This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers, contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are sent over TLS when the original connection used TLS.

Features

Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)

Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)

Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)

Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)

pgxpool: check if connection is expired before acquire (arthurdotwork)

Security Hardening

Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)

Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)

Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)

Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)

Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)

Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)

Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)

Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)

Fix panic on malformed geometric text; return an error instead (MaIII)

Fixes

Fix scanning "char" (OID 18) into *string in binary format (luongs3)

Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)

Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)

Fix data race when context is cancelled during connect

Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)

pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)

pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)

pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check

Add missing error check of rows.Err to load types (Jen Altavilla)

Commits

7293fb1 Update changelog for v5.10.0
1ade285 pgconn: document secure connection configuration
b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
b28e65b pgtype: bound array element count against remaining message bytes
cd1f389 pgtype: bound array binary decode element length against remaining bytes
ff27b5b pgtype: bound hstore binary decode against malicious server input
a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
44f6173 pgconn: cap server-supplied SCRAM iteration count
1a976f7 pgconn: add require_auth to restrict accepted server auth methods
Additional commits viewable in compare view

Updates github.com/mark3labs/mcp-go from 0.52.0 to 0.55.0

Release notes

Sourced from github.com/mark3labs/mcp-go's releases.

Release v0.55.0

No release notes provided.

Release v0.54.1

No release notes provided.

Release v0.54.0

What's Changed

fix(server): handle resources/subscribe and resources/unsubscribe (#865) by @ezynda3 in mark3labs/mcp-go#873

fix(oauth): use LATEST_PROTOCOL_VERSION in metadata discovery (#868) by @ezynda3 in mark3labs/mcp-go#874

fix(oauth): don't hold metadataMu across HTTP discovery (#871) by @ezynda3 in mark3labs/mcp-go#875

feat(mcp): add 2025-11-25 sampling-with-tools and capability sub-fields (#867) by @ezynda3 in mark3labs/mcp-go#876

refactor: use MCP method constants by @nanookclaw in mark3labs/mcp-go#878

docs: add missing godoc comments by @aqilaziz in mark3labs/mcp-go#877

fix: add panic recovery to SSE message handler and stdio tool call worker by @blackwell-systems in mark3labs/mcp-go#882

fix: add panic recovery to task goroutines, fix cleanup goroutine leak by @blackwell-systems in mark3labs/mcp-go#880

feat: add OpenTelemetry tracing hooks to server and client by @QuentinBisson in mark3labs/mcp-go#856

fix: add panic recovery to session hook goroutines by @blackwell-systems in mark3labs/mcp-go#883

feat(mcp): add BaseMetadata.title, Icon.theme, Resource.size (#870) by @ezynda3 in mark3labs/mcp-go#885

New Contributors

@nanookclaw made their first contribution in mark3labs/mcp-go#878

@aqilaziz made their first contribution in mark3labs/mcp-go#877

Full Changelog: mark3labs/mcp-go@v0.53.0...v0.54.0

Release v0.53.0

What's Changed

feat(server): add WithStrictInputSchemaDefault by @QuentinBisson in mark3labs/mcp-go#853

fix(server): add CloseSessions and prevent double-close panic on SSE sessions by @blackwell-systems in mark3labs/mcp-go#852

fix(transport): suppress closed-pipe shutdown noise by @Gujiassh in mark3labs/mcp-go#863

fix: add panic recovery to transport goroutines by @blackwell-systems in mark3labs/mcp-go#861

fix: ToolInputSchema inherits MarshalJSON (fixes #694) by @tamish-max in mark3labs/mcp-go#858

we should use pointers on returns for ListPrompts and ListResources by @Patryk-Stefanski in mark3labs/mcp-go#855

fix(mcp): allow _meta on paginated requests by @curbol in mark3labs/mcp-go#854

refactor(server): use explicit struct literal in ListTools by @ezynda3 in mark3labs/mcp-go#864

New Contributors

@QuentinBisson made their first contribution in mark3labs/mcp-go#853

@tamish-max made their first contribution in mark3labs/mcp-go#858

@curbol made their first contribution in mark3labs/mcp-go#854

Full Changelog: mark3labs/mcp-go@v0.52.0...v0.53.0

Commits

43c2ca0 oauth: return error instead of (nil, nil) from getServerMetadata (#903) (#904)
3b66aa7 mcptest: add SetSamplingHandler and SetElicitationHandler (#902)
42bc0b2 feat(otel): WithServerLogging — OTEL slog bridge for server structured logs (...
d972f3f docs(prompts): add review-pr kit prompt for Go PRs
d5c0727 feat(server): WithLogger consolidates structured logging onto *slog.Logger (#...
3f1c760 feat(tracing): add MetaPropagator for W3C trace context via MCP _meta (SEP-41...
2cacbe7 fix: enforce tool/prompt filters at call time, not just list time (#898)
481f056 fix(tools): print errors to stderr for invalid jsonschema tags (#894)
6e7859c perf(mcp): reduce content unmarshal allocations (#890)
018f190 Add Title and Size to ResourceLink (match Resource / spec) (#887)
Additional commits viewable in compare view

Updates github.com/pb33f/libopenapi from 0.36.3 to 0.38.1

Release notes

Sourced from github.com/pb33f/libopenapi's releases.

v0.38.1

Fixes #590 and moved to our own fork of testify

v0.38.0

Improves parse/index performance and memory use with lazy SpecInfo JSON generation, lower-allocation node indexing, faster component-path conversion, and reduced goroutine overhead in small translation/schema paths.

Adds SkipMetadataCollection for consumers that do not need diagnostic index metadata, allowing faster/lighter parsing for large documents.

Tightens YAML handling around duplicate keys, merge/root errors, empty overlays, and YAML v4 rc.5 rendering behavior.

Fixes OpenAPI 3.0 webhooks extraction so same-named scalar values no longer create empty webhook maps.

Improves change detection and generator metadata fidelity, including anchor-insensitive YAML comparisons and preserved/inferred

YAML tags for generated enum/const metadata.

@asadtariq96

v0.37.3

Address issue #581

v0.37.2

Provides a deeper fix for #575

v0.37.1

Addresses regression identified in #575

v0.37.0

New generator module that Generated Code and Specs.

https://pb33f.io/libopenapi/generating-code/ https://pb33f.io/libopenapi/parsing-code/

Code from OpenAPI and OpenAPI from Code, all built in. no deps. no run-time required.

v0.36.6

Fixes issues with auto-detecting types when bundling by adding a source path to determine type cleanly. No breaking changes.

v0.36.5

New budgeting controls and logic for rendering mocks. Some specs with crazy max limits as traits were causing insane blowout mock generation. No breaking changes.

v0.36.4

Various fixes with bundler dealing with rewriting relative paths in composed mode, some house-keeping and cleanup.

No new features or breaking changes.

Commits

8bbb3fa address issue #590
73ef933 coverage bump
bac2b0e upgrade YAML APIs
dfe2eb2 update deps
6c72b83 bump coverage on arazzo
68a6d17 fix: hold exclusive lock while building legacy node map
6019ccc fix borked windows test
4a22282 perf: lazy SpecInfo JSON, SkipMetadataCollection, and hot-path allocation cuts
ee5ec7c fix(v3): don't inject empty webhooks for OpenAPI 3.0 docs with same-named scalar
29d9ea8 Bump golang.org/x/sync from 0.20.0 to 0.21.0
Additional commits viewable in compare view

Updates github.com/redis/go-redis/v9 from 9.19.0 to 9.21.0

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.21.0

This is a minor release adding new features and bug fixes. There are no breaking changes; upgrading from 9.20.x is a drop-in replacement.

🚀 Highlights

Zero-copy GetToBuffer / SetFromBuffer

Two new StringCmdable methods let callers read and write Redis string values directly into and from pre-allocated byte buffers, eliminating the per-call payload allocation that Get/Set incur:
GetToBuffer(ctx, key, buf) *ZeroCopyStringCmd   // reads into buf; ZeroCopyStringCmd { Val() int; Bytes() []byte; Result() (int, error) }
SetFromBuffer(ctx, key, buf) *StatusCmd
GetToBuffer decodes the bulk reply straight into the caller-owned buf (no intermediate allocation); a buffer that is too small returns an error after draining the payload, so the connection stays aligned for the next reply. SetFromBuffer is provided for API symmetry — it dispatches to the same []byte writer path as Set(ctx, key, buf, 0) and produces byte-identical output on the wire. Available on *Client, *ClusterClient, *Ring, *Conn and Pipeliner.

(#3834) by @ndyakov

Explicit LIMIT 0 for stream trimming

Redis treats XTRIM/XADD approximate-trim (~) LIMIT 0 as "disable the trimming effort cap entirely", which differs from omitting LIMIT (the implicit 100 * stream-node-max-entries default). The command builders previously only emitted LIMIT when limit > 0, so callers could never send an explicit LIMIT 0. Following the KeepTTL = -1 precedent, the new XTrimLimitDisabled = -1 sentinel now emits an explicit LIMIT 0; limit == 0 keeps the historical no-LIMIT behavior, so existing callers produce byte-identical commands.

(#3848) by @TheRealMal

✨ New Features

Zero-copy buffer string commands: new GetToBuffer / SetFromBuffer on StringCmdable and the ZeroCopyStringCmd result type, reading/writing string values into caller-owned buffers without per-call payload allocation (#3834) by @ndyakov

XTrimLimitDisabled sentinel: XTRIM/XADD approximate trimming can now send an explicit LIMIT 0 to disable the trim effort cap, via the new XTrimLimitDisabled = -1 sentinel (#3848) by @TheRealMal

PubSub health-check timeouts: channel.initHealthCheck now bounds the Ping it issues with a fresh per-check timeout context (the exported pingTimeout / reconnectTimeout) instead of context.TODO(), so a stuck health-check Ping can no longer block indefinitely (#3819) by @abdellani

Skip redundant UNWATCH in Tx.Close: a transaction now tracks whether a WATCH is still active (watchArmed) and only issues UNWATCH on Close when it is, removing an extra round trip on the common WATCH/.../EXEC and no-key Watch paths while never returning a connection to the pool with an active watch (#3854) by @fcostaoliveira

🐛 Bug Fixes

maintnotifications ModeAuto fail-open: ModeAuto now stays fail-open when the server does not support maintenance notifications — connections are retired and tracking is guarded during downgrade so the client keeps working instead of erroring (#3853) by @terrorobe

👥 Contributors

We'd like to thank all the contributors who worked on this release!

@abdellani, @fcostaoliveira, @ndyakov, @terrorobe, @TheRealMal

9.20.1

This is a patch release containing bug fixes only. There are no new features or breaking changes; upgrading from 9.20.0 is a drop-in replacement.

🚀 Highlights

RESP3 pub/sub message loss fixed

PeekPushNotificationName previously inspected only the bytes already buffered by bufio, so when a push frame header straddled a buffer fill boundary it could return a truncated notification name (e.g. "messa" instead of "message"). The push processor then mis-routed the frame and ReadReply silently dropped it, causing intermittent RESP3 pub/sub message loss. The peek now grows its window (36 bytes → up to 4 KiB) and reads more from the connection until the header is complete, cleanly separating incomplete prefixes from corrupt frames (including overflow-safe bulk-length handling). Fixes #3839.

... (truncated)

Changelog

Sourced from github.com/redis/go-redis/v9's changelog.

9.21.0 (2026-06-18)

This is a minor release adding new features and bug fixes. There are no breaking changes; upgrading from 9.20.x is a drop-in replacement.

🚀 Highlights

Zero-copy GetToBuffer / SetFromBuffer

Two new StringCmdable methods let callers read and write Redis string values directly into and from pre-allocated byte buffers, eliminating the per-call payload allocation that Get/Set incur:
GetToBuffer(ctx, key, buf) *ZeroCopyStringCmd   // reads into buf; ZeroCopyStringCmd { Val() int; Bytes() []byte; Result() (int, error) }
SetFromBuffer(ctx, key, buf) *StatusCmd
GetToBuffer decodes the bulk reply straight into the caller-owned buf (no intermediate allocation); a buffer that is too small returns an error after draining the payload, so the connection stays aligned for the next reply. SetFromBuffer is provided for API symmetry — it dispatches to the same []byte writer path as Set(ctx, key, buf, 0) and produces byte-identical output on the wire. Available on *Client, *ClusterClient, *Ring, *Conn and Pipeliner.

(#3834) by @ndyakov

Explicit LIMIT 0 for stream trimming

Redis treats XTRIM/XADD approximate-trim (~) LIMIT 0 as "disable the trimming effort cap entirely", which differs from omitting LIMIT (the implicit 100 * stream-node-max-entries default). The command builders previously only emitted LIMIT when limit > 0, so callers could never send an explicit LIMIT 0. Following the KeepTTL = -1 precedent, the new XTrimLimitDisabled = -1 sentinel now emits an explicit LIMIT 0; limit == 0 keeps the historical no-LIMIT behavior, so existing callers produce byte-identical commands.

(#3848) by @TheRealMal

✨ New Features

Zero-copy buffer string commands: new GetToBuffer / SetFromBuffer on StringCmdable and the ZeroCopyStringCmd result type, reading/writing string values into caller-owned buffers without per-call payload allocation (#3834) by @ndyakov

XTrimLimitDisabled sentinel: XTRIM/XADD approximate trimming can now send an explicit LIMIT 0 to disable the trim effort cap, via the new XTrimLimitDisabled = -1 sentinel (#3848) by @TheRealMal

PubSub health-check timeouts: channel.initHealthCheck now bounds the Ping it issues with a fresh per-check timeout context (the exported pingTimeout / reconnectTimeout) instead of context.TODO(), so a stuck health-check Ping can no longer block indefinitely (#3819) by @abdellani

Skip redundant UNWATCH in Tx.Close: a transaction now tracks whether a WATCH is still active (watchArmed) and only issues UNWATCH on Close when it is, removing an extra round trip on the common WATCH/.../EXEC and no-key Watch paths while never returning a connection to the pool with an active watch (#3854) by @fcostaoliveira

🐛 Bug Fixes

maintnotifications ModeAuto fail-open: ModeAuto now stays fail-open when the server does not support maintenance notifications — connections are retired and tracking is guarded during downgrade so the client keeps working instead of erroring (#3853) by @terrorobe

👥 Contributors

We'd like to thank all the contributors who worked on this release!

@abdellani, @fcostaoliveira, @ndyakov, @terrorobe, @TheRealMal

Full Changelog: redis/go-redis@v9.20.1...v9.21.0

9.20.1 (2026-06-11)

This is a patch release containing bug fixes only. There are no new features or breaking changes; upgrading from 9.20.0 is a drop-in replacement.

... (truncated)

Commits

1551837 chore(release): 9.21.0 (#3857)
1cfa927 fix(maintnotifications): keep ModeAuto fail-open (#3853)
1f0ea0e feat(pubsub): introduce timeouts for Ping on channel.initHealthCheck (#3819)
5484b0b feat(tx): skip redundant UNWATCH in Tx.Close when no WATCH is active (#3854)
bf57a51 chore(deps): bump rojopolis/spellcheck-github-actions (#3852)
641294c feat(streams): support explicit LIMIT 0 in XTRIM/XADD trimming via XTrimLimit...
74d9bb0 feat(command): add zero-copy GetToBuffer and SetFromBuffer (#3834)
a13416b chore(release): 9.20.1 (#3847)
10dc44f fix(push): fix peeking when push name is truncated (#3842)
e1a2d68 fix(ft.hybrid): Always generate vector param names if they are not provided b...
Additional commits viewable in compare view

Updates go.yaml.in/yaml/v4 from 4.0.0-rc.4 to 4.0.0-rc.5

Commits

39ad3aa Fix !!merge tag regression for yq #2677
79b4713 Forbid AI co-author attribution in commits
cc48a8d Bump the actions group with 2 updates
b6a4ef8 Revert incorrect gofmt changes
db7ba15 Bump the actions group with 2 updates
6d7a10f Bump crate-ci/typos from 1.45.1 to 1.45.2 in the actions group
dee8e44 Address must() review comments
0a9433f Fix two test issues in runDumpErrorTest
47b8c67 Fix failDump to use direct type assertion
4db0ef6 Address review comments on DumpError PR
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.51.0 to 0.53.0

Commits

45460e0 go.mod: update golang.org/x dependencies
d37c95e pkcs12: limit PBKDF iteration count to prevent CPU exhaustion
e2ffffe ssh: reject incomplete gssapi-with-mic configurations
60e158a ssh/test: isolate CLI tests from user SSH config and agent
1b77d23 ssh/knownhosts: reject lines with multiple or unknown markers
3872a2b ssh/knownhosts: verify declared key type matches decoded key
9f72ecc ssh/knownhosts: treat only ASCII space and tab as whitespace
8f405a4 ssh: validate ECDSA curve matches expected algorithm
bb41b3d ssh: improve DH GEX group selection using PreferredBits
e04e721 ssh/agent: validate ed25519 private key length in Add
Additional commits viewable in compare view

Updates golang.org/x/image from 0.41.0 to 0.43.0

Commits

b5baf41 tiff: avoid overflow when reading IFD entries
e7513b5 tiff: limit the amount of data read in IFD entries
cb9f1a6 tiff: limit uncompressed data reads
304d4cc tiff: reject tiles too much larger than the image
7c04344 tiff: add buffer slice overflow checks for 32-bit systems
c5511df webp: require that VP8/VP8L dimensions match canvas dimensions
38fd220 bmp: don't panic on too-large image, reject 0xN
f95dd26 font/sfnt: avoid panics from out-of-bounds access in invalid GPOS table
1e486eb tiff: don't panic when decoding too-large image on 32-bit platforms
3fd0b07 go.mod: update golang.org/x dependencies
Additional commits viewable in compare view

Updates golang.org/x/term from 0.43.0 to 0.44.0

Commits

3b43943 go.mod: update golang.org/x dependencies
See full diff in compare view

Updates golang.org/x/text from 0.37.0 to 0.38.0

Commits

f4bb632 go.mod: update golang.org/x dependencies
See full diff in compare view

Updates modernc.org/sqlite from 1.50.0 to 1.53.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

2026-06-21 v1.53.0:

Add experimental netbsd/amd64 support, resolving the long-standing build break in [GitLab issue #246](https://gitlab.com/cznic/sqlite/-/issues/246). This target is intentionally not yet listed among the supported platforms in the package documentation: the port had been broken for years and is only now revived, and there is as yet no real-world experience running it under production workloads. Green CI is not the same as battle-tested — so while the full test suite (including the pcache and vec packages and the -race concurrency test) passes on NetBSD 10.1 / Go 1.26.3, and the entire upstream toolchain (libc, cc, ccgo, libz, libtcl8.6, libsqlite3, libsqlite_vec) is green on the NetBSD CI builder, the target is offered for evaluation only. If you run NetBSD, please exercise it with your own workloads and report back via #246; the intent is to promote it to a fully supported platform after a period of broader real-world testing (on the order of a month) elapses without surprises.

Implementation notes: the previously shipped lib/sqlite_netbsd_amd64.go was a stale old-generator transpile that no longer compiled (the mu.enter/mu.leave break in #246); it is replaced by a fresh new-generator transpile consistent with every other platform, and modernc.org/sqlite/vec (sqlite-vec) is vendored and auto-registers on netbsd. Correct operation requires the matching pinned modernc.org/libc, which carries two NetBSD-specific fixes found during this work: the mmap(2) PAD-argument ABI (without it, concurrent WAL access faults with SIGBUS in the WAL-index shared memory) and a working abort(3) (the prior stub left SQLite's crash-recovery writecrash test unable to terminate by signal). As usual, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins.

See [GitLab merge request #82](https://gitlab.com/cznic/sqlite/-/merge_requests/82), thanks Leonardo Taccari (@iamleot) and Thomas Klausner (@wiz)!

Add experimental freebsd/386 and freebsd/arm support. As with the netbsd/amd64 target above, these two 32-bit FreeBSD ports are intentionally not yet listed among the supported platforms in the package documentation: freebsd/386 previously shipped a stale, effectively untested SQLite 3.41 transpile, and freebsd/arm is entirely new, so neither has real-world production mileage yet. Both are now freshly transpiled at SQLite 3.53.2 consistent with every other platform, build cleanly, and pass the full test suite (core, WAL/concurrency, and the vec package) on the FreeBSD CI builders; they are offered for evaluation only. If you run 32-bit FreeBSD, please exercise these targets with your own workloads and report back — the intent is to promote freebsd/386, freebsd/arm, and netbsd/amd64 to fully supported platforms in a future release cycle, once a period of broader real-world testing elapses without surprises.

Implementation notes: correct operation on freebsd/arm requires the matching pinned modernc.org/libc (v1.73.4), which fixes the per-arch mmap(2) off_t encoding for 32-bit FreeBSD; without it the WAL shared-memory mapping faults with SIGBUS under concurrent access, the same class of bug found on the netbsd port. As usual, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins.

See [GitLab merge request #119](https://gitlab.com/cznic/sqlite/-/merge_requests/119), thanks Olivier Cochard-Labbé (@ocochard)!

Add a Go-facing wrapper for SQLITE_CONFIG_PCACHE2. PageCache is the factory and Cache the per-database instance, both idiomatic Go interfaces; Page exposes the raw Buf and Extra pointers that SQLite reads through the C pcache contract. RegisterPageCache and MustRegisterPageCache install the module process-globally before the first sql.Open; subsequent Open calls are gated through a one-shot Xsqlite3_config(SQLITE_CONFIG_PCACHE2) so a too-late Register returns ErrPageCacheTooLate rather than silently falling through to the built-in pcache1. The binding owns the sqlite3_pcache_page stub and re-consults the implementation on every Fetch, reusing the stub only when the returned Page value is unchanged, which keeps a bounded/evicting purgeable cache safe by construction.

See [GitLab merge request #126](https://gitlab.com/cznic/sqlite/-/merge_requests/126), thanks Ian Chechin!

Add modernc.org/sqlite/pcache, the reference page-cache implementation that accompanies the #126 SQLITE_CONFIG_PCACHE2 wrapper. pcache.New returns a *Pool satisfying the PageCache interface; register it once with sqlite.MustRegisterPageCache(pcache.New()) and every connection opened afterwards draws its pages from it. Each Pool.Create mints a fresh per-database Cache: a bounded, LRU-evicting page store that honours the PRAGMA cache_size soft cap and releases the least-recently-unpinned page when it must make room. Page memory — the Buf and Extra buffers SQLite reads through — is allocated with libc.Xmalloc/libc.Xcalloc and therefore lives off the Go heap, which keeps SQLite's interior pointer arithmetic on the page extras from tripping the race detector's checkptr enforcement. Pool.Stats reports aggregate lifetime counters (hits, misses, allocs, evictions, rekeys, truncates, caches) across every cache a Pool has created, so hit/miss/eviction behaviour is observable without instrumenting individual caches. Cross-connection page sharing is out of scope for now; each Create returns an independent per-database cache.

Validated end-to-end against the #126 stress workload (cache_size=16, 4000 BLOB rows with DELETE and incremental_vacuum, integrity_check clean under -race) and benchmarked for the memory-utilization goal tracked in [GitLab issue #204](https://gitlab.com/cznic/sqlite/-/issues/204).

See [GitLab merge request #127](https://gitlab.com/cznic/sqlite/-/merge_requests/127), thanks Ian Chechin!

Tighten the modernc.org/sqlite/pcache reference implementation per cznic's !127 review follow-ups. Adds Stats.EasyRefusals, a per-Pool counter for the cases where FetchCreateEasy returns nil at cap; SQLite reacts to a refusal by spilling dirty pages and retrying with FetchCreateForce, so the new field is a direct proxy for the I/O pressure the strict Easy contract imposes vs pcache1's recycle-without-spill behavior. BenchmarkPoolEvictionChurn was reworked to drive a rotating-residue DELETE (k % 3 = i % 3) and re-insert a matching batch each cycle so the spill pressure recurs and easy-refusals/op scales with b.N instead of capping at the seed's one-time first-cycle cost; both existing benchmarks now report easy-refusals/op alongside the page-allocs/evictions metrics. Stats.Evictions documentation was tightened to match the actual behavior (counts LRU eviction, Unpin(discard=true), Shrink releases, and Unpin(discard=false) trimming back to target after a FetchCreateForce overcommit; bulk frees from Truncate, Rekey collisions, and Destroy are not counted). The TestPoolRoundTripIntegrity comment claiming the workload exercises xRekey ~15 times has been corrected; the SQL surface does not reliably emit xRekey here, and that codepath is covered by the unit tests instead.

See [GitLab merge request #130](https://gitlab.com/cznic/sqlite/-/merge_requests/130), thanks Ian Chechin!

Make modernc.org/sqlite/pcache -race-clean under SQLite's cache=shared mode. The pool already runs correctly under shared-cache because every callback into a given Cache is serialised internally by SQLite's sqlite3BtreeEnter on the BtShared mutex; verified empirically with a lock-free in-flight probe (max-in-flight = 1 on the canonical two-connection workload, 4 on a positive control with goroutines hitting the cache directly). However the Go race detector does not recognise SQLite's libc mutex as a happens-before edge and reports false-positive races on Fetch vs Unpin reads/writes of the per-cache state, which surfaces as DATA RACE failures for any user who registers the pool and runs their suite under -race. A sync.Mutex on the cache type is now taken on every public method (SetSize, PageCount, Fetch, Unpin, Rekey, Truncate, Destroy, Shrink), always. On the common non-shared-cache path the lock is uncontended (one atomic CAS per Lock/Unlock pair, negligible next to the SQLite work it bookends); on the shared-cache path it just rubber-stamps the order SQLite's BtShared mutex already established. A new e2e_test.go TestSharedCacheTwoConns_Integrity drives two sql.Conn against the same cache=shared URI with concurrent writers and asserts PRAGMA integrity_check = ok under -race; passes cleanly with the lock, would surface the false-positive without it. Design notes live in pcache/sharing.go.

See [GitLab merge request #131](https://gitlab.com/cznic/sqlite/-/merge_requests/131), thanks Ian Chechin!

Add a Go wrapper for sqlite3_db_status, the per-connection runtime counters (cache hit/miss/write/spill rates, schema and prepared-statement memory, lookaside usage, deferred foreign keys). DBStatus is an interface implemented by the driver connection and reached through the database/sql escape hatch (*sql.Conn).Raw(), mirroring the existing FileControl surface; DBStatusOp is a distinct typed enum of the SQLITE_DBSTATUS_* verbs so a counter from a different op family will not compile in its place. Status(op, reset) returns the (current, high) pair and optionally resets the counter. This also lets modernc.org/sqlite/pcache measure real I/O instead of the EasyRefusals proxy: the new BenchmarkPoolSpillIO reads the pager-level SQLITE_DBSTATUS_CACHE_SPILL/_CACHE_WRITE counters, which the pager maintains identically for pcache1 and the pool, making the pcache1-vs-pool comparison cznic raised on the !127 review a genuine apples-to-apples measurement. On the rotating-residue eviction-churn wor...
Description has been truncated

dependabot · 2026-06-15T13:28:22Z

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

…ry with 12 updates Bumps the go-minor-and-patch group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/JohannesKaufmann/html-to-markdown/v2](https://github.com/JohannesKaufmann/html-to-markdown) | `2.5.1` | `2.5.2` | | [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.2.5` | `5.3.0` | | [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.2` | `5.10.0` | | [github.com/mark3labs/mcp-go](https://github.com/mark3labs/mcp-go) | `0.52.0` | `0.55.0` | | [github.com/pb33f/libopenapi](https://github.com/pb33f/libopenapi) | `0.36.3` | `0.38.1` | | [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) | `9.19.0` | `9.21.0` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.51.0` | `0.53.0` | | [golang.org/x/image](https://github.com/golang/image) | `0.41.0` | `0.43.0` | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.50.0` | `1.53.0` | Updates `github.com/JohannesKaufmann/html-to-markdown/v2` from 2.5.1 to 2.5.2 - [Release notes](https://github.com/JohannesKaufmann/html-to-markdown/releases) - [Commits](JohannesKaufmann/html-to-markdown@v2.5.1...v2.5.2) Updates `github.com/go-chi/chi/v5` from 5.2.5 to 5.3.0 - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](go-chi/chi@v5.2.5...v5.3.0) Updates `github.com/jackc/pgx/v5` from 5.9.2 to 5.10.0 - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.9.2...v5.10.0) Updates `github.com/mark3labs/mcp-go` from 0.52.0 to 0.55.0 - [Release notes](https://github.com/mark3labs/mcp-go/releases) - [Commits](mark3labs/mcp-go@v0.52.0...v0.55.0) Updates `github.com/pb33f/libopenapi` from 0.36.3 to 0.38.1 - [Release notes](https://github.com/pb33f/libopenapi/releases) - [Commits](pb33f/libopenapi@v0.36.3...v0.38.1) Updates `github.com/redis/go-redis/v9` from 9.19.0 to 9.21.0 - [Release notes](https://github.com/redis/go-redis/releases) - [Changelog](https://github.com/redis/go-redis/blob/master/RELEASE-NOTES.md) - [Commits](redis/go-redis@v9.19.0...v9.21.0) Updates `go.yaml.in/yaml/v4` from 4.0.0-rc.4 to 4.0.0-rc.5 - [Commits](yaml/go-yaml@v4.0.0-rc.4...v4.0.0-rc.5) Updates `golang.org/x/crypto` from 0.51.0 to 0.53.0 - [Commits](golang/crypto@v0.51.0...v0.53.0) Updates `golang.org/x/image` from 0.41.0 to 0.43.0 - [Commits](golang/image@v0.41.0...v0.43.0) Updates `golang.org/x/term` from 0.43.0 to 0.44.0 - [Commits](golang/term@v0.43.0...v0.44.0) Updates `golang.org/x/text` from 0.37.0 to 0.38.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.37.0...v0.38.0) Updates `modernc.org/sqlite` from 1.50.0 to 1.53.0 - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.50.0...v1.53.0) --- updated-dependencies: - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: github.com/JohannesKaufmann/html-to-markdown/v2 dependency-version: 2.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-and-patch - dependency-name: github.com/mark3labs/mcp-go dependency-version: 0.54.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: github.com/pb33f/libopenapi dependency-version: 0.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: github.com/redis/go-redis/v9 dependency-version: 9.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: go.yaml.in/yaml/v4 dependency-version: 4.0.0-rc.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-and-patch - dependency-name: golang.org/x/crypto dependency-version: 0.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/image dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/term dependency-version: 0.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: golang.org/x/text dependency-version: 0.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch - dependency-name: modernc.org/sqlite dependency-version: 1.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-28T16:03:57Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot requested a review from xarmian as a code owner June 15, 2026 13:28

dependabot Bot force-pushed the dependabot/go_modules/go-minor-and-patch-a9dc9ead6e branch from 1e8036f to f65be16 Compare June 22, 2026 13:12

dependabot Bot closed this Jun 28, 2026

dependabot Bot deleted the dependabot/go_modules/go-minor-and-patch-a9dc9ead6e branch June 28, 2026 16:04

Navigation Menu

Uh oh!

chore(deps)(deps): bump the go-minor-and-patch group across 1 directory with 12 updates - #730

chore(deps)(deps): bump the go-minor-and-patch group across 1 directory with 12 updates#730
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-and-patch-a9dc9ead6e

dependabot Bot commented on behalf of github Jun 15, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 15, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.5.2

Changelog

v5.3.0

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

Why a new middleware (not "fix RealIP in place")

The new API

5.10.0 (June 3, 2026)

Features

Security Hardening

Fixes

Release v0.55.0

Release v0.54.1

Release v0.54.0

What's Changed

New Contributors

Release v0.53.0

What's Changed

New Contributors

v0.38.1

v0.38.0

v0.37.3

v0.37.2

v0.37.1

v0.37.0

v0.36.6

v0.36.5

v0.36.4

9.21.0

🚀 Highlights

Zero-copy GetToBuffer / SetFromBuffer

Explicit LIMIT 0 for stream trimming

✨ New Features

🐛 Bug Fixes

👥 Contributors

9.20.1

🚀 Highlights

RESP3 pub/sub message loss fixed

9.21.0 (2026-06-18)

🚀 Highlights

Zero-copy GetToBuffer / SetFromBuffer

Explicit LIMIT 0 for stream trimming

✨ New Features

🐛 Bug Fixes

👥 Contributors

9.20.1 (2026-06-11)

Changelog

Uh oh!

dependabot Bot commented on behalf of github Jun 15, 2026

Labels

Uh oh!

dependabot Bot commented on behalf of github Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 15, 2026 •

edited

Loading

Zero-copy `GetToBuffer` / `SetFromBuffer`

Explicit `LIMIT 0` for stream trimming

Zero-copy `GetToBuffer` / `SetFromBuffer`

Explicit `LIMIT 0` for stream trimming