[dependabot]

Bumps the gomod group with 4 updates in the / directory: connectrpc.com/connect, github.com/codefly-dev/core, github.com/jackc/pgx/v5 and google.golang.org/grpc.

Updates connectrpc.com/connect from 1.21.0 to 1.21.1

Release notes

Sourced from connectrpc.com/connect's releases.

v1.21.1

What's Changed

Bugfixes

• Stop draining gRPC response body after rejecting a message by @​stefanvanburen in connectrpc/connect-go#1005
• Keep sending unary request bodies after an early response by @​stefanvanburen in connectrpc/connect-go#1008
• Report truncated envelopes as internal errors by @​stefanvanburen in connectrpc/connect-go#1015
• Fix removing all compressors on unary Connect clients by @​emcfarlane in connectrpc/connect-go#1016
• Reject a negative Connect-Timeout-Ms instead of expiring the context by @​emcfarlane in connectrpc/connect-go#1017
• Set Connect-Timeout-Ms when less than a millisecond remains by @​emcfarlane in connectrpc/connect-go#1018
• Improve http2 client disconnect error handling by @​emcfarlane in connectrpc/connect-go#1019
• Return the end-stream error when the body read fails after it by @​stepan-romankov in connectrpc/connect-go#1014
• Guard against typed nil *connect.Error by @​emcfarlane in connectrpc/connect-go#1020
• Enforce read max limit on unary errors by @​emcfarlane in connectrpc/connect-go#1022
• Send a minimal end of stream when over WithSendMaxBytes by @​emcfarlane in connectrpc/connect-go#1023

Full Changelog: connectrpc/connect-go@v1.21.0...v1.21.1

Commits

• c4ad2c4 Prepare for v1.21.1 (#1027)
• ac6e6ed Send a minimal end of stream when over WithSendMaxBytes (#1023)
• a58596c Enforce read max limit on unary errors (#1022)
• b88c4f7 Workaround TestClientDeadlineHandling test failure flakes (#1021)
• abe4c95 Guard against typed nil *connect.Error (#1020)
• 6a8459c Return the end-stream error when the body read fails after it (#1014)
• 128a9d9 Improve http2 client disconnect error handling (#1019)
• 108190c Set Connect-Timeout-Ms when less than a millisecond remains (#1018)
• 4bf13bc Reject a negative Connect-Timeout-Ms instead of expiring the context (#1017)
• 8b11d3f Fix removing all compressors on unary Connect clients (#1016)
• Additional commits viewable in compare view

Updates github.com/codefly-dev/core from 0.19.6-0.20261018051341-b81d92e6feda to 0.19.18

Release notes

Sourced from github.com/codefly-dev/core's releases.

v0.19.18

CLI-agent compatibility

Protocol version: 1 (independent of the Core module version). Startup protocol version: 2. Server capabilities: container-recovery-scope/v1.

Contract unchanged from v0.19.17. No agent rebuild is required solely for this Core bump.

Host-supported operation contracts: artifact-execution/v1, base-image-bindings/v1, codefly.dev/docker-build-recipe/v4, codefly.dev/docker-build-recipe/v5, codefly.dev/docker-build-recipe/v6, configuration-value-template/v1, deployment-composition-provenance/v1, runtime-backend-declaration/v1, runtime-init-dependency-mappings/v1, runtime-init-image/v1, runtime-started-artifact/v1. This is not an executor advertisement. Selected executors must implement and advertise the required operation contract before dispatch.

The CLI selects required capabilities for each operation. A matching protocol does not replace capability checks or this run's recovery-scope acknowledgement.

v0.19.17

CLI-agent compatibility

Protocol version: 1 (independent of the Core module version). Startup protocol version: 2. Server capabilities: container-recovery-scope/v1.

Contract unchanged from v0.19.16. No agent rebuild is required solely for this Core bump.

Host-supported operation contracts: artifact-execution/v1, codefly.dev/docker-build-recipe/v4, codefly.dev/docker-build-recipe/v5, codefly.dev/docker-build-recipe/v6, configuration-value-template/v1, deployment-composition-provenance/v1, runtime-backend-declaration/v1, runtime-init-dependency-mappings/v1, runtime-init-image/v1, runtime-started-artifact/v1. This is not an executor advertisement. Selected executors must implement and advertise the required operation contract before dispatch.

The CLI selects required capabilities for each operation. A matching protocol does not replace capability checks or this run's recovery-scope acknowledgement.

v0.19.16

CLI-agent compatibility

Protocol version: 1 (independent of the Core module version). Startup protocol version: 2. Server capabilities: container-recovery-scope/v1.

Contract unchanged from v0.19.15. No agent rebuild is required solely for this Core bump.

Host-supported operation contracts: artifact-execution/v1, codefly.dev/docker-build-recipe/v4, codefly.dev/docker-build-recipe/v5, codefly.dev/docker-build-recipe/v6, configuration-value-template/v1, deployment-composition-provenance/v1, runtime-backend-declaration/v1, runtime-init-dependency-mappings/v1, runtime-init-image/v1, runtime-started-artifact/v1. This is not an executor advertisement. Selected executors must implement and advertise the required operation contract before dispatch.

The CLI selects required capabilities for each operation. A matching protocol does not replace capability checks or this run's recovery-scope acknowledgement.

v0.19.15

CLI-agent compatibility

Protocol version: 1 (independent of the Core module version). Startup protocol version: 2. Server capabilities: container-recovery-scope/v1.

Contract unchanged from v0.19.14. No agent rebuild is required solely for this Core bump.

... (truncated)

Commits

• See full diff in compare view

Updates github.com/jackc/pgx/v5 from 5.10.0 to 5.12.0

Release notes

Sourced from github.com/jackc/pgx/v5's releases.

v5.11.0

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

• stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.
• Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.
• pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)
• pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)
• pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

• Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

• pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

• pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

  • timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.
  • timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.
  • Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.
  • time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.
  • Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

  Behavior changes:

  • date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.
  • All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range

... (truncated)

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

• SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@​igor-kupczynski).
• Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @​president-xd.

Features

• Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)
• Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)
• pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)
• pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

• pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.
• pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

Commits

• b2ef08b Update changelog for v5.12.0
• 8199015 Merge commit from fork
• 5b1a6a0 Merge commit from fork
• 65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
• f2701a0 pgconn: only fall back when Windows service file is missing
• db95468 Merge pull request #2696 from k-zshiba/support-oid8
• fa2327d Start each query on a new line when joining a simple protocol batch
• 2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
• efc0b74 Merge upstream master into support-oid8
• 5a17450 pgconn: require AuthenticationOk before ReadyForQuery
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

• stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • Special Thanks: @​aryansk
• metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
  • Special Thanks: @​yuyangguo42

Bug Fixes

• transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
• server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • Special Thanks: @​stanhu
• server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
• server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
• xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • Special Thanks: @​winklemad
• client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • Special Thanks: @​nvxbug
• transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
  • Special Thanks: @​buger

Commits

• c9ab42c Change version to 1.85.0 (#9434)
• bfb7561 cherry pick (#9433) and (#9563) (#9566)
• 46a2db2 *: update dockerfiles to build using go1.26 to match go.mod (#9548)
• 076bb1c Cherrypick #9533 to v1.85.x. (#9534)
• baaf083 *: update the net package and go version (#9506)
• 678b9b3 Cherrypick #9385 to v1.85.x (#9504)
• 705f9b9 Cherry-pick #9425 into v1.85.x (#9438)
• 1648161 transport: stop read throttling due to controlBuf size, on the client (#9431)
• 1863b59 protoc-gen-go-grpc: Update supported Edition to 2026 (#9426)
• d331f11 server: release mutex while waiting for handlers in stop() (#9394)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions