chore(deps): bump the go-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the go-dependencies group with 2 updates in the /backend directory: github.com/danielgtaylor/huma/v2 and github.com/jackc/pgx/v5.

Updates github.com/danielgtaylor/huma/v2 from 2.38.0 to 2.39.1

Release notes

Sourced from github.com/danielgtaylor/huma/v2's releases.

v2.39.1

Overview

A patch release: correctness fixes for resolvers, validation, and response handling, plus a dependency refresh.

Response Status Visible to Middleware Again

WithContext context propagation in v2.39.0 copied the response status by value, so middleware that called WithContext and then read Status() after next() always saw 0 instead of the status the handler set, breaking access logging and telemetry. The status is now shared by every context copy across all adapters, restoring the pre-2.39 invariant while keeping context propagation intact. (#1081)

Resolvers & Defaults in Arrays and Maps

• Nested resolvers now run for fixed-size arrays ([2]Item), not just slices (#1076)
• A resolver on a named collection type (e.g. type Coords [2]float64) no longer panics, and is no longer conflated with a resolver on its element type, which previously ran the element's resolver twice and the collection's never (#1082)
• Values reached through a map are now written back after being walked, so applying a default no longer panics with reflect: reflect.Value.Set using unaddressable value and resolver mutations are no longer silently discarded (#1082)

Stricter email and uri Formats

Validation for two string formats is tighter, so payloads that previously passed may now return 422:

• email / idn-email accept an addr-spec only; full mailbox forms with a display name (Name <user@example.com>) are rejected
• uri / iri require an absolute URI with a non-empty scheme, while relative references remain valid under uri-reference / iri-reference (#1068)

Validation Robustness

• An unresolvable schema $ref during Validate now reports expected schema $ref to resolve: ... instead of panicking on a nil dereference, covering discriminators and map[string]any / map[any]any values (#1065)
• Named numeric slice parameters (e.g. type IDs []int64) are built with their declared element type and validated with item, length, and uniqueness constraints intact (#1074)

Other Fixes

• Resolver errors that wrap a HeadersError now contribute their headers to the response, matching the handler error path (#1070)
• A nil interface response body no longer panics in the schema link transformer (#1072)
• Dependencies updated (#1066)

What's Changed

• fix: do not panic on unresolved schema $ref during Validate by @​baiyuxi930826 in danielgtaylor/huma#1065
• chore: update dependencies by @​wolveix in danielgtaylor/huma#1066
• fix: tighten format email and uri validation by @​baiyuxi930826 in danielgtaylor/huma#1068
• fix: preserve wrapped resolver error metadata by @​ggmolly in danielgtaylor/huma#1070
• fix: handle nil interface response bodies by @​ggmolly in danielgtaylor/huma#1072
• fix: parse named numeric slice parameters by @​ggmolly in danielgtaylor/huma#1074
• fix: share response status across WithContext copies by @​wolveix in danielgtaylor/huma#1081
• fix: run nested resolvers in fixed arrays by @​ggmolly in danielgtaylor/huma#1076
• fix: distinguish collection and element matches when walking input by @​wolveix in danielgtaylor/huma#1082

New Contributors

• @​baiyuxi930826 made their first contribution in danielgtaylor/huma#1065
• @​ggmolly made their first contribution in danielgtaylor/huma#1070

Full Changelog: danielgtaylor/huma@v2.39.0...v2.39.1

... (truncated)

Commits

• 198225e fix: distinguish collection and element matches when walking input (#1082)
• 5961f0a fix: run nested resolvers in fixed arrays (#1076)
• 85aad8f fix: share response status across WithContext copies (#1081)
• 22a3cb0 fix: parse named numeric slice parameters (#1074)
• ac9959c fix: handle nil interface response bodies (#1072)
• b659c74 fix: preserve wrapped resolver error metadata (#1070)
• 14aea2f fix: tighten format email and uri validation (#1068)
• bba0d54 chore: update dependencies (#1066)
• e114668 fix: do not panic on unresolved schema $ref during Validate (#1065)
• d6f2a37 feat(form-data): handle unmarshalling and validation of non-file JSON form da...
• Additional commits viewable in compare view

Updates github.com/gofiber/fiber/v3 from 3.2.0 to 3.4.0

Release notes

Sourced from github.com/gofiber/fiber/v3's releases.

v3.4.0

🚀 New

• Complete HTTP QUERY method support (#4436, #4456) Adds the HTTP QUERY method (RFC 10008): fiber.MethodQuery, app.Query() routing, safe/idempotent handling in csrf, idempotency, earlydata and cache, plus client.Query() shorthands.

  app.Query("/search", func(c fiber.Ctx) error {
      return c.Send(c.Body()) // QUERY carries the query expression in the body
  })

  https://docs.gofiber.io/client/rest#query
• Add WithContext variants for session storage I/O (#4393) SaveWithContext, DestroyWithContext, RegenerateWithContext and ResetWithContext propagate deadlines/cancellation to the session storage backend; the plain methods keep working unchanged.

  sess := session.FromContext(c)
  err := sess.SaveWithContext(ctx) // storage write bounded by ctx

  https://docs.gofiber.io/middleware/session#session-with-context-timeoutscancellation
• Unify internal and custom constraints into a single interface (#4397) Built-in and custom route constraints now share one ConstraintHandler interface; the optional ConstraintAnalyzer precomputes constraint data at route registration, removing per-request parsing. Existing CustomConstraint implementations keep working unchanged.

  app.RegisterCustomConstraint(evenConstraint{}) // implements Name() + Execute()
  app.Get("/items/:id<even>", handler)

  https://docs.gofiber.io/guide/routing#constrainthandler-interface
• Expose prefork RecoverInterval and ShutdownGracePeriod (#4491) New ListenConfig knobs: PreforkRecoverInterval delays respawning a crashed child (default 0) and PreforkShutdownGracePeriod sets how long the master waits after SIGTERM before SIGKILL (default 5s).

  app.Listen(":3000", fiber.ListenConfig{
      EnablePrefork:              true,
      PreforkRecoverInterval:     time.Second,
      PreforkShutdownGracePeriod: 10 * time.Second,
  })

  https://docs.gofiber.io/api/fiber#preforkrecoverinterval

🧹 Updates

• Reduce avoidable work in the request hot path (#4490)
• Avoid per-request heap allocation in DefaultErrorHandler (#4446)
• Use sentinel errors on typed-getter and Range parse failures (#4448)
• Replace appendLowerBytes with utilsbytes.UnsafeToLower (#4468)
• Add MIMETextEventStream constant (#4415)
• Cache binder decoder type metadata across requests (#4447)
• Eliminate double reflection in binder mergeStruct (-10% allocs) (#4385)
• Reduce binder data map allocations (#4379)
• cache: Append canonical key segments into the pooled buffer (#4450)
• cors: Optimize subdomain origin matching (#4482)
• cors: Optimize exact-origin lookup to O(1) (#4368)
• csrf/redirect: Share scheme/host matching and skip url.Parse on the hot path (#4449)

... (truncated)

Commits

• e88e762 test(listen): add connection handling for shutdown timeout edge case
• 96b30bd chore: bump version to v3.4.0
• cdf4d24 Merge pull request #4491 from gofiber/claude/prefork-knobs-2199
• 83ad285 Merge pull request #4490 from gofiber/perf/hot-path-micro-optimizations
• b6a9545 feat(listen): expose prefork RecoverInterval and ShutdownGracePeriod
• dac0998 perf(router): eliminate bounds checks in route matching hot loops
• ef3bbef perf(ctx): keep Route within the inlining budget
• b1a54ac perf(app): skip mounted error-handler lookup when no sub-apps exist
• 05919e5 Merge pull request #4488 from 0xghost42/fix/fresh-if-modified-since-only
• e618f63 perf(ctx): skip second date parse when If-Modified-Since echoes Last-Modified
• Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.7.6 to 5.10.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.10.0 (June 3, 2026)

This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers, contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are sent over TLS when the original connection used TLS.

Features

• Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
• Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
• Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
• Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
• pgxpool: check if connection is expired before acquire (arthurdotwork)

Security Hardening

• Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
• Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
• Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
• Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
• Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
• Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
• Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
• Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
• Fix panic on malformed geometric text; return an error instead (MaIII)

Fixes

• Fix scanning "char" (OID 18) into *string in binary format (luongs3)
• Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
• Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
• Fix data race when context is cancelled during connect
• Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
• pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
• pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
• pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
• Add missing error check of rows.Err to load types (Jen Altavilla)

5.9.2 (April 18, 2026)

Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)

SQL injection can occur when:

1. The non-default simple protocol is used.
2. A dollar quoted string literal is used in the SQL query.
3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
4. The value of that placeholder is controllable by the attacker.

... (truncated)

Commits

• 7293fb1 Update changelog for v5.10.0
• 1ade285 pgconn: document secure connection configuration
• b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
• 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
• b28e65b pgtype: bound array element count against remaining message bytes
• cd1f389 pgtype: bound array binary decode element length against remaining bytes
• ff27b5b pgtype: bound hstore binary decode against malicious server input
• a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
• 44f6173 pgconn: cap server-supplied SCRAM iteration count
• 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
• Additional commits viewable in compare view

[netlify]

✅ Deploy Preview for generate-appportal canceled.

Name	Link
🔨 Latest commit	8131ada
🔍 Latest deploy log	https://app.netlify.com/projects/generate-appportal/deploys/6a6e542f1f781200080869a7