Skip to content

fix(deps): bump the go-deps group across 1 directory with 6 updates - #235

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/go_modules/develop/go-deps-a94210fb2e
Open

fix(deps): bump the go-deps group across 1 directory with 6 updates#235
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/go_modules/develop/go-deps-a94210fb2e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-deps group with 6 updates in the / directory:

Package From To
github.com/klauspost/compress 1.18.2 1.20.0
github.com/pelletier/go-toml/v2 2.3.0 2.4.3
github.com/sourcegraph/go-diff 0.7.0 0.9.0
golang.org/x/crypto 0.55.0 0.57.0
golang.org/x/sys 0.47.0 0.48.0
modernc.org/sqlite 1.48.0 1.58.0

Updates github.com/klauspost/compress from 1.18.2 to 1.20.0

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.20.0

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.19.2...v1.20.0

v1.19.2

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.19.1...v1.19.2

v1.19.1

What's Changed

New Contributors

Full Changelog: klauspost/compress@v1.19.0...v1.19.1

v1.19.0

... (truncated)

Commits
  • 9d8ccb1 flate: Writer with a preset dictionary emits the dictionary into the output s...
  • f93f23a build(deps): bump the github-actions group with 6 updates (#1200)
  • 42f9d96 xpress: add Microsoft XPRESS (MS-XCA) decompression (#1195)
  • 629c2ea zstd/huff0: break false partial-register dependencies in seqdec/4X decoders (...
  • ba74977 ci: test against go1.27.x, drop go1.24.x (#1198)
  • f5c1529 zstd/huff0: pin avo peephole folds, regenerate arm64 (#1199)
  • 73508b2 s2: arm64 assembly encoders, lowered from the amd64 avo program (#1187)
  • 0e43f04 xxhash: bound input of non-preemptive assembly (#1196)
  • 4005c15 s2: clamp the Go EncodeBetter skip to match the assembly (#1190)
  • dd6de45 gzhttp: limit jitter hash to jitterBuffer bytes (#1192)
  • Additional commits viewable in compare view

Updates github.com/pelletier/go-toml/v2 from 2.3.0 to 2.4.3

Release notes

Sourced from github.com/pelletier/go-toml/v2's releases.

v2.4.3

What's Changed

What's new

Fixed bugs

Documentation

Other changes

New Contributors

Full Changelog: pelletier/go-toml@v2.4.2...v2.4.3

v2.4.2

What's Changed

Fixed bugs

Full Changelog: pelletier/go-toml@v2.4.1...v2.4.2

v2.4.1

What's Changed

Fixed bugs

Full Changelog: pelletier/go-toml@v2.4.0...v2.4.1

v2.4.0

What's Changed

What's new

... (truncated)

Commits
  • 071a36c fix: bound array and inline table nesting depth to prevent stack-overflow DoS...
  • 57fec25 Add RawMessage marshal support to unstable (#1084)
  • 79f82e3 fix: error instead of panic on nil unexported embedded pointer (#1089)
  • a28afed unstable/kind: drop duplicate 'a' from LocalDate comment (#1062)
  • 6fa69af fix: do not recurse forever on recursively embedded structs (#1087)
  • 82b792e fix: report table placement errors with position and key context (#1086)
  • f93de50 perf: avoid interface boxing when decoding date/time values (#1085)
  • 21f8286 Deliver the whole document to a root Unmarshaler (#994) (#1083)
  • 98e94ae Update bundled toml.abnf to TOML 1.1.0 and pin spec-corner behaviour (#1082)
  • 35f78d5 Fix invalid TOML from commented multi-line values (#1081)
  • Additional commits viewable in compare view

Updates github.com/sourcegraph/go-diff from 0.7.0 to 0.9.0

Release notes

Sourced from github.com/sourcegraph/go-diff's releases.

v0.9.0

What's Changed

New Contributors

Full Changelog: sourcegraph/go-diff@v0.8.0...v0.9.0

v0.8.0

What's Changed

Full Changelog: sourcegraph/go-diff@v0.7.0...v0.8.0

Commits
  • cf64c62 refactor/diff: centralize Git extended-header structure (#96)
  • ae9e610 test/reverse: pin reversal semantics to Git patches (#95)
  • 688abd0 fix/reverse: align Git headers with reverse direction (#94)
  • 3aa67b9 fix/reverse: make unsupported copies detectable (#93)
  • 5b49902 Add SCIP code intelligence upload workflow (#89)
  • f8dfc9c fix/reverse: reverse Git extended headers consistently (#92)
  • c69bfd5 Fix panic on short "diff --git" args (#90)
  • 654d317 bump minimum go 1.14 -> 1.20
  • a839d2c Add new functionaltiy for reversing diffs. (#72)
  • 3751ac7 add go test github workflow (#79)
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.55.0 to 0.57.0

Commits
  • 3f62bf1 go.mod: update golang.org/x dependencies
  • 86efde5 ssh: reject unexpected message types on established channels
  • a6cdac6 ssh: drop traffic on undecided channels
  • 39dc44e ssh: don't skip the source-address critical option in CheckCert
  • afebf4c x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+
  • 89f4e9b x509roots/fallback: update bundle
  • 71488c4 ssh/knownhosts: compare only public key portions for revocation
  • 82adefa ssh: synchronize unexpected response test
  • c757c98 all: upgrade go directive to at least 1.26.0 [generated]
  • 593c81a ssh: correctly ignore pre-banner lines
  • Additional commits viewable in compare view

Updates golang.org/x/sys from 0.47.0 to 0.48.0

Commits
  • 613e257 cpu: add riscv64 hwprobe drift test
  • 6f7b10f unix: add MLOCK_ONFAULT constant
  • 663e7c8 cpu: add basic support for GOARCH=sparc64
  • de5f12f cpu: add ppc64le POWER10 detection
  • 80e8acf unix: run go fix
  • 1e3c182 unix: add IPMI interface
  • d429e20 unix: stop generating sparc termbits from the generic header
  • bd3bddf unix: add missing HWTSTAMP_* constants
  • e812f53 windows: add SO_SNDTIMEO constant for socket options
  • f6989c5 unix: align Ifreq so its union accessors cannot fault
  • Additional commits viewable in compare view

Updates modernc.org/sqlite from 1.48.0 to 1.58.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

  • 2026-09-15 v1.59.1:

    • Documentation only: the Driver.Open docstring now covers SQLite's own URI query parameters, mode, cache, immutable, nolock, psow and modeof, which it never mentioned because it listed only the keys the driver interprets itself. The driver opens every connection with SQLITE_OPEN_URI, so in a DSN that starts with file: SQLite applies them and they have always worked; file:/path/to.db?mode=ro opens the database read-only. The docstring also spells out what the two DSN forms do with the query: a plain file name has it stripped before SQLite sees the name, matching github.com/mattn/go-sqlite3, so /path/to.db?mode=ro silently opens read-write and creates a missing file, a trap reported before in [GitLab issue #48](https://gitlab.com/cznic/sqlite/-/issues/48) and [GitLab issue #110](https://gitlab.com/cznic/sqlite/-/issues/110). It contrasts mode=ro with _query_only=1 and notes that a driver key which has to write the database, such as _journal_mode=WAL on a database not yet in WAL mode, fails the open of a mode=ro connection with SQLITE_READONLY. The package documentation's connecting example now points at Driver.Open for the DSN format.
    • Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257).

  • 2026-09-15 v1.59.0:

    • Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/ from modernc.org/libsqlite3 v1.14.5 and modernc.org/libsqlite_vec v0.5.0, which were transpiled against it. As always, downstream go.mod files must pin the same modernc.org/libc version as this repository's go.mod; see the package documentation and [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177). The transpiled SQLite is unchanged: still 3.53.4, byte-identical to v1.58.0 on all 20 targets. The change is beneath it. On the Linux targets libc v1.75.7 replaces the transpiled musl memcpy, memmove, memset, memcmp, strcspn and fabs, loops moving at most four bytes per step, with native Go routines backed by the runtime's vectorized memmove and memclr and by the bytes package; on every target strlen is now a word-at-a-time scan, or bytes.IndexByte on the 64-bit architectures. On the three CPU-bound workloads in the new Performance section of the package documentation, measured on linux/amd64 against the same SQLite 3.53.4 compiled from C with the same options, this driver went from 3.0x, 2.2x and 1.6x the CPU time of the C build to 2.0x, 1.9x and 1.3x. The other operating systems already used a native Go memcpy and memmove and see no such change. vec/ stays at sqlite-vec v0.1.9; its re-vendor, from a transpile made with newer modernc.org/cc and modernc.org/ccgo, differs only in unreferenced macro constants and in one bounds check spelled with INT8_MAX instead of its value, so nothing changes in behavior there either.
    • Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call. After the []driver.Value pooling of #226 this was the last driver-side heap allocation per invocation: one 16-byte object for every Scalar, Step, WindowInverse, WindowValue and Final call. The context now also carries the invocation's sqlite3_context, so accessor methods can be added to it later without touching the trampolines. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return; the documentation on FunctionContext and on the callbacks now says so. On the 1000-row, 3-argument noop scalar UDF benchmark this removes a further 1000 allocs/op (5756 to 4756, and 3756 to 2756 with VolatileArgs) and 16 KB/op; on the reporter's reproducer from #226 it removes about 12% of the remaining allocations (25.3M to 22.4M allocs/op, 553 MB to 505 MB per iteration).
    • Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).
    • Add regression tests for the pooled context: two functions evaluated in one statement must receive two different sqlite3_context values and every callback's context must belong to the invoking connection, checked on two connections held at once and without dereferencing the context, so that a stale one is reported rather than faulted on; eight connections held at once calling a function from their own goroutines, and a function that runs a statement invoking another function, both meant for the race detector. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!
    • Add a Performance section to the package documentation. It records the measured CPU-time ratios of this driver against the same SQLite compiled from C, that they hold under concurrency, where the gap comes from, and the two consequences for applications: index the columns that ORDER BY, GROUP BY and WHERE use, because a query that is merely sluggish in C can cross a deadline here, and bound the database/sql pool with SetMaxOpenConns, because a periodic query that outlasts its period piles up connections without bound. Prompted by a report that attributed a 103 s query to the driver spilling a temporary b-tree in Go; the workload showed no spill and about 2x the CPU cost of C, the wall time being unbounded overlap of periodic polls.

  • 2026-09-01 v1.58.0:

    • Upgrade to SQLite 3.53.4. Upstream's own fix for the journal-rollback data-corruption bug is part of this release, so the local super-journal patch v1.56.0 introduced — and promised to drop once upstream shipped theirs — is dropped; recovery behavior is unchanged. This also bumps the pinned modernc.org/libc to v1.75.6; as always, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins (see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177)).
    • Add opt-in support for Linux Open File Description (OFD) locks on database files. A POSIX record lock is owned by the (process, inode) pair, so the kernel drops every lock the process holds on a database file whenever any descriptor of that file is closed: an os.Open/Close for a hash, a backup check or a metadata probe anywhere in the process — third-party libraries included — silently strips SQLite's transaction locks and leaves the file unprotected against other processes. With OFD locking enabled, the locks belong to the open file description that placed them and survive such a close. Off by default, and staying off until the mode has real-world mileage: without opting in, locking behavior is byte-for-byte that of previous releases. Enable it by setting MODERNC_SQLITE_OFD_LOCK=1 in the environment the process starts with (any value but the empty string or one starting with 0; read once, at library initialization), or from Go with the new OFDLocking(true), which overrides the variable and must run before the first connection is opened; OFDLockingEnabled reports the mode in effect. The switch is deliberately process-wide rather than a DSN parameter: POSIX and OFD locks taken by one process are different owners to the kernel and genuinely conflict, so every connection to a database file inside one process must use the same kind, and a per-DSN knob would advertise a granularity the kernel does not offer (see the discussion in #255). Because the two kinds do not release one another, the mode is frozen at the process's first lock attempt: later attempts to change it return the new ErrOFDLockingTooLate, while querying, and setting the value already in effect, keep working. On kernels older than 3.15, and on filesystems that reject OFD locks, the first lock attempt falls back to POSIX locks for good and OFDLocking returns the new ErrOFDLockingUnavailable from then on, which is also how OFDLockingEnabled turning false reports the fallback; the same error is returned on every platform but Linux, where the API exists but OFD locks do not. Two boundaries to note: the immunity covers the locks on the database file itself, while WAL's -shm coordination stays on POSIX locks; and code in the same process that takes fcntl record locks of its own on a database file — which used to never conflict with SQLite's, while quietly destroying them — now conflicts with them loudly instead. The C side — F_OFD_SETLK routing through a designated per-inode locking descriptor that preserves upstream's unixInodeInfo semantics (last-unlocker release, PENDING piggybacking, unix-excl), guarded to __linux__ — ships in the transpiled sources via libsqlite3!3 and its follow-up hardening, with the OFD lock constants from libc!33; the review rounds, the /proc/locks measurements behind the design, and the Tcl lock/WAL gate that runs both modes are recorded in [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255) and those merge requests.
    • Add the accompanying regression tests. The four OFD scenarios contributed in merge request #136 — lock survival across a rogue os.Close, the interleaved-readers lock lifecycle, the read-only-first designated-descriptor migration, and the failed-first-lock cleanup — run in a re-executed child process with MODERNC_SQLITE_OFD_LOCK=1, since the mode is process-wide and frozen at the first lock so the suite's own process cannot switch; a positive control asserts the variable really switched the mode on before each scenario runs, and the two scenarios whose invariants hold under both modes also run in the parent process's inherited mode. TestOFDLockingSetter exercises the Go call path end to end in a clean child — off by default, enabled before the first connection, the kernel-visible OFDLCK record in /proc/locks as the positive control, frozen after the first lock — and on every other platform the switch is asserted to report itself unavailable.
    • Resolves [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255). See [GitLab merge request #136](https://gitlab.com/cznic/sqlite/-/merge_requests/136), thanks Nathan Herring (@​technosloth), and thanks Gani Georgiev (@​ganigeorgiev) for pressing the opt-in default!

  • 2026-08-19 v1.57.0:

    • Add an opt-in _defensive DSN query parameter that turns on SQLite's defensive mode for the connection, disabling the SQL-level features that let ordinary statements deliberately corrupt the database file. When _defensive=1 (or any strconv.ParseBool true value) is supplied, the driver calls sqlite3_db_config with SQLITE_DBCONFIG_DEFENSIVE immediately after sqlite3_open_v2 and before every other parameter is applied, so the PRAGMAs the driver itself runs, the _pragma list, and every statement the caller prepares are all subject to it. On such a connection PRAGMA writable_schema=ON, PRAGMA journal_mode=OFF and PRAGMA schema_version=N become silent no-ops, and writes to a virtual table's shadow tables (fts5's _data, _idx and so on) and to sqlite_dbpage fail with "table ... may not be modified"; reading those tables, ordinary use of the virtual tables that own them, and VACUUM are unaffected. The flag has no PRAGMA equivalent, so sqlite3_db_config — and therefore a DSN parameter — is the only way to reach it short of dropping to modernc.org/sqlite/lib. The value is parsed before sqlite3_open_v2, so an invalid one fails the connection without creating the database file, and the parameter must appear at most once: a repeated _defensive is an error rather than letting the first value silently win. Absence of the parameter, or _defensive=0, leaves SQLite's default behavior unchanged; existing DSNs continue to work byte-for-byte. Two limits are worth stating plainly, since the name invites more confidence than the flag earns. Defensive mode is a hardening measure, not a sandbox for hostile database files: it is one of several steps SQLite recommends for that purpose, and this build compiles with neither SQLITE_TRUSTED_SCHEMA=0 nor SQLITE_DQS=0 and exposes no authorizer. And it is a property of the connection, not of the database file — a second handle opened on the same file without the parameter is unrestricted.
    • Reject the one DSN combination defensive mode would otherwise swallow in silence. _defensive=1 together with _journal_mode=OFF (or _journal=OFF) now fails the connection instead of opening one in which neither parameter was honoured: SQLite turns PRAGMA journal_mode=OFF into a no-op that still reports success, so the driver would have accepted the mode, executed it, and left the journal untouched without telling anyone. The check runs in the validation phase introduced in v1.55.0, before any statement executes, so a rejected DSN cannot leave the database half-configured. _pragma remains the exception it has always been: _pragma=journal_mode(OFF) alongside _defensive=1 still runs and is still silently ignored by SQLite. Only DSNs using _defensive can be affected, and that parameter is new, so no DSN that opened before changes behavior.
    • See [GitHub pull request #6](modernc-org/sqlite#6), thanks wsman!
    • Ship the sqlite-vec license notice this module has been missing. modernc.org/sqlite/vec has bundled the transpiled sqlite-vec sources since v1.47.0, but the module carried only its own BSD-3-Clause LICENSE and the public-domain SQLite notice. sqlite-vec is Copyright (c) 2024 Alex Garcia, dual-licensed Apache-2.0 OR MIT and used here under MIT, whose terms require the copyright and permission notice to accompany substantial portions of the software — which 2.8 MB of transpiled vec/ plainly is. The notice now ships as LICENSE-SQLITE_VEC in the module root, byte-identical to the LICENSE-MIT in the upstream v0.1.9 archive and named after the file modernc.org/libsqlite_vec extracts it into. Attribution was never absent — vec's package documentation has named the extension, pinned the version and linked upstream — but the license text itself was, and the omission was ours: vendor_libs/main.go copied the per-target transpiles and nothing else. It now copies the notice alongside them and fails the vendoring run if it cannot, so a make vendor can no longer quietly drop it. The vec package documentation gained a License section recording that the package is under a different license from the rest of this module.
    • The SQLite notice is renamed from SQLITE-LICENSE to LICENSE-SQLITE; update any direct links to it. Its contents are unchanged and SQLite remains public domain. The name now matches both the new LICENSE-SQLITE_VEC beside it and the LICENSE-<upstream> convention every other modernc.org repository follows, but it is more than cosmetic: go mod vendor selects the files it copies into a downstream vendor/ tree by matching each name against a fixed list of prefixes — LICENSE among them — so a name merely ending in LICENSE was never propagated. Both bundled notices now travel with the code into vendored builds, which is where the MIT terms on vec/ keep applying. No code changes; no behavior changes.
    • Let a caller-constructed Driver register its own functions, collations and virtual table modules. Driver has always held four categories of registration state, but only RegisterConnectionHook could put anything on a constructed one: functions and collations were reachable through the package-level API alone, and modules through the package-level driver only, which left the modules field written and read through that instance and so process-global state wearing a per-instance field. Driver now has RegisterFunction, RegisterScalarFunction, RegisterDeterministicScalarFunction, RegisterCollationUtf8 and RegisterModule, plus Must* variants of the first four, each registering on that Driver alone; the methods are safe to call concurrently, and the zero Driver is ready to use as-is. vtab.RegisterModule also honours its db argument now: a non-nil db registers on the driver backing it when that driver implements the new vtab.ModuleRegisterer, while a nil db keeps targeting the driver this package registers as sqlite. One existing pattern changes behavior, narrowly and loudly: vtab.RegisterModule(db, ...) where db was opened on a caller-constructed Driver used to discard the db argument and land on the sqlite driver, reaching every connection in the process; it now lands on the constructed driver alone, so a sql.Open("sqlite") connection that used to resolve such a module gets no such module instead. The same pattern is also the one way an existing program could hold one module name on both a constructed Driver and the package-level one: there the first of the two registrations used to win and the second was refused as already registered, whereas now the package-level implementation wins on the constructed Driver's connections regardless of the order they ran in. Reaching that case at all means the program ignored an error the older version returned. Two smaller deviations round out the list: Driver.RegisterModule reports no error for such a collision, and vtab.RegisterModule now validates its name and module arguments before the not-implemented check, so a call with an empty name that returned vtab: RegisterModule not wired into engine outside this driver returns vtab: module name must be non-empty instead. Everything else is additive against v1.56.0: the package-level registration functions target the same driver they always did, connections still receive every module registered through the package-level path whichever Driver opened them, and a db opened on the sqlite driver resolves to that same driver. The isolating change discussed in [GitLab issue #254](https://gitlab.com/cznic/sqlite/-/issues/254) is deliberately not made here.
    • See [GitLab merge request #135](https://gitlab.com/cznic/sqlite/-/merge_requests/135), thanks Ian Chechin!
    • Promote freebsd/386, freebsd/arm and netbsd/amd64 to fully supported platforms. All three are now listed in the package documentation's platform table, which had carried seventeen entries while this module shipped, cross-built and tested twenty. They arrived as experimental in v1.53.0 — netbsd/amd64 reviving a port that had been broken for years, freebsd/386 replacing a stale, effectively untested SQLite 3.41 transpile, and freebsd/arm entirely new — and were deliberately kept out of that table until they had accumulated real-world exposure, with promotion promised once "a period of broader real-world testing … elapses without surprises". That period has elapsed: all three have been in the builder test matrix and in make build_all_targets since v1.53.0, all three pass the full test suite on this release's commit alongside the seventeen platforms already listed, and no open issue reports a defect in any of them. The two netbsd/amd64 build failures filed before the revival, [GitLab issue #202](https://gitlab.com/cznic/sqlite/-/issues/202) and [GitLab issue #234](https://gitlab.com/cznic/sqlite/-/issues/234), no longer reproduce at this commit: Xsqlite3_is_interrupted is present in the sources that target selects, and the mu.enter/mu.leave symbols that broke the build are gone. Documentation only — the transpiled sources under lib/ are byte-for-byte what v1.56.0 shipped, and nothing about how these targets behave changes.

  • 2026-08-03 v1.56.0:

    • Re-vendor the transpiled SQLite sources, picking up modernc.org/libsqlite3's fix for an upstream data-corruption bug in SQLite 3.53.3's journal rollback. The SQLite version is unchanged at 3.53.3; what changes is that the amalgamation is now patched before it is transpiled. 3.53.3 reworked readSuperJournal() to return the super-journal name through a char** out-parameter, and pager_playback() now tests that pointer where it used to test zSuper[0]. A crash during the commit of a multi-database (ATTACH) transaction can leave the super-journal name and its checksum zeroed while the name length and the trailing magic survive; the checksum is a plain byte sum, so an all-zero name still validates and readSuperJournal() hands back a non-NULL pointer to an empty string. pager_playback() then calls sqlite3OsAccess(pVfs, "", SQLITE_ACCESS_EXISTS), gets ENOENT, and deletes the hot journal without playing it back — leaving the database corrupted. This is not a transpilation artifact: a plain gcc build of the stock 3.53.3 amalgamation fails on the same bytes while 3.53.2 recovers them, and it is what has been making upstream's own test/crash.test fail intermittently, in roughly 2% of runs, on every platform. The patch restores the pre-3.53.3 behaviour of reporting a (nul) super-journal name and will be dropped once upstream ships its own fix. Every supported target carries it.
    • Two targets change beyond that patch. On linux/s390x the regenerated transpile allocates C bit-fields MSB-first, as the big-endian platform ABI requires, rather than LSB-first; this comes from modernc.org/cc/v4 v4.29.1 and touches bit-field accesses throughout the SQLite core, s390x being this module's only big-endian target. On linux/riscv64 the transpile was regenerated on a host running GCC 11.4.0 where the previous one used GCC 13.3.0, which drops a handful of unexported compiler-predefined macro constants (the __FLT16_* family, __DBL_IS_IEC_60559__ and friends) and changes the COMPILER=gcc-13.3.0 entry PRAGMA compile_options reports to COMPILER=gcc-11.4.0; no SQLite code generation differs. Every other target's generated code is byte-identical to v1.55.0 apart from the journal-rollback patch above.
    • Bump the pinned modernc.org/libc to v1.74.4, and the remaining dependencies to their current releases. v1.74.2 and v1.74.3 are retracted upstream — a freeaddrinfo lock leak that deadlocks name resolution — and v1.74.4 is the fix. As always, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins (see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177)).
    • Documentation sweep. openbsd/amd64 and openbsd/arm64 join the supported platforms table in the package documentation: both have been in the builder test matrix since January and are cross-built by make build_all_targets, but had never been listed. The vfs DSN query parameter — which names a VFS registered with SQLite, such as one returned by vfs.New — is now documented alongside the other DSN parameters on Driver.Open. The "Debug and development versions" section no longer describes a GO_GENERATE environment variable and a go generate that this repository has not had since generator.go moved to modernc.org/libsqlite3; it now points at that repository and make vendor instead, and the stale //go:generate directive naming the removed file is dropped with it. modernc.org/sqlite/vec and modernc.org/sqlite/vfs gained the package doc comments they were missing, so both finally carry a synopsis on pkg.go.dev. Documentation only; no behavior changes.
    • Add NewConnector, returning a database/sql/driver.Connector for use with sql.OpenDB. It opens the same connections sql.Open("sqlite", dsn) does, from the same registered driver, so every function, collation, connection hook and virtual table module registered through this package applies to them. It exists for callers that need to interpose on the physical connections database/sql opens — tracing, metrics, connection-scoped setup — which sql.Open gives no access to: such a caller can embed the returned Connector, override Connect, and pass its own wrapper to sql.OpenDB. Previously the only way to reach the registered driver was the db, _ := sql.Open("sqlite", ""); drv := db.Driver(); db.Close() idiom, which works only because sql.Open does not connect and this driver does not implement driver.DriverContext; and the only way to get a wrapper into a *sql.DB was sql.Register, which is process-global, panics on a name it has already seen, and cannot be undone, so a library had to invent a unique driver name per configuration. sql.OpenDB registers nothing. Constructing a &sqlite.Driver{} is not an alternative — its fields are unexported, so it carries none of the registrations. NewConnector checks the DSN only as far as it can without opening a database — a query string that does not parse, and conflicting vfs parameters; everything else continues to be validated when the connection is opened, so an unknown parameter or an out-of-range value is reported by Connect rather than at construction. Nothing about the existing sql.Open path changes: *Driver deliberately still does not implement driver.DriverContext, so sql.Open remains lazy and DSN errors continue to surface where they always have. A runnable sample is in examples/connector. Resolves [GitLab issue #253](https://gitlab.com/cznic/sqlite/-/issues/253), thanks Alessandro Segala (@​ItalyPaleAle)!
    • Document that a caller-constructed sqlite.Driver is not the driver this package registers as "sqlite". Its fields are unexported, so it starts with no functions, collations or connection hooks and the only way to give it any is its own RegisterConnectionHook method; the package-level Register* functions always apply to the registered driver. Connections such a Driver opens therefore run without the package-level functions and collations — and because a registered function silently replaces a SQLite built-in of the same name, a Driver you construct can evaluate upper(x), date(x) and the like differently from one opened through sql.Open. Virtual table modules are the one exception: they are held process-globally and reach every Driver. Constructing one remains supported for the private-hook pattern — a driver registered under a name of its own with sql.Register so its connection hooks apply only to its own connections — and is otherwise best avoided in favour of sql.Open or NewConnector. Documentation only; no behavior changes.

  • 2026-07-20 v1.55.0:

    • Add github.com/mattn/go-sqlite3-compatible shorthand DSN query parameters to ease migration from that driver: _busy_timeout/_timeout, _foreign_keys/_fk, _journal_mode/_journal, _synchronous/_sync, _auto_vacuum/_vacuum, and _query_only, each setting the correspondingly named PRAGMA. Values are validated against the same set mattn/go-sqlite3 accepts (case-insensitive) and an unrecognized value fails the connection with an error, so a typo such as _synchronous=fu1l or _foreign_keys=yes_please is reported rather than silently downgrading durability or dropping foreign-key enforcement. The keys are applied in a fixed order independent of their order in the DSN — _busy_timeout and _auto_vacuum before any _pragma values (auto_vacuum must be set before the database is first written), the rest after, and _query_only last — and where a key and its alias are both supplied the alias wins, matching mattn/go-sqlite3; selection is by presence rather than by value, so supplying the alias empty (_foreign_keys=on&_fk=) suppresses the PRAGMA rather than deferring to the primary key, again matching that driver. Behavior change to note: prior releases ignored these keys entirely, so a DSN carried over from a mattn/go-sqlite3 setup changes in two ways. A recognized key that previously did nothing now takes effect — _foreign_keys=on begins enforcing constraints against data that may already violate them, _journal_mode=wal persistently converts the database file, and _query_only=1 makes the connection read-only. And a value outside the accepted set now fails the connection with an error where the same DSN previously opened successfully — for example a duration-style _busy_timeout=5s or _timeout=5000ms, neither of which is the integer that key requires. Review such DSNs before upgrading. _pragma is unchanged and no pre-existing parameter changes meaning, though see the following entry for a change in when all of them are validated.
    • See [GitLab merge request #134](https://gitlab.com/cznic/sqlite/-/merge_requests/134), thanks Toni Spets (@​beeper-hifi) and Ian Chechin!
    • Validate every DSN query parameter before applying any of them. Parameters were previously checked as each was reached, so a DSN whose later parameter was rejected had already executed the PRAGMAs ahead of it. Because PRAGMA journal_mode and PRAGMA auto_vacuum are persistent changes to the database file, a DSN such as file:x.db?_journal_mode=wal&_synchronous=bogus failed the connection and yet left x.db converted to WAL. A failed Open now leaves the database as it found it. This covers the pre-existing _txlock, _timezone, _time_format, _time_integer_format, _inttotime and _texttotime parameters as well as the shorthand keys above: all of them were validated only after the _pragma list had already run, so the same DSN shape — a valid _pragma=journal_mode=wal alongside a misspelled _txlock — converted the file before reporting the error. Only the values accepted for each parameter are unchanged; a DSN that opened successfully before still opens, and one that failed still fails with the same error. _pragma remains the sole exception, since its values are executed verbatim and cannot be checked in advance: a malformed _pragma is still rejected by SQLite as it runs, after any earlier _pragma in the list has taken effect.

  • 2026-07-15 v1.54.0:

    • Up...

      Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 7, 2026
@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown

🟢 Change Impact Analysis

Metric Value
Risk Level LOW 🟢
Files Changed 1
Symbols Changed 1
Directly Affected 0
Transitively Affected 0

Blast Radius: 0 modules, 0 files, 0 unique callers

📝 Changed Symbols (1)
Symbol File Type Confidence
go.mod go.mod modified 30%

Recommendations

  • ℹ️ coverage: 1 symbols have low mapping confidence. Index may be stale.
    • Action: Run 'ckb index' to refresh the SCIP index

Generated by CKB

@github-actions

github-actions Bot commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown

CKB Analysis

Risk Files +50 -54 Modules

🎯 1 changed → 0 affected · 🔥 2 hotspots · 📚 202 stale

Risk factors: Touches 2 hotspot(s)

👥 Suggested: @lisa.welsch1985@gmail.com (100%), @talantyyr@gmail.com (50%)

Metric Value
Impact Analysis 1 symbols → 0 affected 🟢
Doc Coverage 6.9306930693069315% ⚠️
Complexity 0 violations ✅
Coupling 0 gaps ✅
Blast Radius 0 modules, 0 files ✅
Index indexed (0s) 💾
🎯 Change Impact Analysis · 🟢 LOW · 1 changed → 0 affected
Metric Value
Symbols Changed 1
Directly Affected 0
Transitively Affected 0
Modules in Blast Radius 0
Files in Blast Radius 0

Symbols changed in this PR:

  • go.mod [modified] (30%) — go.mod

Recommendations:

  • ℹ️ 1 symbols have low mapping confidence. Index may be stale.
    • Action: Run 'ckb index' to refresh the SCIP index
🔥 Hotspots · 2 volatile files
File Churn Score
go.mod 8.09
go.sum 9.42
💡 Quick wins · 10 suggestions
📚 Stale docs · 202 broken references

Generated by CKB · Run details

@github-actions

github-actions Bot commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown

CKB Review: ✅ PASS — 98/100

2 files (+104 changes) · 2 modules

Changes 2 files across 2 modules. No blocking issues found.

Check Status Detail
hotspots ℹ️ INFO 2 hotspot file(s) touched
blast-radius ℹ️ INFO No symbols with callers in changes
bug-patterns ✅ PASS No bug patterns detected
coupling ✅ PASS No missing co-change files
comment-drift ✅ PASS No comment/code drift detected
health ✅ PASS No significant health changes
tests ✅ PASS 0 test(s) cover the changes
risk ✅ PASS Risk score: 0.20 (low)
secrets ✅ PASS No secrets detected
dead-code ✅ PASS No dead code in changed files
unwired ✅ PASS All exported symbols are reachable from entrypoints
format-consistency ✅ PASS No format consistency issues
complexity ✅ PASS No significant complexity increase
test-gaps ✅ PASS All changed functions have tests
breaking ✅ PASS No breaking API changes
arch-health ⚪ SKIP Cartographer not compiled in this build
layers ⚪ SKIP Cartographer not compiled in this build
Change Breakdown
Category Files Review Priority
config 2 🟢 Quick check
Code Health

Estimated review: ~22min (moderate)

Reviewers: lisa.welsch1985 (100%) · talantyyr (50%)

@dependabot
dependabot Bot force-pushed the dependabot/go_modules/develop/go-deps-a94210fb2e branch 3 times, most recently from 5fcdd07 to ab78d17 Compare July 21, 2026 08:54
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/develop/go-deps-a94210fb2e branch from ab78d17 to a8b7bb1 Compare July 28, 2026 08:53
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/develop/go-deps-a94210fb2e branch from a8b7bb1 to 585869b Compare September 15, 2026 08:54
@SimplyLiz

SimplyLiz commented Sep 17, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
fix(deps): bump the go-deps group across 1 directory with 6 updates
aed32f2 
Bumps the go-deps group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/klauspost/compress](https://github.com/klauspost/compress) | `1.18.2` | `1.20.0` |
| [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) | `2.3.0` | `2.4.3` |
| [github.com/sourcegraph/go-diff](https://github.com/sourcegraph/go-diff) | `0.7.0` | `0.9.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.55.0` | `0.57.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.47.0` | `0.48.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.48.0` | `1.58.0` |



Updates `github.com/klauspost/compress` from 1.18.2 to 1.20.0
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](klauspost/compress@v1.18.2...v1.20.0)

Updates `github.com/pelletier/go-toml/v2` from 2.3.0 to 2.4.3
- [Release notes](https://github.com/pelletier/go-toml/releases)
- [Commits](pelletier/go-toml@v2.3.0...v2.4.3)

Updates `github.com/sourcegraph/go-diff` from 0.7.0 to 0.9.0
- [Release notes](https://github.com/sourcegraph/go-diff/releases)
- [Commits](sourcegraph/go-diff@v0.7.0...v0.9.0)

Updates `golang.org/x/crypto` from 0.55.0 to 0.57.0
- [Commits](golang/crypto@v0.55.0...v0.57.0)

Updates `golang.org/x/sys` from 0.47.0 to 0.48.0
- [Commits](golang/sys@v0.47.0...v0.48.0)

Updates `modernc.org/sqlite` from 1.48.0 to 1.58.0
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.48.0...v1.58.0)

---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/pelletier/go-toml/v2
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/sourcegraph/go-diff
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/crypto
  dependency-version: 0.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/sys
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: modernc.org/sqlite
  dependency-version: 1.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/develop/go-deps-a94210fb2e branch from 585869b to aed32f2 Compare September 17, 2026 09:59
@github-actions

github-actions Bot commented Sep 17, 2026

Copy link
Copy Markdown

🔐 Security Audit Results

❌ Security gate FAILED - 4 HIGH severity gosec finding(s)

Category Findings
🔑 Secrets ✅ 0
🛡️ SAST ⚠️ 28
📦 Dependencies ⚠️ 18
📜 Licenses ⚠️ 142 non-permissive

🛡️ SAST Analysis

Found 28 issue(s) across 1 scanner(s)

Details

Gosec (28 findings)

  • /home/runner/work/ckb/ckb/internal/lip/subscribe.go:207 - G115: integer overflow conversion int -> uint32...
  • /home/runner/work/ckb/ckb/internal/lip/client.go:1030 - G115: integer overflow conversion int -> uint32...
  • /home/runner/work/ckb/ckb/internal/impact/enricher.go:43 - G101: Potential hardcoded credentials...
  • /home/runner/work/ckb/ckb/internal/query/review_coupling.go:43 - G702: Command injection via taint analysis...
  • /home/runner/work/ckb/ckb/internal/tier/runner.go:45 - G204: Subprocess launched with variable...
  • ... and 23 more

📦 Dependency Vulnerabilities

Found 18 vulnerability(ies) across 2 scanner(s)

Details

Trivy (12 findings)

  • CVE-2026-15157 (MEDIUM): undici - undici: undici: HTTP header injection via unvalida...
  • CVE-2026-16728 (MEDIUM): undici - undici: undici: Response desynchronization via ret...
  • CVE-2026-16729 (MEDIUM): undici - undici: Undici: Cookie attribute injection allows ...
  • CVE-2026-33997 (MEDIUM): github.com/docker/docker - moby: docker: github.com/moby/moby: Moby: Privileg...
  • CVE-2026-41568 (MEDIUM): github.com/docker/docker - github.com/docker/docker: github.com/moby/moby: Mo...
  • ... and 7 more

OSV-Scanner (6 findings)

  • github.com/docker/docker: 11 vulnerabilities
  • github.com/go-chi/chi/v5: 3 vulnerabilities
  • github.com/rs/cors: 2 vulnerabilities
  • go.opentelemetry.io/otel: 1 vulnerabilities
  • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: 2 vulnerabilities
  • ... and 1 more

📜 License Issues

Found 142 non-permissive license(s)

Details
  • github.com/BurntSushi/toml: MIT (notice)
  • github.com/google/uuid: BSD-3-Clause (notice)
  • github.com/klauspost/compress: Apache-2.0 (notice)
  • github.com/klauspost/compress: BSD-3-Clause (notice)
  • github.com/klauspost/compress: MIT (notice)
  • github.com/pelletier/go-toml/v2: MIT (notice)
  • github.com/smacker/go-tree-sitter: MIT (notice)
  • github.com/sourcegraph/go-diff: MIT (notice)
  • github.com/sourcegraph/scip: Apache-2.0 (notice)
  • github.com/spf13/cobra: Apache-2.0 (notice)
  • ... and 132 more

Generated by CKB Security Audit | View Details | Security Tab

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@SimplyLiz