Skip to content

build(deps): bump the minor-patch group in /backend with 5 updates - #11

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/backend/minor-patch-d7ec4d6ec0
Open

build(deps): bump the minor-patch group in /backend with 5 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/backend/minor-patch-d7ec4d6ec0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-patch group in /backend with 5 updates:

Package From To
github.com/caarlos0/env/v11 11.2.2 11.4.1
github.com/gin-contrib/cors 1.7.2 1.7.7
github.com/gin-gonic/gin 1.10.0 1.12.0
github.com/golang-migrate/migrate/v4 4.18.1 4.19.1
github.com/jackc/pgx/v5 5.7.1 5.10.0

Updates github.com/caarlos0/env/v11 from 11.2.2 to 11.4.1

Release notes

Sourced from github.com/caarlos0/env/v11's releases.

v11.4.1

Changelog

Bug fixes

  • 6daeb06ac7e3c9532a7eaa5768d45917393b7480: fix: use Key instead of OwnKey in rawEnvVars to properly reference existing defaults in complex structs (#412) (@​AndrewChubatiuk)

Documentation updates

  • 1ff55e6c9733833ce75d62b345916a407dbe4158: docs: adaptive starchart (#416) (@​alexandear)

Other work

  • cf4a9682420b025e44b4773fd7ee0be48bb68b2f: ci(deps): bump the actions group with 3 updates (#411) (@​dependabot[bot])
  • 33faf6f333c2c3dacef2991825f8e03960a2c0cb: ci(deps): bump the actions group with 3 updates (#417) (@​dependabot[bot])
  • 0cb635b62488f4d310809a82a8832cedc9aa94eb: ci(deps): bump the actions group with 6 updates (#415) (@​dependabot[bot])
  • a72d89a8930fc800372a6a338a1acf33e5cc3a56: ci: update release config (@​caarlos0)

Released with GoReleaser Pro!

v11.4.0

Changelog

New Features

  • 2be9960e75cc5f053dcb89c64e43de19765fd154: feat: option to set defaults for zero values only (#325) (@​dnovikoff)

Bug fixes

  • d3505f14213c309f8ca3b0b1e468284749456dde: fix: all new lint issues, update golangci-lint (@​caarlos0)
  • aaa45113e5eb50e2a243959041452bbab40ae3cc: fix: lint issues (@​caarlos0)

Documentation updates

  • 8917d78b4247be8a3f555ccee03305c7763471e4: docs: clarify example a bit (@​caarlos0)

Other work

  • 7b10cf56e20fe41042b7a7148555990b64b85f95: ci(deps): bump github/codeql-action in the actions group (#400) (@​dependabot[bot])
  • c98ad844e1e479526ef6b4069e0b0f1ced5c953d: ci(deps): bump github/codeql-action in the actions group (#410) (@​dependabot[bot])
  • 2ca9b08cafe0bc271636c15fa34d156733631123: ci(deps): bump the actions group with 2 updates (#393) (@​dependabot[bot])
  • cd5c220dbceb1d1353263a5d6fe3f6816aa1217f: ci(deps): bump the actions group with 2 updates (#396) (@​dependabot[bot])
  • 4d25a4659f428119ce5eaf3ea579176b9161c6e0: ci(deps): bump the actions group with 2 updates (#402) (@​dependabot[bot])
  • c660cc91db76b02de72e8ab7e9ad348edef3f891: ci(deps): bump the actions group with 2 updates (#403) (@​dependabot[bot])
  • 3a3ea05453bd16685c807ba089b20a82033a02f1: ci(deps): bump the actions group with 2 updates (#405) (@​dependabot[bot])
  • d28373e3a047e93ad21676ea9878e5dd1ca157f7: ci(deps): bump the actions group with 2 updates (#408) (@​dependabot[bot])
  • 7b5005693b54a0014e4d3a2ee6192c7bce336af7: ci(deps): bump the actions group with 3 updates (#397) (@​dependabot[bot])
  • 6b2db30d1977183eb8a9732c01ff4e6788565a6e: ci(deps): bump the actions group with 3 updates (#399) (@​dependabot[bot])
  • f33230e8e7e0377c9cdb65d43940db1666061766: ci(deps): bump the actions group with 3 updates (#404) (@​dependabot[bot])
  • 2dc7aec137983c972c29779e951011ddb496fc8b: ci(sec): add codeql, govulncheck, grype (@​caarlos0)
  • 82412ce6900082095e9e4b66f5024c0e67ff3fb8: ci: build perms (@​caarlos0)
  • 02495c42107d77c9365aef6a031b7089f734af3b: ci: build perms (@​caarlos0)
  • e5b3c2c879e43e458e060e2a61fb525e161b7715: ci: lint workflow perms (@​caarlos0)
  • 6690dfb3d314535320f3a30365c52f6fb40c8992: ci: pin github actions versions (@​caarlos0)
  • 548a7a66c9d5504d8f9c0488ee47a05ae453c7e2: ci: update dependabot (@​caarlos0)

... (truncated)

Commits
  • a72d89a ci: update release config
  • 6daeb06 fix: use Key instead of OwnKey in rawEnvVars to properly reference existing d...
  • 33faf6f ci(deps): bump the actions group with 3 updates (#417)
  • 1ff55e6 docs: adaptive starchart (#416)
  • 0cb635b ci(deps): bump the actions group with 6 updates (#415)
  • cf4a968 ci(deps): bump the actions group with 3 updates (#411)
  • aaa4511 fix: lint issues
  • 4fe3f70 chore: dependabot update
  • c98ad84 ci(deps): bump github/codeql-action in the actions group (#410)
  • d28373e ci(deps): bump the actions group with 2 updates (#408)
  • Additional commits viewable in compare view

Updates github.com/gin-contrib/cors from 1.7.2 to 1.7.7

Release notes

Sourced from github.com/gin-contrib/cors's releases.

v1.7.7

Changelog

Others

  • 2816d6da1754dae141f65310dfbf4a1600af782a: Add Go 1.26 to GitHub Actions test matrix (@​appleboy)
  • a92928f098c146faaa5e691399c0ab3c2b808d2f: Update golangci-lint version to v2.9 (@​appleboy)
  • b77776e77f9daaf63076e696016cf99340cdc79e: Fix Trivy badge URL in README.md (@​appleboy)

Bug fixes

  • 123928c03ce0b7336b4322d38d57bf7cf4e9b808: fix: allow ^ anchor in regex CORS origin patterns (#177) (@​brokenthumbs)
  • 3585a5e62daa3d1b40e134b6d2a8bf07b33b2d57: fix: resolve golangci-lint issues in tests (@​appleboy)

Enhancements

  • 21c982fe706deec13d8012eb66b8feaed5c1acd2: chore: update Go version and refresh dependencies to latest releases (@​appleboy)
  • 402233a7419c785098703756402484dae63f4417: chore(deps): upgrade golang.org/x/crypto to v0.45.0 (@​appleboy)
  • 0c142794c2885f61c16db122c343da553801a9dd: chore(deps): bump actions/checkout from 4 to 6 (@​appleboy)
  • 3333b3d0d3ff5d3d6e5f715665a0920522e091ea: chore(deps): upgrade quic-go to v0.57.1 (@​appleboy)
  • 754ef53f194ecb7faa198ca6c9365b8975217aba: chore(ci): update golangci-lint to v2.6 (@​appleboy)
  • c5dcea89610356ca36bd8bd2534943105f731b20: chore(deps): bump actions/cache from 4 to 5 (@​appleboy)
  • 139173a220a23bae1172280cfaaf86addd2c5248: chore(ci): upgrade trivy-action from 0.33.1 to 0.35.0 (@​appleboy)
  • 9e6ec27fa96936d68a516d5367486e262812275b: chore(deps): upgrade gin to v1.12.0 and update CI Go versions (@​appleboy)
  • e19d20de2b561cdd642ed336fcca368fd8e251cf: chore(deps): upgrade golang.org/x/text to v0.35.0 (@​appleboy)

Build process updates

  • f46b87eacdb9f84a99136501d3e50873b9ebdb7a: ci: integrate Trivy vulnerability scanning into CI workflow (@​appleboy)
  • c4b4ccff788f6a1ec0d796054d870f1a432b4193: ci: broaden CI Go version testing (@​appleboy)
  • 33f131c7e60abbda06621e3db880ea3b87200c59: ci: add dedicated Trivy security scanning and status badge (@​appleboy)
  • fe8e9d050af48828d10c39a76c03b0ca91cf1061: ci: integrate automated Trivy security scanning via GitHub Actions (@​appleboy)
  • f20e310cdc56e1eabc1a247230e073cc11c1f134: ci: update CI tooling and refine supported Go versions (@​appleboy)
  • d94e4773a2a44fc8c0738ad4fa77d82dc7f57c5f: ci: modernize and consolidate CI workflows and security scanning (@​appleboy)
  • b16eb9fe4380bf20f4725be6714555203d347126: ci: rename Trivy workflow file for enhanced clarity (@​appleboy)
  • ec180b59ed3a195d28938bfa138627714a1316dc: ci(workflow): bump goreleaser/goreleaser-action from v6 to v7 (@​appleboy)

v1.7.6

Changelog

Others

  • f65f3f787bfa4425d557a2975f2c00ce377718d4: test: refactor and expand CORS AllowOrigins test coverage (@​appleboy)

Enhancements

  • 28dfa405cf69fbaacd0a6012026e6dde68dbb1c9: chore: update core dependencies to latest supported versions (@​appleboy)
  • a9706b1fc6fcd2f76de77c756d83d2fbd24362c1: chore: use http.MethodOptions instead of string literal (#164) (@​LombardiDaniel)
  • 7161918d462067a93089e31b125a4bb5af8227f7: chore: update go codec library to improve serialization support (@​appleboy)
  • ebd7f912c7f16d468ce530a8625f1a135f65a76f: chore: pin golangci-lint to a specific version (@​appleboy)

Refactor

  • 47d9afe5a3f22e913dfd5dc0fab17d1fef58cbbc: refactor: refactor tests to table-driven style and simplify router logic (@​appleboy)

Build process updates

  • 90bd363599befa876b8a8d351dea21aa5d58e5d7: ci: upgrade golangci-lint GitHub Action to v8 (@​appleboy)

Documentation updates

  • 516207b6baef2029edd9a5c78e892546ab42b7bb: docs: rewrite and expand README for clarity and comprehensive guidance (@​appleboy)
  • abfb2cb54b85cae2f72f6a7c5a4ee1decbca9bd4: docs: expand and clarify configuration documentation (@​appleboy)
  • 8efeda3905b9493a2c1962393ea783b126ad27aa: docs: revise and expand project documentation for clarity and usability (@​appleboy)
  • 4ee797ec66a133fb02afbcda6d27ef0a58473c9c: docs: reorganize and streamline README structure and content (@​appleboy)

v1.7.5

Changelog

... (truncated)

Commits
  • e19d20d chore(deps): upgrade golang.org/x/text to v0.35.0
  • ec180b5 ci(workflow): bump goreleaser/goreleaser-action from v6 to v7
  • 9e6ec27 chore(deps): upgrade gin to v1.12.0 and update CI Go versions
  • 139173a chore(ci): upgrade trivy-action from 0.33.1 to 0.35.0
  • b77776e Fix Trivy badge URL in README.md
  • a92928f Update golangci-lint version to v2.9
  • 2816d6d Add Go 1.26 to GitHub Actions test matrix
  • c5dcea8 chore(deps): bump actions/cache from 4 to 5
  • 3585a5e fix: resolve golangci-lint issues in tests
  • 754ef53 chore(ci): update golangci-lint to v2.6
  • Additional commits viewable in compare view

Updates github.com/gin-gonic/gin from 1.10.0 to 1.12.0

Release notes

Sourced from github.com/gin-gonic/gin's releases.

v1.12.0

Changelog

Features

  • 192ac89eefc1c30f7c97ae48a9ffb1c6f1c8c8bc: feat(binding): add support for encoding.UnmarshalText in uri/query binding (#4203) (@​takanuva15)
  • 53410d2e07054369e0960fbe2eed97e1b9966f12: feat(context): add GetError and GetErrorSlice methods for error retrieval (#4502) (@​raju-mechatronics)
  • acc55e049e33b401e810dbd8c0d6dcb6b3ba2b05: feat(context): add Protocol Buffers support to content negotiation (#4423) (@​1911860538)
  • 38e765119241d990705169bedb5002a29ae0cbd1: feat(context): implemented Delete method (@​Spyder01)
  • 771dcc6476d7bc6abb9ec0235ecefa4d38fe6fb0: feat(gin): add option to use escaped path (#4420) (@​ldesauw)
  • 4dec17afdff48e8018c83618fbbe69fceeb2b41d: feat(logger): color latency (#4146) (@​wsyqn6)
  • d7776de7d444935ea4385999711bd6331a98fecb: feat(render): add bson protocol (#4145) (@​laurentcau)

Bug fixes

  • b917b14ff9d189f16a7492be79d123a47806ee19: fix(binding): empty value error (#2169) (@​guonaihong)
  • c3d1092b3b48addf6f9cd00fe274ec3bd14650eb: fix(binding): improve empty slice/array handling in form binding (#4380) (@​1911860538)
  • 9914178584e42458ff7d23891463a880f58c9d86: fix(context): ClientIP handling for multiple X-Forwarded-For header values (#4472) (@​Nurysso)
  • 2a794cd0b0faa7d829291375b27a3467ea972b0d: fix(debug): version mismatch (#4403) (@​zeek0x)
  • c3d5a28ed6d3849da820195b6774d212bcc038a9: fix(gin): close os.File in RunFd to prevent resource leak (#4422) (@​1911860538)
  • 5fad976b372e381312f8de69f0969f1284d229d3: fix(gin): literal colon routes not working with engine.Handler() (#4415) (@​pawannn)
  • 63dd3e60cab89c27fb66bce1423bd268d52abad1: fix(recover): suppress http.ErrAbortHandler in recover (#4336) (@​MondayCha)
  • 5c00df8afadd06cc5be530dde00fe6d9fa4a2e4a: fix(render): write content length in Data.Render (#4206) (@​dengaleev)
  • 234a6d4c00cb77af9852aca0b8289745d5529b4b: fix(response): refine hijack behavior for response lifecycle (#4373) (@​appleboy)
  • 472d086af2acd924cb4b9d7be0525f7d790f69bc: fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535) (@​veeceey)
  • 8e07d37c63e5536eb25f4af4c91eabeee4011fba: fix: Correct typos, improve documentation clarity, and remove dead code (#4511) (@​mahanadh)

Enhancements

  • ba093d19477b896ac89a7fc3246af23d290b8e26: chore(binding): upgrade bson dependency to mongo-driver v2 (#4549) (@​BobDu)
  • b2b489dbf4826c2c630717a77fd5e42774625410: chore(context): always trust xff headers from unix socket (#3359) (@​WeidiDeng)
  • ecb3f7b5e2f3915bf1db240ed5eee572f8dbea36: chore(deps): upgrade golang.org/x/crypto to v0.45.0 (#4449) (@​appleboy)
  • af6e8b70b8261bb0c99ad094fe552ab92991620a: chore(deps): upgrade quic-go to v0.57.1 (@​appleboy)
  • db309081bc5c137b2aa15701ef53f7f19788da25: chore(logger): allow skipping query string output (#4547) (@​USA-RedDragon)
  • 26c3a628655cad2388380cb8102d6ce7d4875f3b: chore(response): prevent Flush() panic when http.Flusher (#4479) (@​Twacqwq)
  • 5dd833f1f26de0eb30eae47b17e05ced2482dc41: chore: bump minimum Go version to 1.24 and update workflows (#4388) (@​appleboy)

Refactor

  • 39858a0859c914bd26948fa950477e11bd8d3823: refactor(binding): use maps.Copy for cleaner map handling (#4352) (@​russcoss)
  • c0048f645ee945c4db30593afdea10123e2c30a6: refactor(context): omit the return value names (#4395) (@​wanghaolong613)
  • 915e4c90d28ec4cffc6eb146e208ab5a65eac772: refactor(context): replace hardcoded localhost IPs with constants (#4481) (@​pauloappbr)
  • 414de60574449457f3192a7a1d5528940db2836d: refactor(context): using maps.Clone (#4333) (@​cuiweixie)
  • 59e9d4a794f12c4f9a6c7bed441b9644e5f6d99b: refactor(ginS): use sync.OnceValue to simplify engine function (#4314) (@​1911860538)
  • 3ab698dc5110af1977d57226e4995c57dd34c233: refactor(recovery): smart error comparison (#4142) (@​zeek0x)
  • d1a15347b1e45a8ee816193d3578a93bfd73b70f: refactor(utils): move util functions to utils.go (#4467) (@​zeek0x)
  • e3118cc378d263454098924ebbde7e8d1dd2e904: refactor: for loop can be modernized using range over int (#4392) (@​wanghaolong613)
  • 488f8c3ffa579a8d19beb2bae95ff8ef36b3d53f: refactor: replace magic numbers with named constants in bodyAllowedForStatus (#4529) (@​veeceey)
  • 9968c4bf9d5a99edc3eee2c068a4c9160ece8915: refactor: use b.Loop() to simplify the code and improve performance (#4389) (@​reddaisyy)
  • a85ef5ce4d0cda8834c59c855068ed48b51192d1: refactor: use b.Loop() to simplify the code and improve performance (#4432) (@​efcking)

Build process updates

  • 61b67de522a189b568aced4c5c16917c558e3387: ci(bot): increase frequency and group updates for dependencies (#4367) (@​appleboy)
  • fb27ef26c2fdfe25344b4c039d8a53551f9e912c: ci(lint): refactor test assertions and linter configuration (#4436) (@​appleboy)
  • 93ff771e6dbf10e432864b30f3719ac5c84a4d4a: ci(sec): improve type safety and server organization in HTTP middleware (#4437) (@​appleboy)
  • e88fc8927a52b74f55bec0351604a56ac0aa1c51: ci(sec): schedule Trivy security scans to run daily at midnight UTC (#4439) (@​appleboy)
  • 5e5ff3ace496a31b138b0820136a146bfb5de0ef: ci: replace vulnerability scanning workflow with Trivy integration (#4421) (@​appleboy)
  • 00900fb3e1ea9dde33985a0e4f6afec793d5e786: ci: update CI workflows and standardize Trivy config quotes (#4531) (@​appleboy)
  • ae3f524974fc4f55d18c9e7fae4614503c015226: ci: update Go version support to 1.25+ across CI and docs (#4550) (@​appleboy)

... (truncated)

Changelog

Sourced from github.com/gin-gonic/gin's changelog.

Gin v1.12.0

Features

  • feat(render): add bson protocol (#4145)
  • feat(context): add GetError and GetErrorSlice methods for error retrieval (#4502)
  • feat(binding): add support for encoding.UnmarshalText in uri/query binding (#4203)
  • feat(gin): add option to use escaped path (#4420)
  • feat(context): add Protocol Buffers support to content negotiation (#4423)
  • feat(context): implemented Delete method (#38e7651)
  • feat(logger): color latency (#4146)

Enhancements

  • perf(tree): reduce allocations in findCaseInsensitivePath (#4417)
  • perf(recovery): optimize line reading in stack function (#4466)
  • perf(path): replace regex with custom functions in redirectTrailingSlash (#4414)
  • perf(tree): optimize path parsing using strings.Count (#4246)
  • chore(logger): allow skipping query string output (#4547)
  • chore(context): always trust xff headers from unix socket (#3359)
  • chore(response): prevent Flush() panic when the underlying ResponseWriter does not implement http.Flusher (#4479)
  • refactor(recovery): smart error comparison (#4142)
  • refactor(context): replace hardcoded localhost IPs with constants (#4481)
  • refactor(utils): move util functions to utils.go (#4467)
  • refactor(binding): use maps.Copy for cleaner map handling (#4352)
  • refactor(context): using maps.Clone (#4333)
  • refactor(ginS): use sync.OnceValue to simplify engine function (#4314)
  • refactor: replace magic numbers with named constants in bodyAllowedForStatus (#4529)
  • refactor: for loop can be modernized using range over int (#4392)

Bug Fixes

  • fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535)
  • fix(render): write content length in Data.Render (#4206)
  • fix(context): ClientIP handling for multiple X-Forwarded-For header values (#4472)
  • fix(binding): empty value error (#2169)
  • fix(recover): suppress http.ErrAbortHandler in recover (#4336)
  • fix(gin): literal colon routes not working with engine.Handler() (#4415)
  • fix(gin): close os.File in RunFd to prevent resource leak (#4422)
  • fix(response): refine hijack behavior for response lifecycle (#4373)
  • fix(binding): improve empty slice/array handling in form binding (#4380)
  • fix(debug): version mismatch (#4403)
  • fix: correct typos, improve documentation clarity, and remove dead code (#4511)

Build process updates / CI

  • ci: update Go version support to 1.25+ across CI and docs (#4550)
  • chore(binding): upgrade bson dependency to mongo-driver v2 (#4549)

Gin v1.11.0

... (truncated)

Commits
  • 73726dc docs: update documentation to reflect Go version changes (#4552)
  • e292e5c docs: document and finalize Gin v1.12.0 release (#4551)
  • ae3f524 ci: update Go version support to 1.25+ across CI and docs (#4550)
  • 38534e2 chore(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#4548)
  • 472d086 fix(tree): panic in findCaseInsensitivePathRec with RedirectFixedPath (#4535)
  • fb25834 test(context): use http.StatusContinue constant instead of magic number 100 (...
  • 6f1d5fe test(render): add comprehensive error handling tests (#4541)
  • 5c00df8 fix(render): write content length in Data.Render (#4206)
  • db30908 chore(logger): allow skipping query string output (#4547)
  • ba093d1 chore(binding): upgrade bson dependency to mongo-driver v2 (#4549)
  • Additional commits viewable in compare view

Updates github.com/golang-migrate/migrate/v4 from 4.18.1 to 4.19.1

Release notes

Sourced from github.com/golang-migrate/migrate/v4's releases.

v4.19.1

What's Changed

New Contributors

Full Changelog: golang-migrate/migrate@v4.19.0...v4.19.1

v4.19.0

What's Changed

New Contributors

Full Changelog: golang-migrate/migrate@v4.18.3...v4.19.0

v4.18.3

Changelog

  • a4d0a1b Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  • f37ef79 Bump golang.org/x/crypto from 0.31.0 to 0.35.0
  • 5b97c92 Bump golang.org/x/net from 0.33.0 to 0.38.0
  • e6d84f6 Drop support for Go 1.22 and add support for Go 1.24
  • fccd197 Mention CLI install instructions in main README
  • 34c2b4a Remove redundant build tags
  • a868033 Update FAQ.md - typo
  • 7269490 Update golangci-lint version used in GitHub Actions
  • c5137c4 Update migrate -help output for the readme file
  • 033835a Update to dktest v0.4.5
  • 8b09191 fix: typo limited not limitted

... (truncated)

Commits
  • 89e308c chore: remove dependency on "hashicorp/go-multierror" (#1322)
  • 472ef2e Merge pull request #1336 from golang-migrate/dependabot/go_modules/golang.org...
  • 8d76259 Bump golang.org/x/crypto from 0.43.0 to 0.45.0
  • 9f9df7c chore: Update cloud.google.com/go/spanner version (#1330)
  • a371c8e Merge pull request #1304 from iamonah/fix/clarify-databaseName-meaning
  • 43cc3b3 Merge pull request #1325 from HaraldNordgren/linter_issues
  • f939a89 Merge pull request #1335 from golang-migrate/dependabot/go_modules/golang.org...
  • 6dd86e0 Bump golang.org/x/crypto from 0.36.0 to 0.45.0
  • 70e6d6d Merge pull request #1333 from matsoob/updateGoInBaseImage
  • a51d0da Merge pull request #1334 from golang-migrate/dependabot/go_modules/github.com...
  • Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.7.1 to 5.10.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.10.0 (June 3, 2026)

This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers, contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are sent over TLS when the original connection used TLS.

Features

  • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
  • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
  • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
  • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
  • pgxpool: check if connection is expired before acquire (arthurdotwork)

Security Hardening

  • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
  • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
  • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
  • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
  • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
  • Fix panic on malformed geometric text; return an error instead (MaIII)

Fixes

  • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
  • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
  • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
  • Fix data race when context is cancelled during connect
  • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
  • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
  • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
  • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
  • Add missing error check of rows.Err to load types (Jen Altavilla)

5.9.2 (April 18, 2026)

Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)

SQL injection can occur when:

  1. The non-default simple protocol is used.
  2. A dollar quoted string literal is used in the SQL query.
  3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
  4. The value of that placeholder is controllable by the attacker.

... (truncated)

Commits
  • 7293fb1 Update changelog for v5.10.0
  • 1ade285 pgconn: document secure connection configuration
  • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
  • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
  • b28e65b pgtype: bound array element count against remaining message bytes
  • cd1f389 pgtype: bound array binary decode element length against remaining bytes
  • ff27b5b pgtype: bound hstore binary decode against malicious server input
  • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
  • 44f6173 pgconn: cap server-supplied SCRAM iteration count
  • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-patch group in /backend with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/caarlos0/env/v11](https://github.com/caarlos0/env) | `11.2.2` | `11.4.1` |
| [github.com/gin-contrib/cors](https://github.com/gin-contrib/cors) | `1.7.2` | `1.7.7` |
| [github.com/gin-gonic/gin](https://github.com/gin-gonic/gin) | `1.10.0` | `1.12.0` |
| [github.com/golang-migrate/migrate/v4](https://github.com/golang-migrate/migrate) | `4.18.1` | `4.19.1` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.7.1` | `5.10.0` |


Updates `github.com/caarlos0/env/v11` from 11.2.2 to 11.4.1
- [Release notes](https://github.com/caarlos0/env/releases)
- [Commits](caarlos0/env@v11.2.2...v11.4.1)

Updates `github.com/gin-contrib/cors` from 1.7.2 to 1.7.7
- [Release notes](https://github.com/gin-contrib/cors/releases)
- [Commits](gin-contrib/cors@v1.7.2...v1.7.7)

Updates `github.com/gin-gonic/gin` from 1.10.0 to 1.12.0
- [Release notes](https://github.com/gin-gonic/gin/releases)
- [Changelog](https://github.com/gin-gonic/gin/blob/master/CHANGELOG.md)
- [Commits](gin-gonic/gin@v1.10.0...v1.12.0)

Updates `github.com/golang-migrate/migrate/v4` from 4.18.1 to 4.19.1
- [Release notes](https://github.com/golang-migrate/migrate/releases)
- [Commits](golang-migrate/migrate@v4.18.1...v4.19.1)

Updates `github.com/jackc/pgx/v5` from 5.7.1 to 5.10.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.7.1...v5.10.0)

---
updated-dependencies:
- dependency-name: github.com/caarlos0/env/v11
  dependency-version: 11.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: github.com/gin-contrib/cors
  dependency-version: 1.7.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: github.com/gin-gonic/gin
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: github.com/golang-migrate/migrate/v4
  dependency-version: 4.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants