Skip to content

fix(deps): update go dependencies - #2160

Open
rigelbuild-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-dependencies
Open

fix(deps): update go dependencies#2160
rigelbuild-renovate[bot] wants to merge 1 commit into
mainfrom
renovate/go-dependencies

Conversation

@rigelbuild-renovate

@rigelbuild-renovate rigelbuild-renovate Bot commented Oct 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
connectrpc.com/connect v1.20.0 → v1.21.0 age confidence
connectrpc.com/otelconnect v0.9.0 → v0.11.0 age confidence
github.com/jackc/pgx/v5 v5.10.0 → v5.11.0 age confidence
github.com/minio/minio-go/v7 v7.2.1 → v7.3.0 age confidence
github.com/nats-io/nats-server/v2 v2.14.6 → v2.15.0 age confidence
github.com/nats-io/nats.go v1.53.1 → v1.54.0 age confidence
github.com/wailsapp/wails/v3 v3.0.0-beta.14 → v3.0.0-beta.28 age confidence
go.opentelemetry.io/otel v1.46.0 → v1.47.0 age confidence
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.46.0 → v1.47.0 age confidence
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0 → v1.47.0 age confidence
go.opentelemetry.io/otel/metric v1.46.0 → v1.47.0 age confidence
go.opentelemetry.io/otel/sdk v1.46.0 → v1.47.0 age confidence
go.opentelemetry.io/otel/sdk/metric v1.46.0 → v1.47.0 age confidence
go.opentelemetry.io/otel/trace v1.46.0 → v1.47.0 age confidence
golang.org/x/sync v0.23.0 → v0.24.0 age confidence
golang.org/x/sys v0.48.0 → v0.49.0 age confidence

Release Notes

connectrpc/connect-go (connectrpc.com/connect)

v1.21.0

Compare Source

What's Changed

[!IMPORTANT]

This release adds a security-related feature for servers. The new handler option WithRequestGate runs after the request headers are available and before any message is received. Use this new option to register checks (e.g. authentication) that should happen before the request is decompressed or unmarshaled, and before any interceptors are run. See the documentation for details.

Governance
Enhancements
Bugfixes

New Contributors

Full Changelog: connectrpc/connect-go@v1.20.0...v1.21.0

connectrpc/otelconnect-go (connectrpc.com/otelconnect)

v0.11.0

Compare Source

What's new for connect-go v2

This release of otelconnect-go supports connect-go v2. The module path stays connectrpc.com/otelconnect but this version requires connect-go v2. v0.10.x is the last release series compatible with connect-go v1, so pin connectrpc.com/otelconnect@v0.10 if you're still on connect-go v1. Traces, metrics, and their attributes are unchanged.

v2 separates server and client interceptors, so NewInterceptor splits into NewServerInterceptor and NewClientInterceptor. Both still return an error, so create them before the server or client:

-interceptor, err := otelconnect.NewInterceptor()
+serverInterceptor, err := otelconnect.NewServerInterceptor()
 if err != nil {
      return err
 }
-mux.Handle(userv1connect.NewUserServiceHandler(
-     &userv1connect.UnimplementedUserServiceHandler{},
-     connect.WithInterceptors(interceptor),
-))
+server := connect.NewServer(serverInterceptor)
+userv1connect.RegisterUserServiceHandler(server, &userv1connect.UnimplementedUserServiceHandler{})
+connecthttp.Mount(mux, server)

Clients use NewClientInterceptor the same way, passed to connect.NewClient. All options are unchanged and apply to both constructors. The v2 migration guide covers the change. The migration tool can't tell the server side from the client side at the assignment, so it flags each NewInterceptor call for you to pick the right form. See #​216 for details.

To upgrade, run:

go get connectrpc.com/otelconnect@v0.11.0

Full Changelog: connectrpc/otelconnect-go@v0.10.0...v0.11.0

v0.10.0

Compare Source

What's Changed

This release moves otelconnect to the current OpenTelemetry RPC semantic conventions (semconv v1.43.0). Before this, it emitted the conventions as they stood in v1.21.0. The telemetry it produces has changed a lot, so dashboards, alerts and queries built on earlier versions will need updating:

  • Metrics: Each side now records a single histogram, rpc.server.call.duration or rpc.client.call.duration, measured in seconds. It replaces rpc.{server,client}.duration, which was in milliseconds. The request and response size metrics and the per-RPC message count metrics are removed, because OpenTelemetry deprecated them without replacements. Use WithDurationHistogramOptions to set custom buckets.
  • Attributes: rpc.system is now rpc.system.name, and ConnectRPC reports connectrpc rather than connect_rpc. rpc.method now holds the fully-qualified method (acme.foo.v1.FooService/Bar), and rpc.service is gone. rpc.grpc.status_code and rpc.connect_rpc.error_code are merged into rpc.response.status_code. It uses uppercase code names (OK, NOT_FOUND) for every protocol and is set on every call. Failed calls also get error.type. Client spans and metrics use server.address and server.port, and server spans use network.peer.address and network.peer.port. Together these replace net.peer.name and net.peer.port. Header attributes are now rpc.{request,response}.metadata.<key>.
  • Span events: The per-message rpc.message event is removed, along with the WithoutTraceEvents option.
  • Server peer attributes: Server spans no longer include the client's address and port by default. Opt in with WithServerPeerAttributes to add network.peer.address and network.peer.port. WithoutServerPeerAttributes is removed, since its behavior is now the default.

Existing projects can't opt back into the old conventions. See the README for the full attribute set.

Governance
Enhancements

New Contributors

Full Changelog: connectrpc/otelconnect-go@v0.9.0...v0.10.0

jackc/pgx (github.com/jackc/pgx/v5)

v5.11.0

Compare Source

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with
libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for
connection-string and date/time behavior changes that may affect existing applications.

Features

  • stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be
    scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and
    sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.
  • Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader
    that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.
  • pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size
    (carter-ya)
  • pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection
    sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)
  • pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero;
    zero and negative durations mean no timeout (1991santhu)

Changes

  • Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking
    precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

  • pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service
    file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory
    defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these
    now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

  • pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and
    encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot
    express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x
    faster for timestamp and timestamptz. Bug fixes:

    • timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding.
      time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This
      affected ordinary four-digit BC years, not only extended-range ones. date was never affected.
    • timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with
      day out of range. date could already scan them.
    • Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and
      timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any
      other text-format result.
    • time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.
    • Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even,
      carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six
      fractional digits, so this only affects values from other sources.

    Behavior changes:

    • date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and
      2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.
    • All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the
      text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range
      is checked in both formats so that whether a value is accepted does not depend on QueryExecMode.
      timestamptz also rejects time zone displacements outside PostgreSQL's signed 32-bit seconds range, while accepting
      the wider offsets emitted for POSIX time zones, such as +16.
    • timestamptz values scanned from the text format are now returned in time.Local, or in ScanLocation when it is
      set, matching what the binary format has always returned. Previously the text path kept whatever location
      time.Parse derived from the offset the server sent, so the same value scanned in the two formats could report a
      different Location() and Zone(). The instant is unchanged, but everything that renders the location changes
      with it: Timestamptz.MarshalJSON now writes the client's offset rather than the server's, so a value the server
      sent as +05:30 marshals as 2024-01-01T13:34:05-08:00 on a UTC-8 client instead of 2024-01-02T03:04:05+05:30,
      and DecodeDatabaseSQLValue hands database/sql a time.Time in that same location. Set the codec's
      ScanLocation to time.UTC to pin the location regardless of the client's zone.
    • Error messages from these paths have changed.

  • pgconn: connection URIs (postgres://...) are now parsed by a new parser designed to exactly match libpq's URI
    parser behavior instead of net/url,
    making pgx accept and reject exactly the same URIs as libpq (verified by differential fuzzing against libpq itself).
    Most connection strings are unaffected. Edge-case behavior changes, all matching libpq:

    • + in query values is literal, no longer decoded as a space.
    • Malformed percent-encoding is a parse error instead of the parameter being silently dropped. %00 is rejected.
    • Leading/trailing spaces in URI components are trimmed; interior spaces are a parse error (encode them as %20).
    • # is ordinary data, not a fragment delimiter.
    • The userinfo terminator is the first @ before any / (previously the last @).
    • When a query parameter is repeated, the last occurrence wins (previously the first).
    • ssl=true is accepted as an alias for sslmode=require in URIs (JDBC compatibility). A repeated ssl key
      follows the same last-occurrence-wins rule as other repeated parameters, even across the rewrite to sslmode. If
      the final ssl value is not true, an independent explicit sslmode remains in effect.
    • Multiple hosts with mixed port specs are positionally aligned: postgres://h1,h2:5433/db now means h1:5432 and
      h2:5433 (previously both hosts got port 5433). A port list that is neither a single port nor exactly one port per
      host is an error (could not match N port numbers to M hosts), also for keyword/value connection strings.
    • An IPv6 address in a URI must be enclosed in brackets. A bare postgres://::1/db was previously accepted as host
      ::1; it is now read as an empty host followed by port :1 and fails with an invalid port error. Write it as
      postgres://[::1]/db.
    • Empty host list elements (e.g. h1,,h2) get the default host instead of being dropped. Likewise, an empty host in
      a keyword/value string (host=) now means the default host -- typically the Unix socket directory -- where it
      previously meant a TCP connection to an empty hostname.
    • An empty port (?port= in a URI or port= in a keyword/value string) now means the default port 5432 for the
      affected hosts; previously it was an invalid port error. Like any connection-string port, a present-but-empty port
      takes precedence over PGPORT.
    • ASCII control characters (tab, newline, ...) in a URI are ordinary data bytes, as they are to libpq; net/url
      rejected any URI containing one. The exception is a literal NUL byte, which is still rejected, as net/url did.
      (libpq never sees one -- C strings end at the first NUL -- but in Go a raw NUL could otherwise pass through into
      the NUL-delimited startup message and inject extra parameters.)

    Unlike libpq, unrecognized URI query parameters are still accepted (they become runtime parameters or pgx-specific
    options). Parse error messages avoid quoting the unredacted connection string and redact recognizable password
    fields on a best-effort basis. Invalid connection strings can be structurally ambiguous, so password redaction
    cannot be guaranteed for every malformed input.

  • pgconn: keyword/value connection strings (host=... user=...) now match libpq's parser exactly, the same treatment
    the URI parser received above and verified the same way, by differential fuzzing against libpq itself. Most
    connection strings are unaffected. Behavior changes, all matching libpq:

    • A backslash escapes whatever character follows it and is dropped, where previously only \\ and \' were
      unescaped and every other backslash was kept. A value containing a backslash must now escape it, as libpq
      requires: sslcert=C:\path\to\cert reads as C:pathtocert and has to be written sslcert=C:\\path\\to\\cert.
      This mainly affects Windows certificate and key paths, which previously came through intact without doubling.
    • A trailing backslash in an unquoted value escapes the end of the string, so it is dropped and the value ends
      there; it was previously rejected with invalid backslash. Inside a quoted value the escaped terminator leaves
      the string unterminated, which is still an error.
    • Whitespace inside a keyword is an error (missing "=" after "us" in connection info string) instead of becoming
      part of the key. Whitespace around the = is unaffected. This most often shows up with an unquoted value
      containing a space: application_name=my app host=x previously set neither parameter and sent app host to the
      server as a runtime parameter, and now fails to parse.

    As with URIs, unrecognized keywords are still accepted where libpq rejects them, and an empty user= is still
    dropped so that PGUSER and the OS user still apply.

Fixes

  • Keep the connection open after a recoverable PostgreSQL error from Begin or BeginTx
    (Victor Alejandro Sanz Ararat)
  • Call TraceQueryEnd when Exec fails while deallocating invalidated cached statements (Chris Bandy)
  • Deallocate a failed prepare using the statement name actually sent to the server, and skip cleanup if Parse never
    completed, avoiding leaked prepared statements and unnecessary cleanup errors (Eliran Ben-Zikri)
  • Fix LoadTypes overwriting scalar codecs such as box and point with an incorrect ArrayCodec (Arsen Ozhetov)
  • pgconn: retrieve field descriptions when cached descriptions are empty, such as for cursor FETCH statements,
    including batch and pipeline execution (water)
  • pgconn: keep batch statement descriptions and result formats aligned when commands return no rows or when
    Batch.ExecStatement is mixed with other batch commands; preserve field descriptions for empty results
  • pgconn: handle empty and comment-only queries in pipeline mode, discard stale statement data after bind errors,
    and return a nil result from Pipeline.GetResults on error
  • pgconn: skip reading the password file when a password is already set (Jared Fowkes)
  • pgxpool: treat non-positive MaxConnLifetime values as unlimited instead of immediately expiring connections
    (Aurelien Pillevesse)
  • pgtype: support non-comma text array delimiters through ArrayCodec.Delimiter, including the semicolon delimiter
    used by box[]. LoadType and LoadTypes now load the delimiter from PostgreSQL (Sueun Cho)
  • pgtype: quote text array elements containing internal whitespace (Louisa Huang)
  • pgtype: quote and escape text range bounds containing delimiters, quotes, or backslashes, and distinguish empty
    string bounds from unbounded ranges (Sueun Cho)
  • pgtype: preserve decimal precision in Numeric.ScanScientific and accept scientific notation in
    Numeric.UnmarshalJSON; reject out-of-range scientific exponents and preserve the original input in parse errors
    (Sueun Cho)
  • pgtype: encode and decode numeric infinity in JSON as "Infinity" and "-Infinity" instead of encoding it as zero
    (Vladimir Saraikin)
  • pgtype: treat a valid Numeric with a nil Int as zero in Int64Value, and return errors when converting NaN or
    infinity to an integer instead of panicking (Vladimir Saraikin)
  • pgtype: fix an infinite loop when decoding binary numeric zero with a nonzero digit count (Vladimir Saraikin)
  • pgtype: fix binary numeric digit-count overflow and trailing-byte handling. Binary encoding now rejects values
    whose digit count, weight, or scale cannot fit the wire format, while accepting the full unsigned digit-count range.
  • pgtype: fix scanning through multiple pointer levels, including SQL NULL and XML values, and return an error
    instead of panicking when a pointer-to-pointer scan destination is nil (Rangel Reale)
  • pgtype: use bounds-checked binary reads throughout the codecs and reject malformed lengths, counts, and trailing
    data. This includes fixes for panics on malformed records and truncated multiranges (Vladimir Saraikin), and
    validation of bit / varbit bit lengths against the actual data (g3m0sis).
  • pgtype: return errors instead of panicking on malformed interval text (greymoth-jp), unterminated composite text
    fields, and text arrays whose dimensions and element counts disagree
  • pgtype: cap the initial allocation estimate when parsing hstore text to avoid excessive allocation from unvalidated
    separator counts; valid hstores may still contain any number of pairs (AshSgDe29071999)
  • pgtype: correct reversed bounds in integer scan error messages
  • pgconn: a backslash as the last byte of a quoted value in a keyword/value connection string no longer panics with
    slice bounds out of range. host='a\ -- and the shorter ='\, reachable through pgx.ParseConfig and
    pgxpool.ParseConfig -- now return unterminated quoted string in connection info string, libpq's own message for
    the same input. The unquoted branch has been guarded since be69c1c; the quoted branch carried the same unguarded
    increment since the parser was ported from pgx v3. Found by fuzzing (Maxim Korotkov)
  • pgconn: error messages that embed the connection string now also redact password and sslpassword values supplied
    as URI query parameters; previously only the userinfo password was redacted. Redaction matches keys the way the
    parser does -- percent-encoded spellings such as pass%77ord= are recognized -- and masks the entire raw value, so
    a password containing a space cannot leak its tail into the error message. Credentials stranded outside the
    userinfo by a malformed URI are masked whole, and invalid-port errors no longer embed the offending text (which in
    a malformed URI can be a mislaid password). Redaction of invalid connection strings is necessarily best effort:
    their structure may be ambiguous, so some malformed inputs can still expose password text in an error.
  • pgconn: ParseConfigOptions.ConnStringAllowedKeys no longer exempts an explicitly supplied empty port (?port= in
    a URI or port= in a keyword/value string) from the allow-list. Only the implied all-empty port list of a
    multi-host URI without ports (postgres://h1,h2/db) is exempt. An explicit empty port shadows PGPORT even though
    it is empty, so it must be allowed like any other user-supplied key. The URI-only ssl=true alias is accepted when
    either ssl or sslmode is allowed, and every ssl/sslmode spelling written in the URI is validated --
    including occurrences superseded by later repeated parameters.
  • pgconn: drain socket before close in asyncClose so context cancellation produces a TCP FIN instead of RST, avoiding "connection reset by peer" on the server / proxy (Sean Chittenden at CrowdStrike, Inc.)
  • pgproto3: StartupMessage.Encode rejects a NUL byte in any parameter name or value instead of writing it. The
    startup message body is a run of NUL-delimited strings whose length is data-driven, so a NUL in a value ends that
    parameter and everything after it is read by the server as further parameters -- an application_name of
    x\x00user\x00admin changed the role the connection logged in as. libpq cannot reach this state because its
    parameters are NUL-terminated C strings. Connect now fails with nothing written to the wire, which covers
    settings that bypass connection string parsing: service files and direct assignment to Config.RuntimeParams,
    Config.User, or Config.Database.
  • pgconn: keyword/value connection strings containing a NUL byte are rejected by ParseConfig, as URIs already were.
minio/minio-go (github.com/minio/minio-go/v7)

v7.3.0

Compare Source

What's Changed

New Contributors

Full Changelog: minio/minio-go@v7.2.1...v7.3.0

nats-io/nats-server (github.com/nats-io/nats-server/v2)

v2.15.0

Compare Source

Changelog

Refer to the 2.15 Upgrade Guide for backwards compatibility notes with 2.14.x. This release also contains all changes up to and including v2.14.7.

Go Version
Added

JetStream

Changed

JetStream

  • Streams now have a default limit of 1000 consumers, unless max_consumers is specified in the stream config or account limits (#​8337, #​8566)
    • Applications planning to use a large number of consumers on a stream should configure max_consumers in the stream config or account limits to an appropriately high number
    • The server-wide default of 1000 can be overridden by setting default_max_consumers in the JetStream limits, or can be disabled by setting to -1
    • This limit does not affect existing consumers and will not result in consumer deletions, only the creation of new consumers is prevented
  • Sync changes for replicated streams (#​8447)
    • When the sync_interval is set to always, replicated streams now sync their WAL entries but no longer sync upper stream layer writes
    • The synced log allows the stream to recover safely, but removing unnecessary syncs from the upper stream layer dramatically improves performance
    • Non-replicated R1 streams are not affected by this change and will continue to sync at the stream layer as normal
  • The js_raft_delete_range feature is now enabled by default (#​8520)

Leafnodes

  • The no_advertise option no longer includes the hub's own listener address (#​8451, contributed by @​freakes)
Improved

JetStream

  • Shorter wait for durable source/mirror consumer resets (#​8323)
    • When using durable consumers for sourcing or mirroring, the heartbeats now short-circuit the recreation backoff
  • An atomic batch for a single-replica stream run with sync: always now syncs messages as a group (#​8539, contributed by @​RainyPixel)
  • JetStream source/mirror reply subjects can now opt-in to be domain/account aware (#​8586, contributed by @​ayushk-1801)

MQTT

  • QOS 1 published into JetStream are pipelined for increased throughput (#​8415, contributed by @​levb)
Fixed

Leafnodes

  • Leafnode isolation using request_isolation, or with hub-enforced isolate, now works correctly across cluster nodes (#​8504)
Complete Changes

v2.14.8

Compare Source

Changelog

Refer to the 2.14 Upgrade Guide for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

Go Version
Dependencies
  • github.com/klauspost/compress v1.20.1 (#​8737)
  • github.com/nats-io/nats.go v1.53.1 (#​8737)
Changed

Gateways

  • Support for sending and handling the legacy $GR. reply prefix, used by servers prior to v2.1.2, has been removed (#​8615)
Improved

JetStream

  • Stalled source and mirror flow control is now reported in stream info and warning logs, making missing $JS.FC.> imports or exports easier to diagnose (#​8633)
  • Stream and consumer placement now prefers peers that have caught up with the metalayer, reducing delays in API responses (#​8643)
  • Improved the performance of deleting entries from and encoding AVL sequence sets (#​8646)
  • Fast batch publish now reports backward sequence gaps as well as forward gaps (#​8699)
  • Stream pending message calculations avoid unnecessary filestore cache access and handle deleted sequence ranges more efficiently (#​8680, #​8681)
  • Stream restore waits for the preferred node to become leader, avoiding an incorrect create response during clustered restore (#​8690)
  • Memory backed streams avoid copying message headers and bodies twice when storing messages (#​8652, contributed by @​randomizedcoder)

Monitoring

  • Leafz now reports whether a leafnode connection uses WebSockets (#​8683)

MQTT

  • Partial packets are no longer copied in full on every read, reducing allocations and buffer copying (#​8692)
Fixed

General

  • Concurrent account JWT updates no longer invalidate stream imports and interrupt message delivery (#​8610)
  • Configuration reloads no longer incorrectly disconnect operator mode clients that send an nkey (#​8609)
  • Connz requests selecting a connection by cid now correctly apply account, user and MQTT client ID filters (#​8613)
  • Pipelined client operations are no longer processed after a connection is rejected for exceeding the account's max_connections limit (#​8614)
  • Queue subscription deny permissions are now checked against the mapped delivery subject (#​8616)
  • Outstanding reply permissions are now preserved when inherited account permissions are refreshed without changing the response policy (#​8620, contributed by @​0xasritha)
  • Subscription deny filters are now rebuilt atomically when inherited account permissions are refreshed, preventing a window in which denied messages could be delivered (#​8622, contributed by @​0xasritha)
  • Unquoted configuration values beginning with a number and a size or exponent suffix, such as 0K1abc, are now correctly parsed as strings (#​8263, contributed by @​koriyoshi2041)
  • Account JWT updates now reject invalid subject mappings instead of reporting success, and failed replacements no longer remove existing mappings (#​8627, contributed by @​vulragrag-star)
  • Cached subscription results are now cleared when an already connected client sends another CONNECT, preventing stale results from being reused after an account change (#​8641, reported by @​Tan-JunWei)
  • Fixed several data races affecting service imports and exports during configuration reloads and account updates (#​8675)
  • Per-account routes no longer double count inbound account message and byte statistics (#​8677)
  • TLS certificate pin validation now checks the correct pins after a configuration reload (#​8679)
  • Fast batch ping no longer starts a new batch incorrectly (#​8714)
  • Auth callout rejections are now reported as authentication errors instead of account connection limit errors (#​8688, contributed by @​aniketatgithub)
  • Scoped ProxyRequired settings are now respected in JWTs and auth callouts (#​8694)
  • Subscription interest notifications are no longer missed when a subscription is added or removed concurrently (#​8703)
  • Fixed issues with auth callout auth_users bypass
  • Fixed a PDH counter buffer overflow on Windows

JetStream

  • Stream scale-down requests are now rejected when the target replica count has no configured account tier (#​8608)
  • Stale per-message TTL entries are now removed when their messages have already been deleted, avoiding repeated expiry scans and excess CPU and memory usage (#​8595, contributed by @​digitalstraw)
  • The maximum deliveries exceeded advisory is now sent correctly when a consumer's max_deliver is lowered below a message's existing delivery count (#​8605, contributed by @​zeke-lin)
  • The consumer created time is now preserved after recovery (#​8621)
  • Filestore compaction now respects the configured sync settings when replacing a message block (#​8629)
  • Fixed a race during filestore compaction that could cause consumers to skip messages or lose redelivery tracking (#​8623, contributed by @​as-clearview)
  • Concurrent updates to R1 consumers no longer lose API responses (#​8628)
  • Stream and consumer create and delete requests received during metalayer catchup now receive responses once catchup completes (#​8643)
  • R1 consumer create requests no longer lose their responses when the consumer is deleted immediately afterwards (#​8643)
  • Fixed a data race when handling consumer leader stepdown requests (#​8647)
  • Fixed a memory leak affecting pull requests and direct gets after a configuration reload when the system account is explicitly configured in the accounts block (#​8650, contributed by @​1995parham)
  • Fixed a panic when shutting down a clustered JetStream server immediately after startup (#​8707, contributed by @​clwluvw)
  • Idempo

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@rigelbuild-renovate rigelbuild-renovate Bot added the dependencies Pull requests that update a dependency file label Oct 11, 2026
@rigelbuild-renovate

rigelbuild-renovate Bot commented Oct 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 10 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=5 days

Details:

Package Change
github.com/antithesishq/antithesis-sdk-go v0.7.2-default-no-op -> v0.8.0-default-no-op
github.com/klauspost/compress v1.19.2 -> v1.20.0
github.com/klauspost/cpuid/v2 v2.3.0 -> v2.4.0
github.com/tinylib/msgp v1.6.1 -> v1.6.4
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 -> v1.47.0
golang.org/x/time v0.15.0 -> v0.16.0
google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 -> v0.0.0-20260928230214-8a89bd6388cc
google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 -> v0.0.0-20260928230214-8a89bd6388cc
google.golang.org/grpc v1.83.1 -> v1.83.2
gopkg.in/ini.v1 v1.67.2 -> v1.67.3

@trunk-io

trunk-io Bot commented Oct 11, 2026

Copy link
Copy Markdown

Merging to main in this repository is managed by Trunk.

  • To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

@github-actions

github-actions Bot commented Oct 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Compass engineering docs preview: https://renovate-go-dependencies.compass-eng-docs.pages.dev

Deployed from renovate/go-dependencies at c5eef62.

@rigelbuild-renovate
rigelbuild-renovate Bot force-pushed the renovate/go-dependencies branch 2 times, most recently from 3655a50 to 416f679 Compare October 12, 2026 00:52
@rigelbuild-renovate
rigelbuild-renovate Bot force-pushed the renovate/go-dependencies branch from 416f679 to c5eef62 Compare October 13, 2026 13:38

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mattwilkinsonn mattwilkinsonn Awaiting requested review from mattwilkinsonn mattwilkinsonn is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants