Skip to content

build(deps): bump the go-minor-patch group across 1 directory with 7 updates - #2

Open
dependabot[bot] wants to merge 1 commit into
fastagentfrom
dependabot/go_modules/go-minor-patch-4f648b2df0
Open

build(deps): bump the go-minor-patch group across 1 directory with 7 updates#2
dependabot[bot] wants to merge 1 commit into
fastagentfrom
dependabot/go_modules/go-minor-patch-4f648b2df0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-minor-patch group with 7 updates in the / directory:

Package From To
github.com/alicebob/miniredis/v2 2.39.0 2.40.0
github.com/larksuite/oapi-sdk-go/v3 3.12.0 3.12.2
github.com/minio/minio-go/v7 7.3.0 7.4.1
github.com/redis/go-redis/v9 9.22.0 9.23.0
github.com/slack-go/slack 0.29.0 0.30.1
golang.org/x/crypto 0.57.0 0.58.0
modernc.org/sqlite 1.58.0 1.61.0

Updates github.com/alicebob/miniredis/v2 from 2.39.0 to 2.40.0

Release notes

Sourced from github.com/alicebob/miniredis/v2's releases.

synctest, ZMPOP, BZMPOP, LMPOP

Changelog

Sourced from github.com/alicebob/miniredis/v2's changelog.

v2.40.0

Commits
  • cbf5d02 changelog for v2.40.0
  • 7052ec8 Merge pull request #458 from LuisFigueroaG/feat/lmpop
  • 79f0933 Merge pull request #457 from januththedev/fix/hrandfield-wrongtype
  • 18de130 keep local ip/port
  • 9df7508 int test
  • b29f632 Add LMPOP command
  • ff68fbc Return WRONGTYPE from HRANDFIELD on a non-hash key
  • e31e1a6 Merge pull request #454 from Lephiziel/add-zmpop-bzmpop
  • 77e6d26 Document ZMPOP and BZMPOP support
  • 6691586 Add ZMPOP and BZMPOP commands
  • Additional commits viewable in compare view

Updates github.com/larksuite/oapi-sdk-go/v3 from 3.12.0 to 3.12.2

Commits
  • db9f52d Merge pull request #249 from larksuite/feature/websocket-connection-config
  • acd0825 feat(ws): support connection host and handshake headers
  • c11ccc6 Merge pull request #248 from larksuite/bugfix/webhook-verification-token
  • c759024 feat: support dynamic webhook credentials providers
  • 3c94d63 fix: enforce configured webhook verification tokens
  • See full diff in compare view

Updates github.com/minio/minio-go/v7 from 7.3.0 to 7.4.1

Release notes

Sourced from github.com/minio/minio-go/v7's releases.

v7.4.1

What's Changed

Full Changelog: minio/minio-go@v7.4.0...v7.4.1

v7.4.0

Go 1.26 or later is now required. Go 1.25 is out of support, and golang.org/x/net v0.60.0 (the fix for GO-2026-6603, 6610, 6611, 6612 and 6617) requires Go 1.26 (#2313).

What's Changed

New Contributors

... (truncated)

Commits
  • 1a663bb update lib version to v7.4.1
  • c68b12c fix: abort failed uploads even when the caller cancels (#2318)
  • 8a72fb4 update lib version to v7.4.0
  • 85df9ce get: add opt-in parallel range GET via ParallelWorkers (#2317)
  • 91dc4dd fix: send RetainUntilDate in UTC (#2315)
  • 79b8caa compose: allow parallel upload-part-copy with NumThreads (#2316)
  • 1ab9013 docs: fix 'Recieved' typo in CancelBucketReplicationResync (#2314)
  • 21d2ec1 fix: trim whitespace from bucket location (#2274)
  • 450a9b3 credentials: allow NewKubernetesIdentity to read a projected token file (#2312)
  • aeb0641 docs: remove broken Slack badges (#2304)
  • Additional commits viewable in compare view

Updates github.com/redis/go-redis/v9 from 9.22.0 to 9.23.0

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.23.0

This is a minor release. It contains everything from 9.23.0-beta.1, so these notes cover the full 9.22.0 → 9.23.0 upgrade.

⚠️ Changes to check when you upgrade from 9.22.0:

  • Go 1.26 is now the minimum Go version (#4060). The go directive of the root module and of the submodules moved from 1.24 to 1.26, as part of the dependency bumps for govulncheck findings. Projects that build with Go 1.24 or 1.25 must upgrade the toolchain.
  • Each Client has a dedicated pipeline connection pool (#4002). This includes failover clients and cluster node clients. Pipeline, TxPipeline, and autopipeline operations use this pool, so they do not compete with regular commands for main-pool connections. The pool is for burst capacity only: it dials only when necessary, an unused pool holds zero connections, and if the pool is full an operation uses the main pool. Set PipelinePoolSize: -1 to get the previous single-pool behavior.
  • AutoPipelineOptions.MaxBatchBytes has a default of 128 KiB (before, there was no limit). The default prevents a write/reply deadlock; it is not a throughput control. The buffers of the pipeline pool also have a default of 128 KiB.

⚠️ Changes to experimental APIs since 9.23.0-beta.1 (no effect if you upgrade from 9.22.0):

  • AutoPipelineOptions.FullDuplexFastSubmit is removed (#4018). The submit channel is replaced by a queue that takes a full wave of commands in one lock, so the separate fast path is not necessary. Remove the field from your options.
  • Options.ClientSideCacheRefreshRecencyWindow is removed (#4034). Refresh-on-invalidate now reads again every cached entry of an invalidated key and does not look at how recently the entry was read. On a write-heavy keyspace this means refresh traffic across the full resident cache. Remove the field from your options.
  • LocalCache.LRUClock() is removed (#4034). It returned the recency token that the removed recency window used, and has no replacement. Remove calls to it.
  • ClientSideCacheInvalidationBatchWindow served stale values in beta.1 (#4033). Under load the batcher applied only ~15% of invalidations, and the cache served invalidated values with a ~100% hit rate. 9.23.0 applies all of them. If you used this option on beta.1, upgrade.

🚀 Highlights

Full-Duplex Auto-Pipelining (Experimental)

Set AutoPipelineOptions.FullDuplex to enable the full-duplex mode of the automatic pipeliner. The default mode sends one batch per round trip. In full-duplex mode the engine holds one pipeline-pool connection, and a writer goroutine and a reader goroutine move the ordered command stream in both directions at the same time. On a high-latency link each command completes in approximately one round-trip time (RTT) on a single connection. On a 50 ms WAN profile: ~389k ops/s at 52 ms p50, against ~207k ops/s at 116 ms on the half-duplex ordered path.

The mode works on both faces of a standalone Client (AutoPipeline() and AsyncAutoPipeline()), and natively on a ClusterClient when routing goes to masters only. On a cluster, one child engine per master sends each command to the node that owns its slot, and follows MOVED / ASK redirects and retryable replies (LOADING, READONLY, ...) through the usual cluster redirect path. With replica routing (ReadOnly, RouteByLatency, or RouteRandomly), the autopipeliner uses the half-duplex shard flushers, which obey the shard picker. Config().FullDuplex reports the mode in effect.

Options:

  • FullDuplexWindow — the maximum number of commands in flight (backpressure).
  • FullDuplexIdleTimeout and FullDuplexMaxHold — when the engine returns the held connection to the pool. The pool hooks then do re-authentication and maintenance-notification handoffs.
  • MaxFlushDelay — now also used in full-duplex mode (#4014). The writer waits only when enough commands are in flight, so low-concurrency callers keep the 1×RTT behavior. With MaxFlushDelay=250µs at 1024 callers: +22% ops/s and −26% p99. The default is 0, so this is opt-in.
  • NumShards — on a standalone Client, the number of full-duplex engines (#4022). See below.

Pipeline() on the full-duplex connection (#4021). Standalone Client only. Before, ap.Pipeline() used a pooled connection for each Exec. It now submits the batch to the engine as one contiguous run (FDPipelined), so replies come back in submit order, as on a dedicated connection. At 256–1024 callers with 10 commands per Exec: +49% to +52% throughput on one socket instead of ~150. Errors, retries, hooks, and metrics behave like an ordinary pipeline. A batch that cannot use the stream (a blocking command, a per-command read timeout, a diverted command, or a batch larger than the queue) falls back to the ordinary pipeline. TxPipeline stays on a pooled connection, because MULTI/EXEC needs connection affinity. On a ClusterClient, ap.Pipeline() is still the ordinary cluster pipeline. A batch that the queue cannot admit now reserves its slots and waits in a first-come line, so single commands cannot starve a long pipeline (#4057, merged as part of #4021) by @​vlady-kotsev.

Several engines on one client (#4022). With FullDuplex, NumShards > 1 now means N engines on one client: one pool, one hook chain, N held connections. Commands route by a hash of their first key, so commands on the same key stay on one connection and keep their order without Unordered. Keyless commands are distributed round-robin. An FDPipelined batch stays on one engine. The pipeline pool must hold at least NumShards connections for each full-duplex autopipeliner. More engines help only under high concurrency: with 10-command pipelines, 8 engines were 30% slower than 1 at 8 callers, equal at about 128 callers, and 2.2× faster at 1024 callers.

The full-duplex path supports blocking commands, Options.Limiter (one admission per written batch), per-command and pipeline hooks, OTel metrics, retry budgets (a NoRetry command is never sent again after it is on the wire), and seamless maintenance handoffs. Limits of the stream model:

  • A hook can observe a command, but cannot stop it. A ProcessHook that returns without calling next does not cancel the command on the full-duplex path; the command is already queued on the held connection. Run policy or kill-switch hooks on a plain client or on the half-duplex autopipeliner.
  • Diverted commands are not ordered with the stream. The engine diverts blocking commands, connection-hostile commands, and managed HIMPORT commands. On the async face, wait for the result of a diverted command before you submit a command that depends on it.
  • Single commands on the full-duplex stream do not use the client-side cache. If CSC is enabled, a cacheable command on the stream does not read or write the cache.
  • Duration metrics are recorded per reply. A command that fails before it reaches the reader (lease failure, limiter denial, retry exhaustion, close) calls the error callback but records no operation-duration sample.
rdb := redis.NewClient(&redis.Options{
	Addr: "localhost:6379",
	AutoPipelineOptions: &redis.AutoPipelineOptions{
		FullDuplex: true, // stream commands on one held connection, ~1 RTT each
	},
})
defer rdb.Close()
</tr></table>

... (truncated)

Changelog

Sourced from github.com/redis/go-redis/v9's changelog.

9.23.0 (2026-10-05)

This is a minor release. It contains everything from 9.23.0-beta.1, so these notes cover the full 9.22.0 → 9.23.0 upgrade. The release adds:

  • An experimental full-duplex mode for the automatic pipeliner, now with Pipeline() on the full-duplex connection and several engines on one client.
  • Refresh-on-invalidate and miss coalescing for client-side caching, and a faster cache read path.
  • Better distribution of cluster reads under latency-based routing.
  • Client.EphemeralConn, an opt-in limit on queued autopipeline commands, and many stability fixes.

⚠️ Changes to check when you upgrade from 9.22.0:

  • Go 1.26 is now the minimum Go version (#4060). The go directive of the root module and of the submodules moved from 1.24 to 1.26, as part of the dependency bumps for govulncheck findings. Projects that build with Go 1.24 or 1.25 must upgrade the toolchain.
  • Each Client has a dedicated pipeline connection pool (#4002). This includes failover clients and cluster node clients. Pipeline, TxPipeline, and autopipeline operations use this pool, so they do not compete with regular commands for main-pool connections. The pool is for burst capacity only: it dials only when necessary, an unused pool holds zero connections, and if the pool is full an operation uses the main pool. Set PipelinePoolSize: -1 to get the previous single-pool behavior.
  • AutoPipelineOptions.MaxBatchBytes has a default of 128 KiB (before, there was no limit). The default prevents a write/reply deadlock; it is not a throughput control. The buffers of the pipeline pool also have a default of 128 KiB.

⚠️ Changes to experimental APIs since 9.23.0-beta.1 (no effect if you upgrade from 9.22.0):

  • AutoPipelineOptions.FullDuplexFastSubmit is removed (#4018). The submit channel is replaced by a queue that takes a full wave of commands in one lock, so the separate fast path is not necessary. Remove the field from your options.
  • Options.ClientSideCacheRefreshRecencyWindow is removed (#4034). Refresh-on-invalidate now reads again every cached entry of an invalidated key and does not look at how recently the entry was read. On a write-heavy keyspace this means refresh traffic across the full resident cache. Remove the field from your options.
  • LocalCache.LRUClock() is removed (#4034). It returned the recency token that the removed recency window used, and has no replacement. Remove calls to it.
  • ClientSideCacheInvalidationBatchWindow served stale values in beta.1 (#4033). Under load the batcher applied only ~15% of invalidations, and the cache served invalidated values with a ~100% hit rate. 9.23.0 applies all of them. If you used this option on beta.1, upgrade.

🚀 Highlights

Full-Duplex Auto-Pipelining (Experimental)

Set AutoPipelineOptions.FullDuplex to enable the full-duplex mode of the automatic pipeliner. The default mode sends one batch per round trip. In full-duplex mode the engine holds one pipeline-pool connection, and a writer goroutine and a reader goroutine move the ordered command stream in both directions at the same time. On a high-latency link each command completes in approximately one round-trip time (RTT) on a single connection. On a 50 ms WAN profile: ~389k ops/s at 52 ms p50, against ~207k ops/s at 116 ms on the half-duplex ordered path.

The mode works on both faces of a standalone Client (AutoPipeline() and AsyncAutoPipeline()), and natively on a ClusterClient when routing goes to masters only. On a cluster, one child engine per master sends each command to the node that owns its slot, and follows MOVED / ASK redirects and retryable replies (LOADING, READONLY, ...) through the usual cluster redirect path. With replica routing (ReadOnly, RouteByLatency, or RouteRandomly), the autopipeliner uses the half-duplex shard flushers, which obey the shard picker. Config().FullDuplex reports the mode in effect.

Options:

  • FullDuplexWindow — the maximum number of commands in flight (backpressure).
  • FullDuplexIdleTimeout and FullDuplexMaxHold — when the engine returns the held connection to the pool. The pool hooks then do re-authentication and maintenance-notification handoffs.
  • MaxFlushDelay — now also used in full-duplex mode (#4014). The writer waits only when enough commands are in flight, so low-concurrency callers keep the 1×RTT behavior. With MaxFlushDelay=250µs at 1024 callers: +22% ops/s and −26% p99. The default is 0, so this is opt-in.
  • NumShards — on a standalone Client, the number of full-duplex engines (#4022). See below.

Pipeline() on the full-duplex connection (#4021). Standalone Client only. Before, ap.Pipeline() used a pooled connection for each Exec. It now submits the batch to the engine as one contiguous run (FDPipelined), so replies come back in submit order, as on a dedicated connection. At 256–1024 callers with 10 commands per Exec: +49% to +52% throughput on one socket instead of ~150. Errors, retries, hooks, and metrics behave like an ordinary pipeline. A batch that cannot use the stream (a blocking command, a per-command read timeout, a diverted command, or a batch larger than the queue) falls back to the ordinary pipeline. TxPipeline stays on a pooled connection, because MULTI/EXEC needs connection affinity. On a ClusterClient, ap.Pipeline() is still the ordinary cluster pipeline. A batch that the queue cannot admit now reserves its slots and waits in a first-come line, so single commands cannot starve a long pipeline (#4057, merged as part of #4021) by @​vlady-kotsev.

Several engines on one client (#4022). With FullDuplex, NumShards > 1 now means N engines on one client: one pool, one hook chain, N held connections. Commands route by a hash of their first key, so commands on the same key stay on one connection and keep their order without Unordered. Keyless commands are distributed round-robin. An FDPipelined batch stays on one engine. The pipeline pool must hold at least NumShards connections for each full-duplex autopipeliner. More engines help only under high concurrency: with 10-command pipelines, 8 engines were 30% slower than 1 at 8 callers, equal at about 128 callers, and 2.2× faster at 1024 callers.

The full-duplex path supports blocking commands, Options.Limiter (one admission per written batch), per-command and pipeline hooks, OTel metrics, retry budgets (a NoRetry command is never sent again after it is on the wire), and seamless maintenance handoffs. Limits of the stream model:

  • A hook can observe a command, but cannot stop it. A ProcessHook that returns without calling next does not cancel the command on the full-duplex path; the command is already queued on the held connection. Run policy or kill-switch hooks on a plain client or on the half-duplex autopipeliner.
  • Diverted commands are not ordered with the stream. The engine diverts blocking commands, connection-hostile commands, and managed HIMPORT commands. On the async face, wait for the result of a diverted command before you submit a command that depends on it.
  • Single commands on the full-duplex stream do not use the client-side cache. If CSC is enabled, a cacheable command on the stream does not read or write the cache.
  • Duration metrics are recorded per reply. A command that fails before it reaches the reader (lease failure, limiter denial, retry exhaustion, close) calls the error callback but records no operation-duration sample.
rdb := redis.NewClient(&redis.Options{
</tr></table>

... (truncated)

Commits
  • 6f2b263 chore(release): v9.23.0 (#4074)
  • ec50c69 feat(conn): add DisposableConn to discard on Close (#4039)
  • e3d2548 fix(pool): fix ConnStateMachine waiter races (#4072)
  • 2ee6d86 fix(pool): wake waiters when a connection is released to the pool (#4028)
  • 83d45ed fix:(proto): support uintptr in WriteArg (#4054)
  • c2002af docs(example): add full-duplex examples (#4061)
  • b5f8864 feat(autopipeline): add MaxQueuedCommands hard limit (#4070)
  • 89ecbc5 fix(options): reject invalid skip_verify values in ParseURL (#4064)
  • f813adc feat(autopipeline): run N full-duplex engines on one client (#4022)
  • 349bcf4 feat(autopipeline): run Pipeline on the full-duplex connection (#4021)
  • Additional commits viewable in compare view

Updates github.com/slack-go/slack from 0.29.0 to 0.30.1

Release notes

Sourced from github.com/slack-go/slack's releases.

v0.30.1

[!IMPORTANT] This is a security release. Upgrade if your app passes file URLs from messages or events to GetFile. Full details are in CHANGELOG.md.

Security

GetFile, GetFileContext and UploadToURL now send the token only to https URLs on slack.com, slack-gov.com and their subdomains, and to the host set with OptionAPIURL. Any other URL returns an error before a request is made.

The url_private of a remote or external file (File.IsExternal) points outside Slack, so GetFile(file.URLPrivate) sent the token to that host. See GHSA-3q3v-34v2-g88f.

A test that points GetFile at an httptest server must also pass that server to OptionAPIURL:

api := slack.New("xoxb-test", slack.OptionAPIURL(ts.URL+"/"))
err := api.GetFile(ts.URL+"/files-pri/T1-F1/a.txt", &buf)

Thanks to @​Lordseriouspig (what a handle... 😂) for the report.

Full Changelog: slack-go/slack@v0.30.0...v0.30.1

v0.30.0

[!WARNING] This release has breaking changes. It needs Go 1.26 or later, DeleteFileComment takes its arguments in a new order, and four methods have new variadic signatures that break interfaces and mocks. Read Breaking changes before you upgrade. Full details are in CHANGELOG.md.

Breaking changes

DeleteFileComment takes (fileID, commentID)

DeleteFileComment now uses the same argument order as DeleteFileCommentContext (#1611). Swap the arguments of every call:

// Before
err := api.DeleteFileComment(commentID, fileID)
// After
err := api.DeleteFileComment(fileID, commentID)

The compiler cannot catch this because both arguments are strings. A call that still passes a comment ID (Fc…) will return an error in order to try to catch it. YMMV so please raise an issue if you encounter issues

Variadic options on CreateManifest and GetUserInfo

CreateManifest, CreateManifestContext, GetUserInfo and GetUserInfoContext now take variadic options. An interface or mock that declares the old signature needs the new parameter:

// Before
type slackAPI interface {
      GetUserInfo(user string) (*slack.User, error)
      CreateManifest(manifest *slack.Manifest, token string) (*slack.ManifestResponse, error)
}
</tr></table>

... (truncated)

Changelog

Sourced from github.com/slack-go/slack's changelog.

[0.30.1] - 2026-10-04

Security

  • GetFile, GetFileContext and UploadToURL now send the token only to https URLs on slack.com, slack-gov.com and their subdomains, and to the host set with OptionAPIURL. Any other URL returns an error before a request is made. The url_private of a remote or external file (File.IsExternal) points outside Slack, so GetFile(file.URLPrivate) sent the token to that host (GHSA-3q3v-34v2-g88f). A test that points GetFile at an httptest server must also pass that server to OptionAPIURL.

[0.30.0] - 2026-10-04

Added

  • slackevents: Add the Agent messaging events app_context_changed (AppContextChangedEvent), agent_session_stopped (AgentSessionStoppedEvent) and agent_session_title_changed (AgentSessionTitleChangedEvent). The shared AppContext object is also exposed as AppHomeOpenedEvent.Context and MessageEvent.AppContext, which Slack populates once the app subscribes to app_context_changed. An AppContextEntity carries a string Value for channel, canvas and list entities and a Message for message_context entities, whose value is an object.
  • slackevents: EventsAPICallbackEvent now unmarshals authorizations, so the installations an event was delivered for can be read without a second request.
  • Add SetAgentSessionStatus and RenameAgentSession (plus Context variants) for the agents.sessions.setStatus and agents.sessions.rename methods, with AgentSessionStatus* constants for the accepted statuses.
  • CreateManifest now returns the new app's AppId, Credentials and OAuthAuthorizeUrl from apps.manifest.create. Slack sends the credentials only in this response (#1587).
  • Add Features.AgentView and Features.AssistantView for the features.agent_view and features.assistant_view app manifest settings, so a typed export and update keeps them (#1588, #1589).
  • Add Features.UnfurlDomains, Features.RichPreviews, Features.Search, OAuthConfig.PKCEEnabled, OAuthConfig.TokenManagementEnabled, Settings.IsMCPEnabled, Settings.TokenRotationEnabled, Settings.IncomingWebhooks, Settings.FunctionRuntime, Settings.SIWSLinks, EventSubscriptions.MetadataSubscriptions and OutgoingDomains for the matching app manifest keys, so a typed export and update keeps them. Features.Search covers the two callback IDs, not slackbot_metadata (#1588).
  • Add Attachment.HideColor (hide_color), which removes the color bar from a file unfurl sent with chat.unfurl (#1590).
  • Block Kit: Add TaskCardBlock.HideTitle (hide_title) and WithHideTitle, which hide the

... (truncated)

Commits
  • a015532 chore: bump to v0.30.1
  • 3e2e96d security: send the token only to Slack hosts in GetFile and UploadToURL
  • 39e1829 chore: bump to v0.30.0
  • a76e4ab refactor(users): take a scoped GetUserInfoOption on GetUserInfo (#1613)
  • 81b481f feat(manifests): add raw manifest methods and a team_id option for create (#1...
  • 0dbdd91 feat(users): make include_locale configurable (#1603)
  • e1f05bb GetFile: error on HTML download responses (#1582)
  • 4bce1c2 fix(usergroups): support documented response variants (#1605)
  • 3e17228 feat(manifests): add more fields to manifests_test (#1612)
  • 92e8b00 fix(files)!: take DeleteFileComment arguments as (fileID, commentID) (#1611)
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.57.0 to 0.58.0

Commits
  • 8fdf07b go.mod: update golang.org/x dependencies
  • 2437861 salsa20: fix keystream reuse in LoongArch LSX tail
  • c3db4df acme: prefer test log helpers in test contexts
  • 4e01a84 acme: adds support for profiles draft
  • 8f0f111 ssh: check that no Unicode-aware string function is used
  • b39ff6d ssh: add certificate algorithms for ML-DSA keys
  • 4465db3 ssh: add the ML-DSA public key algorithms
  • 83e695b ssh: implement ETM mode for CBC ciphers
  • 946083a ssh: only drop a trailing carriage return
  • 543dde9 ssh: accept known_hosts entries with a multi-word comment
  • Additional commits viewable in compare view

Updates modernc.org/sqlite from 1.58.0 to 1.61.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

  • 2026-10-21 v1.61.1:

    • Prepared statements are no longer parsed and planned again on every execution. Since v1.61.0, SQLite 3.54 expired a cached statement that has a col = ? term in a join or an ORDER BY query whenever the driver cleared its bindings after a run, so a statement prepared with db.Prepare or tx.Prepare cost about twice what it did in v1.60.1. Integer bindings now stay in place between executions, so a parameter bound to 0 or 1 does not re-prepare it either. Resolves [GitLab issue #264](https://gitlab.com/cznic/sqlite/-/issues/264). See [GitLab merge request #147](https://gitlab.com/cznic/sqlite/-/merge_requests/147), thanks Roman Khafizianov (@​requilence)!
    • Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!
    • Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.
    • Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!
    • The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.
    • Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

  • 2026-10-21 v1.61.0:

  • 2026-09-29 v1.60.1:

    • Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

  • 2026-09-28 v1.60.0:

    • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
    • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and so...

      Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 19, 2026
@dependabot dependabot Bot changed the title chore(deps): bump the go-minor-patch group with 7 updates chore(deps): bump the go-minor-patch group across 1 directory with 7 updates Oct 19, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-minor-patch-4f648b2df0 branch from 4e2223d to 87e50e8 Compare October 19, 2026 19:46
@dependabot dependabot Bot changed the title chore(deps): bump the go-minor-patch group across 1 directory with 7 updates build(deps): bump the go-minor-patch group across 1 directory with 7 updates Oct 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-minor-patch-4f648b2df0 branch from 87e50e8 to f72b031 Compare October 22, 2026 17:00
@dependabot
build(deps): bump the go-minor-patch group across 1 directory with 7 …
c3416c9 
…updates

Bumps the go-minor-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/alicebob/miniredis/v2](https://github.com/alicebob/miniredis) | `2.39.0` | `2.40.0` |
| [github.com/larksuite/oapi-sdk-go/v3](https://github.com/larksuite/oapi-sdk-go) | `3.12.0` | `3.12.2` |
| [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.3.0` | `7.4.1` |
| [github.com/redis/go-redis/v9](https://github.com/redis/go-redis) | `9.22.0` | `9.23.0` |
| [github.com/slack-go/slack](https://github.com/slack-go/slack) | `0.29.0` | `0.30.1` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.58.0` | `1.61.0` |



Updates `github.com/alicebob/miniredis/v2` from 2.39.0 to 2.40.0
- [Release notes](https://github.com/alicebob/miniredis/releases)
- [Changelog](https://github.com/alicebob/miniredis/blob/master/CHANGELOG.md)
- [Commits](alicebob/miniredis@v2.39.0...v2.40.0)

Updates `github.com/larksuite/oapi-sdk-go/v3` from 3.12.0 to 3.12.2
- [Release notes](https://github.com/larksuite/oapi-sdk-go/releases)
- [Changelog](https://github.com/larksuite/oapi-sdk-go/blob/v3_main/changelog.md)
- [Commits](larksuite/oapi-sdk-go@v3.12.0...v3.12.2)

Updates `github.com/minio/minio-go/v7` from 7.3.0 to 7.4.1
- [Release notes](https://github.com/minio/minio-go/releases)
- [Commits](minio/minio-go@v7.3.0...v7.4.1)

Updates `github.com/redis/go-redis/v9` from 9.22.0 to 9.23.0
- [Release notes](https://github.com/redis/go-redis/releases)
- [Changelog](https://github.com/redis/go-redis/blob/master/RELEASE-NOTES.md)
- [Commits](redis/go-redis@v9.22.0...v9.23.0)

Updates `github.com/slack-go/slack` from 0.29.0 to 0.30.1
- [Release notes](https://github.com/slack-go/slack/releases)
- [Changelog](https://github.com/slack-go/slack/blob/master/CHANGELOG.md)
- [Commits](slack-go/slack@v0.29.0...v0.30.1)

Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0
- [Commits](golang/crypto@v0.57.0...v0.58.0)

Updates `modernc.org/sqlite` from 1.58.0 to 1.61.0
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.58.0...v1.61.0)

---
updated-dependencies:
- dependency-name: github.com/alicebob/miniredis/v2
  dependency-version: 2.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/larksuite/oapi-sdk-go/v3
  dependency-version: 3.12.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/minio/minio-go/v7
  dependency-version: 7.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/redis/go-redis/v9
  dependency-version: 9.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/slack-go/slack
  dependency-version: 0.30.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: modernc.org/sqlite
  dependency-version: 1.60.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-minor-patch-4f648b2df0 branch from f72b031 to c3416c9 Compare October 26, 2026 19:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants