Skip to content

chore(deps): bump the go-minor-and-patch group with 6 updates - #886

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-and-patch-36f569e5e9
Open

chore(deps): bump the go-minor-and-patch group with 6 updates#886
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-and-patch-36f569e5e9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-minor-and-patch group with 6 updates:

Package From To
github.com/go-jose/go-jose/v4 4.1.8 4.1.9
github.com/prometheus/client_golang 1.24.1 1.25.0
github.com/twilio/twilio-go 1.32.0 1.33.0
golang.org/x/net 0.61.0 0.62.0
google.golang.org/grpc 1.84.0 1.85.0
modernc.org/sqlite 1.60.1 1.61.1

Updates github.com/go-jose/go-jose/v4 from 4.1.8 to 4.1.9

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.9

Fixed

  • OpaqueSigner now supports unrecognized public key types again (#325, fixes a regression in v4.1.5)
  • Parsing a JWK with an unsupported elliptic curve, or a too-big RSA modulus, now returns ErrUnsupportedKeyType (go-jose/go-jose#327)

Full Changelog: go-jose/go-jose@v4.1.8...v4.1.9

Commits
  • 3c8a86c jwk: return ErrUnsupportedKeyType in more cases (#327)
  • e380088 jwk: return ErrUnsupportedEllipticCurve for unknown EC curves (#279)
  • baa5ec7 opaque: allow unknown public key types in OpaqueSigner (#325)
  • See full diff in compare view

Updates github.com/prometheus/client_golang from 1.24.1 to 1.25.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.25.0

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

What's Changed

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135
Commits

Updates github.com/twilio/twilio-go from 1.32.0 to 1.33.0

Release notes

Sourced from github.com/twilio/twilio-go's releases.

v1.33.0

Twiml

  • Add ElevenLabs voices to <Say> verb.
  • Add partialPromptOnHangup, eagerEotThreshold, asrSmartFormat, ttsTextNormalization, ttsLanguageTextNormalization, elevenlabsLanguageTextNormalization, includeInPrompt, customerName, applicationReconnect, echoPromptFiltering, turnDetection attributes to <ConversationRelay>, and hints, asrSmartFormat, ttsTextNormalization, ttsLanguageTextNormalization attributes to <Language>

Api

  • API Changes

  • 2026-09-22

  • Simplified the criteria field description.

  • 2026-09-18

  • Moved readOnly on the snapshot count fields (profileCount, partitionCount) from the shared schema to the response usage sites, so the counts stay read-only in responses (no change for API consumers).

  • 2026-09-17

  • Renamed 3 Get* operations to Fetch* to match the operationId standard: FetchCohort, FetchSnapshot, FetchOperation.
  • Removed the unused ExpressionId schema and made the operation error example cohort-native, so no aud_ identifiers remain in the spec.
  • Kept libraryVisibility: hidden across the whole surface (info, path items, and operations).

  • 2026-09-08

  • Removed the deprecated header-based-versioning unified specs, consolidating audiences onto the path-based api.twilio.com/v1 surface.

  • 2026-08-31

  • Published the unified audiences spec at api.twilio.com/v1.

  • 2026-08-26

  • Fixed the Cohort operation response mapping in the unified audiences API.

  • 2026-08-19

  • Migrated the unified audiences spec to the Cohort surface (Audiences renamed to Cohorts).
  • Switched downstreamServiceName to audiences-domain.

  • 2026-08-05

  • Added the api.unified.version.preview beta feature.
  • Made the unified APIs available in prod us1.

  • 2026-07-30

  • Fixed example values.

  • 2026-07-29

  • Added the initial version of the audiences API to the unified APIs.

  • 2026-07-20

  • Deployed the audiences-domain OAS to the dev edge.

  • 2026-07-06

  • Added the prod-us1 realm to the audiences public API.

  • 2026-06-23

  • Changed the storeType enum from MEMORA to TWILIO.

  • 2026-05-04

  • Added the stage-us1 realm and x-rate-limit to the audiences API.

  • 2026-04-08

  • Added the initial audiences endpoints.

  • API Changes

  • 2026-10-28

  • Enabled the Redaction Configurations and Redaction Catalog resources in prod-us1.

  • 2026-10-27

  • Enabled the Redaction Configurations and Redaction Catalog resources in stage-us1.

  • 2026-09-28

  • Added the Redaction Configurations resource (/v1/RedactionConfigurations) as a private beta in dev-us1, gated by the api.redaction.enabled beta feature.
  • Added the Redaction Catalog resource (/v1/RedactionCatalog), under the same beta feature. It is restricted to One Console.
  • Add ApplicationSid parameter to TwimlSession and TwimlProcess Create endpoints

... (truncated)

Changelog

Sourced from github.com/twilio/twilio-go's changelog.

[2026-11-05] Version 1.33.0

Twiml

  • Add ElevenLabs voices to <Say> verb.
  • Add partialPromptOnHangup, eagerEotThreshold, asrSmartFormat, ttsTextNormalization, ttsLanguageTextNormalization, elevenlabsLanguageTextNormalization, includeInPrompt, customerName, applicationReconnect, echoPromptFiltering, turnDetection attributes to <ConversationRelay>, and hints, asrSmartFormat, ttsTextNormalization, ttsLanguageTextNormalization attributes to <Language>

Api

  • API Changes

  • 2026-09-22

  • Simplified the criteria field description.

  • 2026-09-18

  • Moved readOnly on the snapshot count fields (profileCount, partitionCount) from the shared schema to the response usage sites, so the counts stay read-only in responses (no change for API consumers).

  • 2026-09-17

  • Renamed 3 Get* operations to Fetch* to match the operationId standard: FetchCohort, FetchSnapshot, FetchOperation.
  • Removed the unused ExpressionId schema and made the operation error example cohort-native, so no aud_ identifiers remain in the spec.
  • Kept libraryVisibility: hidden across the whole surface (info, path items, and operations).

  • 2026-09-08

  • Removed the deprecated header-based-versioning unified specs, consolidating audiences onto the path-based api.twilio.com/v1 surface.

  • 2026-08-31

  • Published the unified audiences spec at api.twilio.com/v1.

  • 2026-08-26

  • Fixed the Cohort operation response mapping in the unified audiences API.

  • 2026-08-19

  • Migrated the unified audiences spec to the Cohort surface (Audiences renamed to Cohorts).
  • Switched downstreamServiceName to audiences-domain.

  • 2026-08-05

  • Added the api.unified.version.preview beta feature.
  • Made the unified APIs available in prod us1.

  • 2026-07-30

  • Fixed example values.

  • 2026-07-29

  • Added the initial version of the audiences API to the unified APIs.

  • 2026-07-20

  • Deployed the audiences-domain OAS to the dev edge.

  • 2026-07-06

  • Added the prod-us1 realm to the audiences public API.

  • 2026-06-23

  • Changed the storeType enum from MEMORA to TWILIO.

  • 2026-05-04

  • Added the stage-us1 realm and x-rate-limit to the audiences API.

  • 2026-04-08

  • Added the initial audiences endpoints.

  • API Changes

  • 2026-10-28

  • Enabled the Redaction Configurations and Redaction Catalog resources in prod-us1.

  • 2026-10-27

  • Enabled the Redaction Configurations and Redaction Catalog resources in stage-us1.

  • 2026-09-28

  • Added the Redaction Configurations resource (/v1/RedactionConfigurations) as a private beta in dev-us1, gated by the api.redaction.enabled beta feature.
  • Added the Redaction Catalog resource (/v1/RedactionCatalog), under the same beta feature. It is restricted to One Console.

... (truncated)

Commits
  • d989d7f [Librarian] Release librarian/release-20261105-065257 (#357)
  • dd40321 support HMAC-SHA256 webhook signatures in RequestValidator (#356)
  • See full diff in compare view

Updates golang.org/x/net from 0.61.0 to 0.62.0

Commits
  • 3de643d html: check all ancestor namespace transitions when rendering raw text
  • 05c76ee ipv4, ipv6: avoid slice bounds panics on empty batch or BPF filter
  • dad306f ipv6: avoid out-of-bounds panic in ICMPFilter
  • 9c0565a ipv4: fix TTL control message parsing on big-endian Linux and Solaris
  • 9425eb3 internal/socket, ipv4, ipv6: avoid panic on empty control message on non-Unix
  • 4b10404 ipv4, ipv6: avoid nil parse function call in ControlMessage.Parse
  • afcf8cd ipv4: fix several missing bounds checks
  • 4af4fce html: avoid quadratic complexity when coalescing text nodes
  • 7e56200 quic: per-path connection ids
  • See full diff in compare view

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

  • stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)

Bug Fixes

  • transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
  • server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
  • server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
  • xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
Commits

Updates modernc.org/sqlite from 1.60.1 to 1.61.1

Release notes

Sourced from modernc.org/sqlite's releases.

v1.61.1

Signed provenance for this release: the two files below. VERIFYING.md in the repository says how to check them.

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

  • 2026-11-07 v1.62.0:

    • Add illumos/amd64, tested on an OmniOS builder. Resolves [GitLab issue #210](https://gitlab.com/cznic/sqlite/-/issues/210), thanks Jasper Siepkes (@​siepkes), who also started the modernc.org/libc port!
    • Re-vendor lib/ from modernc.org/libsqlite3 v1.16.0 and vec/ from modernc.org/libsqlite_vec v0.8.0; SQLite stays 3.54.1 and sqlite-vec v0.1.9. The pinned modernc.org/libc becomes v1.80.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Add opt-in syncing with fdatasync(2), off by default: Fdatasync(true) makes commits sync with fdatasync instead of fsync, process-wide, which skips the timestamp update fsync forces and keeps a commit just as durable. FdatasyncEnabled reports the setting; on macOS and Windows Fdatasync returns ErrFdatasyncUnavailable. Resolves [GitHub issue #10](modernc-org/sqlite#10), thanks aibeshkov!
    • Limit now works on a connection handed out by a driver.Connector that wraps the ones NewConnector opens, provided the wrapper has an Unwrap() driver.Conn method; it used to fail with unexpected driverConn type. NewConnector now also says which optional interfaces such a wrapper must forward. Resolves [GitHub issue #11](modernc-org/sqlite#11), thanks Andres Morey (@​amorey)!

  • 2026-10-31 v1.61.1:

    • Prepared statements are no longer parsed and planned again on every execution. Since v1.61.0, SQLite 3.54 expired a cached statement that has a col = ? term in a join or an ORDER BY query whenever the driver cleared its bindings after a run, so a statement prepared with db.Prepare or tx.Prepare cost about twice what it did in v1.60.1. Integer bindings now stay in place between executions, so a parameter bound to 0 or 1 does not re-prepare it either. Resolves [GitLab issue #264](https://gitlab.com/cznic/sqlite/-/issues/264). See [GitLab merge request #147](https://gitlab.com/cznic/sqlite/-/merge_requests/147), thanks Roman Khafizianov (@​requilence)!
    • Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!
    • Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.
    • Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!
    • The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.
    • Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

  • 2026-10-21 v1.61.0:

  • 2026-09-29 v1.60.1:

    • Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

  • 2026-09-28 v1.60.0:

    • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
    • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.
    • make vendor now writes vendor.json, the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries; the test suite fails when they no longer match. Tooling only. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).
    • vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.
    • Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.
    • The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.
    • Document three limits of the pluggable page cache on RegisterPageCache and Cache: it cannot be combined with modernc.org/sqlite/vec, PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines. Documentation only.
    • Document in the package documentation that state set on a pooled connection is inherited by the next caller to borrow it, and that a connection reached through sql.Conn.Raw is not safe for concurrent use. Documentation only.
    • Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so anything after a ; runs too. Recommended for any application whose DSN is not a compile-time constant.
    • Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof, which have always worked in a DSN starting with file:, and the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257). Documentation only.
    • Add SECURITY.md, the vulnerability reporting policy: three private channels, what is in scope, that only the latest release is supported, and how a confirmed report is disclosed, including an entry in the Go vulnerability database so govulncheck reports it. IRP.md, linked from it, is the maintainers' incident response plan. Documentation only.
    • Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Documentation only.
    • Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries with all seventeen license texts in full, and a Software Bill of Materials, sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), explained in SBOM.md. Both cover what a module-graph tool cannot see: the transpiled SQLite and sqlite-vec C, and the upstreams modernc.org/libc carries, musl among them. Documentation only.

  • 2026-09-15 v1.59.0:

    • Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, memmove, memset, memcmp and strlen with native Go, cutting CPU time on query-heavy workloads by up to a third; see the new Performance section below. As always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does; see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

... (truncated)

Commits
  • 014351f CHANGELOG.md: v1.61.1
  • e699042 conn.go, stmt.go, rows.go: unbind only the parameters that point into the dri...
  • 519e1d2 Merge branch 'clear-bindings-reprepare' into 'master'
  • 0afd2c8 stmt.go, reprepare_test.go, AUTHORS, CONTRIBUTORS: stop re-preparing cached s...
  • 683b727 vfs: implement xDelete and the write methods SQLite could still reach
  • 78c3b0c Merge branch 'threat-model' into 'master'
  • 56d8077 Merge branch 'vfs-readonly-open' into 'master'
  • 0ea9fb8 THREAT-MODEL.md: a row for the vfs.New write panic
  • 67055eb CHANGELOG.md: the vfs.New write panic
  • bbce27d CHANGELOG.md: the threat model and the short-read assertion
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the go-minor-and-patch group with 6 updates
e0d234b 
Bumps the go-minor-and-patch group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.1.8` | `4.1.9` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.1` | `1.25.0` |
| [github.com/twilio/twilio-go](https://github.com/twilio/twilio-go) | `1.32.0` | `1.33.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.61.0` | `0.62.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.84.0` | `1.85.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.60.1` | `1.61.1` |


Updates `github.com/go-jose/go-jose/v4` from 4.1.8 to 4.1.9
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](go-jose/go-jose@v4.1.8...v4.1.9)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

Updates `github.com/twilio/twilio-go` from 1.32.0 to 1.33.0
- [Release notes](https://github.com/twilio/twilio-go/releases)
- [Changelog](https://github.com/twilio/twilio-go/blob/main/CHANGES.md)
- [Commits](twilio/twilio-go@v1.32.0...v1.33.0)

Updates `golang.org/x/net` from 0.61.0 to 0.62.0
- [Commits](golang/net@v0.61.0...v0.62.0)

Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.84.0...v1.85.0)

Updates `modernc.org/sqlite` from 1.60.1 to 1.61.1
- [Release notes](https://gitlab.com/cznic/sqlite/tags)
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.60.1...v1.61.1)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-and-patch
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: github.com/twilio/twilio-go
  dependency-version: 1.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: golang.org/x/net
  dependency-version: 0.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: google.golang.org/grpc
  dependency-version: 1.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: modernc.org/sqlite
  dependency-version: 1.61.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 9, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants