chore(deps): bump the go-modules group across 1 directory with 39 updates

[dependabot]

Bumps the go-modules group with 30 updates in the / directory:

Package	From	To
cloud.google.com/go/pubsub/v2	2.6.1	2.7.0
github.com/Azure/azure-sdk-for-go/sdk/azcore	1.23.0	1.23.1
github.com/Azure/azure-sdk-for-go/sdk/azidentity	1.14.0	1.14.1
github.com/aws/aws-lambda-go	1.54.0	1.55.0
github.com/aws/aws-sdk-go-v2	1.43.5	1.47.0
github.com/aws/aws-sdk-go-v2/config	1.32.36	1.33.4
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue	1.20.60	1.21.4
github.com/aws/aws-sdk-go-v2/service/cloudwatch	1.66.4	1.72.0
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs	1.82.1	1.87.0
github.com/aws/aws-sdk-go-v2/service/sns	1.42.5	1.47.0
github.com/aws/aws-sdk-go-v2/service/sqs	1.46.5	1.52.0
github.com/dapr/dapr	1.18.2	1.18.4
github.com/getsentry/sentry-go	0.48.0	0.49.0
github.com/jackc/pgx/v5	5.10.0	5.11.0
github.com/mmcdole/gofeed	1.3.0	1.4.2
github.com/modelcontextprotocol/go-sdk	1.6.0	1.8.0
github.com/posthog/posthog-go	1.23.0	1.25.1
github.com/quic-go/quic-go	0.61.0	0.62.0
github.com/rabbitmq/amqp091-go	1.13.0	1.14.0
github.com/redis/go-redis/v9	9.21.0	9.22.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	0.67.0	0.71.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	1.45.0	1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	1.45.0	1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	1.45.0	1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	1.45.0	1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	1.45.0	1.46.0
go.opentelemetry.io/otel/exporters/prometheus	0.67.0	0.68.0
k8s.io/apimachinery	0.36.3	0.37.0
k8s.io/client-go	0.36.3	0.37.0
modernc.org/sqlite	1.56.0	1.58.0

Updates cloud.google.com/go/pubsub/v2 from 2.6.1 to 2.7.0

Release notes

Sourced from cloud.google.com/go/pubsub/v2's releases.

pubsub: v2.7.0

2.7.0 (2026-08-26)

Features

• Update API sources and regenerate (#20427) (eb07af9)

pubsub: v2.6.2

2.6.2 (2026-08-19)

Bug Fixes

• pubsub/v2: Update ackID batch size to 1000 (#20393) (530b88a), refs #20391

Commits

• 7801736 chore(main): release pubsub 2.7.0 (#20429)
• eb07af9 feat: update API sources and regenerate (#20427)
• 3ab7d13 chore(main): release storage 1.65.1 (#20420)
• 25e6d40 chore: update librarian to v0.39.0 (#20423)
• 0d8983d chore(agentplatform): Remove the tools submodule from AgentPlatform.
• 08d06c0 fix(internal/kokoro): skip testing modules with no Go source files (#20419)
• 081d506 BREAKING_CHANGE(agentplatform): Migrate Memory Bank methods to `client.memory...
• 574d42d chore(storage): remove redundant internal OTEL attributes (#20421)
• dbb5f6f fix(storage): enforce gRPC writer chunk retry deadlines by tying timers to se...
• 54e5a42 chore(main): release spanner 1.95.0 (#20415)
• Additional commits viewable in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.23.0 to 1.23.1

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azcore's releases.

sdk/azcore/v1.23.1

1.23.1 (2026-08-27)

Other Changes

• Upgraded dependencies.

Commits

• d86ae78 Prep azcore for release (#27471)
• 33dd768 [azwebpubsub] Fix GenerateClientAccessURL on the TokenCredential path (#27422)
• a27ca57 Upgrade TypeSpec Go emitter dependencies (#27466)
• af75eb0 [AutoPR sdk-resourcemanager/purestorageblock/armpurestorageblock]-generated-f...
• 8dcff8c [AutoPR sdk-resourcemanager/redisenterprise/armredisenterprise]-generated-fro...
• e4569f1 [AutoPR sdk-resourcemanager/chaos/armchaos]-generated-from-SDK Generation - G...
• 7069bf8 [AutoPR sdk-resourcemanager/horizondb/armhorizondb]-generated-from-SDK Genera...
• 5ceffce Bump gh-aw to v0.86.2 for mgmt review workflow (#27460)
• 663b6ce Enhance azblob perf tests with OAuth, parallel setup, and profiling (#27324)
• cf17431 [AutoPR sdk-resourcemanager/containerservice/armcontainerservice]-generated-f...
• Additional commits viewable in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.0 to 1.14.1

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/azidentity/v1.14.1

1.14.1 (2026-08-27)

Other Changes

• Upgraded dependencies

Commits

• 920e79a Prep azidentity for release (#27473)
• d86ae78 Prep azcore for release (#27471)
• 33dd768 [azwebpubsub] Fix GenerateClientAccessURL on the TokenCredential path (#27422)
• a27ca57 Upgrade TypeSpec Go emitter dependencies (#27466)
• af75eb0 [AutoPR sdk-resourcemanager/purestorageblock/armpurestorageblock]-generated-f...
• 8dcff8c [AutoPR sdk-resourcemanager/redisenterprise/armredisenterprise]-generated-fro...
• e4569f1 [AutoPR sdk-resourcemanager/chaos/armchaos]-generated-from-SDK Generation - G...
• 7069bf8 [AutoPR sdk-resourcemanager/horizondb/armhorizondb]-generated-from-SDK Genera...
• 5ceffce Bump gh-aw to v0.86.2 for mgmt review workflow (#27460)
• 663b6ce Enhance azblob perf tests with OAuth, parallel setup, and profiling (#27324)
• Additional commits viewable in compare view

Updates github.com/aws/aws-lambda-go from 1.54.0 to 1.55.0

Release notes

Sourced from github.com/aws/aws-lambda-go's releases.

v1.55.0

What's changed

• Bump min go version to 1.26 (#638) — @​maxday
• Enable Go 1.27 compatibility & fix serialization test bugs (#637) — @​djedward
  • Fixed TestMalformedJson to correctly pass a pointer to json.Unmarshal, matching the intended behavior after Go 1.27's JSON library changes.
  • Relaxed error-message matching in tests so both Go 1.27 and earlier versions pass.
  • Hardened flaky integration tests (TestEnableSigterm, TestConcurrencyWithRIE) with polling and increased timeouts.
• Add missing userNotFound field to Cognito auth trigger requests (#630) — @​anzheyazzz
  • Adds 3 missing userNotFound fields to the Cognito auth trigger request events.
• Pin GitHub Actions to commit SHAs (#623) — @​maxday
  • Hardens CI supply-chain security by pinning actions to their SHAs.

Full changelog: aws/aws-lambda-go@v1.54.0...v1.55.0

Commits

• 6800157 feat: bump min go version to 1.26 (#638)
• f0e2311 Fix serialization test bugs and enable Go 1.27 compat (#637)
• 87e344b Merge pull request #630 from aws/fix/cognito-usernotfound-missing-fields
• d6f4d23 Add missing userNotFound field to Cognito auth trigger requests
• 815d21f fix: pin github actions sha (#623)
• See full diff in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.43.5 to 1.47.0

Commits

• b189f38 Release 2026-09-09
• 0905d5f Regenerated Clients
• 9cc4bc5 Update API model
• 126fe2d fix GetObject deadlock (#3554)
• 5126885 Remove retry metrics header middleware (#3546)
• bd8de4d Expand S3 operations that check for an error inside an HTTP 200 response (wav...
• 394ee64 Release 2026-09-08
• 3c9cb8b Regenerated Clients
• 6f85682 Update endpoints model
• cc3942b Update API model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.36 to 1.33.4

Commits

• b189f38 Release 2026-09-09
• 0905d5f Regenerated Clients
• 9cc4bc5 Update API model
• 126fe2d fix GetObject deadlock (#3554)
• 5126885 Remove retry metrics header middleware (#3546)
• bd8de4d Expand S3 operations that check for an error inside an HTTP 200 response (wav...
• 394ee64 Release 2026-09-08
• 3c9cb8b Regenerated Clients
• 6f85682 Update endpoints model
• cc3942b Update API model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue from 1.20.60 to 1.21.4

Commits

• 2de0027 Release 2023-11-28
• f0c890c Regenerated Clients
• e032d9e Update endpoints model
• 507661f Update API model
• 4128360 fix: respect functional option modifications to RetryMaxAttempts (#2390)
• d66ab2c Release 2023-11-27.2
• a264f87 Regenerated Clients
• 7d50b35 Update API model
• 13546ab Release 2023-11-27
• 59ce389 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/cloudwatch from 1.66.4 to 1.72.0

Commits

• 9dbe383 Release 2025-01-03
• 2fb7c64 Regenerated Clients
• 4dd675d Update endpoints model
• 11494d4 Update API model
• 85a08fc Release 2025-01-02
• 4babd6c Regenerated Clients
• 8290236 Update endpoints model
• 75545e9 Update API model
• a655009 Release 2024-12-28
• a7b93d2 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.82.1 to 1.87.0

Commits

• 0ab2d66 Release 2025-08-11
• ae81008 Regenerated Clients
• 6cf56c1 Update endpoints model
• 5e25292 Update API model
• 14e9fb7 upgrade to smithy v1.61.0
• fcdf6ab regen
• 2230299 fix changelog
• 76aa8d7 feat: add support for per service options to Config (#3145)
• 8afe327 Release 2025-08-08
• 4d6e55d Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/dynamodb from 1.63.2 to 1.68.0

Commits

• 18fea5d Release 2024-11-21
• 480ffa8 Regenerated Clients
• 4075928 Update endpoints model
• 2a88650 Update API model
• c527ee8 Release 2024-11-20
• fdd6839 Regenerated Clients
• 6809be0 Update endpoints model
• f040881 Update API model
• 249090e Release 2024-11-19
• c158e16 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/sns from 1.42.5 to 1.47.0

Commits

• b189f38 Release 2026-09-09
• 0905d5f Regenerated Clients
• 9cc4bc5 Update API model
• 126fe2d fix GetObject deadlock (#3554)
• 5126885 Remove retry metrics header middleware (#3546)
• bd8de4d Expand S3 operations that check for an error inside an HTTP 200 response (wav...
• 394ee64 Release 2026-09-08
• 3c9cb8b Regenerated Clients
• 6f85682 Update endpoints model
• cc3942b Update API model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/sqs from 1.46.5 to 1.52.0

Commits

• d7a7049 Release 2024-03-13
• 625e1e6 Regenerated Clients
• 1ed868a Update API model
• e715922 Merge customizations for S3
• b30a1cc Release 2024-03-12
• 71783e1 Regenerated Clients
• f434ec2 Update API model
• 9bac90a Release 2024-03-11
• c3c777b Regenerated Clients
• 2e16e91 Update API model
• Additional commits viewable in compare view

Updates github.com/dapr/dapr from 1.18.2 to 1.18.4

Release notes

Sourced from github.com/dapr/dapr's releases.

Dapr Runtime v1.18.4

Dapr 1.18.4

This update contains the following bug fixes:

• Workflow left permanently PENDING when its start reminder fails during a scheduler restart
• Workflow stranded permanently PENDING when its start reminder fired before the creation commit
• Workflow left permanently PENDING when a placement rebalance interrupted its start reminder registration during a Scheduler outage
• Parent workflow deadlocked forever when a child workflow created after ContinueAsNew collided with a still-running child's instance ID
• Output binding invocations over gRPC forwarding binary trace metadata to components
• Force purge failed for every workflow when history signing was enabled
• Workflow wrongly failed as tampered when a stale completion arrived after ContinueAsNew or a transient state store fault
• Workflow terminate silently dropped when delivered in the same batch as other events
• Workflow schedule and status waits failed with a stalled-actor error while a workflow was stalled
• Workflow NewGuid and other SDK-derived deterministic values repeated after ContinueAsNew
• Hot-reloaded workflow access policy listed in metadata before it was enforced
• Workflow wrongly failed as tampered when a child workflow creation was rejected under history signing
• Child workflow completion was delivered to the parent before the child committed its own state
• Force purge left the workflow actor serving and writing its stale in-memory state
• A child workflow that continued as new could not report its completion under history signing
• Workflow stuck RUNNING after ContinueAsNew when the new generation's first execution was lost
• Workflow stuck RUNNING under WorkflowsClusteredDeployment when a turn was answered with the previous turn's result
• Pluggable pub/sub components delivered messages to the application one at a time

Workflow left permanently PENDING when its start reminder fails during a scheduler restart

Problem

Creating a workflow while a Scheduler replica was shutting down could leave the new instance permanently stuck in PENDING. The workflow actor commits its state (status PENDING) and then registers the start- reminder that launches execution as a separate Scheduler call. When that call failed with rpc error: code = Unknown desc = cron is closed, the error was treated as permanent: the reminder create was attempted once and dropped, while the committed state remained. The instance then reported PENDING indefinitely, had no reminder registered, never executed, and never transitioned to FAILED, so no error surfaced to monitoring. The same window during a Scheduler restart usually produces Unavailable errors, which were correctly retried; only the narrower mid-shutdown window produced the non-retried Unknown error.

Impact

You were affected if workflows were created while a dapr-scheduler-server replica restarted, including routine rolling upgrades. A single replica restart was sufficient. Affected instances were silently lost: callers polling them saw a healthy-looking PENDING status forever, and the instances could only be recovered by purging and recreating them.

Root Cause

The Scheduler returns its internal cron shutdown error as a plain error, which crosses gRPC with code Unknown. The bounded retry around actor reminder creation classified only Unavailable and DeadlineExceeded as transient, so Unknown was surfaced immediately without any retry, dropping the only signal that could ever start the workflow.

Solution

Workflow reminder creation now retries every error with bounded exponential backoff, except clearly-permanent request errors (InvalidArgument, PermissionDenied, Unauthenticated, FailedPrecondition, Unimplemented, NotFound) and Scheduler storage exhaustion (ResourceExhausted), which requires operator intervention and is surfaced to the caller immediately. The Scheduler now returns etcd space-quota exhaustion with gRPC code ResourceExhausted instead of Unknown, so clients can distinguish it from transient failures. Previously only Unavailable and DeadlineExceeded were retried, so any other transient error, including the Scheduler's shutdown and etcd errors that cross the wire as Unknown, was dropped on the first attempt. This applies to all workflow-related reminder creates (start, timer, activity, and termination reminders), and a genuinely permanent error still surfaces within the bounded retry budget.

... (truncated)

Commits

• 6d1c53f Restore concurrent message dispatch for pluggable pub/sub (#10472) (#10486)
• a8f854b [1.18] workflow: register clustered work-item waiters before dispatch (#10482)
• 1ec6fb8 workflow: keep a committed start driven when its reminder create is abandoned...
• 215b54c workflow: comple child's obligations in order (#10467) (#10476)
• d4b70d0 workflow: persist an abandoned continue-as-new generation as a pending start ...
• cf68f77 e2e: fix tests/apps/actorphp/composer.json (#10480)
• 9a93a23 fix e2e: move the actorphp e2e app off the end-of-life PHP 8.0 image (#10478)...
• 745230e workflow: commit a child's terminal state before notifying its parent (#10460...
• 7784f3d tests: drop the php extension installer from the actorphp image (#10473) (#10...
• a6ded97 [1.18] workflow: stamp synthesized child and activity failures with their sou...
• Additional commits viewable in compare view

Updates github.com/getsentry/sentry-go from 0.48.0 to 0.49.0

Release notes

Sourced from github.com/getsentry/sentry-go's releases.

0.49.0

Breaking Changes 🛠

• removing DisableLogs and DisableMetrics client options. Sending metrics and logs is already gated by the usage of our APIs already, so having a global kill switch is counter intuitive. Users that won't to opt out should just not call the relevant APIs or setup the integrations. by @​giortzisg in #1392

New Features ✨

• add WithProxyoption for OTLP. This allows setting an otlptracehttp.HTTPTransportProxyFunc for the span exporter by @​pierrre in #1377

Bug Fixes 🐛

• (echo) Propagate span through request context by @​EricGusmao in #1385
• Skip recover frames on panic. This changes stacktrace behavior for captured panics, removing sentry.Recover frames to focus on the actual panic frames. The changes might affect issue grouping. by @​giortzisg in #1364

Internal Changes 🔧

Deps

• Bump github.com/labstack/echo/v5 from 5.0.3 to 5.2.0 in /echo by @​dependabot in #1399
• Bump github.com/gorilla/websocket from 1.5.1 to 1.5.3 by @​dependabot in #1397
• Bump getsentry/craft from 2.26.6 to 2.27.2 by @​dependabot in #1381
• Bump actions/setup-go from 6.4.0 to 7.0.0 by @​dependabot in #1382
• Bump actions/checkout from 6.0.3 to 7.0.1 by @​dependabot in #1380
• Bump google.golang.org/grpc to 1.82.1 and golang.org/x/sys to 0.46.0 by @​dependabot in #1375
• Bump golang.org/x/text to v0.39.0 and x/net to v0.56.0 by @​giortzisg in #1374

Changelog

Sourced from github.com/getsentry/sentry-go's changelog.

0.49.0

Breaking Changes 🛠

• removing DisableLogs and DisableMetrics client options. Sending metrics and logs is already gated by the usage of our APIs already, so having a global kill switch is counter intuitive. Users that won't to opt out should just not call the relevant APIs or setup the integrations. by @​giortzisg in #1392

New Features ✨

• add WithProxyoption for OTLP. This allows setting an otlptracehttp.HTTPTransportProxyFunc for the span exporter by @​pierrre in #1377

Bug Fixes 🐛

• (echo) Propagate span through request context by @​EricGusmao in #1385
• Skip recover frames on panic. This changes stacktrace behavior for captured panics, removing sentry.Recover frames to focus on the actual panic frames. The changes might affect issue grouping. by @​giortzisg in #1364

Internal Changes 🔧

Deps

• Bump github.com/labstack/echo/v5 from 5.0.3 to 5.2.0 in /echo by @​dependabot in #1399
• Bump github.com/gorilla/websocket from 1.5.1 to 1.5.3 by @​dependabot in #1397
• Bump getsentry/craft from 2.26.6 to 2.27.2 by @​dependabot in #1381
• Bump actions/setup-go from 6.4.0 to 7.0.0 by @​dependabot in #1382
• Bump actions/checkout from 6.0.3 to 7.0.1 by @​dependabot in #1380
• Bump google.golang.org/grpc to 1.82.1 and golang.org/x/sys to 0.46.0 by @​dependabot in #1375
• Bump golang.org/x/text to v0.39.0 and x/net to v0.56.0 by @​giortzisg in #1374

Commits

• 78b09d1 release: 0.49.0
• eff9f37 build(deps): bump github.com/labstack/echo/v5 from 5.0.3 to 5.2.0 in /echo (#...
• c60a2f6 feat!: remove DisableLogs and DisableMetrics options (#1392)
• c3f2330 build(deps): bump github.com/gorilla/websocket from 1.5.1 to 1.5.3 (#1397)
• 9bb14a7 fix(echo): propagate span through request context (#1385)
• fb9acd8 build(deps): bump getsentry/craft from 2.26.6 to 2.27.2 (#1381)
• 17f540e feat(otel/otlp): add WithProxy option to span exporter (#1377)
• ed9834e build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 (#1382)
• af6d9db build(deps): bump actions/checkout from 6.0.3 to 7.0.1 (#1380)
• 93223f7 build(deps): bump google.golang.org/grpc to 1.82.1 and golang.org/x/sys to 0....
• Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0

Release notes

Sourced from github.com/jackc/pgx/v5's releases.

v5.11.0

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

• stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.
• Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.
• pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)
• pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)
• pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

• Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

• pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

• pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

  • timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.
  • timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.
  • Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.
  • time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.
  • Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

  Behavior changes:

  • date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.
  • All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range

... (truncated)

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.11.0 (September 7, 2026)

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

• stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.
• Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.
• pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)
• pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)
• pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

• Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

• pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

• pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

  • timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.
  • timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.
  • Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.
  • time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.
  • Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

  Behavior changes:

  • date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.
  • All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the

... (truncated)

Commits

• 5e583fa Update changelog for v5.11.0
• 3927116 Apply gofumpt formatting required by lint
• eb07165 Quote filesystem paths in development connection strings
• cf5938f Allow unsigned digit counts in binary numeric encoding
• 3930cf5 Accept PostgreSQL POSIX timezone offsets in text timestamps
• 93261be Prefer exact db tag matches when mapping rows to structs
• e8d8ad1 Merge pull request #2647 from sueun-dev/fix-range-text-quoting-20260906
• 01d2fd3 Merge pull request #2644 from eliranbz/fix-failed-prepare-deallocation
• 9b7e3be Merge pull request #2645 from ash2k/move-channel
• 76d78f5 Merge pull request #2643 from AshSgDe29071999/fix/hstore-pairs-estimate-clamp
• Additional commits viewable in compare view

Updates github.com/mmcdole/gofeed from 1.3.0 to 1.4.2

Release notes

Sourced from github.com/mmcdole/gofeed's releases.

v1.4.2

This patch fixes two parser regressions. JSON feeds larger than the 4096-byte detection window are now detected and parsed completely, and RSS feeds with an unknown default namespace on <rss> are parsed as native RSS while recognized extension namespaces retain their meaning.

Changes

• Detect JSON feeds larger than the sniffing window. (#348)
• Tolerate an unknown default namespace on the RSS root. (#347)
• Update actions/setup-go from v6 to v7. (#337)

Full changelog:

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.