Skip to content

build(deps): bump the franz-go group across 1 directory with 3 updates - #766

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/franz-go-bf22ad75ed
Open

build(deps): bump the franz-go group across 1 directory with 3 updates#766
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/franz-go-bf22ad75ed

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the franz-go group with 2 updates in the / directory: github.com/twmb/franz-go and github.com/twmb/franz-go/pkg/kadm.

Updates github.com/twmb/franz-go from 1.20.7 to 1.21.5

Changelog

Sourced from github.com/twmb/franz-go's changelog.

v1.21.5

Three bug fixes:

  • Fixed a nil-pointer panic when building a group OffsetFetch: if the group was assigned a topic that was no longer in the client's tracked set -- reachable when a topic is purged from consuming while still assigned, for example PurgeTopicsFromConsuming overlapping AddConsumeTopics, or the automatic regex missing-topic purge -- loadTopic returned nil and dereferencing it for the topic ID crashed the client. The topic ID is now only set when the topic is known. Thanks @​iwittkau!

  • Fixed a data race on a coordinator's cached node ID. When a broker disconnected while a FindCoordinator load for that broker was still in flight, deleteStaleCoordinatorsByNode could read the in-flight load's node field before the loading goroutine published it (via closing the load's wait channel), which go test -race flagged. The node read now happens only after the load has been observed as complete. Thanks @​nikolauspschuetz!

  • A share partition that was listed in a ShareFetch only to carry a piggybacked acknowledgement -- for a cursor that was revoked, paused, or migrated to a new leader after its records were drained -- was added to the broker's share session but never tracked client-side, so it could never be forgotten. The broker would re-acquire and redeliver that partition's records indefinitely while the client discarded them ("broker returned partition ... we did not ask for"), spinning the share fetch loop. The client now tracks every partition it sends, matching the broker's session bookkeeping.

Relevant commits

v1.21.4

This release is a "large" (many commits) release that has many small or hard to encounter bugs fixed. I pointed Claude's Fable at this repo and ran some audit rounds while available and thankfully got through the highest value audit rounds before Fable was removed.

For once, I will not be describing every bug fixed nor calling out every relevant commit. Instead, if you are curious, look at #1348. Some worthwhile description is below.

... (truncated)

Commits
  • 1ba5fd2 Merge pull request #1356 from twmb/cl
  • 8cc63d8 CHANGELOG: note v1.21.5
  • fa33d0d Merge pull request #1355 from iwittkau/master
  • baeb801 Merge pull request #1354 from nikolauspschuetz/kgo-fix-coordinator-node-race
  • eea2bfc Merge branch 'master' into kgo-fix-coordinator-node-race
  • 5eb78b4 Merge pull request #1352 from twmb/share-session-piggyback-forget-leak
  • ab185e4 kgo: add nil check when loading topics in groupConsumer
  • aca084e kgo: fix data race on coordinatorLoad.node
  • 0965529 cl: note incoming 1.21.5
  • 9155c64 kgo: forget piggyback-only partitions from the share session
  • Additional commits viewable in compare view

Updates github.com/twmb/franz-go/pkg/kadm from 1.17.2 to 1.18.0

Changelog

Sourced from github.com/twmb/franz-go/pkg/kadm's changelog.

v1.18.0

This release adds support for Kafka 3.7, adds a few community requested APIs, some internal improvements, and fixes two bugs. One of the bugfixes is for a deadlock; it is recommended to bump to this release to ensure you do not run into the deadlock. The features in this release are relatively small.

This adds protocol support for KIP-890 and KIP-994, and adds further protocol support for [KIP-848][KIP-848]. If you are using transactions, you may see a new kerr.TransactionAbortable error, which signals that your ongoing transaction should be aborted and will not be successful if you try to commit it.

Lastly, there have been a few improvements to pkg/sr that are not mentioned in these changelog notes.

Bug fixes

  • If you canceled the context used while producing while your client was at the maximum buffered records or bytes, it was possible to experience deadlocks. This has been fixed. See #832 for more details.

  • Previously, if using GetConsumeTopics while regex consuming, the function would return all topics ever discovered. It now returns only the topics that are being consumed.

Improvements

  • The client now internaly ignores OutOfOrderSequenceNumber errors that are encountered when consuming if possible. If a producer produces very infrequently, it is possible the broker forgets the producer by the next time the producer produces. In this case, the producer receives an OutOfOrderSequenceNumber error. The client now internally resets properly so that you do not see the error.

Features

  • AllowRebalance and CloseAllowingRebalance have been added to GroupTransactSession.
  • The FetchTopic type now has includes the topic's TopicID.
  • The ErrGroupSession internal error field is now public, allowing you to test how you handle the internal error.
  • You may now receive a kerr.TransactionAbortable error from many functions while using transactions.

Relevant commits

  • 0fd1959d kgo: support Kafka 3.8's kip-890 modifications
  • 68163c55 bugfix kgo: do not add all topics to internal tps map when regex consuming
  • 3548d1f7 improvement kgo: ignore OOOSN where possible

... (truncated)

Commits

Updates github.com/twmb/franz-go/pkg/kmsg from 1.12.0 to 1.13.1

Changelog

Sourced from github.com/twmb/franz-go/pkg/kmsg's changelog.

v1.13.1

This patch release fixes a bug where a producer could enter a deadlock if a topic is deleted and recreated very quickly while producing.

  • 769e02f producer: avoid deadlock when when quickly recreating a topic

v1.13.0

This release contains a few new APIs, two rare bug fixes, updates to plugins, and changes the library to now require 1.18.

Go version

This library has supported Go 1.15 since the beginning. There have been many useful features that this library has not been able to use because of continued backcompat for 1.15. There is really no reason to support such an old version of Go, and Go itself does not support releases prior to 1.18 -- and 1.18 is currently only supported for security backports. Switching to 1.18 allows this library to remove a few 1.15 / 1.16 backcompat files, and allows switching this library from interface{} to any.

Behavior changes

If group consuming fails with an error that looks non-retryable, the error is now injected into polling as a fake errored fetch. Multiple people have ran into problems where their group consumers were failing due to ACLs or due to network issues, and it is hard to detect these failures: you either have to pay close attention to logs, or you have to hook into HookGroupManageError. Now, the error is injected into polling.

Bug fixes

This release contains two bug fixes, one of which is very rare to encounter, and one of which is very easy to encounter but requires configuring the client in a way that (nearly) nobody does.

Rare: If you were using EndAndBeginTransaction, there was an internal race that could result in a deadlock.

Rare configuration: If you configured balancers manually, and you configured CooperativeSticky with any other eager balancer, then the client would internally sometimes think it was eager consuming, and sometimes think it was cooperative consuming. This would result in stuck partitions while consuming.

Features

... (truncated)

Commits
  • 1a59c2d Merge pull request #404 from twmb/bugfix
  • 5e0ba1c document incoming v1.13.1, update readme, fix golangci-lint
  • d984c21 Merge pull request #401 from bgranvea/fix-segment-bench
  • 769e02f producer: avoid deadlock when when quickly recreating a topic
  • 5c2a90c set async commit
  • 8cb298d Merge pull request #399 from twmb/dependabot/go_modules/examples/hooks_and_lo...
  • 1141ce4 Merge pull request #397 from twmb/dependabot/go_modules/examples/hooks_and_lo...
  • d5ef6e0 Merge pull request #398 from twmb/dependabot/go_modules/examples/bench/google...
  • 8215a54 Merge pull request #400 from twmb/dependabot/go_modules/plugin/kprom/google.g...
  • 6fdb469 build(deps): bump google.golang.org/protobuf in /plugin/kprom
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Apr 21, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/franz-go-bf22ad75ed branch from a36f6c3 to b763085 Compare May 13, 2026 23:53
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/franz-go-bf22ad75ed branch from b763085 to 0a4468e Compare June 22, 2026 23:53
Bumps the franz-go group with 2 updates in the / directory: [github.com/twmb/franz-go](https://github.com/twmb/franz-go) and [github.com/twmb/franz-go/pkg/kadm](https://github.com/twmb/franz-go).


Updates `github.com/twmb/franz-go` from 1.20.7 to 1.21.5
- [Changelog](https://github.com/twmb/franz-go/blob/master/CHANGELOG.md)
- [Commits](twmb/franz-go@v1.20.7...v1.21.5)

Updates `github.com/twmb/franz-go/pkg/kadm` from 1.17.2 to 1.18.0
- [Changelog](https://github.com/twmb/franz-go/blob/master/CHANGELOG.md)
- [Commits](twmb/franz-go@pkg/kadm/v1.17.2...v1.18.0)

Updates `github.com/twmb/franz-go/pkg/kmsg` from 1.12.0 to 1.13.1
- [Changelog](https://github.com/twmb/franz-go/blob/master/CHANGELOG.md)
- [Commits](twmb/franz-go@v1.12.0...v1.13.1)

---
updated-dependencies:
- dependency-name: github.com/twmb/franz-go
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: franz-go
- dependency-name: github.com/twmb/franz-go/pkg/kadm
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: franz-go
- dependency-name: github.com/twmb/franz-go/pkg/kmsg
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: franz-go
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/franz-go-bf22ad75ed branch from 0a4468e to 674b325 Compare August 14, 2026 23:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants