Skip to content

chore(deps): bump the go group with 5 updates - #457

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-5c8b691c5c
Open

chore(deps): bump the go group with 5 updates#457
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-5c8b691c5c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the go group with 5 updates:

Package From To
cel.dev/cel-go 0.32.0 0.33.2
github.com/duckdb/duckdb-go/v2 2.10506.0 2.20000.0
github.com/labstack/echo/v5 5.4.2 5.4.4
google.golang.org/grpc 1.84.0 1.85.0
modernc.org/sqlite 1.61.0 1.61.1

Updates cel.dev/cel-go from 0.32.0 to 0.33.2

Release notes

Sourced from cel.dev/cel-go's releases.

Release v0.33.2

What's Changed

  • Changes to the fast-path list and map accessors to ensure graceful degradation for custom adaptors.

Full Changelog: cel-expr/cel-go@v0.33.1...v0.33.2

Release v0.33.1

Cherry-picks for backwards compatibility with legacy timestamp and timezone formats, and support for google.protobuf.Value types as comprehension keys.

What's Changed

Full Changelog: cel-expr/cel-go@v0.33.0...v0.33.1

Release v0.33.0

This release introduces a high-performance Pratt parser, a unified declarative cost model (common/cost) with aggregate sizing and peak memory tracking, raw pointer traversal for native Go structs, and JSON/YAML parsing extensions, while eliminating quadratic type-checking bottlenecks.

Features

Pull Request Description and Impact
Pratt parser and EnablePrattParser option (#1427, #1433, #1442, #1462, #1472, #1497, #1509, #1511, #1521) Introduces a recursive-descent Pratt parser ported from cel-cpp with iterative parenthesis handling, bounded expression nesting, and escaped function name support, delivering 8x–19x faster single-threaded parsing.
Unified cost model (common/cost), AggregateSizingStrategy, and CostModelVersion (#1430, #1435, #1441, #1474, #1478, #1482, #1512, #1519, #1525, #1537, #1548, #1556, #1558) Unifies static cost estimation and runtime tracking under a declarative cost.OverloadModel AST with container Key/Elem size propagation, aggregate sizing, value-backed ElemOf/KeyOf/ElemTotal/KeyTotal/Length combinators, and versioned compatibility via cel.CostModelVersion.
Runtime peak memory tracking (#1418, #1429) Adds runtime memory tracking and scaled string/byte sizing options to observe and bound peak allocation footprints during evaluation.
Native raw pointer traversal, generic containers, and type aliasing (#1463, #1498, #1503, #1515) Accelerates cel.NativeTypes struct field selection and presence checks via unsafe.Pointer offset traversal, adds generic Go slice/map adapters, and supports native type aliasing.
JSON/YAML parsing and encoding & URL-safe Base64 (#1451, #1461, #1492) Adds json.parse, yaml.parse, and yaml.encode extensions (returning optional_type with 10MB payload safety limits), alongside base64.encodeUrl and base64.decodeUrl in ext.Encoders.
List presence helpers and versioned optional macros (#1447, #1448, #1487) Introduces hasOnly, hasAny, hasAll, and hasExactly in ext.Lists, optional.hasValue(val) in OptionalTypesVersion(3), and single-evaluation optMap/optFlatMap macros in OptionalTypesVersion(4).
HMAC digest and constant-time equality (#1450) Extends ext/security/hmac with hmac.digest and linear-time equality comparisons.
Late-bound functions from Activation (#1483) Enables resolving cel.FunctionVars bindings dynamically from the runtime Activation or cel.Globals.
Type-check error suggestions and cel.Env JSON serialization (#1500, #1554) Adds edit-distance spellchecking and library enablement hints for undeclared symbols/types, plus JSON/YAML config serialization for cel.Env.
AST structural equivalence and @block call tagging (#1467, #1544) Provides format-insensitive AST structural comparison in common/ast and tags cel.@block calls in compiled ASTs.
SLSA + Sigstore artifact signing and OSS-Fuzz consolidation (#1426, #1577) Signs release artifacts with SLSA/Sigstore provenance and consolidates OSS-Fuzz harnesses under fuzzing/.

Fixes

Pull Request Impact and Technical Details
Undo failed assignability checks in place (#1575) Replaces full type-mapping clones during overload resolution with an in-place undo log, eliminating O(N^2) type-checking latency and memory growth on long conjunctions (#1553).
Restore v0.32.0 cost behavior at CostModelVersion(0) and v0.29.2 cost limit error (#1571, #1572, #1573) Restores EvalCancelledError ("operation cancelled: actual cost limit exceeded") when runtime cost limits are exceeded and replays v0.32.0 static/runtime cost rules when pinned to cel.CostModelVersion(0).
Fix unsafe math and saturation in cost estimation and tracking (#1508, #1541) Adds SafeSubtract, SafeTrunc, and SafeMultiplyByFactorTrunc in common/cost so uint64 and float-scaled costs saturate cleanly at math.MaxUint64 (including NaN) and clamp negative values to 0.
Nil-safe Program evaluation and concurrent cost tracker race fix (#1480, #1484, #1486, #1488) Makes Eval, ContextEval, and ConcurrentEval nil-safe, eliminates a data race when capturing cost trackers across goroutines, and removes time-based flakiness in interrupt checks.
Constant folding and partial evaluation AST consistency (#1446, #1453, #1517, #1518) Prunes folded nodes from reference and type maps, checks unknowns before traversing attribute qualifiers, and fixes custom Foldable two-variable iteration.
Native types embedded json:"-" tags and proto.ReflectMessage dereference (#1452, #1551, #1567) Respects json:"-" skip tags on embedded Go structs, fixes JSON tag conversion in ConvertToNative, and prevents invalid field dereferences over proto.ReflectMessage.
Fix regex counted repetition sizing panic (#1438) Prevents a panic when estimating compiled regex program sizes for counted repetitions.

Breaking Changes

... (truncated)

Commits
  • c8b1865 Changes to the fast-path list and map accessors to ensure that object travers...
  • fd8eb23 Release v0.33.1 cherry-picks (#1590)
  • f99b2fe Fix presence perf regression (#1578)
  • 4ab6aed Lint fixes for deprecations, best practices (#1579)
  • 73b80a7 Merge pull request #1577 from dmitriplotnikov/fuzzing
  • f4595e5 Consolidate OSS-Fuzz and internal fuzz targets in fuzzing package
  • da49767 Fix failing BenchmarkCheck cases (#1576)
  • 840daca Replay v0.32.0 costs at version 0; fix optional sizing, call floor, and condi...
  • e205d7a Restore v0.32.0 cost behavior at ModelVersion(0) (#1573)
  • e3e6964 Updates to the 'Length' estimation reasoning (#1570)
  • Additional commits viewable in compare view

Updates github.com/duckdb/duckdb-go/v2 from 2.10506.0 to 2.20000.0

Release notes

Sourced from github.com/duckdb/duckdb-go/v2's releases.

v2.20000.0

[!IMPORTANT] Upgrades to DuckDB v2.0.0 through duckdb-go-bindings v0.20000.0. The native libraries now come from go.duckdb.org, so setups that restrict GOPROXY must allow it. The Go API is unchanged, but some behavior changes with DuckDB v2: RowsAffected for CREATE TABLE AS, profiling metrics, and dropped rows after a failed appender flush. Custom dynamic and static linking changed too. See Upgrading to DuckDB v2 in the README.

What's Changed

Full Changelog: duckdb/duckdb-go@v2.10506.0...v2.20000.0

Commits
  • bb8380a Merge pull request #217 from mlafeldt/duckdb-v2-bindings
  • cd69e0f Document that a failed AppendRow does not append its row
  • 76fd883 Verify the shared library the dynamic lib tests download
  • 554d7ae Document upgrading to DuckDB v2
  • c936ff5 Test dynamic and static linking against the bindings' DuckDB build
  • 7863d1a Report dropped appender rows on Close until Clear acknowledges them
  • 1ce76d5 Read profiling metrics from DuckDB v2's metric groups
  • b4db755 Match DuckDB v2's query logging in TestLogStorage
  • bc675d8 Expect CREATE TABLE AS to report its rows as affected
  • 725eb6c Return nil for typed NULL UDF arguments instead of aborting
  • Additional commits viewable in compare view

Updates github.com/labstack/echo/v5 from 5.4.2 to 5.4.4

Release notes

Sourced from github.com/labstack/echo/v5's releases.

v5.4.4

Proxy identity hardening

The proxy now retains its derived X-Real-IP header when an incoming request includes Connection: X-Real-IP, including mixed-case and duplicate Connection values. The value is restored after Go removes hop-by-hop headers, before the upstream transport runs.

The same captured identity is preserved across retries and balancer request replacement, and the protection applies to WebSocket upgrades. Default and custom transports and extractors remain supported.

Released v5.4.3 can omit the identity header for those requests. Identity spoofing additionally depends on an upstream that falls back to an untrusted source when the header is absent. This release does not change v5’s direct-peer default or the affected ranges of the earlier default-IP CVEs.

No new client-IP migration is required for v5. Applications behind proxies should continue using an extractor that trusts their own proxies. No public API, dependency, or minimum Go-version changes.

Validation

The implementation passed fresh independent Claude review, full race tests on Go 1.25 and 1.27, vet, staticcheck, golint, and govulncheck. Permanent tests cover HTTP/default/custom transports, raw WebSocket negotiation, duplicate/mixed-case header nominations, and a stateful extractor across request-swapping retries.

Implementation: #3200. This ports the additional proxy identity protection released in v4.16.3.

Full Changelog: labstack/echo@v5.4.3...v5.4.4

v5.4.3

Security

Upgrade to v5.4.3 to fix a static route-guard bypass involving encoded empty path segments in non-default path-matching or unescaping configurations. The confirmed impact is access to protected files inside a static root. The fix validates raw and decoded request paths and wildcard boundaries, including singly and doubly encoded leading slashes and guarded directory indexes.

Advisory: GHSA-v97q-3xf5-rj74

Fixes

  • Decode path parameters only once when UnescapePathParamValues is enabled, preserving literal percent-containing values.
  • Correct UseEscapedPathForMatching documentation without changing its behavior.
  • Preserve correctly escaped filenames and static prefixes such as /assets*.

Thanks to MyWorld319 for the static bypass report and alexreid for the parameter-decoding report.

Documentation

  • Publish v4 support dates and the Echo Support offer (#3193).
  • Mention Echo Pro in the Sponsors section (#3192).

Full Changelog: labstack/echo@v5.4.2...v5.4.3

Changelog

Sourced from github.com/labstack/echo/v5's changelog.

v5.4.4 - 2026-10-29

Proxy identity hardening

  • Preserve the derived upstream X-Real-IP after hop-by-hop header stripping. A client can no longer remove that header with Connection: X-Real-IP, including duplicate or mixed-case nominations and WebSocket upgrades.
  • Capture the client identity once and preserve it across retries and balancer request replacement. Default and custom transports and extractors remain supported.
  • Add permanent regressions for HTTP forwarding, raw WebSocket upgrades, header nominations, and stateful extraction during request-swapping retries. Implementation: #3200.

v5 already uses the connection peer by default. This release adds proxy header protection and does not change client-IP configuration or the affected ranges of the earlier default-IP CVEs. A missing identity header can affect an upstream that falls back to an untrusted source; no new client-IP migration, public API, dependency, or minimum Go-version change is introduced.

v5.4.0 - 2026-09-27

Security

This release fixes several security issues. Upgrading is recommended. Some fixes change behavior; read "Behavior changes to check before upgrading" below.

  • Request scheme: Context.Scheme() now uses the X-Forwarded-Proto, X-Forwarded-Protocol, X-Forwarded-Ssl and X-Url-Scheme headers only when the request comes directly from a loopback, link-local or private network address or a unix socket. Before this, any client could send X-Forwarded-Proto: https over plain HTTP and skip HTTPSRedirect. When X-Forwarded-Proto is present, only it is used (its last value), and the scheme is returned in lowercase. Echo#SchemeExtractor (and Config.SchemeExtractor) selects the strategy: ExtractSchemeFromHeaders(...TrustOption) (default), ExtractSchemeDirect() or LegacySchemeExtractor(). The Secure middleware now sets HSTS based on Context.Scheme(). The Proxy middleware always sets X-Forwarded-Proto from Context.Scheme() and removes X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme before forwarding. GHSA-2ffq-g2xg-c22p
  • Proxy middleware: always sets X-Real-IP from Context.RealIP(), so a client can no longer pass a spoofed X-Real-IP to the upstream. GHSA-99jh-6h7p-pp36
  • JSONP: Context.JSONP and Context.JSONPBlob accept only a callback that is empty, a JavaScript identifier or a dot-separated path of identifiers (ASCII letters, digits, _ and $). Any other callback returns a 400 Bad Request error that wraps the new ErrInvalidJSONPCallback, and nothing is written. JSONP responses now carry X-Content-Type-Options: nosniff. JSONP lets any website read the response with the user's cookies, so do not use it for data that needs authentication. GHSA-h9g5-28mm-hx3g
  • MethodOverride: a POST can no longer be overridden to GET, HEAD, OPTIONS, TRACE or CONNECT. Before this, with the MethodFromForm or MethodFromQuery getter and MethodOverride registered with Use before the CSRF middleware, _method=GET skipped the CSRF check. Register MethodOverride with Echo#Pre. GHSA-r7w9-592q-9vg4
  • Redirects: the trailing slash middlewares and the static directory redirect percent-encode control characters in the redirect path. Before this, /%09/evil.example/ redirected browsers to evil.example. GHSA-v753-g4cw-jm48
  • Static files: with the default settings, the Static middleware resolves files from the same form of the path that the router matched, so /admin%2Fsecret.txt or /%61dmin/secret.txt can no longer reach a file under a guarded /admin/* route. GHSA-375p-5qhx-8wq4 The Static middleware and StaticDirectoryHandler (used by Echo.Static, Echo.StaticFS, Group.Static and Group.StaticFS) no longer serve paths with a ., .. or empty segment, such as /assets/../admin/secret.txt, also after path unescaping. GHSA-3pmx-cf9f-34xr

Behavior changes to check before upgrading

  • Proxies or load balancers with public IP addresses. If a proxy connects to your app from a public (or 100.64.0.0/10) address, its X-Forwarded-Proto is now ignored: HTTPSRedirect redirects in a loop and the Secure middleware stops sending HSTS. This affects, for example, Cloudflare, CloudFront and Azure Front Door connecting to a public origin, the GCP external HTTP(S) load balancer including GKE Ingress (35.191.0.0/16, 130.211.0.0/22), and networks that use 100.64.0.0/10 (such as Alibaba Cloud SLB or EKS custom networking). Trust the proxy's address ranges: 
    _, gclb1, _ := net.ParseCIDR("35.191.0.0/16")
_, gclb2, _ := net.ParseCIDR("130.211.0.0/22")
e.SchemeExtractor = echo.ExtractSchemeFromHeaders(echo.TrustIPRange(gclb1), echo.TrustIPRange(gclb2))
    Proxies on the same host, in a private network (AWS ALB, in-cluster ingress controllers such as ingress-nginx or Traefik, most PaaS routers) or on a unix socket keep working without changes. echo.LegacySchemeExtractor() restores the old behavior but is not safe unless every request passes through a proxy that sets these headers. Serverless adapters or middleware that set RemoteAddr to the client's address also make X-Forwarded-Proto ignored (or, if they take it from a header, spoofable).
  • Trusted proxies must set X-Forwarded-Proto. A proxy on a trusted address that passes the client's X-Forwarded-Proto through (for example nginx without proxy_set_header X-Forwarded-Proto $scheme;) still lets the client choose the scheme. An invalid X-Forwarded-Proto value now results in http instead of falling back to the other scheme headers.
  • Your own tests. httptest.NewRequest sets RemoteAddr to 192.0.2.1:1234, which is not trusted, so tests that set X-Forwarded-Proto now see http. Set req.RemoteAddr = "10.0.0.1:1234" or use e.SchemeExtractor = echo.LegacySchemeExtractor() in such tests.
  • Proxy middleware headers. X-Real-IP sent to the upstream is now always Context.RealIP(). In a chain like nginx → Echo Proxy → upstream, configure Echo#IPExtractor (for example echo.ExtractIPFromRealIPHeader()) to pass the client address on. X-Forwarded-Ssl, X-Forwarded-Protocol and X-Url-Scheme are no longer forwarded; X-Forwarded-Proto carries the scheme.
  • MethodOverride. Overriding a POST to GET (for example with X-HTTP-Method-Override: GET to send a long query in a POST body) is no longer done; such requests keep the POST method.
  • Static files. Paths with a double slash or dot segment (for example /assets//app.js) now return 404; in HTML5 mode the index is still served. The Static middleware no longer finds file names that the client sends with non-default escaping (for example %2C, %40 or lowercase hex like %c3%a9) unless StaticConfig.EnablePathUnescaping is set; Echo.Static has behaved this way since v5.2.1. With StaticConfig.EnablePathUnescaping or Config.EnablePathUnescapingStaticFiles, encoded dots (%2e%2e) no longer traverse directories, but encoded slashes are still decoded, so do not combine these options with route-based access control.
  • JSONP. Context.JSONP returns an error for callbacks that are not JavaScript identifiers.

Documentation

  • IPExtractor docs: corrected the description of the default (the direct peer address has been used since v5.1.0).
  • Static middleware: when registered with Echo#Use it runs before route and group middleware, so route guards do not protect the files it serves.

v5.3.1 - 2026-07-21

Fixes

... (truncated)

Commits
  • a45c7bb chore: prepare v5.4.4 proxy hardening release (#3201)
  • b118d3d fix: preserve v5 proxy client identity after hop header stripping (#3200)
  • 9489424 docs: record v4 client IP security release and migration (#3199)
  • 6e06e88 chore: prepare v5.4.3 release (#3196)
  • 078efa6 Merge commit from fork
  • 4deac5d docs: publish v4 support dates and the Echo Support offer (#3193)
  • 9adc7a8 docs: mention Echo Pro in the Sponsors section (#3192)
  • See full diff in compare view

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

  • stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)

Bug Fixes

  • transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
  • server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
  • server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
  • xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
Commits

Updates modernc.org/sqlite from 1.61.0 to 1.61.1

Release notes

Sourced from modernc.org/sqlite's releases.

v1.61.1

Signed provenance for this release: the two files below. VERIFYING.md in the repository says how to check them.

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

  • 2026-11-07 v1.62.0:

    • Add illumos/amd64, tested on an OmniOS builder. Resolves [GitLab issue #210](https://gitlab.com/cznic/sqlite/-/issues/210), thanks Jasper Siepkes (@​siepkes), who also started the modernc.org/libc port!
    • Re-vendor lib/ from modernc.org/libsqlite3 v1.16.0 and vec/ from modernc.org/libsqlite_vec v0.8.0; SQLite stays 3.54.1 and sqlite-vec v0.1.9. The pinned modernc.org/libc becomes v1.80.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Add opt-in syncing with fdatasync(2), off by default: Fdatasync(true) makes commits sync with fdatasync instead of fsync, process-wide, which skips the timestamp update fsync forces and keeps a commit just as durable. FdatasyncEnabled reports the setting; on macOS and Windows Fdatasync returns ErrFdatasyncUnavailable. Resolves [GitHub issue #10](modernc-org/sqlite#10), thanks aibeshkov!
    • Limit now works on a connection handed out by a driver.Connector that wraps the ones NewConnector opens, provided the wrapper has an Unwrap() driver.Conn method; it used to fail with unexpected driverConn type. NewConnector now also says which optional interfaces such a wrapper must forward. Resolves [GitHub issue #11](modernc-org/sqlite#11), thanks Andres Morey (@​amorey)!

  • 2026-10-31 v1.61.1:

    • Prepared statements are no longer parsed and planned again on every execution. Since v1.61.0, SQLite 3.54 expired a cached statement that has a col = ? term in a join or an ORDER BY query whenever the driver cleared its bindings after a run, so a statement prepared with db.Prepare or tx.Prepare cost about twice what it did in v1.60.1. Integer bindings now stay in place between executions, so a parameter bound to 0 or 1 does not re-prepare it either. Resolves [GitLab issue #264](https://gitlab.com/cznic/sqlite/-/issues/264). See [GitLab merge request #147](https://gitlab.com/cznic/sqlite/-/merge_requests/147), thanks Roman Khafizianov (@​requilence)!
    • Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!
    • Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.
    • Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!
    • The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.
    • Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

  • 2026-10-21 v1.61.0:

  • 2026-09-29 v1.60.1:

    • Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

  • 2026-09-28 v1.60.0:

    • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
    • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.
    • make vendor now writes vendor.json, the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries; the test suite fails when they no longer match. Tooling only. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).
    • vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.
    • Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.
    • The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.
    • Document three limits of the pluggable page cache on RegisterPageCache and Cache: it cannot be combined with modernc.org/sqlite/vec, PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines. Documentation only.
    • Document in the package documentation that state set on a pooled connection is inherited by the next caller to borrow it, and that a connection reached through sql.Conn.Raw is not safe for concurrent use. Documentation only.
    • Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so anything after a ; runs too. Recommended for any application whose DSN is not a compile-time constant.
    • Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof, which have always worked in a DSN starting with file:, and the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257). Documentation only.
    • Add SECURITY.md, the vulnerability reporting policy: three private channels, what is in scope, that only the latest release is supported, and how a confirmed report is disclosed, including an entry in the Go vulnerability database so govulncheck reports it. IRP.md, linked from it, is the maintainers' incident response plan. Documentation only.
    • Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Documentation only.
    • Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries with all seventeen license texts in full, and a Software Bill of Materials, sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), explained in SBOM.md. Both cover what a module-graph tool cannot see: the transpiled SQLite and sqlite-vec C, and the upstreams modernc.org/libc carries, musl among them. Documentation only.

  • 2026-09-15 v1.59.0:

    • Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, ...

      Description has been truncated

@dependabot
chore(deps): bump the go group with 5 updates
98f1d62 
Bumps the go group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [cel.dev/cel-go](https://github.com/cel-expr/cel-go) | `0.32.0` | `0.33.2` |
| [github.com/duckdb/duckdb-go/v2](https://github.com/duckdb/duckdb-go) | `2.10506.0` | `2.20000.0` |
| [github.com/labstack/echo/v5](https://github.com/labstack/echo) | `5.4.2` | `5.4.4` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.84.0` | `1.85.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.61.0` | `1.61.1` |


Updates `cel.dev/cel-go` from 0.32.0 to 0.33.2
- [Release notes](https://github.com/cel-expr/cel-go/releases)
- [Commits](cel-expr/cel-go@v0.32.0...v0.33.2)

Updates `github.com/duckdb/duckdb-go/v2` from 2.10506.0 to 2.20000.0
- [Release notes](https://github.com/duckdb/duckdb-go/releases)
- [Commits](duckdb/duckdb-go@v2.10506.0...v2.20000.0)

Updates `github.com/labstack/echo/v5` from 5.4.2 to 5.4.4
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v5.4.2...v5.4.4)

Updates `google.golang.org/grpc` from 1.84.0 to 1.85.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.84.0...v1.85.0)

Updates `modernc.org/sqlite` from 1.61.0 to 1.61.1
- [Release notes](https://gitlab.com/cznic/sqlite/tags)
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.61.0...v1.61.1)

---
updated-dependencies:
- dependency-name: cel.dev/cel-go
  dependency-version: 0.33.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/duckdb/duckdb-go/v2
  dependency-version: 2.20000.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/labstack/echo/v5
  dependency-version: 5.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: google.golang.org/grpc
  dependency-version: 1.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: modernc.org/sqlite
  dependency-version: 1.61.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants