Skip to content

chore(deps): bump the gomod group across 1 directory with 10 updates - #19

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-6e4108ed8e
Open

chore(deps): bump the gomod group across 1 directory with 10 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/gomod-6e4108ed8e

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubJun 8, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the gomod group with 9 updates in the / directory:

PackageFromTo
github.com/aws/aws-sdk-go-v21.41.51.41.12
github.com/aws/aws-sdk-go-v2/config1.32.141.32.23
github.com/aws/aws-sdk-go-v2/service/secretsmanager1.41.51.42.2
github.com/aws/aws-sdk-go-v2/service/ssm1.68.41.69.2
github.com/go-sql-driver/mysql1.9.31.10.0
github.com/jackc/pgx/v55.9.15.10.0
github.com/pressly/goose/v33.27.03.27.1
github.com/rs/zerolog1.35.01.35.1
golang.org/x/sync0.20.00.21.0

Updates github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.12

Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.14 to 1.32.23

Commits

Updates github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.41.5 to 1.42.2

Commits

Updates github.com/aws/aws-sdk-go-v2/service/ssm from 1.68.4 to 1.69.2

Commits

Updates github.com/go-sql-driver/mysql from 1.9.3 to 1.10.0

Release notes

Sourced from github.com/go-sql-driver/mysql's releases.

v1.10.0

What's Changed

New Contributors

Full Changelog: go-sql-driver/mysql@v1.9.2...v1.10.0

Changelog

Sourced from github.com/go-sql-driver/mysql's changelog.

v1.10.0 (2026-04-28)

  • Fix getSystemVar("max_allowed_packet") potentially returned wrong value. (#1754) This affects only when maxAllowedPacket=0 is set.

  • Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0. (#1756) While older versions have reported CVEs, they do not affect go-mysql.

  • Update Go versions to 1.24-1.26. (#1763)

  • Enhance interpolateParams to correctly handle placeholders. (#1732) The question mark (?) within strings and comments will no longer be treated as a placeholder.

Commits

Updates github.com/jackc/pgx/v5 from 5.9.1 to 5.10.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.10.0 (June 3, 2026)

This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers, contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are sent over TLS when the original connection used TLS.

Features

  • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
  • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
  • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
  • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
  • pgxpool: check if connection is expired before acquire (arthurdotwork)

Security Hardening

  • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
  • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
  • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
  • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
  • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
  • Fix panic on malformed geometric text; return an error instead (MaIII)

Fixes

  • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
  • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
  • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
  • Fix data race when context is cancelled during connect
  • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
  • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
  • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
  • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
  • Add missing error check of rows.Err to load types (Jen Altavilla)

5.9.2 (April 18, 2026)

Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)

SQL injection can occur when:

  1. The non-default simple protocol is used.
  2. A dollar quoted string literal is used in the SQL query.
  3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
  4. The value of that placeholder is controllable by the attacker.

... (truncated)

Commits
  • 7293fb1 Update changelog for v5.10.0
  • 1ade285 pgconn: document secure connection configuration
  • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
  • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
  • b28e65b pgtype: bound array element count against remaining message bytes
  • cd1f389 pgtype: bound array binary decode element length against remaining bytes
  • ff27b5b pgtype: bound hstore binary decode against malicious server input
  • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
  • 44f6173 pgconn: cap server-supplied SCRAM iteration count
  • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
  • Additional commits viewable in compare view

Updates github.com/pressly/goose/v3 from 3.27.0 to 3.27.1

Release notes

Sourced from github.com/pressly/goose/v3's releases.

v3.27.1

What's Changed

  • Dependency updates

Full Changelog: pressly/goose@v3.27.0...v3.27.1

Changelog

Sourced from github.com/pressly/goose/v3's changelog.

[v3.27.1] - 2026-04-24

Changed

  • Bump minimum Go version to 1.25.7
  • Various dependency upgrades
Commits
  • e3235f7 release: v3.27.1
  • 883e2f7 build(deps): bump Go and dependency versions (#1067)
  • 2e2fe5c build(deps): bump the gomod group with 3 updates (#1048)
  • 21176ca build(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0 in the gomod group...
  • e7bd535 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (#1042)
  • f9c7cb4 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /internal/t...
  • b6220db build(deps): bump the gomod group across 1 directory with 3 updates (#1041)
  • 65e320f docs: fix README escaping marker in ENVSUB example (#1037)
  • 18f6ef7 build(deps): bump goreleaser/goreleaser-action from 6 to 7 (#1036)
  • de28e04 docs: update v3.27.0 release notes with Go 1.25 minimum and dep upgrades
  • See full diff in compare view

Updates github.com/rs/zerolog from 1.35.0 to 1.35.1

Commits

Updates golang.org/x/sync from 0.20.0 to 0.21.0

Commits

Updates modernc.org/sqlite from 1.48.2 to 1.49.1

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the gomod group across 1 directory with 10 updates
f8c4b28
Bumps the gomod group with 9 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.41.12` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.14` | `1.32.23` |
| [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.42.2` |
| [github.com/aws/aws-sdk-go-v2/service/ssm](https://github.com/aws/aws-sdk-go-v2) | `1.68.4` | `1.69.2` |
| [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.9.3` | `1.10.0` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.1` | `5.10.0` |
| [github.com/pressly/goose/v3](https://github.com/pressly/goose) | `3.27.0` | `3.27.1` |
| [github.com/rs/zerolog](https://github.com/rs/zerolog) | `1.35.0` | `1.35.1` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.20.0` | `0.21.0` |
Updates `github.com/aws/aws-sdk-go-v2` from 1.41.5 to 1.41.12
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...v1.41.12)
Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.14 to 1.32.23
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.32.14...config/v1.32.23)
Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.41.5 to 1.42.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...service/s3/v1.42.2)
Updates `github.com/aws/aws-sdk-go-v2/service/ssm` from 1.68.4 to 1.69.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ssm/v1.68.4...service/ecs/v1.69.2)
Updates `github.com/go-sql-driver/mysql` from 1.9.3 to 1.10.0
- [Release notes](https://github.com/go-sql-driver/mysql/releases)
- [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md)
- [Commits](go-sql-driver/mysql@v1.9.3...v1.10.0)
Updates `github.com/jackc/pgx/v5` from 5.9.1 to 5.10.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.9.1...v5.10.0)
Updates `github.com/pressly/goose/v3` from 3.27.0 to 3.27.1
- [Release notes](https://github.com/pressly/goose/releases)
- [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md)
- [Commits](pressly/goose@v3.27.0...v3.27.1)
Updates `github.com/rs/zerolog` from 1.35.0 to 1.35.1
- [Commits](rs/zerolog@v1.35.0...v1.35.1)
Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
- [Commits](golang/sync@v0.20.0...v0.21.0)
Updates `modernc.org/sqlite` from 1.48.2 to 1.49.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.48.2...v1.49.1)
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
dependency-version: 1.41.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.32.23
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager
dependency-version: 1.42.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ssm
dependency-version: 1.69.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/go-sql-driver/mysql
dependency-version: 1.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/jackc/pgx/v5
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/pressly/goose/v3
dependency-version: 3.27.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/rs/zerolog
dependency-version: 1.35.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: golang.org/x/sync
dependency-version: 0.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: modernc.org/sqlite
dependency-version: 1.49.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabotBot requested a review from webdestroya as a code ownerJune 8, 2026 19:01
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@webdestroyawebdestroyaAwaiting requested review from webdestroyawebdestroya is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
chore(deps): bump the gomod group across 1 directory with 10 updates by dependabot[bot] · Pull Request #19 · webdestroya/groundskeeper · GitHub
Skip to content
chore(deps): bump the gomod group across 1 directory with 10 updates - #19
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/go_modules/gomod-6e4108ed8e
Open
chore(deps): bump the gomod group across 1 directory with 10 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/go_modules/gomod-6e4108ed8e
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubJun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the gomod group with 9 updates in the / directory:
PackageFromTo
github.com/aws/aws-sdk-go-v21.41.51.41.12
github.com/aws/aws-sdk-go-v2/config1.32.141.32.23
github.com/aws/aws-sdk-go-v2/service/secretsmanager1.41.51.42.2
github.com/aws/aws-sdk-go-v2/service/ssm1.68.41.69.2
github.com/go-sql-driver/mysql1.9.31.10.0
github.com/jackc/pgx/v55.9.15.10.0
github.com/pressly/goose/v33.27.03.27.1
github.com/rs/zerolog1.35.01.35.1
golang.org/x/sync0.20.00.21.0
Updates github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.12
Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.14 to 1.32.23
Commits

Updates github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.41.5 to 1.42.2
Commits

Updates github.com/aws/aws-sdk-go-v2/service/ssm from 1.68.4 to 1.69.2
Commits

Updates github.com/go-sql-driver/mysql from 1.9.3 to 1.10.0
Release notes
Sourced from github.com/go-sql-driver/mysql's releases.
v1.10.0
What's Changed
New Contributors
Full Changelog: go-sql-driver/mysql@v1.9.2...v1.10.0
Changelog
Sourced from github.com/go-sql-driver/mysql's changelog.
v1.10.0 (2026-04-28)
  • Fix getSystemVar("max_allowed_packet") potentially returned wrong value. (#1754)
This affects only when maxAllowedPacket=0 is set.
  • Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0. (#1756)
While older versions have reported CVEs, they do not affect go-mysql.
  • Update Go versions to 1.24-1.26. (#1763)
  • Enhance interpolateParams to correctly handle placeholders. (#1732)
The question mark (?) within strings and comments will no longer be treated as a placeholder.
Commits

Updates github.com/jackc/pgx/v5 from 5.9.1 to 5.10.0
Changelog
Sourced from github.com/jackc/pgx/v5's changelog.
5.10.0 (June 3, 2026)
This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers,
contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled
message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication
methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are
sent over TLS when the original connection used TLS.
Features
  • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
  • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
  • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
  • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
  • pgxpool: check if connection is expired before acquire (arthurdotwork)
Security Hardening
  • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
  • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
  • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
  • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
  • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
  • Fix panic on malformed geometric text; return an error instead (MaIII)
Fixes
  • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
  • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
  • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
  • Fix data race when context is cancelled during connect
  • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
  • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
  • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
  • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
  • Add missing error check of rows.Err to load types (Jen Altavilla)
5.9.2 (April 18, 2026)
Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)
SQL injection can occur when:
  1. The non-default simple protocol is used.
  2. A dollar quoted string literal is used in the SQL query.
  3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
  4. The value of that placeholder is controllable by the attacker.
... (truncated)
Commits
  • 7293fb1 Update changelog for v5.10.0
  • 1ade285 pgconn: document secure connection configuration
  • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
  • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
  • b28e65b pgtype: bound array element count against remaining message bytes
  • cd1f389 pgtype: bound array binary decode element length against remaining bytes
  • ff27b5b pgtype: bound hstore binary decode against malicious server input
  • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
  • 44f6173 pgconn: cap server-supplied SCRAM iteration count
  • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
  • Additional commits viewable in compare view

Updates github.com/pressly/goose/v3 from 3.27.0 to 3.27.1
Release notes
Sourced from github.com/pressly/goose/v3's releases.
v3.27.1
What's Changed
  • Dependency updates
Full Changelog: pressly/goose@v3.27.0...v3.27.1
Changelog
Sourced from github.com/pressly/goose/v3's changelog.
[v3.27.1] - 2026-04-24
Changed
  • Bump minimum Go version to 1.25.7
  • Various dependency upgrades
Commits
  • e3235f7 release: v3.27.1
  • 883e2f7 build(deps): bump Go and dependency versions (#1067)
  • 2e2fe5c build(deps): bump the gomod group with 3 updates (#1048)
  • 21176ca build(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0 in the gomod group...
  • e7bd535 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (#1042)
  • f9c7cb4 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /internal/t...
  • b6220db build(deps): bump the gomod group across 1 directory with 3 updates (#1041)
  • 65e320f docs: fix README escaping marker in ENVSUB example (#1037)
  • 18f6ef7 build(deps): bump goreleaser/goreleaser-action from 6 to 7 (#1036)
  • de28e04 docs: update v3.27.0 release notes with Go 1.25 minimum and dep upgrades
  • See full diff in compare view

Updates github.com/rs/zerolog from 1.35.0 to 1.35.1
Commits

Updates golang.org/x/sync from 0.20.0 to 0.21.0
Commits

Updates modernc.org/sqlite from 1.48.2 to 1.49.1
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
@dependabot
chore(deps): bump the gomod group across 1 directory with 10 updates
f8c4b28
Bumps the gomod group with 9 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.41.12` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.14` | `1.32.23` |
| [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.42.2` |
| [github.com/aws/aws-sdk-go-v2/service/ssm](https://github.com/aws/aws-sdk-go-v2) | `1.68.4` | `1.69.2` |
| [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.9.3` | `1.10.0` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.1` | `5.10.0` |
| [github.com/pressly/goose/v3](https://github.com/pressly/goose) | `3.27.0` | `3.27.1` |
| [github.com/rs/zerolog](https://github.com/rs/zerolog) | `1.35.0` | `1.35.1` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.20.0` | `0.21.0` |
Updates `github.com/aws/aws-sdk-go-v2` from 1.41.5 to 1.41.12
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...v1.41.12)
Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.14 to 1.32.23
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.32.14...config/v1.32.23)
Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.41.5 to 1.42.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...service/s3/v1.42.2)
Updates `github.com/aws/aws-sdk-go-v2/service/ssm` from 1.68.4 to 1.69.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ssm/v1.68.4...service/ecs/v1.69.2)
Updates `github.com/go-sql-driver/mysql` from 1.9.3 to 1.10.0
- [Release notes](https://github.com/go-sql-driver/mysql/releases)
- [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md)
- [Commits](go-sql-driver/mysql@v1.9.3...v1.10.0)
Updates `github.com/jackc/pgx/v5` from 5.9.1 to 5.10.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.9.1...v5.10.0)
Updates `github.com/pressly/goose/v3` from 3.27.0 to 3.27.1
- [Release notes](https://github.com/pressly/goose/releases)
- [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md)
- [Commits](pressly/goose@v3.27.0...v3.27.1)
Updates `github.com/rs/zerolog` from 1.35.0 to 1.35.1
- [Commits](rs/zerolog@v1.35.0...v1.35.1)
Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
- [Commits](golang/sync@v0.20.0...v0.21.0)
Updates `modernc.org/sqlite` from 1.48.2 to 1.49.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.48.2...v1.49.1)
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
dependency-version: 1.41.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.32.23
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager
dependency-version: 1.42.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ssm
dependency-version: 1.69.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/go-sql-driver/mysql
dependency-version: 1.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/jackc/pgx/v5
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/pressly/goose/v3
dependency-version: 3.27.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/rs/zerolog
dependency-version: 1.35.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: golang.org/x/sync
dependency-version: 0.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: modernc.org/sqlite
dependency-version: 1.49.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabotBot
requested a review
from webdestroya
as a code ownerJune 8, 2026 19:01
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@webdestroyawebdestroyaAwaiting requested review from webdestroyawebdestroya is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependencies

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(deps): bump the gomod group across 1 directory with 10 updates by dependabot[bot] · Pull Request #19 · webdestroya/groundskeeper · GitHub
Skip to content
chore(deps): bump the gomod group across 1 directory with 10 updates - #19
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/go_modules/gomod-6e4108ed8e
Open
chore(deps): bump the gomod group across 1 directory with 10 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/go_modules/gomod-6e4108ed8e
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubJun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the gomod group with 9 updates in the / directory:
PackageFromTo
github.com/aws/aws-sdk-go-v21.41.51.41.12
github.com/aws/aws-sdk-go-v2/config1.32.141.32.23
github.com/aws/aws-sdk-go-v2/service/secretsmanager1.41.51.42.2
github.com/aws/aws-sdk-go-v2/service/ssm1.68.41.69.2
github.com/go-sql-driver/mysql1.9.31.10.0
github.com/jackc/pgx/v55.9.15.10.0
github.com/pressly/goose/v33.27.03.27.1
github.com/rs/zerolog1.35.01.35.1
golang.org/x/sync0.20.00.21.0
Updates github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.12
Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.14 to 1.32.23
Commits

Updates github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.41.5 to 1.42.2
Commits

Updates github.com/aws/aws-sdk-go-v2/service/ssm from 1.68.4 to 1.69.2
Commits

Updates github.com/go-sql-driver/mysql from 1.9.3 to 1.10.0
Release notes
Sourced from github.com/go-sql-driver/mysql's releases.
v1.10.0
What's Changed
New Contributors
Full Changelog: go-sql-driver/mysql@v1.9.2...v1.10.0
Changelog
Sourced from github.com/go-sql-driver/mysql's changelog.
v1.10.0 (2026-04-28)
  • Fix getSystemVar("max_allowed_packet") potentially returned wrong value. (#1754)
This affects only when maxAllowedPacket=0 is set.
  • Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0. (#1756)
While older versions have reported CVEs, they do not affect go-mysql.
  • Update Go versions to 1.24-1.26. (#1763)
  • Enhance interpolateParams to correctly handle placeholders. (#1732)
The question mark (?) within strings and comments will no longer be treated as a placeholder.
Commits

Updates github.com/jackc/pgx/v5 from 5.9.1 to 5.10.0
Changelog
Sourced from github.com/jackc/pgx/v5's changelog.
5.10.0 (June 3, 2026)
This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers,
contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled
message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication
methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are
sent over TLS when the original connection used TLS.
Features
  • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
  • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
  • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
  • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
  • pgxpool: check if connection is expired before acquire (arthurdotwork)
Security Hardening
  • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
  • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
  • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
  • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
  • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
  • Fix panic on malformed geometric text; return an error instead (MaIII)
Fixes
  • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
  • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
  • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
  • Fix data race when context is cancelled during connect
  • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
  • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
  • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
  • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
  • Add missing error check of rows.Err to load types (Jen Altavilla)
5.9.2 (April 18, 2026)
Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)
SQL injection can occur when:
  1. The non-default simple protocol is used.
  2. A dollar quoted string literal is used in the SQL query.
  3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
  4. The value of that placeholder is controllable by the attacker.
... (truncated)
Commits
  • 7293fb1 Update changelog for v5.10.0
  • 1ade285 pgconn: document secure connection configuration
  • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
  • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
  • b28e65b pgtype: bound array element count against remaining message bytes
  • cd1f389 pgtype: bound array binary decode element length against remaining bytes
  • ff27b5b pgtype: bound hstore binary decode against malicious server input
  • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
  • 44f6173 pgconn: cap server-supplied SCRAM iteration count
  • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
  • Additional commits viewable in compare view

Updates github.com/pressly/goose/v3 from 3.27.0 to 3.27.1
Release notes
Sourced from github.com/pressly/goose/v3's releases.
v3.27.1
What's Changed
  • Dependency updates
Full Changelog: pressly/goose@v3.27.0...v3.27.1
Changelog
Sourced from github.com/pressly/goose/v3's changelog.
[v3.27.1] - 2026-04-24
Changed
  • Bump minimum Go version to 1.25.7
  • Various dependency upgrades
Commits
  • e3235f7 release: v3.27.1
  • 883e2f7 build(deps): bump Go and dependency versions (#1067)
  • 2e2fe5c build(deps): bump the gomod group with 3 updates (#1048)
  • 21176ca build(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0 in the gomod group...
  • e7bd535 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (#1042)
  • f9c7cb4 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /internal/t...
  • b6220db build(deps): bump the gomod group across 1 directory with 3 updates (#1041)
  • 65e320f docs: fix README escaping marker in ENVSUB example (#1037)
  • 18f6ef7 build(deps): bump goreleaser/goreleaser-action from 6 to 7 (#1036)
  • de28e04 docs: update v3.27.0 release notes with Go 1.25 minimum and dep upgrades
  • See full diff in compare view

Updates github.com/rs/zerolog from 1.35.0 to 1.35.1
Commits

Updates golang.org/x/sync from 0.20.0 to 0.21.0
Commits

Updates modernc.org/sqlite from 1.48.2 to 1.49.1
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
@dependabot
chore(deps): bump the gomod group across 1 directory with 10 updates
f8c4b28
Bumps the gomod group with 9 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.41.12` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.14` | `1.32.23` |
| [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.42.2` |
| [github.com/aws/aws-sdk-go-v2/service/ssm](https://github.com/aws/aws-sdk-go-v2) | `1.68.4` | `1.69.2` |
| [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.9.3` | `1.10.0` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.1` | `5.10.0` |
| [github.com/pressly/goose/v3](https://github.com/pressly/goose) | `3.27.0` | `3.27.1` |
| [github.com/rs/zerolog](https://github.com/rs/zerolog) | `1.35.0` | `1.35.1` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.20.0` | `0.21.0` |
Updates `github.com/aws/aws-sdk-go-v2` from 1.41.5 to 1.41.12
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...v1.41.12)
Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.14 to 1.32.23
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.32.14...config/v1.32.23)
Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.41.5 to 1.42.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...service/s3/v1.42.2)
Updates `github.com/aws/aws-sdk-go-v2/service/ssm` from 1.68.4 to 1.69.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ssm/v1.68.4...service/ecs/v1.69.2)
Updates `github.com/go-sql-driver/mysql` from 1.9.3 to 1.10.0
- [Release notes](https://github.com/go-sql-driver/mysql/releases)
- [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md)
- [Commits](go-sql-driver/mysql@v1.9.3...v1.10.0)
Updates `github.com/jackc/pgx/v5` from 5.9.1 to 5.10.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.9.1...v5.10.0)
Updates `github.com/pressly/goose/v3` from 3.27.0 to 3.27.1
- [Release notes](https://github.com/pressly/goose/releases)
- [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md)
- [Commits](pressly/goose@v3.27.0...v3.27.1)
Updates `github.com/rs/zerolog` from 1.35.0 to 1.35.1
- [Commits](rs/zerolog@v1.35.0...v1.35.1)
Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
- [Commits](golang/sync@v0.20.0...v0.21.0)
Updates `modernc.org/sqlite` from 1.48.2 to 1.49.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.48.2...v1.49.1)
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
dependency-version: 1.41.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.32.23
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager
dependency-version: 1.42.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ssm
dependency-version: 1.69.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/go-sql-driver/mysql
dependency-version: 1.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/jackc/pgx/v5
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/pressly/goose/v3
dependency-version: 3.27.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/rs/zerolog
dependency-version: 1.35.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: golang.org/x/sync
dependency-version: 0.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: modernc.org/sqlite
dependency-version: 1.49.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabotBot
requested a review
from webdestroya
as a code ownerJune 8, 2026 19:01
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@webdestroyawebdestroyaAwaiting requested review from webdestroyawebdestroya is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependencies

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(deps): bump the gomod group across 1 directory with 10 updates by dependabot[bot] · Pull Request #19 · webdestroya/groundskeeper · GitHub
Skip to content
chore(deps): bump the gomod group across 1 directory with 10 updates - #19
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/go_modules/gomod-6e4108ed8e
Open
chore(deps): bump the gomod group across 1 directory with 10 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/go_modules/gomod-6e4108ed8e
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubJun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the gomod group with 9 updates in the / directory:
PackageFromTo
github.com/aws/aws-sdk-go-v21.41.51.41.12
github.com/aws/aws-sdk-go-v2/config1.32.141.32.23
github.com/aws/aws-sdk-go-v2/service/secretsmanager1.41.51.42.2
github.com/aws/aws-sdk-go-v2/service/ssm1.68.41.69.2
github.com/go-sql-driver/mysql1.9.31.10.0
github.com/jackc/pgx/v55.9.15.10.0
github.com/pressly/goose/v33.27.03.27.1
github.com/rs/zerolog1.35.01.35.1
golang.org/x/sync0.20.00.21.0
Updates github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.12
Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.14 to 1.32.23
Commits

Updates github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.41.5 to 1.42.2
Commits

Updates github.com/aws/aws-sdk-go-v2/service/ssm from 1.68.4 to 1.69.2
Commits

Updates github.com/go-sql-driver/mysql from 1.9.3 to 1.10.0
Release notes
Sourced from github.com/go-sql-driver/mysql's releases.
v1.10.0
What's Changed
New Contributors
Full Changelog: go-sql-driver/mysql@v1.9.2...v1.10.0
Changelog
Sourced from github.com/go-sql-driver/mysql's changelog.
v1.10.0 (2026-04-28)
  • Fix getSystemVar("max_allowed_packet") potentially returned wrong value. (#1754)
This affects only when maxAllowedPacket=0 is set.
  • Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0. (#1756)
While older versions have reported CVEs, they do not affect go-mysql.
  • Update Go versions to 1.24-1.26. (#1763)
  • Enhance interpolateParams to correctly handle placeholders. (#1732)
The question mark (?) within strings and comments will no longer be treated as a placeholder.
Commits

Updates github.com/jackc/pgx/v5 from 5.9.1 to 5.10.0
Changelog
Sourced from github.com/jackc/pgx/v5's changelog.
5.10.0 (June 3, 2026)
This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers,
contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled
message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication
methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are
sent over TLS when the original connection used TLS.
Features
  • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
  • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
  • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
  • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
  • pgxpool: check if connection is expired before acquire (arthurdotwork)
Security Hardening
  • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
  • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
  • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
  • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
  • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
  • Fix panic on malformed geometric text; return an error instead (MaIII)
Fixes
  • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
  • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
  • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
  • Fix data race when context is cancelled during connect
  • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
  • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
  • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
  • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
  • Add missing error check of rows.Err to load types (Jen Altavilla)
5.9.2 (April 18, 2026)
Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)
SQL injection can occur when:
  1. The non-default simple protocol is used.
  2. A dollar quoted string literal is used in the SQL query.
  3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
  4. The value of that placeholder is controllable by the attacker.
... (truncated)
Commits
  • 7293fb1 Update changelog for v5.10.0
  • 1ade285 pgconn: document secure connection configuration
  • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
  • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
  • b28e65b pgtype: bound array element count against remaining message bytes
  • cd1f389 pgtype: bound array binary decode element length against remaining bytes
  • ff27b5b pgtype: bound hstore binary decode against malicious server input
  • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
  • 44f6173 pgconn: cap server-supplied SCRAM iteration count
  • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
  • Additional commits viewable in compare view

Updates github.com/pressly/goose/v3 from 3.27.0 to 3.27.1
Release notes
Sourced from github.com/pressly/goose/v3's releases.
v3.27.1
What's Changed
  • Dependency updates
Full Changelog: pressly/goose@v3.27.0...v3.27.1
Changelog
Sourced from github.com/pressly/goose/v3's changelog.
[v3.27.1] - 2026-04-24
Changed
  • Bump minimum Go version to 1.25.7
  • Various dependency upgrades
Commits
  • e3235f7 release: v3.27.1
  • 883e2f7 build(deps): bump Go and dependency versions (#1067)
  • 2e2fe5c build(deps): bump the gomod group with 3 updates (#1048)
  • 21176ca build(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0 in the gomod group...
  • e7bd535 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (#1042)
  • f9c7cb4 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /internal/t...
  • b6220db build(deps): bump the gomod group across 1 directory with 3 updates (#1041)
  • 65e320f docs: fix README escaping marker in ENVSUB example (#1037)
  • 18f6ef7 build(deps): bump goreleaser/goreleaser-action from 6 to 7 (#1036)
  • de28e04 docs: update v3.27.0 release notes with Go 1.25 minimum and dep upgrades
  • See full diff in compare view

Updates github.com/rs/zerolog from 1.35.0 to 1.35.1
Commits

Updates golang.org/x/sync from 0.20.0 to 0.21.0
Commits

Updates modernc.org/sqlite from 1.48.2 to 1.49.1
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
@dependabot
chore(deps): bump the gomod group across 1 directory with 10 updates
f8c4b28
Bumps the gomod group with 9 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.41.12` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.14` | `1.32.23` |
| [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.42.2` |
| [github.com/aws/aws-sdk-go-v2/service/ssm](https://github.com/aws/aws-sdk-go-v2) | `1.68.4` | `1.69.2` |
| [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.9.3` | `1.10.0` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.1` | `5.10.0` |
| [github.com/pressly/goose/v3](https://github.com/pressly/goose) | `3.27.0` | `3.27.1` |
| [github.com/rs/zerolog](https://github.com/rs/zerolog) | `1.35.0` | `1.35.1` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.20.0` | `0.21.0` |
Updates `github.com/aws/aws-sdk-go-v2` from 1.41.5 to 1.41.12
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...v1.41.12)
Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.14 to 1.32.23
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.32.14...config/v1.32.23)
Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.41.5 to 1.42.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...service/s3/v1.42.2)
Updates `github.com/aws/aws-sdk-go-v2/service/ssm` from 1.68.4 to 1.69.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ssm/v1.68.4...service/ecs/v1.69.2)
Updates `github.com/go-sql-driver/mysql` from 1.9.3 to 1.10.0
- [Release notes](https://github.com/go-sql-driver/mysql/releases)
- [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md)
- [Commits](go-sql-driver/mysql@v1.9.3...v1.10.0)
Updates `github.com/jackc/pgx/v5` from 5.9.1 to 5.10.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.9.1...v5.10.0)
Updates `github.com/pressly/goose/v3` from 3.27.0 to 3.27.1
- [Release notes](https://github.com/pressly/goose/releases)
- [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md)
- [Commits](pressly/goose@v3.27.0...v3.27.1)
Updates `github.com/rs/zerolog` from 1.35.0 to 1.35.1
- [Commits](rs/zerolog@v1.35.0...v1.35.1)
Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
- [Commits](golang/sync@v0.20.0...v0.21.0)
Updates `modernc.org/sqlite` from 1.48.2 to 1.49.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.48.2...v1.49.1)
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
dependency-version: 1.41.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.32.23
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager
dependency-version: 1.42.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ssm
dependency-version: 1.69.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/go-sql-driver/mysql
dependency-version: 1.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/jackc/pgx/v5
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/pressly/goose/v3
dependency-version: 3.27.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/rs/zerolog
dependency-version: 1.35.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: golang.org/x/sync
dependency-version: 0.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: modernc.org/sqlite
dependency-version: 1.49.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabotBot
requested a review
from webdestroya
as a code ownerJune 8, 2026 19:01
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@webdestroyawebdestroyaAwaiting requested review from webdestroyawebdestroya is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependencies

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
chore(deps): bump the gomod group across 1 directory with 10 updates by dependabot[bot] · Pull Request #19 · webdestroya/groundskeeper · GitHub
Skip to content
chore(deps): bump the gomod group across 1 directory with 10 updates - #19
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/go_modules/gomod-6e4108ed8e
Open
chore(deps): bump the gomod group across 1 directory with 10 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/go_modules/gomod-6e4108ed8e
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubJun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the gomod group with 9 updates in the / directory:
PackageFromTo
github.com/aws/aws-sdk-go-v21.41.51.41.12
github.com/aws/aws-sdk-go-v2/config1.32.141.32.23
github.com/aws/aws-sdk-go-v2/service/secretsmanager1.41.51.42.2
github.com/aws/aws-sdk-go-v2/service/ssm1.68.41.69.2
github.com/go-sql-driver/mysql1.9.31.10.0
github.com/jackc/pgx/v55.9.15.10.0
github.com/pressly/goose/v33.27.03.27.1
github.com/rs/zerolog1.35.01.35.1
golang.org/x/sync0.20.00.21.0
Updates github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.12
Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.14 to 1.32.23
Commits

Updates github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.41.5 to 1.42.2
Commits

Updates github.com/aws/aws-sdk-go-v2/service/ssm from 1.68.4 to 1.69.2
Commits

Updates github.com/go-sql-driver/mysql from 1.9.3 to 1.10.0
Release notes
Sourced from github.com/go-sql-driver/mysql's releases.
v1.10.0
What's Changed
New Contributors
Full Changelog: go-sql-driver/mysql@v1.9.2...v1.10.0
Changelog
Sourced from github.com/go-sql-driver/mysql's changelog.
v1.10.0 (2026-04-28)
  • Fix getSystemVar("max_allowed_packet") potentially returned wrong value. (#1754)
This affects only when maxAllowedPacket=0 is set.
  • Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0. (#1756)
While older versions have reported CVEs, they do not affect go-mysql.
  • Update Go versions to 1.24-1.26. (#1763)
  • Enhance interpolateParams to correctly handle placeholders. (#1732)
The question mark (?) within strings and comments will no longer be treated as a placeholder.
Commits

Updates github.com/jackc/pgx/v5 from 5.9.1 to 5.10.0
Changelog
Sourced from github.com/jackc/pgx/v5's changelog.
5.10.0 (June 3, 2026)
This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers,
contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled
message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication
methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are
sent over TLS when the original connection used TLS.
Features
  • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
  • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
  • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
  • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
  • pgxpool: check if connection is expired before acquire (arthurdotwork)
Security Hardening
  • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
  • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
  • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
  • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
  • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
  • Fix panic on malformed geometric text; return an error instead (MaIII)
Fixes
  • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
  • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
  • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
  • Fix data race when context is cancelled during connect
  • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
  • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
  • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
  • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
  • Add missing error check of rows.Err to load types (Jen Altavilla)
5.9.2 (April 18, 2026)
Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)
SQL injection can occur when:
  1. The non-default simple protocol is used.
  2. A dollar quoted string literal is used in the SQL query.
  3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
  4. The value of that placeholder is controllable by the attacker.
... (truncated)
Commits
  • 7293fb1 Update changelog for v5.10.0
  • 1ade285 pgconn: document secure connection configuration
  • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
  • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
  • b28e65b pgtype: bound array element count against remaining message bytes
  • cd1f389 pgtype: bound array binary decode element length against remaining bytes
  • ff27b5b pgtype: bound hstore binary decode against malicious server input
  • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
  • 44f6173 pgconn: cap server-supplied SCRAM iteration count
  • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
  • Additional commits viewable in compare view

Updates github.com/pressly/goose/v3 from 3.27.0 to 3.27.1
Release notes
Sourced from github.com/pressly/goose/v3's releases.
v3.27.1
What's Changed
  • Dependency updates
Full Changelog: pressly/goose@v3.27.0...v3.27.1
Changelog
Sourced from github.com/pressly/goose/v3's changelog.
[v3.27.1] - 2026-04-24
Changed
  • Bump minimum Go version to 1.25.7
  • Various dependency upgrades
Commits
  • e3235f7 release: v3.27.1
  • 883e2f7 build(deps): bump Go and dependency versions (#1067)
  • 2e2fe5c build(deps): bump the gomod group with 3 updates (#1048)
  • 21176ca build(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0 in the gomod group...
  • e7bd535 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (#1042)
  • f9c7cb4 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /internal/t...
  • b6220db build(deps): bump the gomod group across 1 directory with 3 updates (#1041)
  • 65e320f docs: fix README escaping marker in ENVSUB example (#1037)
  • 18f6ef7 build(deps): bump goreleaser/goreleaser-action from 6 to 7 (#1036)
  • de28e04 docs: update v3.27.0 release notes with Go 1.25 minimum and dep upgrades
  • See full diff in compare view

Updates github.com/rs/zerolog from 1.35.0 to 1.35.1
Commits

Updates golang.org/x/sync from 0.20.0 to 0.21.0
Commits

Updates modernc.org/sqlite from 1.48.2 to 1.49.1
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
@dependabot
chore(deps): bump the gomod group across 1 directory with 10 updates
f8c4b28
Bumps the gomod group with 9 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.41.12` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.14` | `1.32.23` |
| [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.42.2` |
| [github.com/aws/aws-sdk-go-v2/service/ssm](https://github.com/aws/aws-sdk-go-v2) | `1.68.4` | `1.69.2` |
| [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.9.3` | `1.10.0` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.1` | `5.10.0` |
| [github.com/pressly/goose/v3](https://github.com/pressly/goose) | `3.27.0` | `3.27.1` |
| [github.com/rs/zerolog](https://github.com/rs/zerolog) | `1.35.0` | `1.35.1` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.20.0` | `0.21.0` |
Updates `github.com/aws/aws-sdk-go-v2` from 1.41.5 to 1.41.12
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...v1.41.12)
Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.14 to 1.32.23
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.32.14...config/v1.32.23)
Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.41.5 to 1.42.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...service/s3/v1.42.2)
Updates `github.com/aws/aws-sdk-go-v2/service/ssm` from 1.68.4 to 1.69.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ssm/v1.68.4...service/ecs/v1.69.2)
Updates `github.com/go-sql-driver/mysql` from 1.9.3 to 1.10.0
- [Release notes](https://github.com/go-sql-driver/mysql/releases)
- [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md)
- [Commits](go-sql-driver/mysql@v1.9.3...v1.10.0)
Updates `github.com/jackc/pgx/v5` from 5.9.1 to 5.10.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.9.1...v5.10.0)
Updates `github.com/pressly/goose/v3` from 3.27.0 to 3.27.1
- [Release notes](https://github.com/pressly/goose/releases)
- [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md)
- [Commits](pressly/goose@v3.27.0...v3.27.1)
Updates `github.com/rs/zerolog` from 1.35.0 to 1.35.1
- [Commits](rs/zerolog@v1.35.0...v1.35.1)
Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
- [Commits](golang/sync@v0.20.0...v0.21.0)
Updates `modernc.org/sqlite` from 1.48.2 to 1.49.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.48.2...v1.49.1)
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
dependency-version: 1.41.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.32.23
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager
dependency-version: 1.42.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ssm
dependency-version: 1.69.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/go-sql-driver/mysql
dependency-version: 1.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/jackc/pgx/v5
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/pressly/goose/v3
dependency-version: 3.27.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/rs/zerolog
dependency-version: 1.35.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: golang.org/x/sync
dependency-version: 0.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: modernc.org/sqlite
dependency-version: 1.49.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabotBot
requested a review
from webdestroya
as a code ownerJune 8, 2026 19:01
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@webdestroyawebdestroyaAwaiting requested review from webdestroyawebdestroya is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependencies

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(deps): bump the gomod group across 1 directory with 10 updates by dependabot[bot] · Pull Request #19 · webdestroya/groundskeeper · GitHub
Skip to content
chore(deps): bump the gomod group across 1 directory with 10 updates - #19
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/go_modules/gomod-6e4108ed8e
Open
chore(deps): bump the gomod group across 1 directory with 10 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/go_modules/gomod-6e4108ed8e
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubJun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the gomod group with 9 updates in the / directory:
PackageFromTo
github.com/aws/aws-sdk-go-v21.41.51.41.12
github.com/aws/aws-sdk-go-v2/config1.32.141.32.23
github.com/aws/aws-sdk-go-v2/service/secretsmanager1.41.51.42.2
github.com/aws/aws-sdk-go-v2/service/ssm1.68.41.69.2
github.com/go-sql-driver/mysql1.9.31.10.0
github.com/jackc/pgx/v55.9.15.10.0
github.com/pressly/goose/v33.27.03.27.1
github.com/rs/zerolog1.35.01.35.1
golang.org/x/sync0.20.00.21.0
Updates github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.12
Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.14 to 1.32.23
Commits

Updates github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.41.5 to 1.42.2
Commits

Updates github.com/aws/aws-sdk-go-v2/service/ssm from 1.68.4 to 1.69.2
Commits

Updates github.com/go-sql-driver/mysql from 1.9.3 to 1.10.0
Release notes
Sourced from github.com/go-sql-driver/mysql's releases.
v1.10.0
What's Changed
New Contributors
Full Changelog: go-sql-driver/mysql@v1.9.2...v1.10.0
Changelog
Sourced from github.com/go-sql-driver/mysql's changelog.
v1.10.0 (2026-04-28)
  • Fix getSystemVar("max_allowed_packet") potentially returned wrong value. (#1754)
This affects only when maxAllowedPacket=0 is set.
  • Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0. (#1756)
While older versions have reported CVEs, they do not affect go-mysql.
  • Update Go versions to 1.24-1.26. (#1763)
  • Enhance interpolateParams to correctly handle placeholders. (#1732)
The question mark (?) within strings and comments will no longer be treated as a placeholder.
Commits

Updates github.com/jackc/pgx/v5 from 5.9.1 to 5.10.0
Changelog
Sourced from github.com/jackc/pgx/v5's changelog.
5.10.0 (June 3, 2026)
This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers,
contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled
message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication
methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are
sent over TLS when the original connection used TLS.
Features
  • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
  • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
  • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
  • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
  • pgxpool: check if connection is expired before acquire (arthurdotwork)
Security Hardening
  • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
  • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
  • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
  • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
  • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
  • Fix panic on malformed geometric text; return an error instead (MaIII)
Fixes
  • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
  • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
  • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
  • Fix data race when context is cancelled during connect
  • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
  • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
  • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
  • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
  • Add missing error check of rows.Err to load types (Jen Altavilla)
5.9.2 (April 18, 2026)
Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)
SQL injection can occur when:
  1. The non-default simple protocol is used.
  2. A dollar quoted string literal is used in the SQL query.
  3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
  4. The value of that placeholder is controllable by the attacker.
... (truncated)
Commits
  • 7293fb1 Update changelog for v5.10.0
  • 1ade285 pgconn: document secure connection configuration
  • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
  • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
  • b28e65b pgtype: bound array element count against remaining message bytes
  • cd1f389 pgtype: bound array binary decode element length against remaining bytes
  • ff27b5b pgtype: bound hstore binary decode against malicious server input
  • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
  • 44f6173 pgconn: cap server-supplied SCRAM iteration count
  • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
  • Additional commits viewable in compare view

Updates github.com/pressly/goose/v3 from 3.27.0 to 3.27.1
Release notes
Sourced from github.com/pressly/goose/v3's releases.
v3.27.1
What's Changed
  • Dependency updates
Full Changelog: pressly/goose@v3.27.0...v3.27.1
Changelog
Sourced from github.com/pressly/goose/v3's changelog.
[v3.27.1] - 2026-04-24
Changed
  • Bump minimum Go version to 1.25.7
  • Various dependency upgrades
Commits
  • e3235f7 release: v3.27.1
  • 883e2f7 build(deps): bump Go and dependency versions (#1067)
  • 2e2fe5c build(deps): bump the gomod group with 3 updates (#1048)
  • 21176ca build(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0 in the gomod group...
  • e7bd535 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (#1042)
  • f9c7cb4 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /internal/t...
  • b6220db build(deps): bump the gomod group across 1 directory with 3 updates (#1041)
  • 65e320f docs: fix README escaping marker in ENVSUB example (#1037)
  • 18f6ef7 build(deps): bump goreleaser/goreleaser-action from 6 to 7 (#1036)
  • de28e04 docs: update v3.27.0 release notes with Go 1.25 minimum and dep upgrades
  • See full diff in compare view

Updates github.com/rs/zerolog from 1.35.0 to 1.35.1
Commits

Updates golang.org/x/sync from 0.20.0 to 0.21.0
Commits

Updates modernc.org/sqlite from 1.48.2 to 1.49.1
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
@dependabot
chore(deps): bump the gomod group across 1 directory with 10 updates
f8c4b28
Bumps the gomod group with 9 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.41.12` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.14` | `1.32.23` |
| [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.42.2` |
| [github.com/aws/aws-sdk-go-v2/service/ssm](https://github.com/aws/aws-sdk-go-v2) | `1.68.4` | `1.69.2` |
| [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.9.3` | `1.10.0` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.1` | `5.10.0` |
| [github.com/pressly/goose/v3](https://github.com/pressly/goose) | `3.27.0` | `3.27.1` |
| [github.com/rs/zerolog](https://github.com/rs/zerolog) | `1.35.0` | `1.35.1` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.20.0` | `0.21.0` |
Updates `github.com/aws/aws-sdk-go-v2` from 1.41.5 to 1.41.12
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...v1.41.12)
Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.14 to 1.32.23
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.32.14...config/v1.32.23)
Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.41.5 to 1.42.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...service/s3/v1.42.2)
Updates `github.com/aws/aws-sdk-go-v2/service/ssm` from 1.68.4 to 1.69.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ssm/v1.68.4...service/ecs/v1.69.2)
Updates `github.com/go-sql-driver/mysql` from 1.9.3 to 1.10.0
- [Release notes](https://github.com/go-sql-driver/mysql/releases)
- [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md)
- [Commits](go-sql-driver/mysql@v1.9.3...v1.10.0)
Updates `github.com/jackc/pgx/v5` from 5.9.1 to 5.10.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.9.1...v5.10.0)
Updates `github.com/pressly/goose/v3` from 3.27.0 to 3.27.1
- [Release notes](https://github.com/pressly/goose/releases)
- [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md)
- [Commits](pressly/goose@v3.27.0...v3.27.1)
Updates `github.com/rs/zerolog` from 1.35.0 to 1.35.1
- [Commits](rs/zerolog@v1.35.0...v1.35.1)
Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
- [Commits](golang/sync@v0.20.0...v0.21.0)
Updates `modernc.org/sqlite` from 1.48.2 to 1.49.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.48.2...v1.49.1)
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
dependency-version: 1.41.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.32.23
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager
dependency-version: 1.42.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ssm
dependency-version: 1.69.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/go-sql-driver/mysql
dependency-version: 1.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/jackc/pgx/v5
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/pressly/goose/v3
dependency-version: 3.27.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/rs/zerolog
dependency-version: 1.35.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: golang.org/x/sync
dependency-version: 0.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: modernc.org/sqlite
dependency-version: 1.49.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabotBot
requested a review
from webdestroya
as a code ownerJune 8, 2026 19:01
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@webdestroyawebdestroyaAwaiting requested review from webdestroyawebdestroya is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependencies

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
})();
chore(deps): bump the gomod group across 1 directory with 10 updates by dependabot[bot] · Pull Request #19 · webdestroya/groundskeeper · GitHub
Skip to content
chore(deps): bump the gomod group across 1 directory with 10 updates - #19
Open
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/go_modules/gomod-6e4108ed8e
Open
chore(deps): bump the gomod group across 1 directory with 10 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom 
dependabot/go_modules/gomod-6e4108ed8e
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubJun 8, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Bumps the gomod group with 9 updates in the / directory:
PackageFromTo
github.com/aws/aws-sdk-go-v21.41.51.41.12
github.com/aws/aws-sdk-go-v2/config1.32.141.32.23
github.com/aws/aws-sdk-go-v2/service/secretsmanager1.41.51.42.2
github.com/aws/aws-sdk-go-v2/service/ssm1.68.41.69.2
github.com/go-sql-driver/mysql1.9.31.10.0
github.com/jackc/pgx/v55.9.15.10.0
github.com/pressly/goose/v33.27.03.27.1
github.com/rs/zerolog1.35.01.35.1
golang.org/x/sync0.20.00.21.0
Updates github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.12
Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.14 to 1.32.23
Commits

Updates github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.41.5 to 1.42.2
Commits

Updates github.com/aws/aws-sdk-go-v2/service/ssm from 1.68.4 to 1.69.2
Commits

Updates github.com/go-sql-driver/mysql from 1.9.3 to 1.10.0
Release notes
Sourced from github.com/go-sql-driver/mysql's releases.
v1.10.0
What's Changed
New Contributors
Full Changelog: go-sql-driver/mysql@v1.9.2...v1.10.0
Changelog
Sourced from github.com/go-sql-driver/mysql's changelog.
v1.10.0 (2026-04-28)
  • Fix getSystemVar("max_allowed_packet") potentially returned wrong value. (#1754)
This affects only when maxAllowedPacket=0 is set.
  • Bump filippo.io/edwards25519 from 1.1.1 to 1.2.0. (#1756)
While older versions have reported CVEs, they do not affect go-mysql.
  • Update Go versions to 1.24-1.26. (#1763)
  • Enhance interpolateParams to correctly handle placeholders. (#1732)
The question mark (?) within strings and comments will no longer be treated as a placeholder.
Commits

Updates github.com/jackc/pgx/v5 from 5.9.1 to 5.10.0
Changelog
Sourced from github.com/jackc/pgx/v5's changelog.
5.10.0 (June 3, 2026)
This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers,
contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled
message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication
methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are
sent over TLS when the original connection used TLS.
Features
  • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
  • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
  • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
  • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
  • pgxpool: check if connection is expired before acquire (arthurdotwork)
Security Hardening
  • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
  • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
  • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
  • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
  • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
  • Fix panic on malformed geometric text; return an error instead (MaIII)
Fixes
  • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
  • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
  • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
  • Fix data race when context is cancelled during connect
  • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
  • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
  • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
  • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
  • Add missing error check of rows.Err to load types (Jen Altavilla)
5.9.2 (April 18, 2026)
Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)
SQL injection can occur when:
  1. The non-default simple protocol is used.
  2. A dollar quoted string literal is used in the SQL query.
  3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
  4. The value of that placeholder is controllable by the attacker.
... (truncated)
Commits
  • 7293fb1 Update changelog for v5.10.0
  • 1ade285 pgconn: document secure connection configuration
  • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
  • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
  • b28e65b pgtype: bound array element count against remaining message bytes
  • cd1f389 pgtype: bound array binary decode element length against remaining bytes
  • ff27b5b pgtype: bound hstore binary decode against malicious server input
  • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
  • 44f6173 pgconn: cap server-supplied SCRAM iteration count
  • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
  • Additional commits viewable in compare view

Updates github.com/pressly/goose/v3 from 3.27.0 to 3.27.1
Release notes
Sourced from github.com/pressly/goose/v3's releases.
v3.27.1
What's Changed
  • Dependency updates
Full Changelog: pressly/goose@v3.27.0...v3.27.1
Changelog
Sourced from github.com/pressly/goose/v3's changelog.
[v3.27.1] - 2026-04-24
Changed
  • Bump minimum Go version to 1.25.7
  • Various dependency upgrades
Commits
  • e3235f7 release: v3.27.1
  • 883e2f7 build(deps): bump Go and dependency versions (#1067)
  • 2e2fe5c build(deps): bump the gomod group with 3 updates (#1048)
  • 21176ca build(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0 in the gomod group...
  • e7bd535 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (#1042)
  • f9c7cb4 build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /internal/t...
  • b6220db build(deps): bump the gomod group across 1 directory with 3 updates (#1041)
  • 65e320f docs: fix README escaping marker in ENVSUB example (#1037)
  • 18f6ef7 build(deps): bump goreleaser/goreleaser-action from 6 to 7 (#1036)
  • de28e04 docs: update v3.27.0 release notes with Go 1.25 minimum and dep upgrades
  • See full diff in compare view

Updates github.com/rs/zerolog from 1.35.0 to 1.35.1
Commits

Updates golang.org/x/sync from 0.20.0 to 0.21.0
Commits

Updates modernc.org/sqlite from 1.48.2 to 1.49.1
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
@dependabot
chore(deps): bump the gomod group across 1 directory with 10 updates
f8c4b28
Bumps the gomod group with 9 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.41.12` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.14` | `1.32.23` |
| [github.com/aws/aws-sdk-go-v2/service/secretsmanager](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.42.2` |
| [github.com/aws/aws-sdk-go-v2/service/ssm](https://github.com/aws/aws-sdk-go-v2) | `1.68.4` | `1.69.2` |
| [github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql) | `1.9.3` | `1.10.0` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.1` | `5.10.0` |
| [github.com/pressly/goose/v3](https://github.com/pressly/goose) | `3.27.0` | `3.27.1` |
| [github.com/rs/zerolog](https://github.com/rs/zerolog) | `1.35.0` | `1.35.1` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.20.0` | `0.21.0` |
Updates `github.com/aws/aws-sdk-go-v2` from 1.41.5 to 1.41.12
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...v1.41.12)
Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.14 to 1.32.23
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.32.14...config/v1.32.23)
Updates `github.com/aws/aws-sdk-go-v2/service/secretsmanager` from 1.41.5 to 1.42.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...service/s3/v1.42.2)
Updates `github.com/aws/aws-sdk-go-v2/service/ssm` from 1.68.4 to 1.69.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ssm/v1.68.4...service/ecs/v1.69.2)
Updates `github.com/go-sql-driver/mysql` from 1.9.3 to 1.10.0
- [Release notes](https://github.com/go-sql-driver/mysql/releases)
- [Changelog](https://github.com/go-sql-driver/mysql/blob/master/CHANGELOG.md)
- [Commits](go-sql-driver/mysql@v1.9.3...v1.10.0)
Updates `github.com/jackc/pgx/v5` from 5.9.1 to 5.10.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.9.1...v5.10.0)
Updates `github.com/pressly/goose/v3` from 3.27.0 to 3.27.1
- [Release notes](https://github.com/pressly/goose/releases)
- [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md)
- [Commits](pressly/goose@v3.27.0...v3.27.1)
Updates `github.com/rs/zerolog` from 1.35.0 to 1.35.1
- [Commits](rs/zerolog@v1.35.0...v1.35.1)
Updates `golang.org/x/sync` from 0.20.0 to 0.21.0
- [Commits](golang/sync@v0.20.0...v0.21.0)
Updates `modernc.org/sqlite` from 1.48.2 to 1.49.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.48.2...v1.49.1)
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
dependency-version: 1.41.12
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/config
dependency-version: 1.32.23
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/secretsmanager
dependency-version: 1.42.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ssm
dependency-version: 1.69.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/go-sql-driver/mysql
dependency-version: 1.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/jackc/pgx/v5
dependency-version: 5.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: github.com/pressly/goose/v3
dependency-version: 3.27.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: github.com/rs/zerolog
dependency-version: 1.35.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gomod
- dependency-name: golang.org/x/sync
dependency-version: 0.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
- dependency-name: modernc.org/sqlite
dependency-version: 1.49.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gomod
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabotBot
requested a review
from webdestroya
as a code ownerJune 8, 2026 19:01
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@webdestroyawebdestroyaAwaiting requested review from webdestroyawebdestroya is a code owner

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels

dependencies

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

0 participants