chore(deps): bump the go-minor-patch group across 1 directory with 10 updates by dependabot[bot] · Pull Request #212 · DocSpring/rack-gateway

dependabot · 2026-11-06T10:20:46Z

Bumps the go-minor-patch group with 10 updates in the / directory:

Package	From	To
github.com/aws/aws-sdk-go-v2	`1.47.3`	`1.47.5`
github.com/aws/aws-sdk-go-v2/config	`1.33.9`	`1.33.12`
github.com/aws/aws-sdk-go-v2/service/s3	`1.114.3`	`1.114.6`
github.com/convox/stdsdk	`0.0.4`	`0.0.5`
github.com/fxamacker/cbor/v2	`2.9.6`	`2.10.0`
github.com/riverqueue/river	`0.49.0`	`0.50.0`
github.com/riverqueue/river/riverdriver/riverpgxv5	`0.49.0`	`0.50.0`
github.com/riverqueue/river/rivertype	`0.49.0`	`0.50.0`
github.com/sigstore/sigstore-go	`1.3.0`	`1.4.0`
github.com/spf13/pflag	`1.0.10`	`1.1.0`

Updates github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.5

Commits

c350990 Release 2026-10-27
4d2d256 Regenerated Clients
d2bd6cc Update API model
da4b3cc update to smithy-go v1.28.7 (#3608)
c86b81b schema-serde: release final restjson services (#3605)
7393955 Fix login cred update token panic (#3558)
9626aa3 fix nil in stscreds (#3604)
0d657c0 Release 2026-10-26
77b7742 Regenerated Clients
54f1f5e Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.12

Commits

c350990 Release 2026-10-27
4d2d256 Regenerated Clients
d2bd6cc Update API model
da4b3cc update to smithy-go v1.28.7 (#3608)
c86b81b schema-serde: release final restjson services (#3605)
7393955 Fix login cred update token panic (#3558)
9626aa3 fix nil in stscreds (#3604)
0d657c0 Release 2026-10-26
77b7742 Regenerated Clients
54f1f5e Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.3 to 1.114.6

Commits

c350990 Release 2026-10-27
4d2d256 Regenerated Clients
d2bd6cc Update API model
da4b3cc update to smithy-go v1.28.7 (#3608)
c86b81b schema-serde: release final restjson services (#3605)
7393955 Fix login cred update token panic (#3558)
9626aa3 fix nil in stscreds (#3604)
0d657c0 Release 2026-10-26
77b7742 Regenerated Clients
54f1f5e Update endpoints model
Additional commits viewable in compare view

Updates github.com/convox/stdsdk from 0.0.4 to 0.0.5

Commits

bfe0b79 Merge pull request #3 from convox/logs-stream-end-marker
e31411c Report and close finished websocket streams
See full diff in compare view

Updates github.com/fxamacker/cbor/v2 from 2.9.6 to 2.10.0

Release notes

Sourced from github.com/fxamacker/cbor/v2's releases.

v2.10.0

v2.10 speeds up encoding by up to 2.88× and decoding by up to 1.87× with zero memory regressions (B/op, allocs/op), reduces memory use, adds the toindefarray struct tag option, and fixes bugs. The Contributing Guidelines, Security Policy, and templates were extensively updated.

Encoding sorted nested maps of dynamic JSON-like data to CBOR drops from 70 allocs/op to 1 and from 7.2 KiB/op to 4.0 KiB/op in the benchmarks below. Encoding time.Time, big.Int, Tag and Marshaler values, and decoding into time.Time, big.Int and Tag, use 1 to 2 fewer allocs/op (20% to 50% fewer).

This release does not use Go's unsafe package. Performance in user apps depends on configuration and data.

Tests were refactored and coverage increased to 97.7%. Fuzz tests (not yet public) were also extended. Internal checklists and procedures were updated to reduce potential mistakes.

Performance and Benchmarks

Across all 215 benchmarks, there are zero memory regressions (B/op, allocs/op). Just one benchmark showed a speed dip: Marshal/struct_many_flds_all_omitempty_all_empty/map is ~4-5% slower, but only when a struct has 32 fields that are both omitzero and empty (same scenario with an 8-field struct is now faster).

Benchmarks ran with Go 1.26.10 on linux/amd64 (benchstat n=10, p=0.000):

CBOR Speedup by Data Type: groups of different benchmarks summarized per row

CBOR Encoding Reflection-Free Speedup: dynamic JSON-like data types and common types

CBOR Speedup by Data Type

Unmarshal Speedup ΔSec/op

Single values (bool, int, float, byte string, text string) 1.10× to 1.51×¹ -8.87% to -33.92%¹

Epoch time, bignum, other tags 1.18× to 1.64× -15.33% to -38.91%

Arrays and maps to non-struct 1.33× to 1.87× -24.63% to -46.49%

Arrays and maps to structs 1.06× to 1.52× -5.46% to -34.40%

Real-world (COSE, CWT, SenML, WebAuthn) 1.35× to 1.64× -26.06% to -39.19%

¹ 2.54× speedup (-60.64%) when decoding into a named []byte type that has methods.

Marshal Speedup ΔSec/op

Single values (bool, int, float, byte slice, string) 1.32× to 1.55× -24.49% to -35.41%

time.Time, big.Int, Tag, Marshaler² 1.15× to 1.63× -12.94% to -38.84%

Slices and maps 1.35× to 2.88× -25.97% to -65.26%

Structs 1.57× to 2.17× -36.37% to -53.96%

Structs with omitempty fields 0.95×³ to 1.35× +5.01%³ to -25.96%

Real-world (COSE, CWT, SenML, WebAuthn) 1.12× to 1.33× -10.66% to -24.77%

² For addressable values (reached through a pointer, struct field, slice element or map value).

³ Only when every field is omitempty and empty: 7.6 ns slower for a 32-field struct, 2.37 ns faster for an 8-field struct. This is the only performance regression in all 215 benchmarks.

CBOR Encoding Reflection-Free Speedup

PR #870 optimized common types: int, int64, uint, uint64, float64, bool, string, nil, []byte, []any, map[any]any, map[string]any, and map[string]string.

Marshal Benchmarkv2.9.6 → v2.10 Speedup TimeΔSec/op MemoryΔB/op MemoryΔAllocs/op

[]any 2.50× -607.5 ns (-60.03%) - -

... (truncated)

Commits

cc2e8fb Merge pull request #890 from fxamacker/fxamacker/update-docs-for-v2.10.0
c3279a6 Update doc.go and README.md for v2.10.0
9106688 Merge pull request #891 from fxamacker/fxamacker/add-benchmarks
864491f Add more benchmarks
49a20b9 Merge pull request #889 from fxamacker/fxamacker/reduce-float64-unix-time-range
f5fbdcd Fix float range check when decoding Unix time
67a9707 Merge pull request #886 from fxamacker/fxamacker/reduce-allocs
6567310 Merge pull request #888 from fxamacker/fxamacker/cleanup-tests
84ba3bf Fix several test bugs
261eb13 Standardize test failure messages
Additional commits viewable in compare view

Updates github.com/riverqueue/river from 0.49.0 to 0.50.0

Release notes

Sourced from github.com/riverqueue/river's releases.

v0.50.0

Changed

Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).

Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).

Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).

Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).

Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).

Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).

Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).

Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

Changelog

Sourced from github.com/riverqueue/river's changelog.

[0.50.0] - 2026-10-26

Changed

Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).

Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).

Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).

Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).

Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).

Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).

Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).

Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

Commits

3901b3d [go] Prepare v0.50.0 (#1552)
4647e69 [rust] Prepare v0.4.0 (#1550)
dc6af86 [java] Publish complete GitHub release assets for the Maven proxy (#1543)
c411fc1 [ruby] Prepare v0.14.0 (#1551)
d89175d [js] Prepare v0.3.0 (#1549)
237ff56 [js] Remove automatic global polyfill (#1548)
23d2c7e [go, js] bump compatible dependencies (#1545)
274c4b1 [js] bump @types/pg from 8.20.0 to 8.23.1 (#1547)
21ec5ea [go, js] refresh periodic schedules after commit (#1540)
b3a0089 [ruby] open no savepoints inside a transaction (#1544)
Additional commits viewable in compare view

Updates github.com/riverqueue/river/riverdriver/riverpgxv5 from 0.49.0 to 0.50.0

Release notes

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's releases.

v0.50.0

Changed

Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).

Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).

Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).

Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).

Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).

Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).

Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).

Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

Changelog

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's changelog.

[0.50.0] - 2026-10-26

Changed

Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).

Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).

Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).

Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).

Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).

Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).

Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).

Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

Commits

3901b3d [go] Prepare v0.50.0 (#1552)
4647e69 [rust] Prepare v0.4.0 (#1550)
dc6af86 [java] Publish complete GitHub release assets for the Maven proxy (#1543)
c411fc1 [ruby] Prepare v0.14.0 (#1551)
d89175d [js] Prepare v0.3.0 (#1549)
237ff56 [js] Remove automatic global polyfill (#1548)
23d2c7e [go, js] bump compatible dependencies (#1545)
274c4b1 [js] bump @types/pg from 8.20.0 to 8.23.1 (#1547)
21ec5ea [go, js] refresh periodic schedules after commit (#1540)
b3a0089 [ruby] open no savepoints inside a transaction (#1544)
Additional commits viewable in compare view

Updates github.com/riverqueue/river/rivertype from 0.49.0 to 0.50.0

Release notes

Sourced from github.com/riverqueue/river/rivertype's releases.

v0.50.0

Changed

Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).

Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).

Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).

Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).

Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).

Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).

Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).

Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

Changelog

Sourced from github.com/riverqueue/river/rivertype's changelog.

[0.50.0] - 2026-10-26

Changed

Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).

Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).

Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).

Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).

Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).

Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).

Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).

Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

Commits

3901b3d [go] Prepare v0.50.0 (#1552)
4647e69 [rust] Prepare v0.4.0 (#1550)
dc6af86 [java] Publish complete GitHub release assets for the Maven proxy (#1543)
c411fc1 [ruby] Prepare v0.14.0 (#1551)
d89175d [js] Prepare v0.3.0 (#1549)
237ff56 [js] Remove automatic global polyfill (#1548)
23d2c7e [go, js] bump compatible dependencies (#1545)
274c4b1 [js] bump @types/pg from 8.20.0 to 8.23.1 (#1547)
21ec5ea [go, js] refresh periodic schedules after commit (#1540)
b3a0089 [ruby] open no savepoints inside a transaction (#1544)
Additional commits viewable in compare view

Updates github.com/sigstore/sigstore-go from 1.3.0 to 1.4.0

Release notes

Sourced from github.com/sigstore/sigstore-go's releases.

v1.4.0

What's Changed

Add PyPI attestation (PEP 740) verification example by @jflacker in sigstore/sigstore-go#654

retry transient TUF downloads by default by @crazy-max in sigstore/sigstore-go#671

sign: retry Fulcio and TSA requests with httpretry by @codysoyland in sigstore/sigstore-go#676

Bump google.golang.org/grpc from 1.82.1 to 1.83.2 in /examples/oci-image-verification by @dependabot[bot] in sigstore/sigstore-go#678

bound fuzz tests to 64kb inputs by @bobcallaway in sigstore/sigstore-go#680

Bump google.golang.org/grpc from 1.82.1 to 1.83.2 by @dependabot[bot] in sigstore/sigstore-go#674

Bump the minor-patch group across 2 directories with 9 updates by @dependabot[bot] in sigstore/sigstore-go#681

Bump the minor-patch group across 1 directory with 5 updates by @dependabot[bot] in sigstore/sigstore-go#683

Drop patch version from go directive in go.mod by @rdimitrov in sigstore/sigstore-go#685

sign: allow callers to set the User-Agent for Fulcio, TSA and Rekor by @cpanato in sigstore/sigstore-go#686

Bump the minor-patch group across 1 directory with 4 updates by @dependabot[bot] in sigstore/sigstore-go#687

Bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 by @dependabot[bot] in sigstore/sigstore-go#688

fix(verify): use pointer receiver for ErrVerification methods by @Hayden-IO in sigstore/sigstore-go#689

sign: accept custom transports for Rekor clients by @kevinmdavis in sigstore/sigstore-go#690

New Contributors

@jflacker made their first contribution in sigstore/sigstore-go#654

@crazy-max made their first contribution in sigstore/sigstore-go#671

@cpanato made their first contribution in sigstore/sigstore-go#686

@kevinmdavis made their first contribution in sigstore/sigstore-go#690

Full Changelog: sigstore/sigstore-go@v1.3.0...v1.4.0

Commits

be417d9 sign: accept custom transports for Rekor clients (#690)
42c420a fix(verify): use pointer receiver for ErrVerification methods (#689)
924d9a6 Bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 (#688)
f203a5a Bump the minor-patch group across 1 directory with 4 updates (#687)
0161b20 sign: allow callers to set the User-Agent for Fulcio, TSA and Rekor (#686)
35e12bb Drop patch version from go directive in go.mod (#685)
29ea8ed Bump the minor-patch group across 1 directory with 5 updates (#683)
b9b4e28 Bump the minor-patch group across 2 directories with 9 updates (#681)
e55f0ed Bump google.golang.org/grpc from 1.82.1 to 1.83.2 (#674)
a061819 bound fuzz tests to 64kb inputs (#680)
Additional commits viewable in compare view

Updates github.com/spf13/pflag from 1.0.10 to 1.1.0

Release notes

Sourced from github.com/spf13/pflag's releases.

v1.1.0

It's been long enough, and enough things have been fixed, that it might be time to release a new version, even if there isn't any particular big new issue to market as the reason for this release.

If you notice anything breaking, it is entirely un-intentional, but you might also have been relying on undocumented or buggy behavior. Please file an issue describing what you're doing, how it worked before this release and why it doesn't work anymore, and pin your projects to v1.0.10 (the latest release before this one) while we decide how to address your concerns.

What's Changed

README: update badges and minor linting fixes by @thaJeztah in spf13/pflag#452

Show 'correct' explicit bool value syntax in help by @alimpfard in spf13/pflag#453

Fix for Go 1.24 by @pterjan in spf13/pflag#460

fix(map): ensure string-to-string flags maintain stable pointers by @brandon1024 in spf13/pflag#457

Fix getFlagType error message by @wellitonscheer in spf13/pflag#462

update actions, and fix linting issues by @thaJeztah in spf13/pflag#450

fix: README.md indicating the use of godoc(deprecated) by @malklera in spf13/pflag#467

Fix broken link to POSIX argument conventions by @tomasaschan in spf13/pflag#464

Replace raw stdlib parse errors in typed flag Set methods (#269) by @reuvenharrison in spf13/pflag#469

Extend UnknownFlags to UnknownFlagsHandling and introduce PassUnknownFlagToArgs (#337) by @ikedam in spf13/pflag#440

fix: allow nil default IP flags in GetIP by @happysnaker in spf13/pflag#483

fix: allow hex input in UintSlice by @happysnaker in spf13/pflag#484

fix: honor custom IsBoolFlag compatibility by @happysnaker in spf13/pflag#487

docs: clarify SortFlags example with complete runnable program by @happysnaker in spf13/pflag#488

docs: add release process documentation by @happysnaker in spf13/pflag#490

fix: print to set destination, not hardcoded os.Stderr by @quite in spf13/pflag#502

ci: bump golangci-lint to v2.13 for Go 1.27 by @hdimer in spf13/pflag#508

Initialize the target map when a StringToString flag has a nil default by @nikolauspschuetz in spf13/pflag#506

fix: honour deprecated ParseErrorsWhitelist.UnknownFlagsHandling by @lenamonj in spf13/pflag#507

test: add StringSlice Append coverage by @LY-19418 in spf13/pflag#504

Keep wrapping after an unbreakable usage word by @AzazelSensei in spf13/pflag#503

Validate IP slice values before appending or replacing by @agammann in spf13/pflag#513

fix(ci): Use the latest golangci-lint release by @tomasaschan in spf13/pflag#525

Reject IPv6 addresses as IPv4 masks by @yuefdev in spf13/pflag#524

Report the flag name as typed in deprecation warnings by @hdimer in spf13/pflag#500

Document non-interspersed argument parsing by @yuefdev in spf13/pflag#523

Preserve trailing whitespace in StringToString formatting by @r4venrudy in spf13/pflag#522

Reject extra CSV records in StringToString arguments by @Harshil-1603 in spf13/pflag#521

Preserve current string values in CopyToGoFlagSet by @adenzhou1350 in spf13/pflag#520

Fix type identification and mismatch checks for text flags by @dewanshshekhar in spf13/pflag#526

fix: enforce native integer flag bounds on 32-bit platforms by @gdpu11 in spf13/pflag#534

fix: preserve count flag values when parsing fails by @gdpu11 in spf13/pflag#533

New Contributors

@alimpfard made their first contribution in spf13/pflag#453

@pterjan made their first contribution in spf13/pflag#460

@brandon1024 made their first contribution in spf13/pflag#457

@wellitonscheer made their first contribution in spf13/pflag#462

@malklera made their first contribution in spf13/pflag#467

@reuvenharrison made their first contribution in spf13/pflag#469

@ikedam made their first contribution in spf13/pflag#440

@happysnaker made their first contribution in spf13/pflag#483

@quite made their first contribution in

… updates Bumps the go-minor-patch group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.47.3` | `1.47.5` | | [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.33.9` | `1.33.12` | | [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.114.3` | `1.114.6` | | [github.com/convox/stdsdk](https://github.com/convox/stdsdk) | `0.0.4` | `0.0.5` | | [github.com/fxamacker/cbor/v2](https://github.com/fxamacker/cbor) | `2.9.6` | `2.10.0` | | [github.com/riverqueue/river](https://github.com/riverqueue/river) | `0.49.0` | `0.50.0` | | [github.com/riverqueue/river/riverdriver/riverpgxv5](https://github.com/riverqueue/river) | `0.49.0` | `0.50.0` | | [github.com/riverqueue/river/rivertype](https://github.com/riverqueue/river) | `0.49.0` | `0.50.0` | | [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) | `1.3.0` | `1.4.0` | | [github.com/spf13/pflag](https://github.com/spf13/pflag) | `1.0.10` | `1.1.0` | Updates `github.com/aws/aws-sdk-go-v2` from 1.47.3 to 1.47.5 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@v1.47.3...v1.47.5) Updates `github.com/aws/aws-sdk-go-v2/config` from 1.33.9 to 1.33.12 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@config/v1.33.9...config/v1.33.12) Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.114.3 to 1.114.6 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.114.3...service/s3/v1.114.6) Updates `github.com/convox/stdsdk` from 0.0.4 to 0.0.5 - [Commits](convox/stdsdk@v0.0.4...v0.0.5) Updates `github.com/fxamacker/cbor/v2` from 2.9.6 to 2.10.0 - [Release notes](https://github.com/fxamacker/cbor/releases) - [Commits](fxamacker/cbor@v2.9.6...v2.10.0) Updates `github.com/riverqueue/river` from 0.49.0 to 0.50.0 - [Release notes](https://github.com/riverqueue/river/releases) - [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md) - [Commits](riverqueue/river@v0.49.0...v0.50.0) Updates `github.com/riverqueue/river/riverdriver/riverpgxv5` from 0.49.0 to 0.50.0 - [Release notes](https://github.com/riverqueue/river/releases) - [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md) - [Commits](riverqueue/river@v0.49.0...v0.50.0) Updates `github.com/riverqueue/river/rivertype` from 0.49.0 to 0.50.0 - [Release notes](https://github.com/riverqueue/river/releases) - [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md) - [Commits](riverqueue/river@v0.49.0...v0.50.0) Updates `github.com/sigstore/sigstore-go` from 1.3.0 to 1.4.0 - [Release notes](https://github.com/sigstore/sigstore-go/releases) - [Commits](sigstore/sigstore-go@v1.3.0...v1.4.0) Updates `github.com/spf13/pflag` from 1.0.10 to 1.1.0 - [Release notes](https://github.com/spf13/pflag/releases) - [Commits](spf13/pflag@v1.0.10...v1.1.0) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2 dependency-version: 1.47.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-version: 1.33.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.114.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch - dependency-name: github.com/convox/stdsdk dependency-version: 0.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch - dependency-name: github.com/fxamacker/cbor/v2 dependency-version: 2.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-patch - dependency-name: github.com/riverqueue/river dependency-version: 0.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-patch - dependency-name: github.com/riverqueue/river/riverdriver/riverpgxv5 dependency-version: 0.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-patch - dependency-name: github.com/riverqueue/river/rivertype dependency-version: 0.50.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-patch - dependency-name: github.com/sigstore/sigstore-go dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-patch - dependency-name: github.com/spf13/pflag dependency-version: 1.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

deepsource-io · 2026-11-06T10:22:58Z

DeepSource Code Review

We reviewed changes in ebc38cf...b122095 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Nov 6, 2026 10:22a.m.	Review ↗
Go		Nov 6, 2026 10:22a.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 6, 2026

Navigation Menu

Repository navigation

chore(deps): bump the go-minor-patch group across 1 directory with 10 updates - #212

chore(deps): bump the go-minor-patch group across 1 directory with 10 updates#212
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-15442612b6

dependabot Bot commented on behalf of github Nov 6, 2026

Uh oh!

deepsource-io Bot commented Nov 6, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Unmarshal	Speedup	ΔSec/op
Single values (bool, int, float, byte string, text string)	1.10× to 1.51×¹	-8.87% to -33.92%¹
Epoch time, bignum, other tags	1.18× to 1.64×	-15.33% to -38.91%
Arrays and maps to non-struct	1.33× to 1.87×	-24.63% to -46.49%
Arrays and maps to structs	1.06× to 1.52×	-5.46% to -34.40%
Real-world (COSE, CWT, SenML, WebAuthn)	1.35× to 1.64×	-26.06% to -39.19%

Marshal	Speedup	ΔSec/op
Single values (bool, int, float, byte slice, string)	1.32× to 1.55×	-24.49% to -35.41%
time.Time, big.Int, Tag, Marshaler²	1.15× to 1.63×	-12.94% to -38.84%
Slices and maps	1.35× to 2.88×	-25.97% to -65.26%
Structs	1.57× to 2.17×	-36.37% to -53.96%
Structs with omitempty fields	0.95×³ to 1.35×	+5.01%³ to -25.96%
Real-world (COSE, CWT, SenML, WebAuthn)	1.12× to 1.33×	-10.66% to -24.77%

Conversation

dependabot Bot commented on behalf of github Nov 6, 2026

v2.10.0

Performance and Benchmarks

CBOR Speedup by Data Type

CBOR Encoding Reflection-Free Speedup

v0.50.0

Changed

Fixed

[0.50.0] - 2026-10-26

Changed

Fixed

v0.50.0

Changed

Fixed

[0.50.0] - 2026-10-26

Changed

Fixed

v0.50.0

Changed

Fixed

[0.50.0] - 2026-10-26

Changed

Fixed

v1.4.0

What's Changed

New Contributors

v1.1.0

What's Changed

New Contributors

Uh oh!

deepsource-io Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

deepsource-io Bot commented Nov 6, 2026 •

edited

Loading