Skip to content

build(deps): bump the minor-and-patch group with 6 updates - #46

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-and-patch-cac2089528
Open

build(deps): bump the minor-and-patch group with 6 updates#46
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/minor-and-patch-cac2089528

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 6 updates:

Package From To
github.com/a-h/templ 0.3.1001 0.3.1020
github.com/jackc/pgx/v5 5.9.2 5.10.0
github.com/testcontainers/testcontainers-go/modules/mongodb 0.42.0 0.44.0
github.com/testcontainers/testcontainers-go/modules/postgres 0.42.0 0.44.0
github.com/xraph/forge 1.9.2 1.9.3
go.mongodb.org/mongo-driver/v2 2.5.0 2.8.0

Updates github.com/a-h/templ from 0.3.1001 to 0.3.1020

Release notes

Sourced from github.com/a-h/templ's releases.

v0.3.1020

Changelog

  • 09d6b02 chore: bump version
  • a411f13 chore: fix linter warning in test code
  • 524cd39 feat: add -check flag, closes #1007 (#1373)
  • f3d595c feat: add Range to ExpressionAttribute nodes (#1347)
  • 82af17c feat: add Range to GoCode nodes (#1348)
  • cf98cdc feat: add Range to StringExpression nodes (#1349)
  • ff38cee feat: add ranges for attribute node values (#1383)
  • 552ed02 feat: support concurrent rendering of templ components (#1359)
  • b310a97 fix(generatecmd): check cmd.Start() error before inserting cmd in to running map (#1382)
  • 410a80e fix(lsp): delete $GOROOT hack in uri.File
  • 95a0854 fix: allow JSFuncCall on arbitrary HTML attributes (#1375)
  • e581c01 fix: attributes containing a conditional, are always multiline (#1380)
  • b2952ed fix: clear children context in Fragment.Render (#1360)
  • 8fecf2d fix: prevent corrupted output in watch mode with gzip, fixes #1365 (#1366)
  • 7adcb62 fix: show correct updates based on written Go files without watch (#1363)
  • aa493e0 fix: track Range for non-JavaScript ScriptExpression nodes (#1350)
  • d52d64e fix: use dedicated shadow host in Suspense example to ensure header is rendered (#1370)
  • 83176f9 fix: vulnerabilities in x/net (only affects templ watch mode and tests), fixes #1354
Commits
  • 09d6b02 chore: bump version
  • ff38cee feat: add ranges for attribute node values (#1383)
  • e581c01 fix: attributes containing a conditional, are always multiline (#1380)
  • b310a97 fix(generatecmd): check cmd.Start() error before inserting cmd in to `run...
  • 95a0854 fix: allow JSFuncCall on arbitrary HTML attributes (#1375)
  • 8fecf2d fix: prevent corrupted output in watch mode with gzip, fixes #1365 (#1366)
  • a411f13 chore: fix linter warning in test code
  • 524cd39 feat: add -check flag, closes #1007 (#1373)
  • d52d64e fix: use dedicated shadow host in Suspense example to ensure header is render...
  • 552ed02 feat: support concurrent rendering of templ components (#1359)
  • Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.10.0 (June 3, 2026)

This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers, contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are sent over TLS when the original connection used TLS.

Features

  • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
  • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
  • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
  • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
  • pgxpool: check if connection is expired before acquire (arthurdotwork)

Security Hardening

  • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
  • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
  • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
  • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
  • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
  • Fix panic on malformed geometric text; return an error instead (MaIII)

Fixes

  • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
  • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
  • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
  • Fix data race when context is cancelled during connect
  • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
  • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
  • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
  • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
  • Add missing error check of rows.Err to load types (Jen Altavilla)
Commits
  • 7293fb1 Update changelog for v5.10.0
  • 1ade285 pgconn: document secure connection configuration
  • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
  • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
  • b28e65b pgtype: bound array element count against remaining message bytes
  • cd1f389 pgtype: bound array binary decode element length against remaining bytes
  • ff27b5b pgtype: bound hstore binary decode against malicious server input
  • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
  • 44f6173 pgconn: cap server-supplied SCRAM iteration count
  • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
  • Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go/modules/mongodb from 0.42.0 to 0.44.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go/modules/mongodb's releases.

v0.44.0

What's Changed

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

... (truncated)

Commits
  • 007bd6b chore: use new version (v0.44.0) in modules and examples
  • 6fdd2fd feat: allow overriding the session ID (#3051)
  • 0cfd2f9 chore(deps): bump slackapi/slack-github-action from 3.0.3 to 4.0.0 (#3788)
  • 5dda4cd chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#3789)
  • 8cfecf9 chore(deps): bump docker/setup-docker-action from 5.1.0 to 5.4.0 (#3790)
  • 1d054f6 fix: escape the container name in the Docker name filter (#3837)
  • 2f869d6 fix: should print max information by default (#3459)
  • 62941e8 chore(azurite): tidy module dependencies (#3838)
  • 632ee7b security: fix Dependabot alerts for grpc and OTel (#3835)
  • caa68c6 chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1...
  • Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go/modules/postgres from 0.42.0 to 0.44.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go/modules/postgres's releases.

v0.44.0

What's Changed

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

... (truncated)

Commits
  • 007bd6b chore: use new version (v0.44.0) in modules and examples
  • 6fdd2fd feat: allow overriding the session ID (#3051)
  • 0cfd2f9 chore(deps): bump slackapi/slack-github-action from 3.0.3 to 4.0.0 (#3788)
  • 5dda4cd chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#3789)
  • 8cfecf9 chore(deps): bump docker/setup-docker-action from 5.1.0 to 5.4.0 (#3790)
  • 1d054f6 fix: escape the container name in the Docker name filter (#3837)
  • 2f869d6 fix: should print max information by default (#3459)
  • 62941e8 chore(azurite): tidy module dependencies (#3838)
  • 632ee7b security: fix Dependabot alerts for grpc and OTel (#3835)
  • caa68c6 chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1...
  • Additional commits viewable in compare view

Updates github.com/xraph/forge from 1.9.2 to 1.9.3

Commits

Updates go.mongodb.org/mongo-driver/v2 from 2.5.0 to 2.8.0

Release notes

Sourced from go.mongodb.org/mongo-driver/v2's releases.

MongoDB Go Driver 2.8.0

The MongoDB Go Driver Team is pleased to release version 2.8.0 of the official MongoDB Go Driver.

Release Highlights

This release supports the general availability of Queryable Encryption string queries. The query types prefix, suffix, and substring are added as generally available for MongoDB 9.0+ and libmongocrypt 1.20.0. The query types prefixPreview, suffixPreview, and substringPreview remain experimental for 8.2–8.x servers and may be removed in a future release.

Other key facts:

  • The algorithm TextPreview is replaced with String.
  • API rename: options.Text() → options.String(); TextOptions* → StringOptions*; EncryptOptionsBuilder.SetTextOptions → SetStringOptions.

What's Changed

✨ New Features

📦 Dependency Updates

Full Changelog: mongodb/mongo-go-driver@v2.7.0...v2.8.0

For a full list of tickets included in this release, please see the list of fixed issues.

Documentation for the Go Driver can be found on pkg.go.dev and the MongoDB documentation site. BSON library documentation is also available on pkg.go.dev. For issues with, questions about, or feedback for the Go Driver, please look into our support channels, including StackOverflow. Bugs can be reported in the Go Driver project in the MongoDB JIRA where a list of current issues can be found. Your feedback on the Go Driver is greatly appreciated!

MongoDB Go Driver 2.7.0

The MongoDB Go Driver Team is pleased to release version 2.7.0 of the official MongoDB Go Driver.

Release Highlights

This release adds support for sending afterClusterTime on writes in causally consistent sessions, improving alignment between read and write behavior in session-based workflows. It also continues cleanup of session-related and internal-only APIs by deprecating the experimental session API, helping clarify which surfaces are intended for long-term public use. Alongside that, the release includes a handful of targeted quality improvements across BSON validation, change streams, and error reporting to make the driver more predictable and easier to debug.

What's Changed

✨ New Features

🐛 Fixed

... (truncated)

Commits
  • b724f0a BUMP v2.8.0
  • 794aab6 GODRIVER-4002: Add substring to QE GA (#2471)
  • df356c0 Bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /internal/test/goleak (#2469)
  • a59df1a GODRIVER-4015: Bump testdata/specifications from 34479c6 to ea6be20 (#2468)
  • 5db45dc Bump github/codeql-action from 4.36.2 to 4.36.3 in the actions group (#2465)
  • 2426eed Merge pull request #2463 from matthewdale/godriver2962-rename-insert
  • 056dbf1 Merge release/2.7 into master (#2467)
  • 3c8fa07 Merge branch 'master' into merge-release/2.7-into-master-1783517184972
  • 6e6f7dd GODRIVER-3976: Skip change stream csot periodic noop interval secs (#2462)
  • dd14275 GODRIVER-3888 Move update to the mongo package. (#2450)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the minor-and-patch group with 6 updates
c346d5c 
Bumps the minor-and-patch group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/a-h/templ](https://github.com/a-h/templ) | `0.3.1001` | `0.3.1020` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.2` | `5.10.0` |
| [github.com/testcontainers/testcontainers-go/modules/mongodb](https://github.com/testcontainers/testcontainers-go) | `0.42.0` | `0.44.0` |
| [github.com/testcontainers/testcontainers-go/modules/postgres](https://github.com/testcontainers/testcontainers-go) | `0.42.0` | `0.44.0` |
| [github.com/xraph/forge](https://github.com/xraph/forge) | `1.9.2` | `1.9.3` |
| [go.mongodb.org/mongo-driver/v2](https://github.com/mongodb/mongo-go-driver) | `2.5.0` | `2.8.0` |


Updates `github.com/a-h/templ` from 0.3.1001 to 0.3.1020
- [Release notes](https://github.com/a-h/templ/releases)
- [Commits](a-h/templ@v0.3.1001...v0.3.1020)

Updates `github.com/jackc/pgx/v5` from 5.9.2 to 5.10.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.9.2...v5.10.0)

Updates `github.com/testcontainers/testcontainers-go/modules/mongodb` from 0.42.0 to 0.44.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.42.0...v0.44.0)

Updates `github.com/testcontainers/testcontainers-go/modules/postgres` from 0.42.0 to 0.44.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.42.0...v0.44.0)

Updates `github.com/xraph/forge` from 1.9.2 to 1.9.3
- [Release notes](https://github.com/xraph/forge/releases)
- [Changelog](https://github.com/xraph/forge/blob/main/CHANGELOG.md)
- [Commits](https://github.com/xraph/forge/commits)

Updates `go.mongodb.org/mongo-driver/v2` from 2.5.0 to 2.8.0
- [Release notes](https://github.com/mongodb/mongo-go-driver/releases)
- [Commits](mongodb/mongo-go-driver@v2.5.0...v2.8.0)

---
updated-dependencies:
- dependency-name: github.com/a-h/templ
  dependency-version: 0.3.1020
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/testcontainers/testcontainers-go/modules/mongodb
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/testcontainers/testcontainers-go/modules/postgres
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: github.com/xraph/forge
  dependency-version: 1.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: go.mongodb.org/mongo-driver/v2
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants