Skip to content

build(deps): bump the go-modules group with 6 updates - #4

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-modules-22208f268a
Open

build(deps): bump the go-modules group with 6 updates#4
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-modules-22208f268a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown

Bumps the go-modules group with 6 updates:

Package From To
github.com/jackc/pgx/v5 5.9.2 5.10.0
github.com/prometheus/client_golang 1.23.2 1.24.1
github.com/testcontainers/testcontainers-go 0.43.0 0.44.0
github.com/testcontainers/testcontainers-go/modules/postgres 0.43.0 0.44.0
golang.org/x/sync 0.21.0 0.22.0
modernc.org/sqlite 1.38.2 1.56.0

Updates github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.10.0 (June 3, 2026)

This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers, contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are sent over TLS when the original connection used TLS.

Features

  • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
  • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
  • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
  • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
  • pgxpool: check if connection is expired before acquire (arthurdotwork)

Security Hardening

  • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
  • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
  • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
  • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
  • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
  • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
  • Fix panic on malformed geometric text; return an error instead (MaIII)

Fixes

  • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
  • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
  • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
  • Fix data race when context is cancelled during connect
  • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
  • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
  • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
  • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
  • Add missing error check of rows.Err to load types (Jen Altavilla)
Commits
  • 7293fb1 Update changelog for v5.10.0
  • 1ade285 pgconn: document secure connection configuration
  • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
  • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
  • b28e65b pgtype: bound array element count against remaining message bytes
  • cd1f389 pgtype: bound array binary decode element length against remaining bytes
  • ff27b5b pgtype: bound hstore binary decode against malicious server input
  • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
  • 44f6173 pgconn: cap server-supplied SCRAM iteration count
  • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

  • [BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

1.24.0 / 2026-07-20

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927
Commits
  • d6087ee release: cut v1.24.1 (#2076)
  • 48dd383 Cut v1.24.0 (#2061)
  • a725305 Cut v1.24.0-rc.0 (#2058)
  • 77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
  • 78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
  • 34e9a7f Merge pull request #2055 from prombot/repo_sync
  • 43749bc Update common Prometheus files
  • de19217 examples: improve simple main.go example (#1999)
  • 20355eb fix: correct typos in comments and test error messages (#2049)
  • 4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
  • Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go from 0.43.0 to 0.44.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go's releases.

v0.44.0

What's Changed

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

... (truncated)

Commits
  • 007bd6b chore: use new version (v0.44.0) in modules and examples
  • 6fdd2fd feat: allow overriding the session ID (#3051)
  • 0cfd2f9 chore(deps): bump slackapi/slack-github-action from 3.0.3 to 4.0.0 (#3788)
  • 5dda4cd chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#3789)
  • 8cfecf9 chore(deps): bump docker/setup-docker-action from 5.1.0 to 5.4.0 (#3790)
  • 1d054f6 fix: escape the container name in the Docker name filter (#3837)
  • 2f869d6 fix: should print max information by default (#3459)
  • 62941e8 chore(azurite): tidy module dependencies (#3838)
  • 632ee7b security: fix Dependabot alerts for grpc and OTel (#3835)
  • caa68c6 chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1...
  • Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go/modules/postgres from 0.43.0 to 0.44.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go/modules/postgres's releases.

v0.44.0

What's Changed

🔒 Security

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

... (truncated)

Commits
  • 007bd6b chore: use new version (v0.44.0) in modules and examples
  • 6fdd2fd feat: allow overriding the session ID (#3051)
  • 0cfd2f9 chore(deps): bump slackapi/slack-github-action from 3.0.3 to 4.0.0 (#3788)
  • 5dda4cd chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#3789)
  • 8cfecf9 chore(deps): bump docker/setup-docker-action from 5.1.0 to 5.4.0 (#3790)
  • 1d054f6 fix: escape the container name in the Docker name filter (#3837)
  • 2f869d6 fix: should print max information by default (#3459)
  • 62941e8 chore(azurite): tidy module dependencies (#3838)
  • 632ee7b security: fix Dependabot alerts for grpc and OTel (#3835)
  • caa68c6 chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1...
  • Additional commits viewable in compare view

Updates golang.org/x/sync from 0.21.0 to 0.22.0

Commits

Updates modernc.org/sqlite from 1.38.2 to 1.56.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

  • 2026-08-09 v1.57.0:

    • Add an opt-in _defensive DSN query parameter that turns on SQLite's defensive mode for the connection, disabling the SQL-level features that let ordinary statements deliberately corrupt the database file. When _defensive=1 (or any strconv.ParseBool true value) is supplied, the driver calls sqlite3_db_config with SQLITE_DBCONFIG_DEFENSIVE immediately after sqlite3_open_v2 and before every other parameter is applied, so the PRAGMAs the driver itself runs, the _pragma list, and every statement the caller prepares are all subject to it. On such a connection PRAGMA writable_schema=ON, PRAGMA journal_mode=OFF and PRAGMA schema_version=N become silent no-ops, and writes to a virtual table's shadow tables (fts5's _data, _idx and so on) and to sqlite_dbpage fail with "table ... may not be modified"; reading those tables, ordinary use of the virtual tables that own them, and VACUUM are unaffected. The flag has no PRAGMA equivalent, so sqlite3_db_config — and therefore a DSN parameter — is the only way to reach it short of dropping to modernc.org/sqlite/lib. The value is parsed before sqlite3_open_v2, so an invalid one fails the connection without creating the database file, and the parameter must appear at most once: a repeated _defensive is an error rather than letting the first value silently win. Absence of the parameter, or _defensive=0, leaves SQLite's default behavior unchanged; existing DSNs continue to work byte-for-byte. Two limits are worth stating plainly, since the name invites more confidence than the flag earns. Defensive mode is a hardening measure, not a sandbox for hostile database files: it is one of several steps SQLite recommends for that purpose, and this build compiles with neither SQLITE_TRUSTED_SCHEMA=0 nor SQLITE_DQS=0 and exposes no authorizer. And it is a property of the connection, not of the database file — a second handle opened on the same file without the parameter is unrestricted.
    • Reject the one DSN combination defensive mode would otherwise swallow in silence. _defensive=1 together with _journal_mode=OFF (or _journal=OFF) now fails the connection instead of opening one in which neither parameter was honoured: SQLite turns PRAGMA journal_mode=OFF into a no-op that still reports success, so the driver would have accepted the mode, executed it, and left the journal untouched without telling anyone. The check runs in the validation phase introduced in v1.55.0, before any statement executes, so a rejected DSN cannot leave the database half-configured. _pragma remains the exception it has always been: _pragma=journal_mode(OFF) alongside _defensive=1 still runs and is still silently ignored by SQLite. Only DSNs using _defensive can be affected, and that parameter is new, so no DSN that opened before changes behavior.
    • See [GitHub pull request #6](modernc-org/sqlite#6), thanks wsman!
    • Ship the sqlite-vec license notice this module has been missing. modernc.org/sqlite/vec has bundled the transpiled sqlite-vec sources since v1.47.0, but the module carried only its own BSD-3-Clause LICENSE and the public-domain SQLite notice. sqlite-vec is Copyright (c) 2024 Alex Garcia, dual-licensed Apache-2.0 OR MIT and used here under MIT, whose terms require the copyright and permission notice to accompany substantial portions of the software — which 2.8 MB of transpiled vec/ plainly is. The notice now ships as LICENSE-SQLITE_VEC in the module root, byte-identical to the LICENSE-MIT in the upstream v0.1.9 archive and named after the file modernc.org/libsqlite_vec extracts it into. Attribution was never absent — vec's package documentation has named the extension, pinned the version and linked upstream — but the license text itself was, and the omission was ours: vendor_libs/main.go copied the per-target transpiles and nothing else. It now copies the notice alongside them and fails the vendoring run if it cannot, so a make vendor can no longer quietly drop it. The vec package documentation gained a License section recording that the package is under a different license from the rest of this module.
    • The SQLite notice is renamed from SQLITE-LICENSE to LICENSE-SQLITE; update any direct links to it. Its contents are unchanged and SQLite remains public domain. The name now matches both the new LICENSE-SQLITE_VEC beside it and the LICENSE-<upstream> convention every other modernc.org repository follows, but it is more than cosmetic: go mod vendor selects the files it copies into a downstream vendor/ tree by matching each name against a fixed list of prefixes — LICENSE among them — so a name merely ending in LICENSE was never propagated. Both bundled notices now travel with the code into vendored builds, which is where the MIT terms on vec/ keep applying. No code changes; no behavior changes.

  • 2026-08-03 v1.56.0:

    • Re-vendor the transpiled SQLite sources, picking up modernc.org/libsqlite3's fix for an upstream data-corruption bug in SQLite 3.53.3's journal rollback. The SQLite version is unchanged at 3.53.3; what changes is that the amalgamation is now patched before it is transpiled. 3.53.3 reworked readSuperJournal() to return the super-journal name through a char** out-parameter, and pager_playback() now tests that pointer where it used to test zSuper[0]. A crash during the commit of a multi-database (ATTACH) transaction can leave the super-journal name and its checksum zeroed while the name length and the trailing magic survive; the checksum is a plain byte sum, so an all-zero name still validates and readSuperJournal() hands back a non-NULL pointer to an empty string. pager_playback() then calls sqlite3OsAccess(pVfs, "", SQLITE_ACCESS_EXISTS), gets ENOENT, and deletes the hot journal without playing it back — leaving the database corrupted. This is not a transpilation artifact: a plain gcc build of the stock 3.53.3 amalgamation fails on the same bytes while 3.53.2 recovers them, and it is what has been making upstream's own test/crash.test fail intermittently, in roughly 2% of runs, on every platform. The patch restores the pre-3.53.3 behaviour of reporting a (nul) super-journal name and will be dropped once upstream ships its own fix. Every supported target carries it.
    • Two targets change beyond that patch. On linux/s390x the regenerated transpile allocates C bit-fields MSB-first, as the big-endian platform ABI requires, rather than LSB-first; this comes from modernc.org/cc/v4 v4.29.1 and touches bit-field accesses throughout the SQLite core, s390x being this module's only big-endian target. On linux/riscv64 the transpile was regenerated on a host running GCC 11.4.0 where the previous one used GCC 13.3.0, which drops a handful of unexported compiler-predefined macro constants (the __FLT16_* family, __DBL_IS_IEC_60559__ and friends) and changes the COMPILER=gcc-13.3.0 entry PRAGMA compile_options reports to COMPILER=gcc-11.4.0; no SQLite code generation differs. Every other target's generated code is byte-identical to v1.55.0 apart from the journal-rollback patch above.
    • Bump the pinned modernc.org/libc to v1.74.4, and the remaining dependencies to their current releases. v1.74.2 and v1.74.3 are retracted upstream — a freeaddrinfo lock leak that deadlocks name resolution — and v1.74.4 is the fix. As always, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins (see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177)).
    • Documentation sweep. openbsd/amd64 and openbsd/arm64 join the supported platforms table in the package documentation: both have been in the builder test matrix since January and are cross-built by make build_all_targets, but had never been listed. The vfs DSN query parameter — which names a VFS registered with SQLite, such as one returned by vfs.New — is now documented alongside the other DSN parameters on Driver.Open. The "Debug and development versions" section no longer describes a GO_GENERATE environment variable and a go generate that this repository has not had since generator.go moved to modernc.org/libsqlite3; it now points at that repository and make vendor instead, and the stale //go:generate directive naming the removed file is dropped with it. modernc.org/sqlite/vec and modernc.org/sqlite/vfs gained the package doc comments they were missing, so both finally carry a synopsis on pkg.go.dev. Documentation only; no behavior changes.
    • Add NewConnector, returning a database/sql/driver.Connector for use with sql.OpenDB. It opens the same connections sql.Open("sqlite", dsn) does, from the same registered driver, so every function, collation, connection hook and virtual table module registered through this package applies to them. It exists for callers that need to interpose on the physical connections database/sql opens — tracing, metrics, connection-scoped setup — which sql.Open gives no access to: such a caller can embed the returned Connector, override Connect, and pass its own wrapper to sql.OpenDB. Previously the only way to reach the registered driver was the db, _ := sql.Open("sqlite", ""); drv := db.Driver(); db.Close() idiom, which works only because sql.Open does not connect and this driver does not implement driver.DriverContext; and the only way to get a wrapper into a *sql.DB was sql.Register, which is process-global, panics on a name it has already seen, and cannot be undone, so a library had to invent a unique driver name per configuration. sql.OpenDB registers nothing. Constructing a &sqlite.Driver{} is not an alternative — its fields are unexported, so it carries none of the registrations. NewConnector checks the DSN only as far as it can without opening a database — a query string that does not parse, and conflicting vfs parameters; everything else continues to be validated when the connection is opened, so an unknown parameter or an out-of-range value is reported by Connect rather than at construction. Nothing about the existing sql.Open path changes: *Driver deliberately still does not implement driver.DriverContext, so sql.Open remains lazy and DSN errors continue to surface where they always have. A runnable sample is in examples/connector. Resolves [GitLab issue #253](https://gitlab.com/cznic/sqlite/-/issues/253), thanks Alessandro Segala (@​ItalyPaleAle)!
    • Document that a caller-constructed sqlite.Driver is not the driver this package registers as "sqlite". Its fields are unexported, so it starts with no functions, collations or connection hooks and the only way to give it any is its own RegisterConnectionHook method; the package-level Register* functions always apply to the registered driver. Connections such a Driver opens therefore run without the package-level functions and collations — and because a registered function silently replaces a SQLite built-in of the same name, a Driver you construct can evaluate upper(x), date(x) and the like differently from one opened through sql.Open. Virtual table modules are the one exception: they are held process-globally and reach every Driver. Constructing one remains supported for the private-hook pattern — a driver registered under a name of its own with sql.Register so its connection hooks apply only to its own connections — and is otherwise best avoided in favour of sql.Open or NewConnector. Documentation only; no behavior changes.

  • 2026-07-20 v1.55.0:

    • Add github.com/mattn/go-sqlite3-compatible shorthand DSN query parameters to ease migration from that driver: _busy_timeout/_timeout, _foreign_keys/_fk, _journal_mode/_journal, _synchronous/_sync, _auto_vacuum/_vacuum, and _query_only, each setting the correspondingly named PRAGMA. Values are validated against the same set mattn/go-sqlite3 accepts (case-insensitive) and an unrecognized value fails the connection with an error, so a typo such as _synchronous=fu1l or _foreign_keys=yes_please is reported rather than silently downgrading durability or dropping foreign-key enforcement. The keys are applied in a fixed order independent of their order in the DSN — _busy_timeout and _auto_vacuum before any _pragma values (auto_vacuum must be set before the database is first written), the rest after, and _query_only last — and where a key and its alias are both supplied the alias wins, matching mattn/go-sqlite3; selection is by presence rather than by value, so supplying the alias empty (_foreign_keys=on&_fk=) suppresses the PRAGMA rather than deferring to the primary key, again matching that driver. Behavior change to note: prior releases ignored these keys entirely, so a DSN carried over from a mattn/go-sqlite3 setup changes in two ways. A recognized key that previously did nothing now takes effect — _foreign_keys=on begins enforcing constraints against data that may already violate them, _journal_mode=wal persistently converts the database file, and _query_only=1 makes the connection read-only. And a value outside the accepted set now fails the connection with an error where the same DSN previously opened successfully — for example a duration-style _busy_timeout=5s or _timeout=5000ms, neither of which is the integer that key requires. Review such DSNs before upgrading. _pragma is unchanged and no pre-existing parameter changes meaning, though see the following entry for a change in when all of them are validated.
    • See [GitLab merge request #134](https://gitlab.com/cznic/sqlite/-/merge_requests/134), thanks Toni Spets (@​beeper-hifi) and Ian Chechin!
    • Validate every DSN query parameter before applying any of them. Parameters were previously checked as each was reached, so a DSN whose later parameter was rejected had already executed the PRAGMAs ahead of it. Because PRAGMA jo...

      Description has been truncated

@dependabot
build(deps): bump the go-modules group with 6 updates
1ad1b0e 
Bumps the go-modules group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.9.2` | `5.10.0` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` |
| [github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go) | `0.43.0` | `0.44.0` |
| [github.com/testcontainers/testcontainers-go/modules/postgres](https://github.com/testcontainers/testcontainers-go) | `0.43.0` | `0.44.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.21.0` | `0.22.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.38.2` | `1.56.0` |


Updates `github.com/jackc/pgx/v5` from 5.9.2 to 5.10.0
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.9.2...v5.10.0)

Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.23.2...v1.24.1)

Updates `github.com/testcontainers/testcontainers-go` from 0.43.0 to 0.44.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.43.0...v0.44.0)

Updates `github.com/testcontainers/testcontainers-go/modules/postgres` from 0.43.0 to 0.44.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.43.0...v0.44.0)

Updates `golang.org/x/sync` from 0.21.0 to 0.22.0
- [Commits](golang/sync@v0.21.0...v0.22.0)

Updates `modernc.org/sqlite` from 1.38.2 to 1.56.0
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.38.2...v1.56.0)

---
updated-dependencies:
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/testcontainers/testcontainers-go
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/testcontainers/testcontainers-go/modules/postgres
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: golang.org/x/sync
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: modernc.org/sqlite
  dependency-version: 1.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants