Skip to content

build(deps): bump the go group across 1 directory with 10 updates - #45

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/server/go-d634514ca4
Open

build(deps): bump the go group across 1 directory with 10 updates#45
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/server/go-d634514ca4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the go group with 10 updates in the /server directory:

Package From To
github.com/aws/aws-sdk-go-v2 1.47.3 1.47.5
github.com/aws/aws-sdk-go-v2/credentials 1.20.9 1.20.13
github.com/aws/aws-sdk-go-v2/service/s3 1.114.3 1.114.6
github.com/caarlos0/env/v11 11.4.1 11.4.2
github.com/jackc/pgx/v5 5.11.0 5.12.0
github.com/labstack/echo/v5 5.4.0 5.4.4
github.com/oapi-codegen/runtime 1.7.0 1.8.0
github.com/riverqueue/river 0.49.0 0.51.0
github.com/riverqueue/river/riverdriver/riverpgxv5 0.49.0 0.51.0
github.com/riverqueue/river/rivertype 0.49.0 0.51.0

Updates github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.5

Commits

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.20.9 to 1.20.13

Commits

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.3 to 1.114.6

Commits

Updates github.com/caarlos0/env/v11 from 11.4.1 to 11.4.2

Release notes

Sourced from github.com/caarlos0/env/v11's releases.

v11.4.2

Changelog

Bug fixes

  • fb6403538040f91bb1d4e3fac6c55905ebd10b2d: fix: doubled word in godoc comment (#431) (@​Pastalikek65)
  • 91fe9347cf2f6aa8880f850028e6630efafe60f8: fix: stop expand from recursing forever on a cyclic reference (#447) (@​abo3losh1)

Documentation updates

  • a2a709a914da2148a509f72a05dce15b0ac40abb: docs: document empty env var fallback to envDefault (#432) (@​Pastalikek65)
  • 33898796de44f96b01ca683f203b06a1579f9ddd: docs: license year (@​caarlos0)
  • a3a36cc60fa222b41957573b94fefa5624dd6365: docs: remove starchart.cc embed (#425) (@​caarlos0)

Other work

  • f5677ae3ae59e55319f7f992cd552abc52e2f1a3: ci(deps): bump the actions group with 10 updates (#424) (@​dependabot[bot])
  • 9625c9ef37e172743ee83ccdac1edeaae09ae429: ci(deps): bump the actions group with 5 updates (#423) (@​dependabot[bot])
  • 505764460181dd3bfcd15b26dc7f63b7322737ad: ci(deps): bump the actions group with 6 updates (#444) (@​dependabot[bot])
  • 8e82ff585cacfbe00b0c876460db82b750ba8218: ci(deps): bump the actions group with 6 updates (#454) (@​dependabot[bot])
  • 970ff84ff33ee20994a4aa21a598340a48e228b9: ci(deps): bump the actions group with 7 updates (#429) (@​dependabot[bot])
  • 6c3de6f047c2bab82da5029c23a36e461d8499c9: ci(deps): bump the actions group with 7 updates (#434) (@​dependabot[bot])
  • c1b2429e2590d5ddc35531bf69baa11874e8b59a: ci: add aggregate build check and update Go support (#448) (@​caarlos0)

Released with GoReleaser!

Commits
  • 91fe934 fix: stop expand from recursing forever on a cyclic reference (#447)
  • 8e82ff5 ci(deps): bump the actions group with 6 updates (#454)
  • c1b2429 ci: add aggregate build check and update Go support (#448)
  • 5057644 ci(deps): bump the actions group with 6 updates (#444)
  • fb64035 fix: doubled word in godoc comment (#431)
  • a2a709a docs: document empty env var fallback to envDefault (#432)
  • 6c3de6f ci(deps): bump the actions group with 7 updates (#434)
  • 970ff84 ci(deps): bump the actions group with 7 updates (#429)
  • a3a36cc docs: remove starchart.cc embed (#425)
  • f5677ae ci(deps): bump the actions group with 10 updates (#424)
  • Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.11.0 to 5.12.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

  • SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@​igor-kupczynski).
  • Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @​president-xd.

Features

  • Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)
  • Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)
  • pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)
  • pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

  • pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.
  • pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

Commits
  • b2ef08b Update changelog for v5.12.0
  • 8199015 Merge commit from fork
  • 5b1a6a0 Merge commit from fork
  • 65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
  • f2701a0 pgconn: only fall back when Windows service file is missing
  • db95468 Merge pull request #2696 from k-zshiba/support-oid8
  • fa2327d Start each query on a new line when joining a simple protocol batch
  • 2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
  • efc0b74 Merge upstream master into support-oid8
  • 5a17450 pgconn: require AuthenticationOk before ReadyForQuery
  • Additional commits viewable in compare view

Updates github.com/labstack/echo/v5 from 5.4.0 to 5.4.4

Release notes

Sourced from github.com/labstack/echo/v5's releases.

v5.4.4

Proxy identity hardening

The proxy now retains its derived X-Real-IP header when an incoming request includes Connection: X-Real-IP, including mixed-case and duplicate Connection values. The value is restored after Go removes hop-by-hop headers, before the upstream transport runs.

The same captured identity is preserved across retries and balancer request replacement, and the protection applies to WebSocket upgrades. Default and custom transports and extractors remain supported.

Released v5.4.3 can omit the identity header for those requests. Identity spoofing additionally depends on an upstream that falls back to an untrusted source when the header is absent. This release does not change v5’s direct-peer default or the affected ranges of the earlier default-IP CVEs.

No new client-IP migration is required for v5. Applications behind proxies should continue using an extractor that trusts their own proxies. No public API, dependency, or minimum Go-version changes.

Validation

The implementation passed fresh independent Claude review, full race tests on Go 1.25 and 1.27, vet, staticcheck, golint, and govulncheck. Permanent tests cover HTTP/default/custom transports, raw WebSocket negotiation, duplicate/mixed-case header nominations, and a stateful extractor across request-swapping retries.

Implementation: #3200. This ports the additional proxy identity protection released in v4.16.3.

Full Changelog: labstack/echo@v5.4.3...v5.4.4

v5.4.3

Security

Upgrade to v5.4.3 to fix a static route-guard bypass involving encoded empty path segments in non-default path-matching or unescaping configurations. The confirmed impact is access to protected files inside a static root. The fix validates raw and decoded request paths and wildcard boundaries, including singly and doubly encoded leading slashes and guarded directory indexes.

Advisory: GHSA-v97q-3xf5-rj74

Fixes

  • Decode path parameters only once when UnescapePathParamValues is enabled, preserving literal percent-containing values.
  • Correct UseEscapedPathForMatching documentation without changing its behavior.
  • Preserve correctly escaped filenames and static prefixes such as /assets*.

Thanks to MyWorld319 for the static bypass report and alexreid for the parameter-decoding report.

Documentation

  • Publish v4 support dates and the Echo Support offer (#3193).
  • Mention Echo Pro in the Sponsors section (#3192).

Full Changelog: labstack/echo@v5.4.2...v5.4.3

v5.4.2

Fixes

  • Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer reach credential validation or consume AllowedCheckLimit. Valid credentials are still required. #3138, thanks to @​Shubham-Padkonde.
  • Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3135, thanks to @​hoangtaiki.

Upgrade

</tr></table>

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v5's changelog.

v5.4.4 - 2026-10-29

Proxy identity hardening

  • Preserve the derived upstream X-Real-IP after hop-by-hop header stripping. A client can no longer remove that header with Connection: X-Real-IP, including duplicate or mixed-case nominations and WebSocket upgrades.
  • Capture the client identity once and preserve it across retries and balancer request replacement. Default and custom transports and extractors remain supported.
  • Add permanent regressions for HTTP forwarding, raw WebSocket upgrades, header nominations, and stateful extraction during request-swapping retries. Implementation: #3200.

v5 already uses the connection peer by default. This release adds proxy header protection and does not change client-IP configuration or the affected ranges of the earlier default-IP CVEs. A missing identity header can affect an upstream that falls back to an untrusted source; no new client-IP migration, public API, dependency, or minimum Go-version change is introduced.

Commits
  • a45c7bb chore: prepare v5.4.4 proxy hardening release (#3201)
  • b118d3d fix: preserve v5 proxy client identity after hop header stripping (#3200)
  • 9489424 docs: record v4 client IP security release and migration (#3199)
  • 6e06e88 chore: prepare v5.4.3 release (#3196)
  • 078efa6 Merge commit from fork
  • 4deac5d docs: publish v4 support dates and the Echo Support offer (#3193)
  • 9adc7a8 docs: mention Echo Pro in the Sponsors section (#3192)
  • 7c312e0 chore: prepare v5.4.2 release (#3190)
  • f9d7e77 fix(middleware): reject empty tokens in CSRF validation (#3135)
  • 0996992 fix: check Basic authentication scheme boundary (#3138)
  • Additional commits viewable in compare view

Updates github.com/oapi-codegen/runtime from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/oapi-codegen/runtime's releases.

v1.8.0: Bind the request body value the validator saw

This release adds a request body binder that reuses the value a kin-openapi validation middleware already decoded, so strict servers no longer decode the body a second time with different matching rules. It also rounds out types.Date's text encoding and fixes a deepObject serialization quirk. Existing binding and serialization behaviour is unchanged unless generated code calls the new function. The root module's dependencies are unchanged; the separate strictmiddleware/echo-v5 module now requires Echo v5.4.2.

Notable Changes

BindJSONBody: bind exactly what the validator validated

Strict servers generated by oapi-codegen decode the JSON request body with encoding/json after a validation middleware has already decoded and validated it. The two decoders do not agree on member names: encoding/json matches struct fields case-insensitively, so a body like {"role":"user","ROLE":"admin"} validates as role: user and then binds as Role: "admin". Anything the validator checked can be bypassed by a differently-cased duplicate.

BindJSONBody(r *http.Request, v any) error closes that gap. When the request has passed through a validator built on kin-openapi v0.151.0 or later with openapi3filter.Options.KeepValidatedValue set, the body carries the value the validator decoded, and BindJSONBody binds that value into the destination with BindJSONValue(value, v any) error instead of reading the body again. Binding follows encoding/json's rules (struct tags, embedded structs, json.Unmarshaler and encoding.TextUnmarshaler, base64 for []byte, float64 for any, json.Number preserved) with one deliberate difference: member names are matched to struct fields exactly.

Without a validated value, or when the value cannot be bound into the destination type, BindJSONBody falls back to json.NewDecoder(r.Body).Decode(v), so error responses are unchanged for everyone who is not running a validator. The oapi-codegen validation middlewares enable KeepValidatedValue by default as of nethttp-middleware v1.3.1, echo-middleware v1.2.1, echo-v5-middleware v0.2.1, gin-middleware v1.2.1 and iris-middleware v1.2.1. The net/http strict server template that calls BindJSONBody is landing in oapi-codegenoapi-codegen/oapi-codegen#2605

types.Date implements encoding.TextMarshaler

Date had an UnmarshalText that parses 2006-01-02 but no MarshalText, so it inherited time.Time's RFC 3339 one. Any codec that pairs TextMarshaler with TextUnmarshaler (encoding/xml, DynamoDB mappers, and others) therefore wrote a Date it could not read back. MarshalText now formats with DateFormat, matching MarshalJSON, String and UnmarshalText. Thanks to @​jusabe-kreditz.

deepObject no longer emits param[]=null for nil maps and slices

Marshalling a deepObject parameter whose field held a typed nil map or nil slice produced a param[]=null pair, because the intermediate json.Marshal turned the nil into null. Such fields are now omitted, as an empty map or slice already was. Nil pointers are still serialized as null, as before. Thanks to @​SKalt (#160).

🚀 New features and improvements

🐛 Bug fixes

📦 Dependency updates

Sponsors

We would like to thank our sponsors for their support during this release.

... (truncated)

Commits
  • c0b2ca2 fix(deps): update module github.com/labstack/echo/v5 to v5.4.2 (#166)
  • 170896a Add BindJSONBody to bind the request body value kin-openapi validated (#165)
  • c702e06 fix: omit nil maps and slices from deepObject marshalling (#161)
  • ea5fc39 Add MarshalText to types.Date (#162)
  • 64f16fb chore(deps): update release-drafter/release-drafter action to v7.10.0 (#164)
  • 9808d04 fix(deps): update module github.com/labstack/echo/v5 to v5.4.1 (#163)
  • df8dfa8 chore(deps): update github/codeql-action action to v4.39.1 (#159)
  • ae0fff0 chore(deps): update oapi-codegen/actions action to v0.9.2 (#158)
  • 2fd3480 chore(deps): update module github.com/golangci/golangci-lint to v2.15.0 (#157)
  • See full diff in compare view

Updates github.com/riverqueue/river from 0.49.0 to 0.51.0

Release notes

Sourced from github.com/riverqueue/river's releases.

v0.51.0

Added

  • Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

  • Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).
  • Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).
  • Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).
  • Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

v0.50.0

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Changelog

Sourced from github.com/riverqueue/river's changelog.

[0.51.0] - 2026-10-31

Added

  • Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

  • Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).
  • Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).
  • Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).
  • Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

[0.50.0] - 2026-10-26

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Commits
  • 69c0b45 [go] Prepare v0.51.0 (#1571)
  • 737146d Add a Where escape hatch to JobDeleteManyParams (#1570)
  • e898054 [go, java, js, rust] Alternative implementation for reconciling jobs against ...
  • 4f79f7b Bump crass from 1.0.7 to 1.0.8 in /ruby/rails/riverqueue-rails (#1562)
  • f995760 [ruby] Prepare v0.15.0 (#1561)
  • b330cfb [ruby] Add river migrate-get/validate/version subcommands (#1560)
  • 5c2d873 [go] Fix notifier hanging after a listen or unlisten times out (#1559)
  • 53ce383 [go] Fix InsertManyFast and QueueUpdate panics on drivers without listene...
  • fc6c1d5 [java, js, ruby] bump compatible dependencies (#1553)
  • 012b72c Fix intermittently failing test TestJobCleaner/CustomizableInterval (#1531)
  • Additional commits viewable in compare view

Updates github.com/riverqueue/river/riverdriver/riverpgxv5 from 0.49.0 to 0.51.0

Release notes

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's releases.

v0.51.0

Added

  • Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

  • Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).
  • Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).
  • Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).
  • Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

v0.50.0

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Changelog

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's changelog.

[0.51.0] - 2026-10-31

Added

  • Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

  • Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).
  • Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).
  • Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).
  • Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

[0.50.0] - 2026-10-26

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and t...

    Description has been truncated

@dependabot
build(deps): bump the go group across 1 directory with 10 updates
1ca12ba 
Bumps the go group with 10 updates in the /server directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.47.3` | `1.47.5` |
| [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) | `1.20.9` | `1.20.13` |
| [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.114.3` | `1.114.6` |
| [github.com/caarlos0/env/v11](https://github.com/caarlos0/env) | `11.4.1` | `11.4.2` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.11.0` | `5.12.0` |
| [github.com/labstack/echo/v5](https://github.com/labstack/echo) | `5.4.0` | `5.4.4` |
| [github.com/oapi-codegen/runtime](https://github.com/oapi-codegen/runtime) | `1.7.0` | `1.8.0` |
| [github.com/riverqueue/river](https://github.com/riverqueue/river) | `0.49.0` | `0.51.0` |
| [github.com/riverqueue/river/riverdriver/riverpgxv5](https://github.com/riverqueue/river) | `0.49.0` | `0.51.0` |
| [github.com/riverqueue/river/rivertype](https://github.com/riverqueue/river) | `0.49.0` | `0.51.0` |



Updates `github.com/aws/aws-sdk-go-v2` from 1.47.3 to 1.47.5
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.47.3...v1.47.5)

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.20.9 to 1.20.13
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@credentials/v1.20.9...credentials/v1.20.13)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.114.3 to 1.114.6
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.114.3...service/s3/v1.114.6)

Updates `github.com/caarlos0/env/v11` from 11.4.1 to 11.4.2
- [Release notes](https://github.com/caarlos0/env/releases)
- [Commits](caarlos0/env@v11.4.1...v11.4.2)

Updates `github.com/jackc/pgx/v5` from 5.11.0 to 5.12.0
- [Release notes](https://github.com/jackc/pgx/releases)
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.11.0...v5.12.0)

Updates `github.com/labstack/echo/v5` from 5.4.0 to 5.4.4
- [Release notes](https://github.com/labstack/echo/releases)
- [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md)
- [Commits](labstack/echo@v5.4.0...v5.4.4)

Updates `github.com/oapi-codegen/runtime` from 1.7.0 to 1.8.0
- [Release notes](https://github.com/oapi-codegen/runtime/releases)
- [Commits](oapi-codegen/runtime@v1.7.0...v1.8.0)

Updates `github.com/riverqueue/river` from 0.49.0 to 0.51.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.49.0...v0.51.0)

Updates `github.com/riverqueue/river/riverdriver/riverpgxv5` from 0.49.0 to 0.51.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.49.0...v0.51.0)

Updates `github.com/riverqueue/river/rivertype` from 0.49.0 to 0.51.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.49.0...v0.51.0)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.47.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-version: 1.20.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-version: 1.114.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/caarlos0/env/v11
  dependency-version: 11.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/labstack/echo/v5
  dependency-version: 5.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/oapi-codegen/runtime
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/riverqueue/river
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/riverqueue/river/riverdriver/riverpgxv5
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/riverqueue/river/rivertype
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 9, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants