[dependabot]

Bumps the compatible-go-dependencies group with 8 updates in the / directory:

Package	From	To
modernc.org/sqlite	1.58.0	1.61.0
github.com/nats-io/nats.go	1.54.0	1.55.0
github.com/rabbitmq/amqp091-go	1.15.0	1.16.0
github.com/aws/aws-sdk-go-v2	1.47.3	1.47.4
github.com/aws/aws-sdk-go-v2/config	1.33.9	1.33.10
github.com/aws/aws-sdk-go-v2/credentials	1.20.9	1.20.10
github.com/aws/aws-sdk-go-v2/service/sqs	1.52.4	1.52.6
github.com/jackc/pgx/v5	5.10.0	5.11.0

Bumps the compatible-go-dependencies group with 1 update in the /driver/natsqueue directory: github.com/nats-io/nats.go.
Bumps the compatible-go-dependencies group with 1 update in the /driver/postgresqueue directory: github.com/jackc/pgx/v5.
Bumps the compatible-go-dependencies group with 1 update in the /driver/rabbitmqqueue directory: github.com/rabbitmq/amqp091-go.
Bumps the compatible-go-dependencies group with 1 update in the /driver/sqlitequeue directory: modernc.org/sqlite.
Bumps the compatible-go-dependencies group with 4 updates in the /driver/sqsqueue directory: github.com/aws/aws-sdk-go-v2, github.com/aws/aws-sdk-go-v2/config, github.com/aws/aws-sdk-go-v2/credentials and github.com/aws/aws-sdk-go-v2/service/sqs.
Bumps the compatible-go-dependencies group with 3 updates in the /integration directory: modernc.org/sqlite, github.com/rabbitmq/amqp091-go and github.com/jackc/pgx/v5.

Updates modernc.org/sqlite from 1.58.0 to 1.61.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

• 2026-10-31 v1.61.1:

  • Prepared statements are no longer parsed and planned again on every execution. Since v1.61.0, SQLite 3.54 expired a cached statement that has a col = ? term in a join or an ORDER BY query whenever the driver cleared its bindings after a run, so a statement prepared with db.Prepare or tx.Prepare cost about twice what it did in v1.60.1. Integer bindings now stay in place between executions, so a parameter bound to 0 or 1 does not re-prepare it either. Resolves [GitLab issue #264](https://gitlab.com/cznic/sqlite/-/issues/264). See [GitLab merge request #147](https://gitlab.com/cznic/sqlite/-/merge_requests/147), thanks Roman Khafizianov (@​requilence)!
  • Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!
  • Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.
  • Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!
  • The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.
  • Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

• 2026-10-21 v1.61.0:

  • Upgrade to SQLite 3.54.1, re-vendoring lib/ from modernc.org/libsqlite3 v1.15.2 and vec/ from modernc.org/libsqlite_vec v0.7.0; sqlite-vec stays v0.1.9. The pinned modernc.org/libc becomes v1.79.0; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Add _time_format=string_no_monotonic, opt-in: times are written in the default layout but without Go's monotonic clock reading, the m=+... suffix, so a scanned time matches its row again when bound in WHERE col = ?. The default is unchanged. Resolves [GitLab issue #259](https://gitlab.com/cznic/sqlite/-/issues/259). See [GitLab merge request #142](https://gitlab.com/cznic/sqlite/-/merge_requests/142), thanks 不插电 (@​r27153733)!
  • Each release tag now gets a signed provenance document, linked from its GitLab release; VERIFYING.md says what it proves and how to check one. Tooling only. See [GitLab merge request #141](https://gitlab.com/cznic/sqlite/-/merge_requests/141).
  • Add an opt-in SQLite authorizer per connection: AuthorizerRegisterer, reached through sql.Conn.Raw or installed on every pooled connection from RegisterConnectionHook; existing connections are unchanged. Resolves [GitLab issue #256](https://gitlab.com/cznic/sqlite/-/issues/256). See [GitLab merge request #139](https://gitlab.com/cznic/sqlite/-/merge_requests/139), thanks Tedla Brandsema (@​TedlaBrandsema)!
  • Closing a connection now forgets the pre-update, commit and rollback hooks registered on it; their entries used to linger after Close.
  • With a shared cache, BeginTx now waits for a lock another connection holds instead of failing at once with SQLITE_LOCKED_SHAREDCACHE (262), as executing BEGIN IMMEDIATE did; Commit and Rollback wait likewise while another connection changes the schema. busy_timeout does not bound the wait; the call's context does. See [GitLab merge request #143](https://gitlab.com/cznic/sqlite/-/merge_requests/143), thanks Ian Chechin!
  • PrepareContext and BeginTx with a context that is already done now return the context's error, as ExecContext and QueryContext do. See [GitLab merge request #143](https://gitlab.com/cznic/sqlite/-/merge_requests/143), thanks Ian Chechin!
  • A context that is done before a statement starts running, for example while its arguments are being bound, now stops the statement within 1000 VM steps. SQLite discarded that interrupt, so a long statement ran to completion and only then returned the context's error. See [GitHub pull request #9](modernc-org/sqlite#9), thanks Chris Gianelloni (@​wolf31o2)!
  • A statement waiting for a lock under busy_timeout now stops waiting once its context is done, with the context's error, instead of sleeping on until the timeout; the wait's retry schedule and its bound are otherwise unchanged, and so is a call without a deadline. PrepareContext ended this way returns the context's error too, where it returned SQLITE_BUSY. Resolves [GitLab issue #262](https://gitlab.com/cznic/sqlite/-/issues/262), thanks SirLouen!

• 2026-09-29 v1.60.1:

  • Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

• 2026-09-28 v1.60.0:

  • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
  • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.
  • make vendor now writes vendor.json, the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries; the test suite fails when they no longer match. Tooling only. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).
  • vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.
  • Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.
  • The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.
  • Document three limits of the pluggable page cache on RegisterPageCache and Cache: it cannot be combined with modernc.org/sqlite/vec, PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines. Documentation only.
  • Document in the package documentation that state set on a pooled connection is inherited by the next caller to borrow it, and that a connection reached through sql.Conn.Raw is not safe for concurrent use. Documentation only.
  • Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so anything after a ; runs too. Recommended for any application whose DSN is not a compile-time constant.
  • Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof, which have always worked in a DSN starting with file:, and the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257). Documentation only.
  • Add SECURITY.md, the vulnerability reporting policy: three private channels, what is in scope, that only the latest release is supported, and how a confirmed report is disclosed, including an entry in the Go vulnerability database so govulncheck reports it. IRP.md, linked from it, is the maintainers' incident response plan. Documentation only.
  • Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Documentation only.
  • Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries with all seventeen license texts in full, and a Software Bill of Materials, sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), explained in SBOM.md. Both cover what a module-graph tool cannot see: the transpiled SQLite and sqlite-vec C, and the upstreams modernc.org/libc carries, musl among them. Documentation only.

• 2026-09-15 v1.59.0:

  • Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, memmove, memset, memcmp and strlen with native Go, cutting CPU time on query-heavy workloads by up to a third; see the new Performance section below. As always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does; see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call, removing the last driver-side allocation per invocation. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return. Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).
  • Add regression tests pinning the identity and the pooling of that context. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!
  • Add a Performance section to the package documentation: measured CPU-time ratios of this driver against the same SQLite compiled from C, where the gap comes from, and the two consequences for applications — index the columns that ORDER BY, GROUP BY and WHERE use, and bound the database/sql pool with SetMaxOpenConns.

• 2026-09-01 v1.58.0:

  • Upgrade to SQLite 3.53.4. It carries upstream's own fix for the journal-rollback data-corruption bug, so the local super-journal patch v1.56.0 introduced is dropped; recovery behavior is unchanged. Also bumps the pinned modernc.org/libc to v1.75.6; as always, downstream modules must pin the same version this one does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

... (truncated)

Commits

• 4df1ebe sqlite, conn, stmt, tx: end a busy_timeout wait when the call's context is done
• 44ae8d4 update dependencies, make vendor: SQLite 3.54.1, libc v1.79.0
• 570dc56 CHANGELOG.md: context cancellation before a statement starts (GitHub PR #9)
• 4eacffe sqlite, conn: keep one cancellation flag per connection
• 4926b7a Merge GitHub pull request #9 'fix/context-cancellation'
• 3587a68 fix: preserve cancellation before SQLite execution
• fd37819 Merge branch 'tx-shared-cache-wait' into 'master'
• 75b4e62 conn: watch the context only while waiting for a shared-cache lock
• 5856ee8 tx, conn: wait for a shared-cache lock in BeginTx, Commit and Rollback, and e...
• 0fc3f90 conn: forget the pre-update, commit and rollback hooks on Close
• Additional commits viewable in compare view

Updates github.com/nats-io/nats.go from 1.54.0 to 1.55.0

Release notes

Sourced from github.com/nats-io/nats.go's releases.

Release v1.55.0

Changelog

This is the biggest nats.go release in a long time: 47 changes with more than half of them coming from 18 external contributors - thank you all!

Most of this release is a robustness effort. Nearly 30 bug fixes address deadlocks, goroutine and timer leaks, data races and stalls in reconnect and drain handling, pull and ordered consumers, async publish and service API. It also adds the FetchMaxBytes() option and Conn.RemoteAccount().

ADDED

• Core NATS:
  • Conn.RemoteAccount() and ServerInfo.RemoteAccount exposing the account the client is bound to (#2156)
• JetStream:
  • FetchMaxBytes() option to limit both the number of messages and total bytes in a single Fetch() request. Thanks @​manenim for the contribution (#2198)
  • StreamInfo.Domain, StreamInfo.Alternates, StreamState.Lost, StreamSourceInfo.External and StreamSourceInfo.Error in stream info (#2168)
  • ErrStreamMessageExceedsMaximum for JetStream error code 10054, returned when a message exceeds the stream's MaxMsgSize. Thanks @​matehsan for the contribution (#2110)

FIXED

• Core NATS:
  • ForceReconnect() called while already reconnecting disabling ReconnectWait and custom reconnect delays, so the client dialed in a tight loop. Thanks @​Arsen302 for the contribution and @​MokiMeow for the diagnosis and test (#2179)
  • Connection closing for good instead of reconnecting after a partial write left a truncated message on the wire (#2169)
  • Connection status listeners losing an unread event and being unregistered when the next status was sent (#2193)
  • Message headers not counted against subscription pending byte limits, so header-heavy subscriptions could exceed the limit without reporting a slow consumer. Thanks @​Grivn for the contribution (#2200)
  • Requests interrupted by a reconnect returning ErrConnectionClosed instead of ErrDisconnected. Thanks @​AshSgDe29071999 for the contribution (#2129)
  • Default port added to the path instead of the host for server URLs with a path and no port, e.g. ws://host/nats. Thanks @​dannyshafer for the contribution (#2177)
  • Close() during Drain() flipping the closed connection back to DRAINING_PUBS and flushing on it. Thanks @​Kshot3000 for the contribution (#2163)
  • Drain() waiting for the full DrainTimeout when the connection was closed mid-drain (#2171)
  • IsSystemAccount() reset to false by async INFO updates, such as cluster topology changes or lame duck mode (#2156)
• JetStream:
  • Pull consumer Consume() and Messages() deadlocking on Stop() or Drain() while buffered messages were still being delivered. Thanks @​clwluvw for the contribution (#2165)
  • Messages() iterator goroutines leaking after the connection is closed. Thanks @​clwluvw for the contribution (#2166)
  • Heartbeat timer and status listener left running when Consume() ends because the connection was closed. Thanks @​clwluvw for the contribution (#2164)
  • Messages() iterator returning ErrMsgIteratorClosed instead of the remaining buffered messages when Next() raced with Drain() (#2188)
  • Pull consumer with StopAfter stalling until the missed heartbeat check (30s by default) after a pull expired. Thanks @​huynguyen7 for the contribution (#2208)
  • Ordered consumer with StopAfter hanging on Stop()/Drain(), delivering too many or too few messages, or panicking after a consumer reset. Thanks @​clwluvw for the contribution (#2167)
  • Ordered consumer Fetch(), Next() and FetchBytes() blocking forever after returning ErrOrderedConsumerConcurrentRequests, and FetchNoWait() restarting from the beginning of the stream (#2211)
  • Ordered consumer Consume() and Messages() using the 15s pull consumer heartbeat instead of the 5s ordered default, so a stalled consumer was reset after ~30s instead of ~10s. Thanks @​arminazimi for the contribution (#2182)
  • PublishAsync() exceeding WithPublishAsyncMaxPending() under concurrent calls. Thanks @​ShravanthReddy for the contribution (#2126)
  • Async publish error callbacks for messages pending during a reconnect delayed until the publisher shut down. Thanks @​H-XX-D for the contribution (#2150)
  • Data race between Info() and CachedInfo() on streams and consumers. Thanks @​vulragrag-star for the contribution (#2152)
  • Reusing the same KeyValueConfig.Sources for several KeyValue buckets carrying the first bucket's subject transform into the next ones, so their reads returned ErrKeyNotFound. Thanks @​zhechen-cs for the contribution (#2190)
  • Object Store GetFile() leaving trailing bytes of an existing destination file when downloading a shorter object. Thanks @​zhechen-cs for the contribution (#2197)
• Legacy JetStream:
  • Async publish error callbacks for messages pending during a reconnect delayed until the publisher shut down. Thanks @​H-XX-D for the contribution (#2150)
  • KeyValue Create() and Update() on a cross-domain mirrored bucket failing with nats: no response from stream. Thanks @​spicysharkco for the contribution (#2203)
  • Object Store GetFile() leaving trailing bytes of an existing destination file when downloading a shorter object. Thanks @​zhechen-cs for the contribution (#2197)
• Service API:
  • Panic in AddService() on a closed connection (#2154)
  • Panic with send on closed channel when callbacks were queued during Stop() (#2173)
  • Service stopping on async errors from unrelated subscriptions with overlapping subjects. Async errors are now matched by subscription, recorded in endpoint stats and passed to ErrorHandler, and only a closed connection stops the service (#2174)

... (truncated)

Commits

• 6068694 Release v1.55.0 (#2214)
• 063b4ad [FIXED] Honor ReconnectWait after ForceReconnect during reconnect (#2179)
• 0a4cfc1 [ADDED] JetStream: stream alternates, lost data, source external/error (#2168)
• c3830a0 [IMPROVED] Document default MaxAckPending for legacy JetStream subscriptions ...
• 2560ee4 [IMPROVED] Avoid per-message metadata allocations in JetStream consumers (#2212)
• 8afc207 [FIXED] Ordered consumer Fetch deadlock and FetchNoWait redelivery (#2211)
• d1936d7 [FIXED] Correct StopAfter pending accounting for pull consumers (#2208)
• b431a07 [FIXED] micro: service and endpoint metadata can be changed after it is set (...
• ef8ce42 [FIXED] micro: Reset clears the endpoint queue group in stats (#2195)
• e28f7be [FIXED] Connection status listeners losing unread events (#2193)
• Additional commits viewable in compare view

Updates github.com/rabbitmq/amqp091-go from 1.15.0 to 1.16.0

Release notes

Sourced from github.com/rabbitmq/amqp091-go's releases.

v1.16.0

What's Changed

• chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#391
• docs: document URI credential percent-encoding requirement (#305) by @​cipherprofessor in rabbitmq/amqp091-go#396
• Surface the broker's connection.close reason from Dial instead of a hardcoded 403 by @​mohammadkshn in rabbitmq/amqp091-go#393
• chore: remove redundant legacy +build tag from fuzz.go by @​cipherprofessor in rabbitmq/amqp091-go#395
• Reader hardening by @​Zerpet in rabbitmq/amqp091-go#397
• chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#398
• Add Fuzzy tests for reader by @​Zerpet in rabbitmq/amqp091-go#399
• chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#401
• Reject heartbeat frames sent on a non-zero channel by @​suchitd in rabbitmq/amqp091-go#402
• Add support for basic cancel ok response by @​Zerpet in rabbitmq/amqp091-go#405
• Reject out-of-range heartbeat in ParseURI by @​suchitd in rabbitmq/amqp091-go#407
• Start recovery watcher only after a successful handshake by @​suchitd in rabbitmq/amqp091-go#409
• chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#410
• Fix golangci-lint v2.15.0 errcheck failures by @​suchitd in rabbitmq/amqp091-go#411

New Contributors

• @​cipherprofessor made their first contribution in rabbitmq/amqp091-go#396
• @​mohammadkshn made their first contribution in rabbitmq/amqp091-go#393

Full Changelog: rabbitmq/amqp091-go@v1.15.0...v1.16.0

Changelog

Sourced from github.com/rabbitmq/amqp091-go's changelog.

v1.16.0 (2026-10-19)

Full Changelog

Implemented enhancements:

• Add support for basic cancel ok response #405 (Zerpet)

Fixed bugs:

• Start recovery watcher only after a successful handshake #409 (suchitd)
• Reject out-of-range heartbeat in ParseURI #407 (suchitd)
• Reject heartbeat frames sent on a non-zero channel #402 (suchitd)

Closed issues:

• DialConfig leaks a watchConnection goroutine when the AMQP handshake fails with Recovery enabled #408
• panic: unexpected frame type #400
• v1.13.0: openComplete() zeroes caller-owned SASL credentials, breaking Config reuse across dials #394
• Dial returns 403 "no access to this vhost" when the broker refuses connection.open with 530 NOT_ALLOWED (e.g. user connection limit reached) #392
• Question mark in password breaks connection string parsing #305

Merged pull requests:

• Fix golangci-lint v2.15.0 errcheck failures #411 (suchitd)
• chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 in the github-actions group #410 (dependabot[bot])
• chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 in the github-actions group #401 (dependabot[bot])
• Add Fuzzy tests for reader #399 (Zerpet)
• chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 in the github-actions group #398 (dependabot[bot])
• Reader hardening #397 (Zerpet)
• docs: document URI credential percent-encoding requirement (#305) #396 (cipherprofessor)
• chore: remove redundant legacy +build tag from fuzz.go #395 (cipherprofessor)
• Surface the broker's connection.close reason from Dial instead of a hardcoded 403 #393 (mohammadkshn)
• chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0 in the github-actions group #391 (dependabot[bot])

Commits

• 0149b60 Update changelog.md for v1.16.0
• 76fec2b Merge pull request #411 from rabbitmq/fix/errcheck-golangci-lint-v2.15
• e3acbe6 Fix golangci-lint v2.15.0 errcheck failures
• 3aa2215 Release v1.16.0
• ba61a26 Merge pull request #410 from rabbitmq/dependabot/github_actions/github-action...
• 11f9b30 chore(deps): bump github/codeql-action
• e7fe0bd Merge pull request #409 from rabbitmq/fix/dialconfig-watcher-leak-on-failed-open
• 4f11601 Start recovery watcher only after a successful handshake
• c0131b7 Merge pull request #407 from rabbitmq/fix/uri-heartbeat-correctness
• 61d31a1 Reject out-of-range heartbeat in ParseURI
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.4

Commits

• 4aaad74 Release 2026-10-22
• 4c1f2f2 Regenerated Clients
• edb4ad6 Update endpoints model
• 414c9e4 Update API model
• 5bba534 Bump Smithy Go to 1.28.6 (#3600)
• 0d2e6fa Release 2026-10-21
• 0d7e55d Regenerated Clients
• d5bf455 Update endpoints model
• e92707e Update API model
• d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.10

Commits

• 4aaad74 Release 2026-10-22
• 4c1f2f2 Regenerated Clients
• edb4ad6 Update endpoints model
• 414c9e4 Update API model
• 5bba534 Bump Smithy Go to 1.28.6 (#3600)
• 0d2e6fa Release 2026-10-21
• 0d7e55d Regenerated Clients
• d5bf455 Update endpoints model
• e92707e Update API model
• d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.20.9 to 1.20.10

Commits

• 4b3b917 Release 2022-09-14
• 3ad6cfd Regenerated Clients
• abfad89 Update SDK's smithy-go dependency to v1.13.3
• b5262aa Update SDK with latest version of API models (#1844)
• a13b7a4 codegen: Upgrade to smithy 1.25.0 (#1835)
• 296bfb3 Update PULL_REQUEST_TEMPLATE.md (#1843)
• 63566f0 Update BuildAuthToken to validate endpoint contains a port (#1837)
• b011f04 Update credentials.go (#1841)
• 018b8c3 Amend typological errors in retryer package comments
• 5b135f8 Release 2022-09-02.2
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/sqs from 1.52.4 to 1.52.6

Commits

• d1d210d Release 2024-08-22
• afb0408 Regenerated Clients
• 05f4492 Update partitions file
• 600651a Update endpoints model
• ebaae40 Update API model
• 38fe812 Release 2024-08-21
• b504211 Regenerated Clients
• 02f3045 Update endpoints model
• f7d2cf6 Update API model
• 4d36126 Release 2024-08-20
• Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0

Release notes

Sourced from github.com/jackc/pgx/v5's releases.

v5.11.0

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

• stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.
• Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.
• pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)
• pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)
• pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

• Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

• pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

• pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

  • timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.
  • timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.
  • Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.
  • time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.
  • Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

  Behavior changes:

  • date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.
  • All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range

... (truncated)

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.11.0 (September 7, 2026)

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

• stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.
• Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.
• pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)
• pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)
• pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

• Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

• pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

• pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a...

  Description has been truncated

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.