Skip to content

deps: bump the go-minor-patch group across 1 directory with 14 updates - #1085

Merged
jiashuoz merged 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-3b680974ad
Oct 22, 2026
Merged

deps: bump the go-minor-patch group across 1 directory with 14 updates#1085
jiashuoz merged 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-3b680974ad

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-minor-patch group with 14 updates in the / directory:

Package From To
github.com/aws/aws-sdk-go-v2/config 1.33.5 1.33.9
github.com/aws/aws-sdk-go-v2/service/sesv2 1.73.0 1.79.1
github.com/aws/aws-sdk-go-v2/service/sts 1.51.0 1.51.4
github.com/aws/smithy-go 1.28.1 1.28.5
github.com/go-chi/chi/v5 5.3.2 5.5.0
github.com/go-jose/go-jose/v4 4.1.5 4.1.6
github.com/gowebpki/jcs 1.0.1 1.0.2
github.com/prometheus/client_golang 1.24.1 1.25.0
github.com/riverqueue/river 0.47.0 0.49.0
github.com/riverqueue/river/riverdriver/riverpgxv5 0.47.0 0.49.0
github.com/riverqueue/river/rivertype 0.47.0 0.49.0
golang.org/x/crypto 0.57.0 0.58.0
golang.org/x/net 0.59.0 0.60.0
golang.org/x/text 0.42.0 0.43.0

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.5 to 1.33.9

Commits

Updates github.com/aws/aws-sdk-go-v2/service/sesv2 from 1.73.0 to 1.79.1

Commits

Updates github.com/aws/aws-sdk-go-v2/service/sts from 1.51.0 to 1.51.4

Commits

Updates github.com/aws/smithy-go from 1.28.1 to 1.28.5

Changelog

Sourced from github.com/aws/smithy-go's changelog.

Release (2026-10-09)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.28.5
    • Bug Fix: Retain the key with the zero value when encountering a null-value key in a dense map. This matches how legacy code-generated JSON deserializers behaved.

Release (2026-10-07)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.28.4
    • Bug Fix: Revert #698 that fixed JoinPath with trailing slash. This has a side effect on certain S3 API paths in the downstream SDK that need more consideration.

Release (2026-10-06)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.28.3
    • Bug Fix: Accept either casing of message/Message on modeled JSON error structures in schema-based deserialization, and emit the smithy.api#error trait in generated schemas
    • Bug Fix: Include the underlying error when logging failures to discard or close an HTTP response body

Release (2026-09-18)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.28.2
    • Bug Fix: Avoid allocating a slice in ValidateEndpointHost by indexing into the hostname instead of using strings.Split.
    • Bug Fix: Fix event stream decode panic on unknown header value type.
    • Bug Fix: Fix schema-serde CBOR decode panic on malformed string/blob length.
    • Bug Fix: JoinPath keeps a trailing slash when the added path is a slash.

Release (2026-08-26)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.28.1
    • Bug Fix: Fix broken AddLogger middleware since its insert point was removed.

Release (2026-08-25.2)

... (truncated)

Commits

Updates github.com/go-chi/chi/v5 from 5.3.2 to 5.5.0

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.5.0

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.4.0...v5.5.0

v5.4.0

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.3.2...v5.4.0

Commits
  • 3a33ba5 middleware: SupressNotFound must not mutate the request's route context (#1220)
  • 6075570 middleware: parse quoted ContentCharset media parameters (#1218)
  • 46295d0 middleware: test Retry-After rounding in one table test (#1217)
  • c6e33a1 middleware: build Maybe handler once (#1197)
  • c9744a3 middleware: test ClientIPFromHeader does not fall back to other headers (#1208)
  • fff8bb2 middleware: add Deprecation (RFC 9745), make Sunset RFC 8594 only (#1195)
  • 7f9b744 middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* (#1214)
  • 167e1e3 README: point middleware doc links to chi/v5 (#1196)
  • 3d1777a middleware: honor Discard when flushing (#1185)
  • b1c9ab4 middleware: record response status when flushing (#1174)
  • Additional commits viewable in compare view

Updates github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.6

Fixed Security Issues

This release contains a fix for GHSA-mgcc-cww5-fp2q

Breaking Changes

The fix for GHSA-mgcc-cww5-fp2q involves capping the size of the RSA modulus of keys accepted by JWK parsing. This limit is 4096 bits. If you need this to be higher, set MaxRSAModulusBits before performing any JWK parsing.

Changed

Full Changelog: go-jose/go-jose@v4.1.5...v4.1.6

Commits

Updates github.com/gowebpki/jcs from 1.0.1 to 1.0.2

Release notes

Sourced from github.com/gowebpki/jcs's releases.

Version 1.0.2

A fully implemented version of RFC 8785 for Golang with fixes for various bugs.

Commits

Updates github.com/prometheus/client_golang from 1.24.1 to 1.25.0

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.25.0

⚠️ This release raises the minimum required Go version to 1.26 and includes breaking API changes in api/prometheus/v1 (see the [CHANGE] entries below). ⚠️

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135

What's Changed

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.25.0 / 2026-10-07

  • [CHANGE] Minimum required Go version is now 1.26, only the two latest Go versions (1.26 and 1.27) are supported from now on. #2138
  • [CHANGE] api/prometheus/v1: Query, QueryRange, Series, LabelNames, and LabelValues now return Infos annotations in addition to Warnings, matching the Prometheus server's info annotations. This changes the signatures of these methods and of api.Client's Do/DoGetFallback; custom API client implementations must be updated. #1963
  • [CHANGE] api/prometheus/v1: Rework TSDBBlocks result types to align with the Prometheus server's tsdb.BlockMeta: TSDBBlocksResult now contains Blocks []TSDBBlockMeta directly instead of mirroring the full API envelope, nested types are renamed (TSDBBlockMeta, TSDBBlockStats, TSDBBlockMetaCompaction), stat fields are uint64 with omitempty tags, and the optional compaction parents field is included. #1928
  • [FEATURE] testutil: Add GatherAndFormat to encode a subset of metrics from a Gatherer. #2091
  • [FEATURE] promhttp: Add HandlerOpts.AcceptedFormats to customize the formats negotiated from the incoming Accept header, enabling opt-in to experimental formats such as OpenMetrics 2.0 without changing default negotiation. #2146
  • [ENHANCEMENT] promhttp: Negotiated metrics responses now include a Vary header. #2142
  • [ENHANCEMENT] prometheus: Regenerate the default runtime collector metrics for Go 1.25 and Go 1.26. #2090, #2095
  • [ENHANCEMENT] testutil: Finalize OpenMetrics output in GatherAndFormat and CollectAndFormat (terminating # EOF). #2125
  • [BUGFIX] api: Match complete URL path placeholders only; a :foo argument no longer substitutes inside :foobar. #2136
  • [BUGFIX] exp/api/remote: Reset the pooled buffer before generic proto marshaling, preventing corrupted remote-write payloads. #2139
  • [BUGFIX] testutil/promlint: Fix "mibi" unit prefix to "mebi". #2135
Commits

Updates github.com/riverqueue/river from 0.47.0 to 0.49.0

Release notes

Sourced from github.com/riverqueue/river's releases.

v0.49.0

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.32.0 to get a compatible package.

Changed

  • Internal transaction helpers now reuse existing transactions instead of creating unnecessary savepoints. Callers of transactional APIs must roll back their transaction on error; applications that need partial rollback can create an explicit savepoint around the River call. Set RIVER_USE_LEGACY_SUBTRANSACTIONS=1 (or true) before starting the application to restore savepoints in these helpers, including those used by River Pro. This is a temporary compatibility fallback planned for removal in a future release. [PR #1420](riverqueue/river#1420).

Fixed

  • Fixed rivertest.Worker to honor a configured Config.JobStuckThreshold for stuck job detection. Previously, it always used an internal 5 second threshold, so the Job appears to be stuck log line was emitted at a different time than it would be under a real client. [PR #1418](riverqueue/river#1418).
  • Fixed SQLite job cleanup stalling when excluded queues fill the oldest batch, and added support for included queue filters so per-queue retention works on SQLite. [PR #1417](riverqueue/river#1417).
  • Fixed a unique insert skipped as a duplicate of a job of a different kind (possible with UniqueOpts.ExcludeKind) changing the existing job's kind to its own. [PR #1421](riverqueue/river#1421).

v0.48.0

⚠️ This release contains a new database migration, version 8, but it only affects SQLite:

  • If you're on Postgres, you can ignore it with no adverse effect.
  • If you're on SQLite, it rebuilds river_job to add an AUTOINCREMENT keyword to the primary key, preventing a possible edge case where generated job IDs could be reused after deletion. It's not necessary to run the migration for River to work, but it's a good idea to get it in when convenient. [PR #1390](riverqueue/river#1390).

Added

  • Added support for YugabyteDB. When LISTEN/NOTIFY is unavailable or disabled, clients automatically poll for running job cancellations and queue pause, resume, and metadata changes, and skip unsupported notification broadcasts. This works with the default PollOnly: false. Native notifications require YugabyteDB 2025.2.3 or later with ysql_yb_enable_listen_notify=true on both Masters and TServers. [PR #1347](riverqueue/river#1347).
  • Added Config.LeaderElectionDisabled to let a client work jobs without participating in leader election or running maintenance services. Other eligible clients in the same database and schema continue handling scheduling, retries, periodic enqueueing, rescue, and cleanup. [PR #1382](riverqueue/river#1382).
  • Added Config.FetchOnlyKnownKinds to restrict job fetching to registered worker kinds, including aliases. Clients with different workers can share a queue while leaving unknown jobs available without consuming attempts. Disabled by default; leader election and stuck-job rescue behavior are unchanged. [PR #1396](riverqueue/river#1396).

Changed

  • UniqueOpts.ByPeriod now derives a job's period from its effective scheduled time (InsertOpts.ScheduledAt when set, otherwise the insertion time), so scheduled jobs are deduplicated against other jobs scheduled in the same period rather than against jobs inserted in the same period. Periods are also now always measured in UTC, so processes and ScheduledAt values in different time zones produce the same unique key for the same period. Unique keys for scheduled ByPeriod jobs, and for any ByPeriod job inserted from a process whose local time zone isn't UTC, differ from those produced by previous versions. During a rolling upgrade, old and new clients may therefore each insert one job for such a period; jobs that aren't scheduled and are inserted from UTC processes are unaffected. [PR #1377](riverqueue/river#1377).
  • UniqueOpts{ExcludeKind: true} alone is now rejected at insert time instead of being silently ignored. UniqueOpts.isEmpty() now considers ExcludeKind, in line with the equivalent handling in internal/dbunique. Warning: This new rejection can be considered a minor breaking change. [PR #1404](riverqueue/river#1404).

Fixed

  • Fixed cancelled transaction starts leaving Turso connections unusable, which could prevent maintenance from recovering after a startup failure. [PR #1347](riverqueue/river#1347).
  • Fixed maintenance startup failures leaving a client renewing leadership with maintenance stopped in poll-only mode. After exhausting startup retries, clients now request local resignation without depending on database notifications. [PR #1347](riverqueue/river#1347).
  • Fixed JobRescuer overwriting jobs that complete, leave the running state, or are claimed again by another worker after being fetched for rescue, preserving their state, errors, metadata, and timestamps across PostgreSQL and SQLite drivers. Fixes #1302. [PR #1373](riverqueue/river#1373).
  • Fixed SQLite job list pagination skipping or repeating jobs by formatting cursor timestamps consistently with stored timestamps. [PR #1374](riverqueue/river#1374).
  • Improved PostgreSQL job listing performance when filtering by one finalized state (completed, cancelled, or discarded) and sorting by finalized time, including in River UI. [PR #1374](riverqueue/river#1374).
  • Fixed rivermigrate leaving river_migration rows behind after migrating a non-main migration line down through its version 1, which caused a later up migration of that line to skip version 1. With MigrateTx, rows for every removed version were left behind. [PR #1378](riverqueue/river#1378).
  • Fixed river bench inserting every benchmark job with a num arg of 0 instead of numbering jobs sequentially. [PR #1379](riverqueue/river#1379).
  • Attempt errors that are valid JSON but don't have the shape River writes (for example an at timestamp in another format, an attempt stored as a string, or an error or trace that isn't a string) are now decoded on a best effort basis when reading jobs from the database. Timestamps outside RFC 3339 are left zero; stored values are unchanged. Previously a single such element made its job unreadable, and if that happened while fetching jobs, every job locked in the same fetch was left running indefinitely. [PR #1380](riverqueue/river#1380).
  • A fetched job whose row can't be decoded (for example a SQLite job whose tags were changed to something other than an array of strings) no longer leaves every job locked in the same fetch stuck running. The other jobs are worked normally, while the undecodable job's attempt fails with an error describing the decode failure, and it's retried or discarded like any other failed job. Its original values are preserved, with non-array errors values wrapped to append the failure or rescue error. Neither the rescuer nor the SQLite scheduler fails on such a job, so its retry doesn't stop other jobs from being rescued or scheduled. [PR #1380](riverqueue/river#1380).
  • Fixed SQLite notification listeners delivering notifications from before a subscription or from an unsubscribe gap. Notification reads now fetch subscribed topics in bounded batches, and cleanup deletes expired notifications in batches of 10,000 rows (reduced to 1,000 after repeated timeouts), with pauses between batches to reduce write lock contention. [PR #1381](riverqueue/river#1381).
  • Fixed the job completer panicking when a job it was finalizing had its state changed concurrently, like being moved to pending out of band, or being rescued while the completer's update waited on the row lock (in which case PostgreSQL returns the job's pre-update running row). Such jobs are now skipped without emitting a completion event. [PR #1383](riverqueue/river#1383).
  • Fixed JobList pagination skipping or repeating jobs when ordering by JobListOrderByTime with multiple states. Cursors now use the same time field as the list's ordering (the one for the first listed state) rather than the one for each job's own state. Jobs where that field is null, like finalized_at for unfinalized jobs, are paginated correctly and consistently sort last in ascending order and first in descending order on all drivers. Ordering by JobListOrderByTime with an empty States() filter now uses scheduled_at instead of returning an error. [PR #1384](riverqueue/river#1384).
  • A SQLite job whose args, attempted_by, errors, metadata, or tags were changed to text that isn't valid JSON no longer makes every fetch from its queue fail with a "malformed JSON" error. The job's attempt fails like that of any other job that can't be decoded, and completing, rescuing, or scheduling it no longer fails either. Invalid values are left in place, except that an invalid errors value is kept as a string in a new array so that attempt errors can still be appended. [PR #1386](riverqueue/river#1386).
  • Fixed UniqueOpts.ByArgs skipping distinct jobs or failing inserts when JSON keys contain path syntax (like user.id), are empty, or come from unnamed tags like json:",omitempty". Unaffected unique keys remain unchanged; affected jobs may be inserted again after upgrading or by old and new clients during a rolling upgrade. [PR #1387](riverqueue/river#1387).
  • Fixed JobListCursor.UnmarshalText rejecting valid cursors whose URL-safe base64 encoding contains - or _, so cursors produced by MarshalText always round-trip. [PR #1388](riverqueue/river#1388).
  • Fixed SQLite drivers deleting jobs in a finalized state whose retention period was set to -1 (keep forever), like Config.DiscardedJobRetentionPeriod: -1, whenever another state's retention period was finite. [PR #1389](riverqueue/river#1389).
  • Fixed SQLite reusing the ID of a deleted job when that job held the largest ID, which could cause an ID observed earlier to refer to an unrelated job later. [PR #1390](riverqueue/river#1390).
  • Fixed the Job appears to be stuck log line reporting the client-level JobTimeout instead of the worker-level timeout when a worker overrides Timeout. [PR #1394](riverqueue/river#1394).

... (truncated)

Changelog

Sourced from github.com/riverqueue/river's changelog.

[0.49.0] - 2026-10-05

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.32.0 to get a compatible package.

Changed

  • Internal transaction helpers now reuse existing transactions instead of creating unnecessary savepoints. Callers of transactional APIs must roll back their transaction on error; applications that need partial rollback can create an explicit savepoint around the River call. Set RIVER_USE_LEGACY_SUBTRANSACTIONS=1 (or true) before starting the application to restore savepoints in these helpers, including those used by River Pro. This is a temporary compatibility fallback planned for removal in a future release. [PR #1420](riverqueue/river#1420).

Fixed

  • Fixed rivertest.Worker to honor a configured Config.JobStuckThreshold for stuck job detection. Previously, it always used an internal 5 second threshold, so the Job appears to be stuck log line was emitted at a different time than it would be under a real client. [PR #1418](riverqueue/river#1418).
  • Fixed SQLite job cleanup stalling when excluded queues fill the oldest batch, and added support for included queue filters so per-queue retention works on SQLite. [PR #1417](riverqueue/river#1417).
  • Fixed a unique insert skipped as a duplicate of a job of a different kind (possible with UniqueOpts.ExcludeKind) changing the existing job's kind to its own. [PR #1421](riverqueue/river#1421).

[0.48.0] - 2026-09-30

⚠️ This release contains a new database migration, version 8, but it only affects SQLite:

  • If you're on Postgres, you can ignore it with no adverse effect.
  • If you're on SQLite, it rebuilds river_job to add an AUTOINCREMENT keyword to the primary key, preventing a possible edge case where generated job IDs could be reused after deletion. It's not necessary to run the migration for River to work, but it's a good idea to get it in when convenient. [PR #1390](riverqueue/river#1390).

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.31.0 to get a compatible package.

Added

  • Added support for YugabyteDB. When LISTEN/NOTIFY is unavailable or disabled, clients automatically poll for running job cancellations and queue pause, resume, and metadata changes, and skip unsupported notification broadcasts. This works with the default PollOnly: false. Native notifications require YugabyteDB 2025.2.3 or later with ysql_yb_enable_listen_notify=true on both Masters and TServers. [PR #1347](riverqueue/river#1347).
  • Added Config.LeaderElectionDisabled to let a client work jobs without participating in leader election or running maintenance services. Other eligible clients in the same database and schema continue handling scheduling, retries, periodic enqueueing, rescue, and cleanup. [PR #1382](riverqueue/river#1382).
  • Added Config.FetchOnlyKnownKinds to restrict job fetching to registered worker kinds, including aliases. Clients with different workers can share a queue while leaving unknown jobs available without consuming attempts. Disabled by default; leader election and stuck-job rescue behavior are unchanged. [PR #1396](riverqueue/river#1396).

Changed

  • UniqueOpts.ByPeriod now derives a job's period from its effective scheduled time (InsertOpts.ScheduledAt when set, otherwise the insertion time), so scheduled jobs are deduplicated against other jobs scheduled in the same period rather than against jobs inserted in the same period. Periods are also now always measured in UTC, so processes and ScheduledAt values in different time zones produce the same unique key for the same period. Unique keys for scheduled ByPeriod jobs, and for any ByPeriod job inserted from a process whose local time zone isn't UTC, differ from those produced by previous versions. During a rolling upgrade, old and new clients may therefore each insert one job for such a period; jobs that aren't scheduled and are inserted from UTC processes are unaffected. [PR #1377](riverqueue/river#1377).
  • UniqueOpts{ExcludeKind: true} alone is now rejected at insert time instead of being silently ignored. UniqueOpts.isEmpty() now considers ExcludeKind, in line with the equivalent handling in interna...

    Description has been truncated

@dependabot
deps: bump the go-minor-patch group across 1 directory with 14 updates
a40b5b9 
Bumps the go-minor-patch group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.33.5` | `1.33.9` |
| [github.com/aws/aws-sdk-go-v2/service/sesv2](https://github.com/aws/aws-sdk-go-v2) | `1.73.0` | `1.79.1` |
| [github.com/aws/aws-sdk-go-v2/service/sts](https://github.com/aws/aws-sdk-go-v2) | `1.51.0` | `1.51.4` |
| [github.com/aws/smithy-go](https://github.com/aws/smithy-go) | `1.28.1` | `1.28.5` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.3.2` | `5.5.0` |
| [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.1.5` | `4.1.6` |
| [github.com/gowebpki/jcs](https://github.com/gowebpki/jcs) | `1.0.1` | `1.0.2` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.1` | `1.25.0` |
| [github.com/riverqueue/river](https://github.com/riverqueue/river) | `0.47.0` | `0.49.0` |
| [github.com/riverqueue/river/riverdriver/riverpgxv5](https://github.com/riverqueue/river) | `0.47.0` | `0.49.0` |
| [github.com/riverqueue/river/rivertype](https://github.com/riverqueue/river) | `0.47.0` | `0.49.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.59.0` | `0.60.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.42.0` | `0.43.0` |



Updates `github.com/aws/aws-sdk-go-v2/config` from 1.33.5 to 1.33.9
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.33.5...config/v1.33.9)

Updates `github.com/aws/aws-sdk-go-v2/service/sesv2` from 1.73.0 to 1.79.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.73.0...service/s3/v1.79.1)

Updates `github.com/aws/aws-sdk-go-v2/service/sts` from 1.51.0 to 1.51.4
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.51.0...service/s3/v1.51.4)

Updates `github.com/aws/smithy-go` from 1.28.1 to 1.28.5
- [Release notes](https://github.com/aws/smithy-go/releases)
- [Changelog](https://github.com/aws/smithy-go/blob/main/CHANGELOG.md)
- [Commits](aws/smithy-go@v1.28.1...v1.28.5)

Updates `github.com/go-chi/chi/v5` from 5.3.2 to 5.5.0
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.3.2...v5.5.0)

Updates `github.com/go-jose/go-jose/v4` from 4.1.5 to 4.1.6
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](go-jose/go-jose@v4.1.5...v4.1.6)

Updates `github.com/gowebpki/jcs` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/gowebpki/jcs/releases)
- [Commits](gowebpki/jcs@v1.0.1...v1.0.2)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

Updates `github.com/riverqueue/river` from 0.47.0 to 0.49.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.47.0...v0.49.0)

Updates `github.com/riverqueue/river/riverdriver/riverpgxv5` from 0.47.0 to 0.49.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.47.0...v0.49.0)

Updates `github.com/riverqueue/river/rivertype` from 0.47.0 to 0.49.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.47.0...v0.49.0)

Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0
- [Commits](golang/crypto@v0.57.0...v0.58.0)

Updates `golang.org/x/net` from 0.59.0 to 0.60.0
- [Commits](golang/net@v0.59.0...v0.60.0)

Updates `golang.org/x/text` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.42.0...v0.43.0)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/aws/aws-sdk-go-v2/service/sesv2
  dependency-version: 1.79.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/aws/aws-sdk-go-v2/service/sts
  dependency-version: 1.51.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/aws/smithy-go
  dependency-version: 1.28.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/gowebpki/jcs
  dependency-version: 1.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/riverqueue/river
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/riverqueue/river/riverdriver/riverpgxv5
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/riverqueue/river/rivertype
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: golang.org/x/net
  dependency-version: 0.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: golang.org/x/text
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from jiashuoz as a code owner October 20, 2026 13:39
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 20, 2026
@jiashuoz
jiashuoz merged commit ade4116 into main Oct 22, 2026
29 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jiashuoz jiashuoz Awaiting requested review from jiashuoz jiashuoz is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jiashuoz