chore(deps): bump the gomod-minor-patch group across 1 directory with 9 updates by dependabot[bot] · Pull Request #69 · nimiplatform/nimi

dependabot · 2026-07-27T03:25:23Z

Bumps the gomod-minor-patch group with 7 updates in the /runtime directory:

Package	From	To
github.com/fsnotify/fsnotify	`1.9.0`	`1.10.1`
github.com/modelcontextprotocol/go-sdk	`1.6.0`	`1.6.1`
github.com/oklog/ulid/v2	`2.1.1`	`2.1.2`
github.com/zalando/go-keyring	`0.2.6`	`0.2.8`
golang.org/x/net	`0.54.0`	`0.57.0`
google.golang.org/grpc	`1.81.0`	`1.82.1`
modernc.org/sqlite	`1.48.2`	`1.54.0`

Updates github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1

Release notes

Sourced from github.com/fsnotify/fsnotify's releases.

v1.10.1

Changes and fixes

inotify: don't remove sibling watches sharing a path prefix (#754)

inotify, windows: don't rename sibling watches sharing a path prefix (#755)

#754: fsnotify/fsnotify#754 #755: fsnotify/fsnotify#755

v1.10.0

This version of fsnotify needs Go 1.23.

Changes and fixes

inotify: improve initialization error message (#731)

inotify: send Rename event if recursive watch is renamed (#696)

inotify: avoid copying event buffers when reading names (#741)

kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (#748)

kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (#740)

windows: fix nil pointer dereference in remWatch (#736)

windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (#709, #749)

#696: fsnotify/fsnotify#696 #709: fsnotify/fsnotify#709 #731: fsnotify/fsnotify#731 #736: fsnotify/fsnotify#736 #740: fsnotify/fsnotify#740 #741: fsnotify/fsnotify#741 #748: fsnotify/fsnotify#748 #749: fsnotify/fsnotify#749

Changelog

Sourced from github.com/fsnotify/fsnotify's changelog.

1.10.1 2026-05-04

Changes and fixes

inotify: don't remove sibling watches sharing a path prefix (#754)

inotify, windows: don't rename sibling watches sharing a path prefix (#755)

#754: fsnotify/fsnotify#754 #755: fsnotify/fsnotify#755

1.10.0 2026-04-30

This version of fsnotify needs Go 1.23.

Changes and fixes

inotify: improve initialization error message (#731)

inotify: send Rename event if recursive watch is renamed (#696)

inotify: avoid copying event buffers when reading names (#741)

kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (#748)

kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (#740)

windows: fix nil pointer dereference in remWatch (#736)

windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (#709, #749)

#696: fsnotify/fsnotify#696 #709: fsnotify/fsnotify#709 #731: fsnotify/fsnotify#731 #736: fsnotify/fsnotify#736 #740: fsnotify/fsnotify#740 #741: fsnotify/fsnotify#741 #748: fsnotify/fsnotify#748 #749: fsnotify/fsnotify#749

Commits

76b01a6 Release 1.10.1
fec150b Update changelog
162b421 inotify, windows: don't rename sibling watches sharing a path prefix (#755)
224257f inotify: don't remove sibling watches sharing a path prefix (#754)
e0c956c windows: document directory Write events and stabilize tests (#745)
8d01d7b Release 1.10.0
602284e Update changelog
7f03e59 kqueue: skip ENOENT entries in watchDirectoryFiles (#748)
dab9dde windows: lock watch field updates against concurrent WatchList (#709) (#749)
eadf267 kqueue: drop watches directly in Close() instead of going through remove() (#...
Additional commits viewable in compare view

Updates github.com/modelcontextprotocol/go-sdk from 1.6.0 to 1.6.1

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.6.1

This release adds an MCPGODEBUG flag to opt out of the Content-Type check on POST requests.

Behavior Changes

Prior to v1.6.0 (v1.4.0...v1.5.0), the Content-Type check on POST requests was gated by the same disablecrossoriginprotection MCPGODEBUG flag as the cross-origin protection. In v1.6.0, the cross-origin protection was disabled by default (replaced by the opt-in enableoriginverification flag), but the Content-Type check was kept on unconditionally, leaving no way to disable it. This release restores an escape hatch for both the Streamable HTTP and SSE transports: setting MCPGODEBUG=disablecontenttypecheck=1 skips the Content-Type: application/json validation on POST requests. See #957.

What's Changed

mcp: add MCPGPDEBUG for opt-in Content-Type check by @guglielmo-san in modelcontextprotocol/go-sdk#972

Full Changelog: modelcontextprotocol/go-sdk@v1.6.0...v1.6.1

Commits

d454bba mcp: add MCPGPDEBUG for opt-in Content-Type check (#972)
See full diff in compare view

Updates github.com/oklog/ulid/v2 from 2.1.1 to 2.1.2

Release notes

Sourced from github.com/oklog/ulid/v2's releases.

v2.1.2

What's Changed

fix: Scan accepts text-encoded ULIDs in []byte by @sonnemusk in oklog/ulid#134

New Contributors

@sonnemusk made their first contribution in oklog/ulid#134

Full Changelog: oklog/ulid@v2.1.1...v2.1.2

Commits

75921a7 fix: Scan accepts text-encoded ULIDs in []byte (#134)
See full diff in compare view

Updates github.com/zalando/go-keyring from 0.2.6 to 0.2.8

Release notes

Sourced from github.com/zalando/go-keyring's releases.

v0.2.8

What's Changed

gh: hardening workflows by @szuecs in zalando/go-keyring#141

Full Changelog: zalando/go-keyring@v0.2.7...v0.2.8

v0.2.7

What's Changed

Inline shellescape dependency by @williammartin in zalando/go-keyring#117

docs: Fix 404-ing secret service link by @tinder-ryantrontz in zalando/go-keyring#120

fix(readme): remove extra trailing slash by @tinder-ryantrontz in zalando/go-keyring#121

docs: document how to set data via the CLI and then access it via the Go library by @alexec in zalando/go-keyring#128

security: GH Actions by @szuecs in zalando/go-keyring#137

Bump actions/checkout from 4 to 6 by @dependabot[bot] in zalando/go-keyring#138

Bump actions/setup-go from 5 to 6 by @dependabot[bot] in zalando/go-keyring#139

Bump the all-go-mod-patch-and-minor group with 2 updates by @dependabot[bot] in zalando/go-keyring#140

New Contributors

@tinder-ryantrontz made their first contribution in zalando/go-keyring#120

@alexec made their first contribution in zalando/go-keyring#128

@dependabot[bot] made their first contribution in zalando/go-keyring#138

Full Changelog: zalando/go-keyring@v0.2.6...v0.2.7

Commits

a8cdfe3 Merge pull request #141 from zalando/gh/hardening-workflows
d4162d9 gh: hardening workflows
e0dd98f Merge pull request #140 from zalando/dependabot/go_modules/all-go-mod-patch-a...
98f9091 Merge pull request #139 from zalando/dependabot/github_actions/actions/setup-...
40806c2 Merge pull request #138 from zalando/dependabot/github_actions/actions/checko...
1d4d07c Bump the all-go-mod-patch-and-minor group with 2 updates
e6c0d8a Bump actions/setup-go from 5 to 6
0151d30 Bump actions/checkout from 4 to 6
d6ac580 Merge pull request #137 from zalando/security/gh-actions
036041f security: GH Actions should be able read only
Additional commits viewable in compare view

Updates golang.org/x/net from 0.54.0 to 0.57.0

Commits

b8f09f6 go.mod: update golang.org/x dependencies
f05f21b idna: reject all-ASCII xn-- labels on all Go versions
0f748cf internal/http3: clean up stream I/O methods usages in tests
0bb961e internal/http3: add net/http.ResponseController support
0ca694d webdav: document Dir's lack of defense against filesystem modification
bd5f1dc http2: initialize Transport on NewClientConn
488ff63 bpf: add security considerations to package docs
93d1f25 xsrftoken: avoid token collisions
5a3baee internal/http3: prevent panic in QPACK decoder due to overflow
9e7fdbf internal/http3: fix wrong argument being given when validating header value
Additional commits viewable in compare view

Updates golang.org/x/sys from 0.44.0 to 0.47.0

Commits

9e7e939 cpu: handle vendor suffixes in parseRelease
f6fb8a1 unix: use epoll_pwait rather than epoll_wait
f3eeabf windows: avoid length overflow in NewNTString
3cb6647 unix: update glibc to 2.43
c507910 windows: document safe usage of TrusteeValue
d58dcfa unix: add GPIO constants and structs
397d5f8 unix: update to Linux kernel 7.0
0a387f7 cpu: detect zbc extension on riscv64
758f71c cpu: add LLACQ_SCREL, SCQ, DBAR_HINTS detection for loong64
99666ae unix: merge Linux readv/writev implementation with Darwin/OpenBSD
Additional commits viewable in compare view

Updates golang.org/x/term from 0.43.0 to 0.45.0

Commits

9f69229 go.mod: update golang.org/x dependencies
3b43943 go.mod: update golang.org/x dependencies
See full diff in compare view

Updates google.golang.org/grpc from 1.81.0 to 1.82.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.82.1

Security

server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.

xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.

xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.

xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.

Release 1.82.0

Behavior Changes

server: Remove support for GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment varibale. Strict incoming RPC path validation (which has been the default since v1.79.3) can no longer be disabled. (#9112)

transport: Add environment variable to change the default max header list size from 16MB to 8KB. This may be enabled by setting GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true. This will be enabled by default in a subsequent release. (#9019)

balancer: Load Balancing policy registry is now case-sensitive. Set GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false (and file an issue) to revert to case-insensitive behavior. (#9017)

New Features

experimental/stats: Expose a new API, NewContextWithLabelCallback, to register a callback that is invoked when telemetry labels are added. (#8877)

Special Thanks: @seth-epps

client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (#8929)

Special Thanks: @chengxilo

server: Add environment variable GRPC_GO_SERVER_GOROUTINE_LABELS that controls setting runtime/pprof.Labels on goroutines spawned by the server. Set GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true to add the grpc.method label on goroutines spawned to handle incoming requests. (#9082)

Special Thanks: @dfinkel

Bug Fixes

xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (#9138)

grpc: In the deprecated gzip Compressor (used via the deprecated WithCompressor dial option), enforce the MaxRecvMsgSize limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (#9114)

Special Thanks: @evilgensec

stats/opentelemetry: Record retry attempts, grpc.previous-rpc-attempts, at the call level and not the attempt level. (#8923)

encoding: Ensure Close() is always called on readers returned from Compressor.Decompress if possible. (#9135)

channelz: Fix the LastMessageSentTimestamp and LastMessageReceivedTimestamp fields in SocketMetrics to ensure they contain correct timestamp values. (#9109)

Release 1.81.1

Security

xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per gRFC A41. (#9111)

Special Thanks: @al4an444

Bug Fixes

otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. (#9081)

Commits

ebd8f06 Change version to 1.82.1 (#9238)
4ea465d Cherry-pick commits (#9236)
9494a2c Change version to 1.82.1-dev (#9171)
bd23985 Change version to 1.82.0 (#9170)
0f3086d Fix minor issues not covered by PR #9137 (#9147)
fef07fb internal: Split v3procservicepb import into pb and grpc for extproc (#9163)
91dd64f transport: surface subsequent data when receiving non-gRPC header (#8929)
adc97de test/kokoro: add config for regional-td test (#9158)
57c9ff1 xds: ensure full-string matching for RBAC Filter rules (#9148)
b58f32d server: Set a pprof label on new stream goroutines (#9082)
Additional commits viewable in compare view

Updates modernc.org/sqlite from 1.48.2 to 1.54.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

2026-07-20 v1.55.0:

Add github.com/mattn/go-sqlite3-compatible shorthand DSN query parameters to ease migration from that driver: _busy_timeout/_timeout, _foreign_keys/_fk, _journal_mode/_journal, _synchronous/_sync, _auto_vacuum/_vacuum, and _query_only, each setting the correspondingly named PRAGMA. Values are validated against the same set mattn/go-sqlite3 accepts (case-insensitive) and an unrecognized value fails the connection with an error, so a typo such as _synchronous=fu1l or _foreign_keys=yes_please is reported rather than silently downgrading durability or dropping foreign-key enforcement. The keys are applied in a fixed order independent of their order in the DSN — _busy_timeout and _auto_vacuum before any _pragma values (auto_vacuum must be set before the database is first written), the rest after, and _query_only last — and where a key and its alias are both supplied the alias wins, matching mattn/go-sqlite3; selection is by presence rather than by value, so supplying the alias empty (_foreign_keys=on&_fk=) suppresses the PRAGMA rather than deferring to the primary key, again matching that driver. Behavior change to note: prior releases ignored these keys entirely, so a DSN carried over from a mattn/go-sqlite3 setup changes in two ways. A recognized key that previously did nothing now takes effect — _foreign_keys=on begins enforcing constraints against data that may already violate them, _journal_mode=wal persistently converts the database file, and _query_only=1 makes the connection read-only. And a value outside the accepted set now fails the connection with an error where the same DSN previously opened successfully — for example a duration-style _busy_timeout=5s or _timeout=5000ms, neither of which is the integer that key requires. Review such DSNs before upgrading. _pragma is unchanged and no pre-existing parameter changes meaning, though see the following entry for a change in when all of them are validated.

See [GitLab merge request #134](https://gitlab.com/cznic/sqlite/-/merge_requests/134), thanks Toni Spets (@beeper-hifi) and Ian Chechin!

Validate every DSN query parameter before applying any of them. Parameters were previously checked as each was reached, so a DSN whose later parameter was rejected had already executed the PRAGMAs ahead of it. Because PRAGMA journal_mode and PRAGMA auto_vacuum are persistent changes to the database file, a DSN such as file:x.db?_journal_mode=wal&_synchronous=bogus failed the connection and yet left x.db converted to WAL. A failed Open now leaves the database as it found it. This covers the pre-existing _txlock, _timezone, _time_format, _time_integer_format, _inttotime and _texttotime parameters as well as the shorthand keys above: all of them were validated only after the _pragma list had already run, so the same DSN shape — a valid _pragma=journal_mode=wal alongside a misspelled _txlock — converted the file before reporting the error. Only the values accepted for each parameter are unchanged; a DSN that opened successfully before still opens, and one that failed still fails with the same error. _pragma remains the sole exception, since its values are executed verbatim and cannot be checked in advance: a malformed _pragma is still rejected by SQLite as it runs, after any earlier _pragma in the list has taken effect.

2026-07-15 v1.54.0:

Upgrade to SQLite 3.53.3. This also bumps the pinned modernc.org/libc to v1.74.1; as always, downstream modules must pin the exact same modernc.org/libc version this module's go.mod pins (see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177)).

Under the opt-in _texttotime DSN parameter, best-effort parse date-shaped TEXT values from columns SQLite reports with an empty declared type — aggregates and expressions over a date column (MAX(d), COALESCE(d, ...), upper(d), d || ''), subqueries, and typeless real columns (CREATE TABLE t(x)) — into time.Time, instead of delivering them as a raw string that Scan cannot store into a *time.Time. The existing declared DATE/DATETIME/TIME/TIMESTAMP path is unchanged; this only adds the empty-decltype case. The conversion is strictly best-effort: a value that does not parse as a time falls through to the original string, so no Scan that worked before can newly fail. ColumnTypeScanType continues to report string for empty-decltype columns, since the declared type cannot prove the column is temporal. Without _texttotime the behavior is byte-for-byte unchanged. Resolves [GitLab issue #248](https://gitlab.com/cznic/sqlite/-/issues/248).

See [GitLab merge request #133](https://gitlab.com/cznic/sqlite/-/merge_requests/133), thanks Ian Chechin!

2026-06-21 v1.53.0:

Add experimental netbsd/amd64 support, resolving the long-standing build break in [GitLab issue #246](https://gitlab.com/cznic/sqlite/-/issues/246). This target is intentionally not yet listed among the supported platforms in the package documentation: the port had been broken for years and is only now revived, and there is as yet no real-world experience running it under production workloads. Green CI is not the same as battle-tested — so while the full test suite (including the pcache and vec packages and the -race concurrency test) passes on NetBSD 10.1 / Go 1.26.3, and the entire upstream toolchain (libc, cc, ccgo, libz, libtcl8.6, libsqlite3, libsqlite_vec) is green on the NetBSD CI builder, the target is offered for evaluation only. If you run NetBSD, please exercise it with your own workloads and report back via #246; the intent is to promote it to a fully supported platform after a period of broader real-world testing (on the order of a month) elapses without surprises.

Implementation notes: the previously shipped lib/sqlite_netbsd_amd64.go was a stale old-generator transpile that no longer compiled (the mu.enter/mu.leave break in #246); it is replaced by a fresh new-generator transpile consistent with every other platform, and modernc.org/sqlite/vec (sqlite-vec) is vendored and auto-registers on netbsd. Correct operation requires the matching pinned modernc.org/libc, which carries two NetBSD-specific fixes found during this work: the mmap(2) PAD-argument ABI (without it, concurrent WAL access faults with SIGBUS in the WAL-index shared memory) and a working abort(3) (the prior stub left SQLite's crash-recovery writecrash test unable to terminate by signal). As usual, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins.

See [GitLab merge request #82](https://gitlab.com/cznic/sqlite/-/merge_requests/82), thanks Leonardo Taccari (@iamleot) and Thomas Klausner (@wiz)!

Add experimental freebsd/386 and freebsd/arm support. As with the netbsd/amd64 target above, these two 32-bit FreeBSD ports are intentionally not yet listed among the supported platforms in the package documentation: freebsd/386 previously shipped a stale, effectively untested SQLite 3.41 transpile, and freebsd/arm is entirely new, so neither has real-world production mileage yet. Both are now freshly transpiled at SQLite 3.53.2 consistent with every other platform, build cleanly, and pass the full test suite (core, WAL/concurrency, and the vec package) on the FreeBSD CI builders; they are offered for evaluation only. If you run 32-bit FreeBSD, please exercise these targets with your own workloads and report back — the intent is to promote freebsd/386, freebsd/arm, and netbsd/amd64 to fully supported platforms in a future release cycle, once a period of broader real-world testing elapses without surprises.

Implementation notes: correct operation on freebsd/arm requires the matching pinned modernc.org/libc (v1.73.4), which fixes the per-arch mmap(2) off_t encoding for 32-bit FreeBSD; without it the WAL shared-memory mapping faults with SIGBUS under concurrent access, the same class of bug found on the netbsd port. As usual, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins.

See [GitLab merge request #119](https://gitlab.com/cznic/sqlite/-/merge_requests/119), thanks Olivier Cochard-Labbé (@ocochard)!

Add a Go-facing wrapper for SQLITE_CONFIG_PCACHE2. PageCache is the factory and Cache the per-database instance, both idiomatic Go interfaces; Page exposes the raw Buf and Extra pointers that SQLite reads through the C pcache contract. RegisterPageCache and MustRegisterPageCache install the module process-globally before the first sql.Open; subsequent Open calls are gated through a one-shot Xsqlite3_config(SQLITE_CONFIG_PCACHE2) so a too-late Register returns ErrPageCacheTooLate rather than silently falling through to the built-in pcache1. The binding owns the sqlite3_pcache_page stub and re-consults the implementation on every Fetch, reusing the stub only when the returned Page value is unchanged, which keeps a bounded/evicting purgeable cache safe by construction.

See [GitLab merge request #126](https://gitlab.com/cznic/sqlite/-/merge_requests/126), thanks Ian Chechin!

Add modernc.org/sqlite/pcache, the reference page-cache implementation that accompanies the #126 SQLITE_CONFIG_PCACHE2 wrapper. pcache.New returns a *Pool satisfying the PageCache interface; register it once with sqlite.MustRegisterPageCache(pcache.New()) and every connection opened afterwards draws its pages from it. Each Pool.Create mints a fresh per-database Cache: a bounded, LRU-evicting page store that honours the PRAGMA cache_size soft cap and releases the least-recently-unpinned page when it must make room. Page memory — the Buf and Extra buffers SQLite reads through — is allocated with libc.Xmalloc/libc.Xcalloc and therefore lives off the Go heap, which keeps SQLite's interior pointer arithmetic on the page extras from tripping the race detector's checkptr enforcement. Pool.Stats reports aggregate lifetime counters (hits, misses, allocs, evictions, rekeys, truncates, caches) across every cache a Pool has created, so hit/miss/eviction behaviour is observable without instrumenting individual caches. Cross-connection page sharing is out of scope for now; each Create returns an independent per-database cache.

Validated end-to-end against the #126 stress workload (cache_size=16, 4000 BLOB rows with DELETE and incremental_vacuum, integrity_check clean under -race) and benchmarked for the memory-utilization goal tracked in [GitLab issue #204](https://gitlab.com/cznic/sqlite/-/issues/204).

See [GitLab merge request #127](https://gitlab.com/cznic/sqlite/-/merge_requests/127), thanks Ian Chechin!

Tighten the modernc.org/sqlite/pcache reference implementation per cznic's !127 review follow-ups. Adds Stats.EasyRefusals, a per-Pool counter for the cases where FetchCreateEasy returns nil at cap; SQLite reacts to a refusal by spilling dirty pages and retrying with FetchCreateForce, so the new field is a direct proxy for the I/O pressure the strict Easy contract imposes vs pcache1's recycle-without-spill behavior. BenchmarkPoolEvictionChurn was reworked to drive a rotating-residue DELETE (k % 3 = i % 3) and re-insert a matching batch each cycle so the spill pressure recurs and easy-refusals/op scales with b.N instead of capping at the seed's one-time first-cycle cost; both existing benchmarks now report easy-refusals/op alongside the page-allocs/evictions metrics. Stats.Evictions documentation was tightened to match the actual behavior (counts LRU eviction, Unpin(discard=true), Shrink releases, and Unpin(discard=false) trimming back to target after a FetchCreateForce overcommit; bulk frees from Truncate, Rekey collisions, and Destroy are not counted). The TestPoolRoundTripIntegrity comment claiming the workload exercises xRekey ~15 times has been corrected; the SQL surface does not reliably emit xRekey here, and that codepath is covered by the unit tests instead.

See [GitLab merge request #130](https://gitlab.com/cznic/sqlite/-/merge_requests/130), thanks Ian Chechin!

Make modernc.org/sqlite/pcache -race-clean under SQLite's cache=shared mode. The pool already runs correctly under shared-cache because every callback into a given Cache is serialised internally by SQLite's sqlite3BtreeEnter on the BtShared mutex; verified empirically with a lock-free in-flight probe (max-in-flight = 1 on the canonical two-connection workload, 4 on a positive control with goroutines hitting the cache directly). However the Go race detector does not recognise SQLite's libc mutex as a happens-before edge and reports false-positive races on Fetch vs Unpin reads/writes of the per-cache state, which surfaces as DATA RACE failures for any user who registers the pool and runs their suite under -race. A sync.Mutex on the cache type is now taken on every public method (SetSize, PageCount, Fetch, Unpin, Rekey, Truncate, Destroy, Shrink), always. On the common non-shared-cache path the lock is uncontended (one atomic CAS per Lock/Unlock pair, negligible next to the SQLite work it bookends); on the shared-cache path it just rubber-stamps the order SQLite's BtShared mutex already established. A new e2e_test.go TestSharedCacheTwoConns_Integrity drives two sql.Conn against the same cache=shared URI with concurrent writers and asserts PRAGMA integrity_check = ok under -race; passes cleanly with the lock, would surface the false-positive without it. Design notes live in pcache/sharing.go.

See [GitLab merge request #131](https://gitlab.com/cznic/sqlite/-/merge_requests/131), thanks Ian Chechin!

Add a Go wrapper for sqlite3_db_status, the per-connection runtime counters (cache hit/miss/write/spill rates, schema and prepared-statement memory, lookaside usage, deferred foreign keys). DBStatus is an interface implemented by the driver connection and reached through the database/sql escape hatch (*sql.Conn).Raw(), mirroring the existing FileControl surface; DBStatusOp is a distinct typed enum of the SQLITE_DBSTATUS_* verbs so a counter from a different op family will not compile in its place. Status(op, reset) returns the (current, high) pair and optionally resets the counter. This also lets modernc.org/sqlite/pcache measure real I/O instead of the EasyRefusals proxy: the new BenchmarkPoolSpillIO reads the pager-level SQLITE_DBSTATUS_CACHE_SPILL/_CACHE_WRITE counters, which the pager maintains identically for pcache1 and the pool, making the pcache1-vs-pool comparison cznic raised on the !127 review a genuine apples-to-apples measurement. On the rotating-residue eviction-churn workload at cache_size=16 the pool spills ~3.5x more than pcache1 (cache-spill/op 31.96 vs 8.96) for ~3% more page writes (cache-write/op 450 vs 436) at identical hit/miss, quantifying the I/O cost of the strict Easy contract that EasyRefusals only proxied.

See [GitLab merge request #132](https://gitlab.com/cznic/sqlite/-/merge_requests/132), thanks Ian Chechin!

Add an opt-in _dqs DSN query parameter that disables SQLite's double-quoted string literal compatibility quirk on a per-connection basis. When _dqs=0 (or any strconv.ParseBool false value) is supplied, the driver calls sqlite3_db_config with SQLITE_DBCONFIG_DQS_DDL and SQLITE_DBCONFIG_DQS_DML set to off before any statement is prepared, so a double-quoted identifier that fails to resolve raises a parse error instead of silently falling back to a string literal. Absence of the parameter, or _dqs=1, leaves SQLite's default behavior unchanged; existing DSNs continue to work byte-for-byte. Resolves [GitLab issue #61](https://gitlab.com/cznic/sqlite/-/issues/61).

See [GitLab merge request #128](https://gitlab.com/cznic/sqlite/-/merge_requests/128), thanks Ian Chechin!

Add an opt-in _error_rc DSN query parameter for clearer error reporting on open-time failures. When _error_rc=1 (or any strconv.ParseBool true value) is supplied, error strings synthesised from a (rc, db) pair only append sqlite3_errmsg(db) when sqlite3_extended_errcode(db) is consistent with the operation rc (full match first, primary code &0xff as fallback). On mismatch the canonical sqlite3_errstr(rc) is used alone, so an open-time SQLITE_CANTOPEN no longer carries the temporary handle's stale "out of memory" errmsg. Absence of the parameter, or _error_rc=0, preserves the legacy "errstr: errmsg" form byte-for-byte; existing callers that parse error strings are unaffected. The driver's *Error.Code() returns the same SQLite result code in both modes. Parsed before sqlite3_open_v2 so open-time errors are covered. Resolves [GitLab issue #230](https://gitlab.com/cznic/sqlite/-/issues/230).

See [GitLab merge request #129](https://gitlab.com/cznic/sqlite/-/merge_requests/129), thanks Ian Chechin!

2026-06-06 v1.52.0:

Upgrade to SQLite 3.53.2.

Add Backup.Remaining and Backup.PageCount, thin wrappers around the existing sqlite3_backup_remaining and sqlite3_backup_pagecount C symbols. Together they expose the per-Step progress counters that the underlying backup object already maintains, enabling progress reporting during online backups without dropping to modernc.org/sqlite/lib directly.

See [GitLab merge request #122](https://gitlab.com/cznic/sqlite/-/merge_requests/122), thanks Ian Chechin!

Drop the redundant second copy in (*conn).columnText, the path that backs every Rows.Scan into a Go string for a TEXT column. The value's bytes are still copied once out of SQLite-owned memory into a fresh Go buffer; that buffer is then reinterpreted as the result string with unsafe.String rather than copied a second time by the implicit string([]byte) conversion. This removes one allocation per TEXT value per row and roughly halves the bytes allocated on that path; on the new BenchmarkColumnTextScan cases it is ~13–20% faster for payloads of 256 B and larger, with no measurable change for very short strings. Purely internal: no API or behavioral change, and the returned string never aliases SQLite's buffer.

See [GitLab merge request #123](https://gitlab.com/cznic/sqlite/-/merge_requests/123), thanks Ian Chechin!

Cache each result column's declared type once per result set in newRows instead of recomputing it on every row. The TEXT branch of Rows.Next calls ColumnTypeDatabaseTypeName for every TEXT column on every row (independent of any DSN flag), which previously did a libc.GoString + strings.ToUpper each time; that lookup is now a single index into a cached, pre-uppercased []string, and ColumnTypeScanType reads the same cache and drops its per-call strings.ToLower. The declared type is fixed for the lifetime of a prepared statement, so the C round-trip is paid once per column rather than once per column per row, removing exactly 1 alloc + 8 B per TEXT column per row from the Next hot path. The new BenchmarkTextToTimeScan cases show ~7% faster on a 1000-row DATETIME SELECT under _texttotime=1. Purely internal: ColumnTypeDatabaseTypeName and ColumnTypeScanType return identical values, no API or behavioral change.

See [GitLab merge request #124](https://gitlab.com/cznic/sqlite/-/merge_requests/124), thanks Ian Chechin!

Cache, per result column, the parseTimeFormats index that first parsed a TEXT-stored DATE/DATETIME/TIMESTAMP value, and try that format first on later rows instead of re-walking the list from the top. (*conn).parseTime previously ran time.Parse down the format list on every such row; for the canonical SQLite TEXT datetime format every row paid two failed time.Parse attempts — each allocating a *time.ParseError — before the match. On a 1000-row DATETIME TEXT SELECT this cuts ~50% of allocs/op and ~57% of B/op and is ~37% faster. The fall-through chain is preserved exactly: the seven formats are mutually exclusive, so the cached hint can never select a different match than the in-order scan, and the parsed driver.Value is identical to before. Purely internal: no API or behavioral change.

See [GitLab merge request #125](https://gitlab.com/cznic/sqlite/-/merge_requests/125), thanks Ian Chechin!

2026-05-28 v1.51.0:

Pool the []driver.Value slice passed to scalar/aggregate UDF callbacks and to vtab Filter/Insert/Update callbacks, eliminating the dominant per-row allocation on UDF-heavy queries. Benchmarks on a 1000-row, 3-arg noop scalar UDF show ~40% fewer bytes/op and ~15% fewer allocs/op.

Document the matching "arguments are not valid past return" contract on vtab.Cursor.Filter and vtab.Updater.Insert/Update, consistent with the existing rule for FunctionImpl.Scalar / AggregateFunction.Step / WindowInverse.

Resolves [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #114](https://gitlab.com/cznic/sqlite/-/merge_requests/114), thanks Ian Chechin!

... (truncated)

Commits

693ff38 upgrade to SQLite 3.53.3
5d24346 Merge branch 'texttotime-aggregates' into 'master'
892d847 sqlite: document _texttotime empty-decltype upgrade, widen #248 comment, add ...
f2c8758 sqlite: _texttotime best-effort parse for empty-decltype TEXT columns (#248)
6b32d1e CHANGELOG.md: document experimental freebsd/386 + freebsd/arm (#119)
697300f Merge branch 'dbstatus-binding' into 'master'
759639f sqlite: review fixes for !132 — restore #131 CHANGELOG link, correct DBStatus...
40ff027 sqlite: add DBStatus wrapper for sqlite3_db_status + pcache spill-I/O benchmark
6a28fe7 HACKING.md: document CHANGELOG versioning + MR integration flow
adff4b1 Merge branch 'pcache-shared-cache-draft' into 'master'
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… 9 updates Bumps the gomod-minor-patch group with 7 updates in the /runtime directory: | Package | From | To | | --- | --- | --- | | [github.com/fsnotify/fsnotify](https://github.com/fsnotify/fsnotify) | `1.9.0` | `1.10.1` | | [github.com/modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) | `1.6.0` | `1.6.1` | | [github.com/oklog/ulid/v2](https://github.com/oklog/ulid) | `2.1.1` | `2.1.2` | | [github.com/zalando/go-keyring](https://github.com/zalando/go-keyring) | `0.2.6` | `0.2.8` | | [golang.org/x/net](https://github.com/golang/net) | `0.54.0` | `0.57.0` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.81.0` | `1.82.1` | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.48.2` | `1.54.0` | Updates `github.com/fsnotify/fsnotify` from 1.9.0 to 1.10.1 - [Release notes](https://github.com/fsnotify/fsnotify/releases) - [Changelog](https://github.com/fsnotify/fsnotify/blob/main/CHANGELOG.md) - [Commits](fsnotify/fsnotify@v1.9.0...v1.10.1) Updates `github.com/modelcontextprotocol/go-sdk` from 1.6.0 to 1.6.1 - [Release notes](https://github.com/modelcontextprotocol/go-sdk/releases) - [Commits](modelcontextprotocol/go-sdk@v1.6.0...v1.6.1) Updates `github.com/oklog/ulid/v2` from 2.1.1 to 2.1.2 - [Release notes](https://github.com/oklog/ulid/releases) - [Changelog](https://github.com/oklog/ulid/blob/main/CHANGELOG.md) - [Commits](oklog/ulid@v2.1.1...v2.1.2) Updates `github.com/zalando/go-keyring` from 0.2.6 to 0.2.8 - [Release notes](https://github.com/zalando/go-keyring/releases) - [Commits](zalando/go-keyring@v0.2.6...v0.2.8) Updates `golang.org/x/net` from 0.54.0 to 0.57.0 - [Commits](golang/net@v0.54.0...v0.57.0) Updates `golang.org/x/sys` from 0.44.0 to 0.47.0 - [Commits](golang/sys@v0.44.0...v0.47.0) Updates `golang.org/x/term` from 0.43.0 to 0.45.0 - [Commits](golang/term@v0.43.0...v0.45.0) Updates `google.golang.org/grpc` from 1.81.0 to 1.82.1 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.81.0...v1.82.1) Updates `modernc.org/sqlite` from 1.48.2 to 1.54.0 - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.48.2...v1.54.0) --- updated-dependencies: - dependency-name: github.com/fsnotify/fsnotify dependency-version: 1.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-patch - dependency-name: github.com/modelcontextprotocol/go-sdk dependency-version: 1.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-minor-patch - dependency-name: github.com/oklog/ulid/v2 dependency-version: 2.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-minor-patch - dependency-name: github.com/zalando/go-keyring dependency-version: 0.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gomod-minor-patch - dependency-name: golang.org/x/net dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-patch - dependency-name: golang.org/x/sys dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-patch - dependency-name: golang.org/x/term dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-patch - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-patch - dependency-name: modernc.org/sqlite dependency-version: 1.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-07-27T03:25:32Z

Thanks for your first pull request to Nimi.
Please ensure CI passes and include verification commands in the PR template.

cloudflare-workers-and-pages · 2026-07-27T03:27:55Z

Deploying nimi-doc with Cloudflare Pages

Latest commit:	`e26acbb`
Status:	✅ Deploy successful!
Preview URL:	https://fd8dad52.nimi-doc.pages.dev
Branch Preview URL:	https://dependabot-go-modules-runtim-xgga.nimi-doc.pages.dev

View logs

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 27, 2026

dependabot Bot requested a review from hallida as a code owner July 27, 2026 03:25

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 27, 2026

github-actions Bot added the runtime label Jul 27, 2026

github-actions Bot added the size/M label Jul 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the gomod-minor-patch group across 1 directory with 9 updates - #69

chore(deps): bump the gomod-minor-patch group across 1 directory with 9 updates#69
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/runtime/gomod-minor-patch-b22d6cf5f4

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026

v1.10.1

Changes and fixes

v1.10.0

Changes and fixes

1.10.1 2026-05-04

Changes and fixes

1.10.0 2026-04-30

Changes and fixes

v1.6.1

Behavior Changes

What's Changed

v2.1.2

What's Changed

New Contributors

v0.2.8

What's Changed

v0.2.7

What's Changed

New Contributors

Release 1.82.1

Security

Release 1.82.0

Behavior Changes

New Features

Bug Fixes

Release 1.81.1

Security

Bug Fixes

Changelog

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 27, 2026

Deploying nimi-doc with Cloudflare Pages

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants