deps: bump the all-go-dependencies group across 1 directory with 16 updates by dependabot[bot] · Pull Request #105 · chainreactors/aiscan

dependabot · 2026-08-19T05:13:43Z

Bumps the all-go-dependencies group with 13 updates in the / directory:

Package	From	To
github.com/alecthomas/chroma/v2	`2.14.0`	`2.27.0`
github.com/asticode/go-astiav	`0.41.0`	`0.42.0`
github.com/carapace-sh/carapace	`1.11.6`	`1.15.1`
github.com/chainreactors/libcstx/go	`0.3.2`	`0.4.0`
github.com/charmbracelet/glamour	`0.8.0`	`1.0.0`
github.com/gookit/config/v2	`2.2.8`	`2.2.9`
github.com/mattn/go-runewidth	`0.0.23`	`0.0.27`
github.com/projectdiscovery/goflags	`0.1.75`	`0.1.76`
github.com/projectdiscovery/gologger	`1.1.71`	`1.1.72`
golang.org/x/image	`0.42.0`	`0.45.0`
google.golang.org/protobuf	`1.36.11`	`1.36.12`
modernc.org/sqlite	`1.45.0`	`1.56.0`
github.com/stretchr/testify	`1.11.1`	`1.12.0`

Updates github.com/alecthomas/chroma/v2 from 2.14.0 to 2.27.0

Release notes

Sourced from github.com/alecthomas/chroma/v2's releases.

v2.27.0

Changelog

a6d00fe fix(html): make mode class output opt-in via WithModeClasses

f52d015 chore: some house-keeping

f08a9ab chore: add fmt + test to BUILD.bit

6da8f88 fix(yaml): comments can be key-values (#1289)

67785a4 chore(deps): update all non-major dependencies (#1285)

d9dd73f Add templ XML lexer (#1283)

effffdb chore(deps): update all non-major dependencies (#1280)

03236a4 support for PostScript font files (#1282)

e10d532 Fix YAML slash comments with colons (#1278)

v2.26.1

Changelog

56c7702 fix: downgrade go.mod version to 1.25

v2.26.0

Changelog

a4d3f60 feat(chromad): use style counterparts for theme switching

ce159e6 chore: migrate to new bit format

180ea9f perf(colour): replace Sprintf/ParseUint round-trip in NewColour with direct bit arithmetic (#1274)

68a08b0 docs: how to support dynamic theme switching

6fb9d92 feat(html): tag output with style mode

a71fea3 feat(styles): add light/dark mode support

v2.25.0

Changelog

c3826f0 chore: go mod tidy

fb5bc39 fix: emit HTTP body tokens without Coalesce

a3c2946 Improve Nu file detection (#1260)

e841b1a chore(deps): update all non-major dependencies (#1272)

3ed2db8 Add Gemfile.lock lexer (& ruby improvements) (#1269)

41fb546 Add YAML+Jinja lexer (#1268)

e99b881 chore(deps): update all non-major dependencies (#1263)

e67dd2f (Markless) Fix parse issue for embed directives without options (#1266)

dffa370 fix(go): tokenize trailing // as comment instead of consuming next line (#1265)

1cf1560 chore: upgrade to github.com/dlclark/regexp2/v2

2cbcf7b chore: upgrade golangci-lint

786675b chore(deps): update all non-major dependencies (#1257)

235590c feat: add JSONL support to JSON lexer (#1262)

f9b5c97 fix(dart): match single-line comments without trailing newline (#1225) (#1261)

097f8e9 Mention Arturo in README (#1256)

d46ce60 feat(markdown): highlight frontmatter and comments (#1245)

f786b2a feat(lexers): add support for LilyPond (#1255)

0a02b98 chore(deps): update actions/checkout digest to de0fac2 (#1212)

c55009e Fix AGENTS.md referencing a non-existent scripts directory (#1231)

c5e763e Improve protobuf lexer (#1253)

113cd0e Add Arturo lexer (#1232)

4498d71 chore(deps): update dependency binaryen to v129 (#1238)

885f912 Added f4 to "Projects using Chroma" list (#1242)

... (truncated)

Commits

a6d00fe fix(html): make mode class output opt-in via WithModeClasses
f52d015 chore: some house-keeping
f08a9ab chore: add fmt + test to BUILD.bit
6da8f88 fix(yaml): comments can be key-values (#1289)
67785a4 chore(deps): update all non-major dependencies (#1285)
d9dd73f Add templ XML lexer (#1283)
effffdb chore(deps): update all non-major dependencies (#1280)
03236a4 support for PostScript font files (#1282)
e10d532 Fix YAML slash comments with colons (#1278)
56c7702 fix: downgrade go.mod version to 1.25
Additional commits viewable in compare view

Updates github.com/asticode/go-astiav from 0.41.0 to 0.42.0

Commits

5c71be8 Add support for chapters (#191)
5ea8aac Add ENOENT to errors (#193)
8cab7fa Removed coverall from github action
ac70158 fix warnings concerning golang (#192)
0780125 Updated devcontainer.json
1e8b8e4 Now using vasprintf in astiavLogCallback
See full diff in compare view

Updates github.com/carapace-sh/carapace from 1.11.6 to 1.15.1

Release notes

Sourced from github.com/carapace-sh/carapace's releases.

v1.15.1

Changelog

99e94b56840f201083d0e51ea36507ab86c19e2e Merge pull request #1279 from carapace-sh/fix/darwin-process-table-scan

23944b8eee9bac3f97678155b7d170f7a92a3661 fix: avoid macOS process table scan when shell is already known

04feb78c0ff06e0e0cade88c3d3614a5b7de5f84 Merge pull request #1277 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.6

1576016685ce950ae93e322ea883b518db5670b5 build(deps): bump github/codeql-action from 4.37.5 to 4.37.6

26aeef2e6ab007b245de9946721746e4d7c4475f Merge pull request #1276 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.5

83edaf3613f995e77d397b01ee9166ccc7d3ace2 build(deps): bump github/codeql-action from 4.37.4 to 4.37.5

v1.15.0

Changelog

58a55f0eaa56e9387fc7d6800cd1b9531431d1d0 Merge pull request #1275 from carapace-sh/docs/carapace-dev-pflag-delimiter-disabled

ffac8c585278cba42275c020fb3beebd20160ae0 Document delimiter-disabled optarg attached values in carapace-dev skill

14967526cc021932be66a31c160dd16392f21362 feat/optarg delimiter attached (#1272)

30d1cbf48523182d5c42de3be440eb19d472cce0 Merge pull request #1273 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.4

e72227b11eb47ccbba75c32169c5a5c277a930c3 build(deps): bump github/codeql-action from 4.37.3 to 4.37.4

b3f65d47fcca704a9b5ad674c29105523b19c700 Merge pull request #1271 from carapace-sh/keywords-enabled-disabled

3f975d5abfe895c322572f76f473155527ce3467 style: added en-/disabled keywords

8f8d4637c5d66c8b5257579c3f19fd90512eb010 Merge pull request #1270 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.3

d773945ce83fc44992d3a504b3a9d6b7a562b507 build(deps): bump github/codeql-action from 4 to 4.37.3

066da3950bd4c3214d9ba44e2c132a0a66019171 Merge pull request #1269 from carapace-sh/update-carapace-dev-skill

b5fde5bf4847fabf59aacf3adecdb239790e7fbf Update carapace-dev skill for flag prefix and ArgumentStyle changes

v1.14.0

Changelog

993ea5f7f783e35463569aa241d9a1258daa93e5 Merge pull request #1268 from carapace-sh/flagprefix

e7bffd59dc0d665116299d853a854bac9a5d5538 Support custom flag prefix from carapace-pflag (e.g. '&' for elvish)

748aa9f9c8566421d9aad2181fea6ebdff722192 argumentstyle (#1227)

v1.13.3

Changelog

a24bc6a368d89fbb5c028554bf457c10dda5edee Merge pull request #1267 from carapace-sh/rsteube-patch-1

f3df1f9138f824288a8d740d20efef21b029074c Update README.md

b0a542d64a0ad755e716b9052e77eed24feeece2 Merge pull request #1266 from carapace-sh/fix/symlink-repo-discovery

23bdecbd965d936b45868d4f81948ae33b606e27 Resolve symlinks before upward directory traversal in repo discovery

344f1881bf249e6a2f3f02ac881e8bb490ff6255 Merge pull request #1265 from carapace-sh/dependabot/github_actions/actions/setup-go-7

192121c1c974a006f2b8c9626bba734711113237 bump actions/setup-go from 6 to 7

458a0c1bb496650e7d2bd2badecf07390c16fd39 Merge pull request #1264 from carapace-sh/sandbox-expect-strict

eeaa2bb8d58d6eadb114bd5ddbe5ed3cad6d0dda Add ExpectStrict to sandbox for full action comparison including Uids

b20a6d9a96b7325767952cfba54fe9362008ade2 Merge pull request #1262 from carapace-sh/zsh-skill/capture-completion-reference

acdebb8e023b45c69aca4830a0b5426df3886a16 Add zsh skill reference for completion capture technique

v1.13.2

Changelog

42d4b3c26d657cdf1a479b8d4552c2e15f6dd429 Merge pull request #1261 from carapace-sh/sandbox-strip-uids

85535696a984f4a8b19c118de988c6bb4f3fe3c8 Strip Uids in sandbox Expect/ExpectNot comparisons

v1.13.1

Changelog

ab8d05608eabb3a2877cc59d721f827543f12187 Merge pull request #1260 from carapace-sh/fix-multipartsp-uid-preservation

... (truncated)

Commits

99e94b5 Merge pull request #1279 from carapace-sh/fix/darwin-process-table-scan
23944b8 fix: avoid macOS process table scan when shell is already known
04feb78 Merge pull request #1277 from carapace-sh/dependabot/github_actions/github/co...
1576016 build(deps): bump github/codeql-action from 4.37.5 to 4.37.6
26aeef2 Merge pull request #1276 from carapace-sh/dependabot/github_actions/github/co...
83edaf3 build(deps): bump github/codeql-action from 4.37.4 to 4.37.5
58a55f0 Merge pull request #1275 from carapace-sh/docs/carapace-dev-pflag-delimiter-d...
ffac8c5 Document delimiter-disabled optarg attached values in carapace-dev skill
1496752 feat/optarg delimiter attached (#1272)
30d1cbf Merge pull request #1273 from carapace-sh/dependabot/github_actions/github/co...
Additional commits viewable in compare view

Updates github.com/chainreactors/libcstx/go from 0.3.2 to 0.4.0

Commits

e977199 Merge pull request #9 from chainreactors/chore/update-ffi-v0.4.0
40f88cc chore: update libcstx to v0.4.0
de7cbf5 Merge pull request #8 from chainreactors/refactor/go-repository-cas-api
19eccad feat(go): expose native CAS graph index
a4eabbe feat(go): expose repository CAS and graph difference APIs
See full diff in compare view

Updates github.com/charmbracelet/glamour from 0.8.0 to 1.0.0

Release notes

Sourced from github.com/charmbracelet/glamour's releases.

v0.10.0

Actually readable tables

Big tables that included links were always hard to read. Links can be very long, and tables often have limited space to render them. This means that links often took the space of many lines and weren't properly clickable because they were being truncated in practice.

Starting on this release, Glamour will render links and images at the footer of the table, with a reference number so you can easily find the link you're looking for. If you want the old behavior, it is still supported via the new WithInlineTableLinks option.

The New Way

The Old Way

Wanna render tables with inline links? You still can:
r, err := glamour.NewTermRenderer(glamour.WithInlineTableLinks(true))
if err != nil { /*...*/ }
out, err := r.RenderBytes(in)
if err != nil { /.../ }
fmt.Fprintf(os.Stdout, "%s\n", out)
Prettier GitHub links

We also introduced a change so that GitHub links inside tables that reference issues, discussions or PRs will be shown in its shortened form, similar to how GitHub itself present the links on issue descriptions: owner/repo#123.

Extra

Also, we introduced WithTableWrap, so you can disable table text wrapping if really want:
r, err := glamour.NewTermRenderer(glamour.WithTableWrap(false))
if err != nil { ... }
out, err := r.RenderBytes(in)
if err != nil { ... }
fmt.Fprintf(os.Stdout, "%s\n", out)
Changelog

New Features

... (truncated)

Commits

69661fd chore(deps): bump actions/checkout from 5 to 6 in the all group (#491)
0af1a2d chore(deps): bump the all group with 2 updates (#482)
a9ec019 chore(deps): bump github.com/charmbracelet/x/ansi in the all group (#477)
7a4cf0c ci: sync dependabot config (#476)
49c8248 chore(deps): bump the all group with 2 updates (#472)
c1ce505 chore(deps): bump actions/setup-go from 5 to 6 in the all group (#471)
f9c650c ci: sync dependabot config (#470)
e3c481b chore(deps): bump actions/checkout from 4 to 5 (#469)
7209389 chore(deps): bump golang.org/x/term from 0.33.0 to 0.34.0 (#468)
f447e14 chore(deps): bump github.com/charmbracelet/x/ansi from 0.9.3 to 0.10.1 (#467)
Additional commits viewable in compare view

Updates github.com/gookit/config/v2 from 2.2.8 to 2.2.9

Release notes

Sourced from github.com/gookit/config/v2's releases.

v2.2.9

Change Log

Fixed

fix(read): Duration() parses Go duration strings (e.g. "300s", "1h30m") (#218) gookit/config@94aa2e8

fix(reload): reset data before reloading files gookit/config@6a3fe04

Other

build(deps): bump github.com/gookit/goutil from 0.7.5 to 0.7.6 (#215) gookit/config@fc79c1b

build(deps): bump WillAbides/setup-go-faster from 1.15.0 to 1.19.0 (#214) gookit/config@c345d01

build(deps): bump actions/checkout from 6 to 7 (#216) gookit/config@e4ef650

build(deps): bump github.com/gookit/goutil from 0.7.6 to 0.8.0 (#217) gookit/config@99340a5

docs(watch): debounce reload example gookit/config@78c5e7e

ci: update ci testing go version gookit/config@0edfefc

Commits

0edfefc ci: update ci testing go version
78c5e7e docs(watch): debounce reload example
6a3fe04 fix(reload): reset data before reloading files
94aa2e8 fix(read): Duration() parses Go duration strings (e.g. "300s", "1h30m") (#218)
99340a5 build(deps): bump github.com/gookit/goutil from 0.7.6 to 0.8.0 (#217)
e4ef650 build(deps): bump actions/checkout from 6 to 7 (#216)
c345d01 build(deps): bump WillAbides/setup-go-faster from 1.15.0 to 1.19.0 (#214)
fc79c1b build(deps): bump github.com/gookit/goutil from 0.7.5 to 0.7.6 (#215)
See full diff in compare view

Updates github.com/mattn/go-runewidth from 0.0.23 to 0.0.27

Commits

f2d8bfe Merge pull request #103 from mattn/restore-zerowidthjoiner
2cd35a6 Restore ZeroWidthJoiner as a deprecated no-op
b2badb7 Avoid ambiguous-width prefix in TruncatePrefix test
a1307e2 Add TruncatePrefix tests for multi-rune grapheme clusters
9beccfd Merge pull request #79 from umlx5h/add_truncate_prefix
0b200cc Merge pull request #97 from mattn/perf/precomputed-width-lut
fc57c61 Merge pull request #93 from apocelipes/feat-optimize-fill
2e05c0b Merge pull request #102 from mattn/fix/spacing-marks-and-cluster-width
3e28133 Fix width of spacing marks and multi-rune grapheme clusters
b571037 Merge pull request #98 from bugwhisperer418/master
Additional commits viewable in compare view

Updates github.com/projectdiscovery/goflags from 0.1.75 to 0.1.76

Release notes

Sourced from github.com/projectdiscovery/goflags's releases.

Release v0.1.76

0.1.76 (2026-08-11)

Bug Fixes

multibyte value parsing (ab0b9c5), closes projectdiscovery/nuclei#7645 #251

Commits

c2b50c5 Merge pull request #252 from projectdiscovery/dwisiswant0/fix/multibyte-value...
3586e89 bump go
6280410 fix lint
ab0b9c5 fix: multibyte value parsing
See full diff in compare view

Updates github.com/projectdiscovery/gologger from 1.1.71 to 1.1.72

Release notes

Sourced from github.com/projectdiscovery/gologger's releases.

Release v1.1.72

1.1.72 (2026-08-09)

Commits

f047aad Merge pull request #153 from projectdiscovery/dependabot/github_actions/main/...
e792122 Merge pull request #152 from projectdiscovery/dependabot/github_actions/main/...
4d36837 Merge pull request #151 from projectdiscovery/dependabot/github_actions/main/...
520bbbc chore(deps): bump actions/setup-go from 6 to 7
7fd8ed1 chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0
b51f41b chore(deps): bump actions/checkout from 6 to 7
See full diff in compare view

Updates golang.org/x/image from 0.42.0 to 0.45.0

Commits

3ebddc7 go.mod: update golang.org/x dependencies
981eaa0 vp8l: avoid allocating many unused Huffman tree groups
315273a vector: using golang.org/x/sys/cpu for feature detection
891abcb go.mod: update golang.org/x dependencies
f50490d font: document (lack of) security hardening in font packages
7a0cfda webp: check for VP8L dimension mismatch before allocation
4339315 tiff: consistently skip horizontal padding in tiled images
b5baf41 tiff: avoid overflow when reading IFD entries
e7513b5 tiff: limit the amount of data read in IFD entries
cb9f1a6 tiff: limit uncompressed data reads
Additional commits viewable in compare view

Updates golang.org/x/sys from 0.46.0 to 0.47.0

Commits

9e7e939 cpu: handle vendor suffixes in parseRelease
f6fb8a1 unix: use epoll_pwait rather than epoll_wait
f3eeabf windows: avoid length overflow in NewNTString
3cb6647 unix: update glibc to 2.43
c507910 windows: document safe usage of TrusteeValue
See full diff in compare view

Updates golang.org/x/term from 0.44.0 to 0.45.0

Commits

9f69229 go.mod: update golang.org/x dependencies
See full diff in compare view

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

Updates modernc.org/sqlite from 1.45.0 to 1.56.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

2026-08-15 v1.57.0:

Add an opt-in _defensive DSN query parameter that turns on SQLite's defensive mode for the connection, disabling the SQL-level features that let ordinary statements deliberately corrupt the database file. When _defensive=1 (or any strconv.ParseBool true value) is supplied, the driver calls sqlite3_db_config with SQLITE_DBCONFIG_DEFENSIVE immediately after sqlite3_open_v2 and before every other parameter is applied, so the PRAGMAs the driver itself runs, the _pragma list, and every statement the caller prepares are all subject to it. On such a connection PRAGMA writable_schema=ON, PRAGMA journal_mode=OFF and PRAGMA schema_version=N become silent no-ops, and writes to a virtual table's shadow tables (fts5's _data, _idx and so on) and to sqlite_dbpage fail with "table ... may not be modified"; reading those tables, ordinary use of the virtual tables that own them, and VACUUM are unaffected. The flag has no PRAGMA equivalent, so sqlite3_db_config — and therefore a DSN parameter — is the only way to reach it short of dropping to modernc.org/sqlite/lib. The value is parsed before sqlite3_open_v2, so an invalid one fails the connection without creating the database file, and the parameter must appear at most once: a repeated _defensive is an error rather than letting the first value silently win. Absence of the parameter, or _defensive=0, leaves SQLite's default behavior unchanged; existing DSNs continue to work byte-for-byte. Two limits are worth stating plainly, since the name invites more confidence than the flag earns. Defensive mode is a hardening measure, not a sandbox for hostile database files: it is one of several steps SQLite recommends for that purpose, and this build compiles with neither SQLITE_TRUSTED_SCHEMA=0 nor SQLITE_DQS=0 and exposes no authorizer. And it is a property of the connection, not of the database file — a second handle opened on the same file without the parameter is unrestricted.

Reject the one DSN combination defensive mode would otherwise swallow in silence. _defensive=1 together with _journal_mode=OFF (or _journal=OFF) now fails the connection instead of opening one in which neither parameter was honoured: SQLite turns PRAGMA journal_mode=OFF into a no-op that still reports success, so the driver would have accepted the mode, executed it, and left the journal untouched without telling anyone. The check runs in the validation phase introduced in v1.55.0, before any statement executes, so a rejected DSN cannot leave the database half-configured. _pragma remains the exception it has always been: _pragma=journal_mode(OFF) alongside _defensive=1 still runs and is still silently ignored by SQLite. Only DSNs using _defensive can be affected, and that parameter is new, so no DSN that opened before changes behavior.

See [GitHub pull request #6](modernc-org/sqlite#6), thanks wsman!

Ship the sqlite-vec license notice this module has been missing. modernc.org/sqlite/vec has bundled the transpiled sqlite-vec sources since v1.47.0, but the module carried only its own BSD-3-Clause LICENSE and the public-domain SQLite notice. sqlite-vec is Copyright (c) 2024 Alex Garcia, dual-licensed Apache-2.0 OR MIT and used here under MIT, whose terms require the copyright and permission notice to accompany substantial portions of the software — which 2.8 MB of transpiled vec/ plainly is. The notice now ships as LICENSE-SQLITE_VEC in the module root, byte-identical to the LICENSE-MIT in the upstream v0.1.9 archive and named after the file modernc.org/libsqlite_vec extracts it into. Attribution was never absent — vec's package documentation has named the extension, pinned the version and linked upstream — but the license text itself was, and the omission was ours: vendor_libs/main.go copied the per-target transpiles and nothing else. It now copies the notice alongside them and fails the vendoring run if it cannot, so a make vendor can no longer quietly drop it. The vec package documentation gained a License section recording that the package is under a different license from the rest of this module.

The SQLite notice is renamed from SQLITE-LICENSE to LICENSE-SQLITE; update any direct links to it. Its contents are unchanged and SQLite remains public domain. The name now matches both the new LICENSE-SQLITE_VEC beside it and the LICENSE-<upstream> convention every other modernc.org repository follows, but it is more than cosmetic: go mod vendor selects the files it copies into a downstream vendor/ tree by matching each name against a fixed list of prefixes — LICENSE among them — so a name merely ending in LICENSE was never propagated. Both bundled notices now travel with the code into vendored builds, which is where the MIT terms on vec/ keep applying. No code changes; no behavior changes.

Let a caller-constructed Driver register its own functions, collations and virtual table modules. Driver has always held four categories of registration state, but only RegisterConnectionHook could put anything on a constructed one: functions and collations were reachable through the package-level API alone, and modules through the package-level driver only, which left the modules field written and read through that instance and so process-global state wearing a per-instance field. Driver now has RegisterFunction, RegisterScalarFunction, RegisterDeterministicScalarFunction, RegisterCollationUtf8 and RegisterModule, plus Must* variants of the first four, each registering on that Driver alone; the methods are safe to call concurrently, and the zero Driver is ready to use as-is. vtab.RegisterModule also honours its db argument now: a non-nil db registers on the driver backing it when that driver implements the new vtab.ModuleRegisterer, while a nil db keeps targeting the driver this package registers as sqlite. One existing pattern changes behavior, narrowly and loudly: vtab.RegisterModule(db, ...) where db was opened on a caller-constructed Driver used to discard the db argument and land on the sqlite driver, reaching every connection in the process; it now lands on the constructed driver alone, so a sql.Open("sqlite") connection that used to resolve such a module gets no such module instead. The same pattern is also the one way an existing program could hold one module name on both a constructed Driver and the package-level one: there the first of the two registrations used to win and the second was refused as already registered, whereas now the package-level implementation wins on the constructed Driver's connections regardless of the order they ran in. Reaching that case at all means the program ignored an error the older version returned. Two smaller deviations round out the list: Driver.RegisterModule reports no error for such a collision, and vtab.RegisterModule now validates its name and module arguments before the not-implemented check, so a call with an empty name that returned vtab: RegisterModule not wired into engine outside this driver returns vtab: module name must be non-empty instead. Everything else is additive against v1.56.0: the package-level registration functions target the same driver they always did, connections still receive every module registered through the package-level path whichever Driver opened them, and a db opened on the sqlite driver resolves to that same driver. The isolating change discussed in [GitLab issue #254](https://gitlab.com/cznic/sqlite/-/issues/254) is deliberately not made here.

See [GitLab merge request #135](https://gitlab.com/cznic/sqlite/-/merge_requests/135), thanks Ian Chechin!

2026-08-03 v1.56.0:

Re-vendor the transpiled SQLite sources, picking up modernc.org/libsqlite3's fix for an upstream data-corruption bug in SQLite 3.53.3's journal rollback. The SQLite version is unchanged at 3.53.3; what changes is that the amalgamation is now patched before it is transpiled. 3.53.3 reworked readSuperJournal() to return the super-journal name through a char** out-parameter, and pager_playback() now tests that pointer where it used to test zSuper[0]. A crash during the commit of a multi-database (ATTACH) transaction can leave the super-journal name and its checksum zeroed while the name length and the trailing magic survive; the checksum is a plain byte sum, so an all-zero name still validates and readSuperJournal() hands back a non-NULL pointer to an empty string. pager_playback() then calls sqlite3OsAccess(pVfs, "", SQLITE_ACCESS_EXISTS), gets ENOENT, and deletes the hot journal without playing it back — leaving the database corrupted. This is not a transpilation artifact: a plain gcc build of the stock 3.53.3 amalgamation fails on the same bytes while 3.53.2 recovers them, and it is what has been making upstream's own test/crash.test fail intermittently, in roughly 2% of runs, on every platform. The patch restores the pre-3.53.3 behaviour of reporting a (nul) super-journal name and will be dropped once upstream ships its own fix. Every supported target carries it.

Two targets change beyond that patch. On linux/s390x the regenerated transpile allocates C bit-fields MSB-first, as the big-endian platform ABI requires, rather than LSB-first; this comes from modernc.org/cc/v4 v4.29.1 and touches bit-field accesses throughout the SQLite core, s390x being this module's only big-endian target. On linux/riscv64 the transpile was regenerated on a host running GCC 11.4.0 where the previous one used GCC 13.3.0, which drops a handful of unexported compiler-predefined macro constants (the __FLT16_* family, __DBL_IS_IEC_60559__ and friends) and changes the COMPILER=gcc-13.3.0 entry PRAGMA compile_options reports to COMPILER=gcc-11.4.0; no SQLite code generation differs. Every other target's generated code is byte-identical to v1.55.0 apart from the journal-rollback patch above.

Bump the pinned modernc.org/libc to v1.74.4, and the remaining dependencies to their current releases. v1.74.2 and v1.74.3 are retracted upstream — a freeaddrinfo lock leak that deadlocks name resolution — and v1.74.4 is the fix. As always, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins (see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177)).

Documentation sweep. openbsd/amd64 and openbsd/arm64 join the supported platforms table in the package documentation: both have been in the builder test matrix since January and are cross-built by make build_all_targets, but had never been listed. The vfs DSN query parameter — which names a VFS registered with SQLite, such as one returned by vfs.New — is now documented alongside the other DSN parameters on Driver.Open. The "Debug and development versions" section no longer describes a GO_GENERATE environment variable and a go generate that this repository has not had since generator.go moved to modernc.org/libsqlite3; it now points at that repository and make vendor instead, and the stale //go:generate directive naming the removed file is dropped with it. modernc.org/sqlite/vec and modernc.org/sqlite/vfs gained the package doc comments they were missing, so both finally carry a synopsis on pkg.go.dev. Documentation only; no behavior changes.

Add NewConnector, returning a database/sql/driver.Connector for use with sql.OpenDB. It opens the same connections sql.Open("sqlite", dsn) does, from the same registered driver, so every function, collation, connection hook and virtual table module registered through this package applies to them. It exists for callers that need to interpose on the physical connections database/sql opens — tracing, metrics, connection-scoped setup — which sql.Open gives no access to: such a caller can embed the returned Connector, override Connect, and pass its own wrapper to sql.OpenDB. Previously the only way to reach the registered driver was the db, _ := sql.Open("sqlite", ""); drv := db.Driver(); db.Close() idiom, which works only because sql.Open does not connect and this driver does not implement driver.DriverContext; and the only way to get a wrapper into a *sql.DB was sql.Register, which is process-global, panics on a name it has already seen, and cannot be undone, so a library had to invent a unique driver name per configuration. sql.OpenDB registers nothing. Constructing a &sqlite.Driver{} is not an alternative — its fields are unexported, so it carries none of the registrations. NewConnector checks the DSN only as far as it can without opening a database — a query string that does not parse, and conflicting vfs parameters; everything else continues to be validated when the connection is opened, so an unknown parameter or an out-of-range value is reported by Connect rather than at construction. Nothing about the existing sql.Open path changes: *Driver deliberately still does not implement driver.DriverContext, so sql.Open remains lazy and DSN errors continue to surface where they always have. A runnable sample is in examples/connector. Resolves [GitLab issue #253](https://gitlab.com/cznic/sqlite/-/issues/253), thanks Alessandro Segala (@ItalyPaleAle)!

Document that a caller-constructed sqlite.Driver is not the driver this package registers as "sqlite". Its fields are unexported, so it starts with no functions, collations or connection hooks and the only way to give it any is its own RegisterConnectionHook method; the package-level Register* functions always apply to the registered driver. Connections such a Driver opens therefore run without the package-level functions and collations — and because a registered function silently replaces a SQLite built-in of the same name, a Driver you construct can evaluate upper(x), date(x) and the like differently from one opened through sql.Open. Virtual table modules are the one exception: they are held process-globally and reach every Driver. Constructing one remains supported for the private-hook pattern — a driver registered under a name of its own with sql.Register so its connection hooks apply only to its own connections — and is otherwise best avoided in favour of sql.Open or NewConnector. Documentation only; no behavior changes.

2026-07-20 v1.55.0:

Add github.com/mattn/go-sqlite3-compatible shorthand DSN query parameters to ease migration from that driver: _busy_timeout/_timeout, _foreign_keys/_fk, _journal_mode/_journal, _synchronous/_sync, _auto_vacuum/_vacuum, and _query_only, each setting the correspondingly named PRAGMA. Values are validated against the same set mattn/go-sqlite3 accepts (case-insensitive) and an unrecognized value fails the connection with an error, so a typo such as _synchronous=fu1l or _foreign_keys=yes_please is reported rather than silently downgrading durability or dropping foreign-key enforcement. The keys are applied in a fixed order independent of their order in the DSN — _busy_timeout and _auto_vacuum before any _pragma values (auto_vacuum must be set before the database is first written), the rest after, and _query_only last — and where a key and its alias are both supplied the alias wins, matching mattn/go-sqlite3; selection is by presence rather than by value, so supplying the alias empty (_foreign_keys=on&_fk=) suppresses the PRAGMA rather than deferring to the primary key, again matching that driver. Behavior change to note: prior releases ignored these keys entirely, so a DSN carried over from a mattn/go-sqlite3 setup changes in two ways. A recognized key that previously did nothing now takes effect — _foreign_keys=on begins enforcing constraints against data that may already violate them, _journal_mode=wal persistently converts the database file, and _query_only=1 makes the connection read-only. And a value outside the accepted set now fails the connection with an error where the same DSN previously opened successfully — for example a duration-style _busy_timeout=5s or _timeout=5000ms, neither of which is the integer that key requires. Review such DSNs before upgrading. _pragma is unchanged and no pre-existing parameter changes meaning, though see the following entry for a change in when all of them are validated.

See [GitLab merge request #134](https://gitlab.com/cznic/sqlite/-/merge_requests/134), thanks Toni Spets (@beeper-hifi) and Ian Chechin!

Validate every DSN query parameter before applying any of them. Parameters were previously checked as each was reached, so a DSN whose later parameter was rejected had already executed the PRAGMAs ahead of it. Because PRAGMA journal_mode and PRAGMA auto_vacuum are persistent changes to the database file, a DSN such as file:x.db?_journal_mode=wal&_synchronous=bogus failed the connection and yet left x.db converted to WAL. A failed Open now leaves the database as it found it. This covers the pre-existing _txlock, _timezone, _time_format, _time_integer_format, _inttotime and _texttotime parameters as well as the shorthand keys above: all of them were validated only after the _pragma list had already run, so the same DSN shape — a valid _pragma=journal_mode=wal alongside a misspelled _txlock — converted the file before reporting the error. Only the values accepted for each parameter are unchanged; a DSN that opened successfully before still opens, and one that failed still fails with the same error. _pragma remains the sole exception, since its values are executed verbatim and cannot be checked in advance: a malformed _pragma is still rejected by SQLite as it runs, after any earlier _pragma in the list has taken effect.

2026-07-15 v1.54.0:

Upgrade to SQLite 3.53.3. This also bumps the pinned modernc.org/libc to v1.74.1; as always, downstream modules must pin the exact same modernc.org/libc version this module's go.mod pins (see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177)).

Under the opt-in _texttotime DSN parameter, best-effort parse date-shaped TEXT values from columns SQLite reports with an empty declared type — aggregates and expressions over a date column (MAX(d), COALESCE(d, ...), upper(d), d || ''), subqueries, and typeless real columns (CREATE TABLE t(x)) — into time.Time, instead of delivering them as a raw string that Scan cannot store into a *time.Time. The existing declared DATE/DATETIME/TIME/TIMESTAMP path is unchanged; this only adds the empty-decltype case. The conversion is strictly best-effort: a value that does not parse as a time falls through to the original string, so no Scan that worked before can newly fail. ColumnTypeScanType continues to report string for empty-decltype columns, since the declared type cannot prove the column is temporal. Without _texttotime the behavior is byte-for-byte unchanged. Resolves [GitLab issue #248](https://gitlab.com/cznic/sqlite/-/issues/248).

See [GitLab merge request #133](https://gitlab.com/cznic/sqlite/-/merge_requests/133), thanks Ian Chechin!

2026-06-21 v1.53.0:

Add experimental netbsd/amd64 support, resolving the long-standing build break in [GitLab issue #246](https://gitlab.com/cznic/sqlite/-/issues/246). This target is intentionally not yet listed among the supported platforms in the package documentation: the port had been broken for years and is only now revived, and there is as yet no real-world experience running it under production workloads. Green CI is not the same as battle-tested — so while the full test suite (including the pcache and vec packages and the -race concurrency test) passes on NetBSD 10.1 / Go 1.26.3, and the entire upstream toolchain (libc, cc, ccgo, libz, libtcl8.6, libsqlite3, libsqlite_vec) is green on the NetBSD CI builder, the target is offered for evaluation only. If you run NetBSD, please exercise it with your own workloads and report back via #246; the intent is to promote it to a fully supported platform after a period of broader real-world testing (on the order of a month) elapses without surprises.

Implementation notes: the previously shipped lib/sqlite_netbsd_amd64.go was a stale old-generator transpile that no longer compiled (the mu.enter/mu.leave break in #246); it is replaced by a fresh new-generator transpile consistent with every other platform, and modernc.org/sqlite/vec (sqlite-vec) is vendored and auto-registers on netbsd. Correct operation requires the matching pinned modernc.org/libc, which carries two NetBSD-specific fixes found during this work: the mmap(2) Description has been truncated

dependabot · 2026-08-19T05:13:44Z

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

…pdates Bumps the all-go-dependencies group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma) | `2.14.0` | `2.27.0` | | [github.com/asticode/go-astiav](https://github.com/asticode/go-astiav) | `0.41.0` | `0.42.0` | | [github.com/carapace-sh/carapace](https://github.com/carapace-sh/carapace) | `1.11.6` | `1.15.1` | | [github.com/chainreactors/libcstx/go](https://github.com/chainreactors/libcstx) | `0.3.2` | `0.4.0` | | [github.com/charmbracelet/glamour](https://github.com/charmbracelet/glamour) | `0.8.0` | `1.0.0` | | [github.com/gookit/config/v2](https://github.com/gookit/config) | `2.2.8` | `2.2.9` | | [github.com/mattn/go-runewidth](https://github.com/mattn/go-runewidth) | `0.0.23` | `0.0.27` | | [github.com/projectdiscovery/goflags](https://github.com/projectdiscovery/goflags) | `0.1.75` | `0.1.76` | | [github.com/projectdiscovery/gologger](https://github.com/projectdiscovery/gologger) | `1.1.71` | `1.1.72` | | [golang.org/x/image](https://github.com/golang/image) | `0.42.0` | `0.45.0` | | google.golang.org/protobuf | `1.36.11` | `1.36.12` | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.45.0` | `1.56.0` | | [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.0` | Updates `github.com/alecthomas/chroma/v2` from 2.14.0 to 2.27.0 - [Release notes](https://github.com/alecthomas/chroma/releases) - [Commits](alecthomas/chroma@v2.14.0...v2.27.0) Updates `github.com/asticode/go-astiav` from 0.41.0 to 0.42.0 - [Commits](asticode/go-astiav@v0.41.0...v0.42.0) Updates `github.com/carapace-sh/carapace` from 1.11.6 to 1.15.1 - [Release notes](https://github.com/carapace-sh/carapace/releases) - [Commits](carapace-sh/carapace@v1.11.6...v1.15.1) Updates `github.com/chainreactors/libcstx/go` from 0.3.2 to 0.4.0 - [Release notes](https://github.com/chainreactors/libcstx/releases) - [Commits](chainreactors/libcstx@v0.3.2...v0.4.0) Updates `github.com/charmbracelet/glamour` from 0.8.0 to 1.0.0 - [Release notes](https://github.com/charmbracelet/glamour/releases) - [Commits](charmbracelet/glamour@v0.8.0...v1.0.0) Updates `github.com/gookit/config/v2` from 2.2.8 to 2.2.9 - [Release notes](https://github.com/gookit/config/releases) - [Commits](gookit/config@v2.2.8...v2.2.9) Updates `github.com/mattn/go-runewidth` from 0.0.23 to 0.0.27 - [Commits](mattn/go-runewidth@v0.0.23...v0.0.27) Updates `github.com/projectdiscovery/goflags` from 0.1.75 to 0.1.76 - [Release notes](https://github.com/projectdiscovery/goflags/releases) - [Commits](projectdiscovery/goflags@v0.1.75...v0.1.76) Updates `github.com/projectdiscovery/gologger` from 1.1.71 to 1.1.72 - [Release notes](https://github.com/projectdiscovery/gologger/releases) - [Commits](projectdiscovery/gologger@v1.1.71...v1.1.72) Updates `golang.org/x/image` from 0.42.0 to 0.45.0 - [Commits](golang/image@v0.42.0...v0.45.0) Updates `golang.org/x/sys` from 0.46.0 to 0.47.0 - [Commits](golang/sys@v0.46.0...v0.47.0) Updates `golang.org/x/term` from 0.44.0 to 0.45.0 - [Commits](golang/term@v0.44.0...v0.45.0) Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12 Updates `modernc.org/sqlite` from 1.45.0 to 1.56.0 - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.45.0...v1.56.0) Updates `github.com/charmbracelet/lipgloss` from 1.1.0 to 1.1.1-0.20250404203927-76690c660834 - [Release notes](https://github.com/charmbracelet/lipgloss/releases) - [Commits](https://github.com/charmbracelet/lipgloss/commits) Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.0 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.0) --- updated-dependencies: - dependency-name: github.com/alecthomas/chroma/v2 dependency-version: 2.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: github.com/asticode/go-astiav dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: github.com/carapace-sh/carapace dependency-version: 1.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: github.com/chainreactors/libcstx/go dependency-version: 0.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: github.com/charmbracelet/glamour dependency-version: 1.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-go-dependencies - dependency-name: github.com/charmbracelet/lipgloss dependency-version: 1.1.1-0.20250404203927-76690c660834 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: github.com/gookit/config/v2 dependency-version: 2.2.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: github.com/mattn/go-runewidth dependency-version: 0.0.27 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: github.com/projectdiscovery/goflags dependency-version: 0.1.76 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: github.com/projectdiscovery/gologger dependency-version: 1.1.72 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: github.com/stretchr/testify dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: golang.org/x/image dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: golang.org/x/sys dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: golang.org/x/term dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies - dependency-name: google.golang.org/protobuf dependency-version: 1.36.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-go-dependencies - dependency-name: modernc.org/sqlite dependency-version: 1.56.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot changed the title ~~deps: bump the all-go-dependencies group with 16 updates~~ deps: bump the all-go-dependencies group across 1 directory with 16 updates Aug 19, 2026

dependabot Bot force-pushed the dependabot/go_modules/all-go-dependencies-31bc8c3c2b branch from b69a898 to 65a1a97 Compare August 19, 2026 07:38

Navigation Menu

Uh oh!

deps: bump the all-go-dependencies group across 1 directory with 16 updates - #105

deps: bump the all-go-dependencies group across 1 directory with 16 updates#105
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/all-go-dependencies-31bc8c3c2b

dependabot Bot commented on behalf of github Aug 19, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.27.0

Changelog

v2.26.1

Changelog

v2.26.0

Changelog

v2.25.0

Changelog

v1.15.1

Changelog

v1.15.0

Changelog

v1.14.0

Changelog

v1.13.3

Changelog

v1.13.2

Changelog

v1.13.1

Changelog

v0.10.0

Actually readable tables

The New Way

The Old Way

Prettier GitHub links

Extra

Changelog

New Features

v2.2.9

Change Log

Fixed

Other

Release v0.1.76

0.1.76 (2026-08-11)

Bug Fixes

Release v1.1.72

1.1.72 (2026-08-09)

Changelog

Uh oh!

dependabot Bot commented on behalf of github Aug 19, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 19, 2026 •

edited

Loading