chore(deps): bump the go-deps group in /backend/services/submission with 3 updates by dependabot[bot] · Pull Request #4 · stjosephsplacements/AetherCode

dependabot · 2026-10-07T19:10:23Z

Bumps the go-deps group in /backend/services/submission with 3 updates: github.com/jackc/pgx/v5, github.com/stretchr/testify and google.golang.org/grpc.

Updates github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0

Release notes

Sourced from github.com/jackc/pgx/v5's releases.

v5.11.0

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.

Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.

pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)

pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)

pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.

timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.

Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.

time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.

Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

Behavior changes:

date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.

All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range

... (truncated)

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.11.0 (September 7, 2026)

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.

Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.

pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)

pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)

pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.

timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.

Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.

time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.

Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

Behavior changes:

date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.

All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the

... (truncated)

Commits

5e583fa Update changelog for v5.11.0
3927116 Apply gofumpt formatting required by lint
eb07165 Quote filesystem paths in development connection strings
cf5938f Allow unsigned digit counts in binary numeric encoding
3930cf5 Accept PostgreSQL POSIX timezone offsets in text timestamps
93261be Prefer exact db tag matches when mapping rows to structs
e8d8ad1 Merge pull request #2647 from sueun-dev/fix-range-text-quoting-20260906
01d2fd3 Merge pull request #2644 from eliranbz/fix-failed-prepare-deallocation
9b7e3be Merge pull request #2645 from ash2k/move-channel
76d78f5 Merge pull request #2643 from AshSgDe29071999/fix/hstore-pairs-estimate-clamp
Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

Change yaml library to go.yaml.in/yaml/v3 by @harryzcy in stretchr/testify#1935

change yaml library to go.yaml.in/yaml/v3 by @boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

@harryzcy made their first contribution in stretchr/testify#1935

@boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

Change yaml library to go.yaml.in/yaml/v3 by @harryzcy in stretchr/testify#1935

change yaml library to go.yaml.in/yaml/v3 by @boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

@harryzcy made their first contribution in stretchr/testify#1935

@boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

assert: make *AssertionFunc types just aliases by @dolmen in stretchr/testify#1563

Fixes

mock: avoid panic when expected type is nil in Arguments.Diff by @mutaiib in stretchr/testify#1775

mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @brackendawson in stretchr/testify#1786

suite: validate method signatures and continue execution for valid tests by @vyas-git in stretchr/testify#1665

assert.PanicsWithError: report error message by @olivergondza in stretchr/testify#1400

assert: IsIncreasing et al can return false w/out failing by @brackendawson in stretchr/testify#1787

add type to error message of assert.Same by @egawata in stretchr/testify#1792

mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @brackendawson in stretchr/testify#1795

assert: truncate very long objects in test failure messages by @brackendawson in stretchr/testify#1646

assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @nghiack7 in stretchr/testify#1888

suite: prevent panic when SetupTest skips with HandleStats by @blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

CI: test also with Go 1.23 by @dolmen in stretchr/testify#1783

Vendor unmaintained github.com/pmezard/go-difflib by @brackendawson in stretchr/testify#1708

Promote ccoVeille to maintainer by @brackendawson in stretchr/testify#1784

build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in stretchr/testify#1790

assert.YAMLEq: Document mutlidoc behavior by @brackendawson in stretchr/testify#1791

_codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @dolmen in stretchr/testify#1782

doc: remove ineffective inline code blocks by @brackendawson in stretchr/testify#1714

Tag generated assertions as non-generated in new .gitattributes by @ubunatic in stretchr/testify#1815

... (truncated)

Commits

959dbda Merge pull request #1935 from harryzcy/yaml-update
9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
001eb79 Merge pull request #1905 from Kentzo/patch-1
ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
f8c01f3 mock: Mock.Return does not exist anymore
12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
a11649e assert: make *AssertionFunc type just aliases
dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
098f8d7 _codegen: use strings.Builder
Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.83.0 to 1.84.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.84.0

Behavior Changes

stats/otel: The grpc.lb.pick_first.* metrics have been removed and replaced with grpc.subchannel.* metrics. See gRFC A94 for more details. (#9215)

New Features

xds: Add support for contains_match in route header matchers. (#9223)

Special Thanks: @nvxbug

Bug Fixes

client: Fix a bug where a ClientConn could get permanently stuck in IDLE when an RPC was canceled during stream creation. Previously, such cancellations triggered stream cleanup twice, corrupting the channel's idleness state and causing subsequent RPCs to fail with deadline exceeded errors. (#9191)

Special Thanks: @utkuozdemir

client: Fix a bug where non-gRPC HTTP responses ending with an empty DATA frame failed the RPC with status code Internal instead of preserving the HTTP-mapped status code and response body. (#9217)

Special Thanks: @chengxilo

credentials: Validate metadata returned by per-RPC credentials, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from credentials was sent to the server in outgoing HTTP/2 requests. (#9202)

Special Thanks: @buger

credentials/sts: Prevent potential token leakage by disallowing HTTP redirects during STS token exchange. Previously, 3xx redirects were followed automatically, replaying the request body containing authentication tokens to the redirect destination. (#9299)

Special Thanks: @nvxbug

randomsubsetting: Ignore endpoints that contain no addresses. Previously, this could cause the policy to panic while computing hashes. (#9259)

Special Thanks: @fallintoplace

stats/otel: Ensure method names are populated in trace spans when metrics are disabled. Previously, running with tracing enabled and metrics disabled resulted in server trace spans lacking the RPC method name (recording only "Recv."). (#9262)

transport: Return io.ErrUnexpectedEOF when EOF is encountered after partial header or message body reads. Previously, partial reads could return a plain io.EOF, failing to distinguish truncated data from a clean end of stream. (#9204)

Special Thanks: @buger

transport: Validate metadata supplied by balancers (in PickResult.Metadata) and resolver addresses, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from these sources was sent to the server in outgoing HTTP/2 requests. (#9203)

Special Thanks: @buger

xds: Fix a rare corner case that could prevent a cluster from being removed when it is no longer in use. (#9140)

xds: Fix panic during route matching for routes containing header matchers with empty exact_match strings. (#9223)

Special Thanks: @nvxbug

xds: Reject routes containing header matchers with empty prefix_match or suffix_match strings. Previously, this caused a panic during route matching. (#9223)

Special Thanks: @nvxbug

xds: Fix EDS drop policies being applied at a much lower rate than configured due to an integer overflow. (#9257)

Special Thanks: @nvxbug

xds: Reject EDS resources containing drop policies with unsupported denominators. Previously, such resources caused the client to panic when calculating drop rates. (#9218)

Special Thanks: @nvxbug

xds/rbac: Reject RBAC configurations containing nested Principal or Permission rules with :scheme or grpc- prefixed header matchers. Previously, such configurations could cause DENY policies to fail open. (#9258)

Special Thanks: @nvxbug

xds/rbac: Rewrite host header matchers to :authority in nested Principal and Permission rules. Previously, this rewrite only applied to top-level rules, causing nested host matchers to never match incoming requests and DENY policies to fail open. (#9258)

Special Thanks: @nvxbug

xds/rbac: Reject CidrRanges with an unset prefix length. Previously, an omitted prefix_len field caused a panic during RBAC configuration parsing. (#9250)

Special Thanks: @nvxbug

Performance Improvements

transport: Avoid a heap allocation when flushing shared write buffers. (#9233)

Special Thanks: @zaidoon1

credentials/alts: Support dynamic frame size negotiation and add the GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE environment variable (default 4KiB, max 512KiB) to configure the maximum ALTS record frame size. (#9268)

Release 1.83.2

... (truncated)

Commits

e84aa5a Change version to 1.84.0 (#9324)
c5ae88d Cherrypick #9204 and #9321 to v1.84.x (#9407)
a592f6a Cherrypick #9351 and #9404 to v1.84.x (#9408)
d5a4111 cherry-pick #9365 to v1.84.x (#9370)
89d55e0 cherry-pick #9346 to v1.84.x (#9372)
8a9f866 Cherry-pick #9332 to v1.84.x (#9338)
f8b54e7 Cherry-pick #9331 to v1.84.x (#9334)
30ce1d5 xds: support injecting bootstrap and server config into HTTP filter config pa...
54c743e extproc : wait for async RPC to complete in test (#9311)
538bb2f endpointsharding: decouple locking, and simplify ChildState API (#9290)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-deps group in /backend/services/submission with 3 updates: [github.com/jackc/pgx/v5](https://github.com/jackc/pgx), [github.com/stretchr/testify](https://github.com/stretchr/testify) and [google.golang.org/grpc](https://github.com/grpc/grpc-go). Updates `github.com/jackc/pgx/v5` from 5.10.0 to 5.11.0 - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.10.0...v5.11.0) Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.1) Updates `google.golang.org/grpc` from 1.83.0 to 1.84.0 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.83.0...v1.84.0) --- updated-dependencies: - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: github.com/stretchr/testify dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: google.golang.org/grpc dependency-version: 1.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-10-07T19:10:55Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 23779208-dde8-40fa-b560-907ac583126f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 7, 2026

dependabot Bot requested a review from Shreesh-Sree as a code owner October 7, 2026 19:10

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 7, 2026

Shreesh-Sree merged commit b5d6b91 into development Oct 8, 2026
20 of 21 checks passed

Shreesh-Sree deleted the dependabot/go_modules/backend/services/submission/development/go-deps-17227b2623 branch October 8, 2026 09:19

Navigation Menu

Repository navigation

chore(deps): bump the go-deps group in /backend/services/submission with 3 updates - #4

chore(deps): bump the go-deps group in /backend/services/submission with 3 updates#4
Shreesh-Sree merged 1 commit into
developmentfrom
dependabot/go_modules/backend/services/submission/development/go-deps-17227b2623

dependabot Bot commented on behalf of github Oct 7, 2026

Uh oh!

coderabbitai Bot commented Oct 7, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 7, 2026

v5.11.0

Features

Changes

5.11.0 (September 7, 2026)

Features

Changes

v1.12.1

What's Changed

New Contributors

What's Changed

New Contributors

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

Release 1.84.0

Behavior Changes

New Features

Bug Fixes

Performance Improvements

Release 1.83.2

Uh oh!

coderabbitai Bot commented Oct 7, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant