Skip to content

chore(deps): bump the go-minor-patch group across 1 directory with 15 updates - #223

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-25e7ecd5dd
Open

chore(deps): bump the go-minor-patch group across 1 directory with 15 updates#223
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-minor-patch-25e7ecd5dd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the go-minor-patch group with 15 updates in the / directory:

Package From To
github.com/aws/aws-sdk-go-v2 1.47.3 1.47.7
github.com/aws/aws-sdk-go-v2/config 1.33.9 1.33.15
github.com/aws/aws-sdk-go-v2/service/s3 1.114.3 1.114.8
github.com/convox/stdsdk 0.0.4 0.0.5
github.com/fxamacker/cbor/v2 2.9.6 2.10.0
github.com/gin-contrib/cors 1.7.9 1.7.10
github.com/gin-contrib/requestid 1.0.8 1.0.9
github.com/gin-contrib/secure 1.1.5 1.1.6
github.com/jackc/pgx/v5 5.11.0 5.12.0
github.com/riverqueue/river 0.49.0 0.51.1
github.com/riverqueue/river/riverdriver/riverpgxv5 0.49.0 0.51.1
github.com/riverqueue/river/rivertype 0.49.0 0.51.1
github.com/sigstore/sigstore-go 1.3.0 1.4.0
github.com/spf13/pflag 1.0.10 1.1.0
golang.org/x/sync 0.24.0 0.25.0

Updates github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.7

Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.15

Commits

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.3 to 1.114.8

Commits

Updates github.com/convox/stdsdk from 0.0.4 to 0.0.5

Commits
  • bfe0b79 Merge pull request #3 from convox/logs-stream-end-marker
  • e31411c Report and close finished websocket streams
  • See full diff in compare view

Updates github.com/fxamacker/cbor/v2 from 2.9.6 to 2.10.0

Release notes

Sourced from github.com/fxamacker/cbor/v2's releases.

v2.10.0

v2.10 speeds up encoding by up to 2.88× and decoding by up to 1.87× with zero memory regressions (B/op, allocs/op), reduces memory use, adds the toindefarray struct tag option, and fixes bugs. The Contributing Guidelines, Security Policy, and templates were extensively updated.

Encoding sorted nested maps of dynamic JSON-like data to CBOR drops from 70 allocs/op to 1 and from 7.2 KiB/op to 4.0 KiB/op in the benchmarks below. Encoding time.Time, big.Int, Tag and Marshaler values, and decoding into time.Time, big.Int and Tag, use 1 to 2 fewer allocs/op (20% to 50% fewer).

This release does not use Go's unsafe package. Performance in user apps depends on configuration and data.

Tests were refactored and coverage increased to 97.7%. Fuzz tests (not yet public) were also extended. Internal checklists and procedures were updated to reduce potential mistakes.

Performance and Benchmarks

Across all 215 benchmarks, there are zero memory regressions (B/op, allocs/op). Just one benchmark showed a speed dip: Marshal/struct_many_flds_all_omitempty_all_empty/map is ~4-5% slower, but only when a struct has 32 fields that are both omitzero and empty (same scenario with an 8-field struct is now faster).

Benchmarks ran with Go 1.26.10 on linux/amd64 (benchstat n=10, p=0.000):

  • CBOR Speedup by Data Type: groups of different benchmarks summarized per row
  • CBOR Encoding Reflection-Free Speedup: dynamic JSON-like data types and common types

CBOR Speedup by Data Type

Unmarshal Speedup ΔSec/op
Single values (bool, int, float, byte string, text string) 1.10× to 1.51×¹ -8.87% to -33.92%¹
Epoch time, bignum, other tags 1.18× to 1.64× -15.33% to -38.91%
Arrays and maps to non-struct 1.33× to 1.87× -24.63% to -46.49%
Arrays and maps to structs 1.06× to 1.52× -5.46% to -34.40%
Real-world (COSE, CWT, SenML, WebAuthn) 1.35× to 1.64× -26.06% to -39.19%

¹ 2.54× speedup (-60.64%) when decoding into a named []byte type that has methods.

Marshal Speedup ΔSec/op
Single values (bool, int, float, byte slice, string) 1.32× to 1.55× -24.49% to -35.41%
time.Time, big.Int, Tag, Marshaler² 1.15× to 1.63× -12.94% to -38.84%
Slices and maps 1.35× to 2.88× -25.97% to -65.26%
Structs 1.57× to 2.17× -36.37% to -53.96%
Structs with omitempty fields 0.95׳ to 1.35× +5.01%³ to -25.96%
Real-world (COSE, CWT, SenML, WebAuthn) 1.12× to 1.33× -10.66% to -24.77%

² For addressable values (reached through a pointer, struct field, slice element or map value).

³ Only when every field is omitempty and empty: 7.6 ns slower for a 32-field struct, 2.37 ns faster for an 8-field struct. This is the only performance regression in all 215 benchmarks.

CBOR Encoding Reflection-Free Speedup

PR #870 optimized common types: int, int64, uint, uint64, float64, bool, string, nil, []byte, []any, map[any]any, map[string]any, and map[string]string.

Marshal Benchmarkv2.9.6 → v2.10 Speedup TimeΔSec/op MemoryΔB/op MemoryΔAllocs/op
[]any 2.50× -607.5 ns (-60.03%) - -

... (truncated)

Commits
  • cc2e8fb Merge pull request #890 from fxamacker/fxamacker/update-docs-for-v2.10.0
  • c3279a6 Update doc.go and README.md for v2.10.0
  • 9106688 Merge pull request #891 from fxamacker/fxamacker/add-benchmarks
  • 864491f Add more benchmarks
  • 49a20b9 Merge pull request #889 from fxamacker/fxamacker/reduce-float64-unix-time-range
  • f5fbdcd Fix float range check when decoding Unix time
  • 67a9707 Merge pull request #886 from fxamacker/fxamacker/reduce-allocs
  • 6567310 Merge pull request #888 from fxamacker/fxamacker/cleanup-tests
  • 84ba3bf Fix several test bugs
  • 261eb13 Standardize test failure messages
  • Additional commits viewable in compare view

Updates github.com/gin-contrib/cors from 1.7.9 to 1.7.10

Release notes

Sourced from github.com/gin-contrib/cors's releases.

v1.7.10

Changelog

Build process updates

  • 8de01bff1e2b874463f38a90c93b061e9ed365df: ci(lint): adopt golangci-lint v2.14.0 tooling and strict lint config (#198) (@​appleboy)
  • 2dbb16335bf21e59e11a2b81626baa093d6f873c: build: upgrade Go and resolve security findings (#200) (@​appleboy)
Commits
  • 2dbb163 build: upgrade Go and resolve security findings (#200)
  • 8de01bf ci(lint): adopt golangci-lint v2.14.0 tooling and strict lint config (#198)
  • See full diff in compare view

Updates github.com/gin-contrib/requestid from 1.0.8 to 1.0.9

Release notes

Sourced from github.com/gin-contrib/requestid's releases.

v1.0.9

Changelog

Build process updates

  • 8a9bdb688aaa5b573a067b7827b92f48a10ed475: ci(lint): adopt golangci-lint v2.14.0 tooling and strict lint config (#80) (@​appleboy)
  • 94b8e592d01f498eb5954e4b7a067141b3aa42c3: build: upgrade Go and resolve security findings (#81) (@​appleboy)
Commits
  • 94b8e59 build: upgrade Go and resolve security findings (#81)
  • 8a9bdb6 ci(lint): adopt golangci-lint v2.14.0 tooling and strict lint config (#80)
  • See full diff in compare view

Updates github.com/gin-contrib/secure from 1.1.5 to 1.1.6

Release notes

Sourced from github.com/gin-contrib/secure's releases.

v1.1.6

Changelog

Build process updates

  • df23c07a1144a1a768a59b266b91b4a35289b246: ci(lint): adopt golangci-lint v2.14.0 tooling and strict lint config (#78) (@​appleboy)
  • 1ef3bee30b9229c97c9459635cba267eacf9824d: build: upgrade Go and resolve security findings (#79) (@​appleboy)
Commits
  • 1ef3bee build: upgrade Go and resolve security findings (#79)
  • df23c07 ci(lint): adopt golangci-lint v2.14.0 tooling and strict lint config (#78)
  • See full diff in compare view

Updates github.com/jackc/pgx/v5 from 5.11.0 to 5.12.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

  • SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@​igor-kupczynski).
  • Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @​president-xd.

Features

  • Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)
  • Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)
  • pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)
  • pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

  • pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.
  • pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

Commits
  • b2ef08b Update changelog for v5.12.0
  • 8199015 Merge commit from fork
  • 5b1a6a0 Merge commit from fork
  • 65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
  • f2701a0 pgconn: only fall back when Windows service file is missing
  • db95468 Merge pull request #2696 from k-zshiba/support-oid8
  • fa2327d Start each query on a new line when joining a simple protocol batch
  • 2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
  • efc0b74 Merge upstream master into support-oid8
  • 5a17450 pgconn: require AuthenticationOk before ReadyForQuery
  • Additional commits viewable in compare view

Updates github.com/riverqueue/river from 0.49.0 to 0.51.1

Release notes

Sourced from github.com/riverqueue/river's releases.

v0.51.1

Fixed

  • Fixed a client ignoring queue pause, resume, or metadata changes until it restarted when the queue control notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their queues' settings once a minute. [Issue #1579](riverqueue/river#1579).
  • Fixed the notifier never reconnecting when its connection went silent without an error, like after a dropped network path, because its health check ping had no timeout. The ping now times out after 10 seconds. [Issue #1579](riverqueue/river#1579).
  • Fixed maintenance services logging errors during normal shutdown or leadership loss, including PeriodicJobEnqueuer reporting Error starting transaction: context canceled when stopped during staggered startup. Genuine query timeouts and database failures are still logged, and periodic job transactions now roll back even after cancellation. [PR #1577](riverqueue/river#1577).

v0.51.0

Added

  • Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

  • Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).
  • Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).
  • Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).
  • Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

v0.50.0

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Changelog

Sourced from github.com/riverqueue/river's changelog.

[0.51.1] - 2026-11-05

Fixed

  • Fixed a client ignoring queue pause, resume, or metadata changes until it restarted when the queue control notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their queues' settings once a minute. [Issue #1579](riverqueue/river#1579).
  • Fixed the notifier never reconnecting when its connection went silent without an error, like after a dropped network path, because its health check ping had no timeout. The ping now times out after 10 seconds. [Issue #1579](riverqueue/river#1579).
  • Fixed maintenance services logging errors during normal shutdown or leadership loss, including PeriodicJobEnqueuer reporting Error starting transaction: context canceled when stopped during staggered startup. Genuine query timeouts and database failures are still logged, and periodic job transactions now roll back even after cancellation. [PR #1577](riverqueue/river#1577).

[0.51.0] - 2026-10-31

Added

  • Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

  • Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).
  • Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).
  • Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).
  • Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

[0.50.0] - 2026-10-26

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Commits
  • 6c72392 [go, js, rust] Prepare v0.51.1, v0.3.1, and v0.5.1
  • 9db53b9 [go, js, rust] Fix context canceled problem in start when stopping (#1577)
  • 43e6f22 Poll queue settings as a fallback when a notifier is configured (#1582)
  • 578a67f Credit JP for Ruby fixes (#1581)
  • a4de726 [rust] Align CLI with Go reference implementation (#1580)
  • 1e8fa0d [ruby] Prepare v0.16.0 (#1578)
  • f9517e7 [ruby] Helper argument to immediately set output with atomic metadata update ...
  • 2f6ac09 [ruby] Miscellaneous ActiveRecord/Sequel database optimizations (#1574)
  • a6faf39 [java] Add QUEUE_DEFAULT constant like other languages (#1557)
  • 5ebd708 🤖 [rust] Fix race in resumable cursor checkpoint test (#1565)
  • Additional commits viewable in compare view

Updates github.com/riverqueue/river/riverdriver/riverpgxv5 from 0.49.0 to 0.51.1

Release notes

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's releases.

v0.51.1

Fixed

  • Fixed a client ignoring queue pause, resume, or metadata changes until it restarted when the queue control notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their queues' settings once a minute. [Issue #1579](riverqueue/river#1579).
  • Fixed the notifier never reconnecting when its connection went silent without an error, like after a dropped network path, because its health check ping had no timeout. The ping now times out after 10 seconds. [Issue #1579](riverqueue/river#1579).
  • Fixed maintenance services logging errors during normal shutdown or leadership loss, including PeriodicJobEnqueuer reporting Error starting transaction: context canceled when stopped during staggered startup. Genuine query timeouts and database failures are still logged, and periodic job transactions now roll back even after cancellation. [PR #1577](riverqueue/river#1577).

v0.51.0

Added

  • Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

  • Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).
  • Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).
  • Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).
  • Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

v0.50.0

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Changelog

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's changelog.

[0.51.1] - 2026-11-05

Fixed

  • Fixed a client ignoring queue pause, resume, or metadata changes until it restarted when the queue control notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their queues' settings once a minute. [Issue #1579](riverqueue/river#1579).
  • Fixed the notifier never reconnecting when its connection went silent without an error, like after a dropped network path, because its health check ping had no timeout. The ping now times out after 10 seconds. [Issue #1579](riverqueue/river#1579).
  • Fixed maintenance services logging errors during normal shutdown or leadership loss, including PeriodicJobEnqueuer reporting Error starting transaction: context canceled when stopped during staggered startup. Genuine query timeouts and database failures are still logged, and periodic job transactions now roll back even after cancellation. [PR #1577](riverqueue/river#1577).

[0.51.0] - 2026-10-31

Added

  • Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

  • Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).
  • Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).
  • Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).
  • Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

[0.50.0] - 2026-10-26

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Commits
  • 6c72392 [go, js, rust] Prepare v0.51.1, v0.3.1, and v0.5.1
  • 9db53b9 [go, js, rust] Fix context canceled problem in start when stopping (#1577)
  • 43e6f22 Poll queue settings as a fallback when a notifier is configured (#1582)
  • 578a67f Credit JP for Ruby fixes (#1581)
  • a4de726 [rust] Align CLI with Go reference implementation (#1580)
  • 1e8fa0d [ruby] Prepare v0.16.0 (#1578)
  • f9517e7 [ruby] Helper argument to immediately set...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 11, 2026
@deepsource-io

deepsource-io Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown

DeepSource Code Review

We reviewed changes in 090e679...2c6d8a4 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade   Security  

Reliability  

Complexity  

Hygiene  

Code Review Summary

Analyzer Status Updated (UTC) Details
JavaScript Nov 13, 2026 10:21a.m. Review ↗
Go Nov 13, 2026 10:21a.m. Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

@dependabot
chore(deps): bump the go-minor-patch group across 1 directory with 15…
2c6d8a4 
… updates

Bumps the go-minor-patch group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.47.3` | `1.47.7` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.33.9` | `1.33.15` |
| [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.114.3` | `1.114.8` |
| [github.com/convox/stdsdk](https://github.com/convox/stdsdk) | `0.0.4` | `0.0.5` |
| [github.com/fxamacker/cbor/v2](https://github.com/fxamacker/cbor) | `2.9.6` | `2.10.0` |
| [github.com/gin-contrib/cors](https://github.com/gin-contrib/cors) | `1.7.9` | `1.7.10` |
| [github.com/gin-contrib/requestid](https://github.com/gin-contrib/requestid) | `1.0.8` | `1.0.9` |
| [github.com/gin-contrib/secure](https://github.com/gin-contrib/secure) | `1.1.5` | `1.1.6` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.11.0` | `5.12.0` |
| [github.com/riverqueue/river](https://github.com/riverqueue/river) | `0.49.0` | `0.51.1` |
| [github.com/riverqueue/river/riverdriver/riverpgxv5](https://github.com/riverqueue/river) | `0.49.0` | `0.51.1` |
| [github.com/riverqueue/river/rivertype](https://github.com/riverqueue/river) | `0.49.0` | `0.51.1` |
| [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) | `1.3.0` | `1.4.0` |
| [github.com/spf13/pflag](https://github.com/spf13/pflag) | `1.0.10` | `1.1.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.24.0` | `0.25.0` |



Updates `github.com/aws/aws-sdk-go-v2` from 1.47.3 to 1.47.7
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.47.3...v1.47.7)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.33.9 to 1.33.15
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.33.9...config/v1.33.15)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.114.3 to 1.114.8
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.114.3...service/s3/v1.114.8)

Updates `github.com/convox/stdsdk` from 0.0.4 to 0.0.5
- [Commits](convox/stdsdk@v0.0.4...v0.0.5)

Updates `github.com/fxamacker/cbor/v2` from 2.9.6 to 2.10.0
- [Release notes](https://github.com/fxamacker/cbor/releases)
- [Commits](fxamacker/cbor@v2.9.6...v2.10.0)

Updates `github.com/gin-contrib/cors` from 1.7.9 to 1.7.10
- [Release notes](https://github.com/gin-contrib/cors/releases)
- [Commits](gin-contrib/cors@v1.7.9...v1.7.10)

Updates `github.com/gin-contrib/requestid` from 1.0.8 to 1.0.9
- [Release notes](https://github.com/gin-contrib/requestid/releases)
- [Commits](gin-contrib/requestid@v1.0.8...v1.0.9)

Updates `github.com/gin-contrib/secure` from 1.1.5 to 1.1.6
- [Release notes](https://github.com/gin-contrib/secure/releases)
- [Commits](gin-contrib/secure@v1.1.5...v1.1.6)

Updates `github.com/jackc/pgx/v5` from 5.11.0 to 5.12.0
- [Release notes](https://github.com/jackc/pgx/releases)
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.11.0...v5.12.0)

Updates `github.com/riverqueue/river` from 0.49.0 to 0.51.1
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.49.0...v0.51.1)

Updates `github.com/riverqueue/river/riverdriver/riverpgxv5` from 0.49.0 to 0.51.1
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.49.0...v0.51.1)

Updates `github.com/riverqueue/river/rivertype` from 0.49.0 to 0.51.1
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.49.0...v0.51.1)

Updates `github.com/sigstore/sigstore-go` from 1.3.0 to 1.4.0
- [Release notes](https://github.com/sigstore/sigstore-go/releases)
- [Commits](sigstore/sigstore-go@v1.3.0...v1.4.0)

Updates `github.com/spf13/pflag` from 1.0.10 to 1.1.0
- [Release notes](https://github.com/spf13/pflag/releases)
- [Commits](spf13/pflag@v1.0.10...v1.1.0)

Updates `golang.org/x/sync` from 0.24.0 to 0.25.0
- [Commits](golang/sync@v0.24.0...v0.25.0)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.47.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-version: 1.114.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/convox/stdsdk
  dependency-version: 0.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/fxamacker/cbor/v2
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/gin-contrib/cors
  dependency-version: 1.7.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/gin-contrib/requestid
  dependency-version: 1.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/gin-contrib/secure
  dependency-version: 1.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-patch
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/riverqueue/river
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/riverqueue/river/riverdriver/riverpgxv5
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/riverqueue/river/rivertype
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/sigstore/sigstore-go
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: github.com/spf13/pflag
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
- dependency-name: golang.org/x/sync
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/go-minor-patch-25e7ecd5dd branch from 33b855d to 2c6d8a4 Compare November 13, 2026 10:20

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants