Skip to content

deps: bump the all-go-dependencies group across 1 directory with 17 updates - #116

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/all-go-dependencies-1cf1ff10c7
Open

deps: bump the all-go-dependencies group across 1 directory with 17 updates#116
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/all-go-dependencies-1cf1ff10c7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-go-dependencies group with 14 updates in the / directory:

Package From To
github.com/alecthomas/chroma/v2 2.14.0 2.27.0
github.com/asticode/go-astiav 0.41.0 0.42.0
github.com/carapace-sh/carapace 1.11.6 1.15.3
github.com/chainreactors/libcstx/go 0.3.2 0.4.1
github.com/charmbracelet/glamour 0.8.0 1.0.0
github.com/gookit/config/v2 2.2.8 2.2.9
github.com/mattn/go-runewidth 0.0.23 0.0.28
github.com/projectdiscovery/goflags 0.1.75 0.1.76
github.com/projectdiscovery/gologger 1.1.71 1.1.72
github.com/projectdiscovery/utils 0.11.1 0.11.2
golang.org/x/image 0.42.0 0.45.0
google.golang.org/protobuf 1.36.11 1.36.12
modernc.org/sqlite 1.45.0 1.57.0
github.com/stretchr/testify 1.11.1 1.12.1

Updates github.com/alecthomas/chroma/v2 from 2.14.0 to 2.27.0

Release notes

Sourced from github.com/alecthomas/chroma/v2's releases.

v2.27.0

Changelog

  • a6d00fe fix(html): make mode class output opt-in via WithModeClasses
  • f52d015 chore: some house-keeping
  • f08a9ab chore: add fmt + test to BUILD.bit
  • 6da8f88 fix(yaml): comments can be key-values (#1289)
  • 67785a4 chore(deps): update all non-major dependencies (#1285)
  • d9dd73f Add templ XML lexer (#1283)
  • effffdb chore(deps): update all non-major dependencies (#1280)
  • 03236a4 support for PostScript font files (#1282)
  • e10d532 Fix YAML slash comments with colons (#1278)

v2.26.1

Changelog

  • 56c7702 fix: downgrade go.mod version to 1.25

v2.26.0

Changelog

  • a4d3f60 feat(chromad): use style counterparts for theme switching
  • ce159e6 chore: migrate to new bit format
  • 180ea9f perf(colour): replace Sprintf/ParseUint round-trip in NewColour with direct bit arithmetic (#1274)
  • 68a08b0 docs: how to support dynamic theme switching
  • 6fb9d92 feat(html): tag output with style mode
  • a71fea3 feat(styles): add light/dark mode support

v2.25.0

Changelog

  • c3826f0 chore: go mod tidy
  • fb5bc39 fix: emit HTTP body tokens without Coalesce
  • a3c2946 Improve Nu file detection (#1260)
  • e841b1a chore(deps): update all non-major dependencies (#1272)
  • 3ed2db8 Add Gemfile.lock lexer (& ruby improvements) (#1269)
  • 41fb546 Add YAML+Jinja lexer (#1268)
  • e99b881 chore(deps): update all non-major dependencies (#1263)
  • e67dd2f (Markless) Fix parse issue for embed directives without options (#1266)
  • dffa370 fix(go): tokenize trailing // as comment instead of consuming next line (#1265)
  • 1cf1560 chore: upgrade to github.com/dlclark/regexp2/v2
  • 2cbcf7b chore: upgrade golangci-lint
  • 786675b chore(deps): update all non-major dependencies (#1257)
  • 235590c feat: add JSONL support to JSON lexer (#1262)
  • f9b5c97 fix(dart): match single-line comments without trailing newline (#1225) (#1261)
  • 097f8e9 Mention Arturo in README (#1256)
  • d46ce60 feat(markdown): highlight frontmatter and comments (#1245)
  • f786b2a feat(lexers): add support for LilyPond (#1255)
  • 0a02b98 chore(deps): update actions/checkout digest to de0fac2 (#1212)
  • c55009e Fix AGENTS.md referencing a non-existent scripts directory (#1231)
  • c5e763e Improve protobuf lexer (#1253)
  • 113cd0e Add Arturo lexer (#1232)
  • 4498d71 chore(deps): update dependency binaryen to v129 (#1238)
  • 885f912 Added f4 to "Projects using Chroma" list (#1242)

... (truncated)

Commits

Updates github.com/asticode/go-astiav from 0.41.0 to 0.42.0

Commits

Updates github.com/carapace-sh/carapace from 1.11.6 to 1.15.3

Release notes

Sourced from github.com/carapace-sh/carapace's releases.

v1.15.3

Changelog

  • 87a3fe27a8654bc34645a283102f4151babf048b Merge pull request #1287 from carapace-sh/fix/env-var-leak
  • 5aee3681af3e1074e6f093163533b3b0761229da fix: remove CARAPACE_SHELL env var from all shell snippets
  • 0bcaa3d2532099d12e7371b57b316fee8e510db5 Merge pull request #1286 from carapace-sh/darwin-sysctl
  • ba948c065ba1b5a98481db0dd3e771f572a90a59 fix: use PID-specific sysctl on macOS to avoid full process table scan

v1.15.2

No release notes provided.

v1.15.1

Changelog

  • 99e94b56840f201083d0e51ea36507ab86c19e2e Merge pull request #1279 from carapace-sh/fix/darwin-process-table-scan
  • 23944b8eee9bac3f97678155b7d170f7a92a3661 fix: avoid macOS process table scan when shell is already known
  • 04feb78c0ff06e0e0cade88c3d3614a5b7de5f84 Merge pull request #1277 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.6
  • 1576016685ce950ae93e322ea883b518db5670b5 build(deps): bump github/codeql-action from 4.37.5 to 4.37.6
  • 26aeef2e6ab007b245de9946721746e4d7c4475f Merge pull request #1276 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.5
  • 83edaf3613f995e77d397b01ee9166ccc7d3ace2 build(deps): bump github/codeql-action from 4.37.4 to 4.37.5

v1.15.0

Changelog

  • 58a55f0eaa56e9387fc7d6800cd1b9531431d1d0 Merge pull request #1275 from carapace-sh/docs/carapace-dev-pflag-delimiter-disabled
  • ffac8c585278cba42275c020fb3beebd20160ae0 Document delimiter-disabled optarg attached values in carapace-dev skill
  • 14967526cc021932be66a31c160dd16392f21362 feat/optarg delimiter attached (#1272)
  • 30d1cbf48523182d5c42de3be440eb19d472cce0 Merge pull request #1273 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.4
  • e72227b11eb47ccbba75c32169c5a5c277a930c3 build(deps): bump github/codeql-action from 4.37.3 to 4.37.4
  • b3f65d47fcca704a9b5ad674c29105523b19c700 Merge pull request #1271 from carapace-sh/keywords-enabled-disabled
  • 3f975d5abfe895c322572f76f473155527ce3467 style: added en-/disabled keywords
  • 8f8d4637c5d66c8b5257579c3f19fd90512eb010 Merge pull request #1270 from carapace-sh/dependabot/github_actions/github/codeql-action-4.37.3
  • d773945ce83fc44992d3a504b3a9d6b7a562b507 build(deps): bump github/codeql-action from 4 to 4.37.3
  • 066da3950bd4c3214d9ba44e2c132a0a66019171 Merge pull request #1269 from carapace-sh/update-carapace-dev-skill
  • b5fde5bf4847fabf59aacf3adecdb239790e7fbf Update carapace-dev skill for flag prefix and ArgumentStyle changes

v1.14.0

Changelog

  • 993ea5f7f783e35463569aa241d9a1258daa93e5 Merge pull request #1268 from carapace-sh/flagprefix
  • e7bffd59dc0d665116299d853a854bac9a5d5538 Support custom flag prefix from carapace-pflag (e.g. '&' for elvish)
  • 748aa9f9c8566421d9aad2181fea6ebdff722192 argumentstyle (#1227)

v1.13.3

Changelog

  • a24bc6a368d89fbb5c028554bf457c10dda5edee Merge pull request #1267 from carapace-sh/rsteube-patch-1
  • f3df1f9138f824288a8d740d20efef21b029074c Update README.md
  • b0a542d64a0ad755e716b9052e77eed24feeece2 Merge pull request #1266 from carapace-sh/fix/symlink-repo-discovery
  • 23bdecbd965d936b45868d4f81948ae33b606e27 Resolve symlinks before upward directory traversal in repo discovery
  • 344f1881bf249e6a2f3f02ac881e8bb490ff6255 Merge pull request #1265 from carapace-sh/dependabot/github_actions/actions/setup-go-7
  • 192121c1c974a006f2b8c9626bba734711113237 bump actions/setup-go from 6 to 7
  • 458a0c1bb496650e7d2bd2badecf07390c16fd39 Merge pull request #1264 from carapace-sh/sandbox-expect-strict
  • eeaa2bb8d58d6eadb114bd5ddbe5ed3cad6d0dda Add ExpectStrict to sandbox for full action comparison including Uids
  • b20a6d9a96b7325767952cfba54fe9362008ade2 Merge pull request #1262 from carapace-sh/zsh-skill/capture-completion-reference

... (truncated)

Commits
  • 87a3fe2 Merge pull request #1287 from carapace-sh/fix/env-var-leak
  • 5aee368 fix: remove CARAPACE_SHELL env var from all shell snippets
  • 0bcaa3d Merge pull request #1286 from carapace-sh/darwin-sysctl
  • ab42edd Merge pull request #1285 from carapace-sh/fix/execlog-command-context
  • ba948c0 fix: use PID-specific sysctl on macOS to avoid full process table scan
  • eebd795 Add execlog.CommandContext to support context-based subprocess cancellation
  • f542ce6 Merge pull request #1283 from carapace-sh/dependabot/github_actions/github/co...
  • 03d129b build(deps): bump github/codeql-action from 4.37.7 to 4.37.8
  • b79ad38 Merge pull request #1282 from carapace-sh/add-keywords
  • 3252146 style: add missing keyword entries for common semantic values
  • Additional commits viewable in compare view

Updates github.com/chainreactors/libcstx/go from 0.3.2 to 0.4.1

Release notes

Sourced from github.com/chainreactors/libcstx/go's releases.

libcstx v0.4.1 syncs the cstx v0.4.1 SDK, generated bindings, prebuilt FFI libraries, and WASM bundle.

  • Updates the Go SDK and native FFI interfaces for cstx v0.4.1.
  • Includes refreshed repository/history and graph APIs.
  • Ships updated Python type stubs and WASM artifacts.
  • Passes the Go regression test suite on the release commit.

Go consumers should use module version github.com/chainreactors/libcstx/go v0.4.1 (tag go/v0.4.1).

Commits
  • 776e8d1 Merge pull request #10 from chainreactors/chore/update-ffi-v0.4.1
  • 2667399 chore: update libcstx to v0.4.1
  • e977199 Merge pull request #9 from chainreactors/chore/update-ffi-v0.4.0
  • 40f88cc chore: update libcstx to v0.4.0
  • de7cbf5 Merge pull request #8 from chainreactors/refactor/go-repository-cas-api
  • 19eccad feat(go): expose native CAS graph index
  • a4eabbe feat(go): expose repository CAS and graph difference APIs
  • See full diff in compare view

Updates github.com/charmbracelet/glamour from 0.8.0 to 1.0.0

Release notes

Sourced from github.com/charmbracelet/glamour's releases.

v0.10.0

Actually readable tables

Big tables that included links were always hard to read. Links can be very long, and tables often have limited space to render them. This means that links often took the space of many lines and weren't properly clickable because they were being truncated in practice.

Starting on this release, Glamour will render links and images at the footer of the table, with a reference number so you can easily find the link you're looking for. If you want the old behavior, it is still supported via the new WithInlineTableLinks option.

The New Way

table_with_footer_links_and_images

The Old Way

Wanna render tables with inline links? You still can:

r, err := glamour.NewTermRenderer(glamour.WithInlineTableLinks(true))
if err != nil { /*...*/ }
out, err := r.RenderBytes(in)
if err != nil { /.../ }
fmt.Fprintf(os.Stdout, "%s\n", out)

table_with_inline_links_and_images

Prettier GitHub links

We also introduced a change so that GitHub links inside tables that reference issues, discussions or PRs will be shown in its shortened form, similar to how GitHub itself present the links on issue descriptions: owner/repo#123.

table_with_footer_auto_links_short

Extra

Also, we introduced WithTableWrap, so you can disable table text wrapping if really want:

r, err := glamour.NewTermRenderer(glamour.WithTableWrap(false))
if err != nil { ... }
out, err := r.RenderBytes(in)
if err != nil { ... }
fmt.Fprintf(os.Stdout, "%s\n", out)

Changelog

New Features

... (truncated)

Commits
  • 69661fd chore(deps): bump actions/checkout from 5 to 6 in the all group (#491)
  • 0af1a2d chore(deps): bump the all group with 2 updates (#482)
  • a9ec019 chore(deps): bump github.com/charmbracelet/x/ansi in the all group (#477)
  • 7a4cf0c ci: sync dependabot config (#476)
  • 49c8248 chore(deps): bump the all group with 2 updates (#472)
  • c1ce505 chore(deps): bump actions/setup-go from 5 to 6 in the all group (#471)
  • f9c650c ci: sync dependabot config (#470)
  • e3c481b chore(deps): bump actions/checkout from 4 to 5 (#469)
  • 7209389 chore(deps): bump golang.org/x/term from 0.33.0 to 0.34.0 (#468)
  • f447e14 chore(deps): bump github.com/charmbracelet/x/ansi from 0.9.3 to 0.10.1 (#467)
  • Additional commits viewable in compare view

Updates github.com/gookit/config/v2 from 2.2.8 to 2.2.9

Release notes

Sourced from github.com/gookit/config/v2's releases.

v2.2.9

Change Log

Fixed

Other

Commits
  • 0edfefc ci: update ci testing go version
  • 78c5e7e docs(watch): debounce reload example
  • 6a3fe04 fix(reload): reset data before reloading files
  • 94aa2e8 fix(read): Duration() parses Go duration strings (e.g. "300s", "1h30m") (#218)
  • 99340a5 build(deps): bump github.com/gookit/goutil from 0.7.6 to 0.8.0 (#217)
  • e4ef650 build(deps): bump actions/checkout from 6 to 7 (#216)
  • c345d01 build(deps): bump WillAbides/setup-go-faster from 1.15.0 to 1.19.0 (#214)
  • fc79c1b build(deps): bump github.com/gookit/goutil from 0.7.5 to 0.7.6 (#215)
  • See full diff in compare view

Updates github.com/mattn/go-runewidth from 0.0.23 to 0.0.28

Commits
  • 554428c Merge pull request #105 from mattn/lazy-width-lut
  • 27d1448 Avoid regexp and map construction at package load
  • 69a63c6 Build the strict width LUT lazily to fix startup regression
  • f2d8bfe Merge pull request #103 from mattn/restore-zerowidthjoiner
  • 2cd35a6 Restore ZeroWidthJoiner as a deprecated no-op
  • b2badb7 Avoid ambiguous-width prefix in TruncatePrefix test
  • a1307e2 Add TruncatePrefix tests for multi-rune grapheme clusters
  • 9beccfd Merge pull request #79 from umlx5h/add_truncate_prefix
  • 0b200cc Merge pull request #97 from mattn/perf/precomputed-width-lut
  • fc57c61 Merge pull request #93 from apocelipes/feat-optimize-fill
  • Additional commits viewable in compare view

Updates github.com/projectdiscovery/goflags from 0.1.75 to 0.1.76

Release notes

Sourced from github.com/projectdiscovery/goflags's releases.

Release v0.1.76

0.1.76 (2026-08-11)

Bug Fixes

Commits

Updates github.com/projectdiscovery/gologger from 1.1.71 to 1.1.72

Release notes

Sourced from github.com/projectdiscovery/gologger's releases.

Release v1.1.72

1.1.72 (2026-08-09)

Commits
  • f047aad Merge pull request #153 from projectdiscovery/dependabot/github_actions/main/...
  • e792122 Merge pull request #152 from projectdiscovery/dependabot/github_actions/main/...
  • 4d36837 Merge pull request #151 from projectdiscovery/dependabot/github_actions/main/...
  • 520bbbc chore(deps): bump actions/setup-go from 6 to 7
  • 7fd8ed1 chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0
  • b51f41b chore(deps): bump actions/checkout from 6 to 7
  • See full diff in compare view

Updates github.com/projectdiscovery/utils from 0.11.1 to 0.11.2

Release notes

Sourced from github.com/projectdiscovery/utils's releases.

v0.11.2

Automatically released using projectdiscovery/actions/svu-next action.


What's Changed

New Contributors

Full Changelog: projectdiscovery/utils@v0.11.1...v0.11.2

Commits
  • bae51aa fix(process): register interrupt handler before raising in windows test (#768)
  • 4d18312 Merge pull request #769 from projectdiscovery/dependabot/go_modules/main/modu...
  • 62ebc0b chore(deps): bump the modules group with 2 updates
  • 749f184 Merge pull request #758 from projectdiscovery/dependabot/go_modules/golang.or...
  • 1d7251b Merge pull request #762 from projectdiscovery/dependabot/go_modules/main/modu...
  • 9b1ce1f chore(deps): bump the modules group across 1 directory with 5 updates
  • 6242b4b Merge pull request #764 from projectdiscovery/add-chrome-shell
  • 2a52b18 bump linter
  • 91e10ed harden unzip
  • eb89254 add chromeshell
  • Additional commits viewable in compare view

Updates golang.org/x/image from 0.42.0 to 0.45.0

Commits
  • 3ebddc7 go.mod: update golang.org/x dependencies
  • 981eaa0 vp8l: avoid allocating many unused Huffman tree groups
  • 315273a vector: using golang.org/x/sys/cpu for feature detection
  • 891abcb go.mod: update golang.org/x dependencies
  • f50490d font: document (lack of) security hardening in font packages
  • 7a0cfda webp: check for VP8L dimension mismatch before allocation
  • 4339315 tiff: consistently skip horizontal padding in tiled images
  • b5baf41 tiff: avoid overflow when reading IFD entries
  • e7513b5 tiff: limit the amount of data read in IFD entries
  • cb9f1a6 tiff: limit uncompressed data reads
  • Additional commits viewable in compare view

Updates golang.org/x/sys from 0.46.0 to 0.47.0

Commits
  • 9e7e939 cpu: handle vendor suffixes in parseRelease
  • f6fb8a1 unix: use epoll_pwait rather than epoll_wait
  • f3eeabf windows: avoid length overflow in NewNTString
  • 3cb6647 unix: update glibc to 2.43
  • c507910 windows: document safe usage of TrusteeValue
  • See full diff in compare view

Updates golang.org/x/term from 0.44.0 to 0.45.0

Commits

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

Updates modernc.org/sqlite from 1.45.0 to 1.57.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

  • 2026-08-19 v1.57.0:

    • Add an opt-in _defensive DSN query parameter that turns on SQLite's defensive mode for the connection, disabling the SQL-level features that let ordinary statements deliberately corrupt the database file. When _defensive=1 (or any strconv.ParseBool true value) is supplied, the driver calls sqlite3_db_config with SQLITE_DBCONFIG_DEFENSIVE immediately after sqlite3_open_v2 and before every other parameter is applied, so the PRAGMAs the driver itself runs, the _pragma list, and every statement the caller prepares are all subject to it. On such a connection PRAGMA writable_schema=ON, PRAGMA journal_mode=OFF and PRAGMA schema_version=N become silent no-ops, and writes to a virtual table's shadow tables (fts5's _data, _idx and so on) and to sqlite_dbpage fail with "table ... may not be modified"; reading those tables, ordinary use of the virtual tables that own them, and VACUUM are unaffected. The flag has no PRAGMA equivalent, so sqlite3_db_config — and therefore a DSN parameter — is the only way to reach it short of dropping to modernc.org/sqlite/lib. The value is parsed before sqlite3_open_v2, so an invalid one fails the connection without creating the database file, and the parameter must appear at most once: a repeated _defensive is an error rather than letting the first value silently win. Absence of the parameter, or _defensive=0, leaves SQLite's default behavior unchanged; existing DSNs continue to work byte-for-byte. Two limits are worth stating plainly, since the name invites more confidence than the flag earns. Defensive mode is a hardening measure, not a sandbox for hostile database files: it is one of several steps SQLite recommends for that purpose, and this build compiles with neither SQLITE_TRUSTED_SCHEMA=0 nor SQLITE_DQS=0 and exposes no authorizer. And it is a property of the connection, not of the database file — a second handle opened on the same file without the parameter is unrestricted.
    • Reject the one DSN combination defensive mode would otherwise swallow in silence. _defensive=1 together with _journal_mode=OFF (or _journal=OFF) now fails the connection instead of opening one in which neither parameter was honoured: SQLite turns PRAGMA journal_mode=OFF into a no-op that still reports success, so the driver would have accepted the mode, executed it, and left the journal untouched without telling anyone. The check runs in the validation phase introduced in v1.55.0, before any statement executes, so a rejected DSN cannot leave the database half-configured. _pragma remains the exception it has always been: _pragma=journal_mode(OFF) alongside _defensive=1 still runs and is still silently ignored by SQLite. Only DSNs using _defensive can be affected, and that parameter is new, so no DSN that opened before changes behavior.
    • See [GitHub pull request #6](modernc-org/sqlite#6), thanks wsman!
    • Ship the sqlite-vec license notice this module has been missing. modernc.org/sqlite/vec has bundled the transpiled sqlite-vec sources since v1.47.0, but the module carried only its own BSD-3-Clause LICENSE and the public-domain SQLite notice. sqlite-vec is Copyright (c) 2024 Alex Garcia, dual-licensed Apache-2.0 OR MIT and used here under MIT, whose terms require the copyright and permission notice to accompany substantial portions of the software — which 2.8 MB of transpiled vec/ plainly is. The notice now ships as LICENSE-SQLITE_VEC in the module root, byte-identical to the LICENSE-MIT in the upstream v0.1.9 archive and named after the file modernc.org/libsqlite_vec extracts it into. Attribution was never absent — vec's package documentation has named the extension, pinned the version and linked upstream — but the license text itself was, and the omission was ours: vendor_libs/main.go copied the per-target transpiles and nothing else. It now copies the notice alongside them and fails the vendoring run if it cannot, so a make vendor can no longer quietly drop it. The vec package documentation gained a License section recording that the package is under a different license from the rest of this module.
    • The SQLite notice is renamed from SQLITE-LICENSE to LICENSE-SQLITE; update any direct links to it. Its contents are unchanged and SQLite remains public domain. The name now matches both the new LICENSE-SQLITE_VEC beside it and the LICENSE-<upstream> convention every other modernc.org repository follows, but it is more than cosmetic: go mod vendor selects the files it copies into a downstream vendor/ tree by matching each name against a fixed list of prefixes — LICENSE among them — so a name merely ending in LICENSE was never propagated. Both bundled notices now travel with the code into vendored builds, which is where the MIT terms on vec/ keep applying. No code changes; no behavior changes.
    • Let a caller-constructed Driver register its own functions, collations and virtual table modules. Driver has always held four categories of registration state, but only RegisterConnectionHook could put anything on a constructed one: functions and collations were reachable through the package-level API alone, and modules through the package-level driver only, which left the modules field written and read through that instance and so process-global state wearing a per-instance field. Driver now has RegisterFunction, RegisterScalarFunction, RegisterDeterministicScalarFunction, RegisterCollationUtf8 and RegisterModule, plus Must* variants of the first four, each registering on that Driver alone; the methods are safe to call concurrently, and the zero Driver is ready to use as-is. vtab.RegisterModule also honours its db argument now: a non-nil db registers on the driver backing it when that driver implements the new vtab.ModuleRegisterer, while a nil db keeps targeting the driver this package registers as sqlite. One existing pattern changes behavior, narrowly and loudly: vtab.RegisterModule(db, ...) where db was opened on a caller-constructed Driver used to discard the db argument and land on the sqlite driver, reaching every connection in the process; it now lands on the constructed driver alone, so a sql.Open("sqlite") connection that used to resolve such a module gets no such module instead. The same pattern is also the one way an existing program could hold one module name on both a constructed Driver and the package-level one: there the first of the two registrations used to win and the second was refused as already registered, whereas now the package-level implementation wins on the constructed Driver's connections regardless of the order they ran in. Reaching that case at all means the program ignored an error the older version returned. Two smaller deviations round out the list: Driver.RegisterModule reports no error for such a collision, and vtab.RegisterModule now validates its name and module arguments before the not-implemented check, so a call with an empty name that returned vtab: RegisterModule not wired into engine outside this driver returns vtab: module name must be non-empty instead. Everything else is additive against v1.56.0: the package-level registration functions target the same driver they always did, connections still receive every module registered through the package-level path whichever Driver opened them, and a db opened on the sqlite driver resolves to that same driver. The isolating change discussed in [GitLab issue #254](https://gitlab.com/cznic/sqlite/-/issues/254) is deliberately not made here.
    • See [GitLab merge request #135](https://gitlab.com/cznic/sqlite/-/merge_requests/135), thanks Ian Chechin!
    • Promote freebsd/386, freebsd/arm and netbsd/amd64 to fully supported platforms. All three are now listed in the package documentation's platform table, which had carried seventeen entries while this module shipped, cross-built and tested twenty. They arrived as experimental in v1.53.0 — netbsd/amd64 reviving a port that had been broken for years, freebsd/386 replacing a stale, effectively untested SQLite 3.41 transpile, and freebsd/arm entirely new — and were deliberately kept out of that table until they had accumulated real-world exposure, with promotion promised once "a period of broader real-world testing … elapses without surprises". That period has elapsed: all three have been in the builder test matrix and in make build_all_targets since v1.53.0, all three pass the full test suite on this release's commit alongside the seventeen platforms already listed, and no open issue reports a defect in any of them. The two netbsd/amd64 build failures filed before the revival, [GitLab issue #202](https://gitlab.com/cznic/sqlite/-/issues/202) and [GitLab issue #234](https://gitlab.com/cznic/sqlite/-/issues/234), no longer reproduce at this commit: Xsqlite3_is_interrupted is present in the sources that target selects, and the mu.enter/mu.leave symbols that broke the build are gone. Documentation only — the transpiled sources under lib/ are byte-for-byte what v1.56.0 shipped, and nothing about how these targets behave changes.
  • 2026-08-03 v1.56.0:

    • Re-vendor the transpiled SQLite sources, picking up modernc.org/libsqlite3's fix for an upstream data-corruption bug in SQLite 3.53.3's journal rollback. The SQLite version is unchanged at 3.53.3; what changes is that the amalgamation is now patched before it is transpiled. 3.53.3 reworked readSuperJournal() to return the super-journal name through a char** out-parameter, and pager_playback() now tests that pointer where it used to test zSuper[0]. A crash during the commit of a multi-database (ATTACH) transaction can leave the super-journal name and its checksum zeroed while the name length and the trailing magic survive; the checksum is a plain byte sum, so an all-zero name still validates and readSuperJournal() hands back a non-NULL pointer to an empty string. pager_playback() then calls sqlite3OsAccess(pVfs, "", SQLITE_ACCESS_EXISTS), gets ENOENT, and deletes the hot journal without playing it back — leaving the database corrupted. This is not a transpilation artifact: a plain gcc build of the stock 3.53.3 amalgamation fails on the same bytes while 3.53.2 recovers them, and it is what has been making upstream's own test/crash.test fail intermittently, in roughly 2% of runs, on every platform. The patch restores the pre-3.53.3 behaviour of reporting a (nul) super-journal name and will be dropped once upstream ships its own fix. Every supported target carries it.
    • Two targets change beyond that patch. On linux/s390x the regenerated transpile allocates C bit-fields MSB-first, as the big-endian platform ABI requires, rather than LSB-first; this comes from modernc.org/cc/v4 v4.29.1 and touches bit-field accesses throughout the SQLite core, s390x being this module's only big-endian target. On linux/riscv64 the transpile was regenerated on a host running GCC 11.4.0 where the previous one used GCC 13.3.0, which drops a handful of unexported compiler-predefined macro constants (the __FLT16_* family, __DBL_IS_IEC_60559__ and friends) and changes the COMPILER=gcc-13.3.0 entry PRAGMA compile_options reports to COMPILER=gcc-11.4.0; no SQLite code generation differs. Every other target's generated code is byte-identical to v1.55.0 apart from the journal-rollback patch above.
    • Bump the pinned modernc.org/libc to v1.74.4, and the remaining dependencies to their current releases. v1.74.2 and v1.74.3 are retracted upstream — a freeaddrinfo lock leak that deadlocks name resolution — and v1.74.4 is the fix. As always, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins (see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177)).
    • Documentation sweep. openbsd/amd64 and openbsd/arm64 join the supported platforms table in the package documentation: both have been in the builder test matrix since January and are cross-built by make build_all_targets, but had never been listed. The vfs DSN query parameter — which names a VFS registered with SQLite, such as one returned by vfs.New — is now documented alongside the other DSN parameters on Driver.Open. The "Debug and development versions" section no longer describes a GO_GENERATE environment variable and a go generate that this repository has not had since generator.go moved to modernc.org/libsqlite3; it now points at that repository and make vendor instead, and the stale //go:generate directive naming the removed file is dropped with it. modernc.org/sqlite/vec and modernc.org/sqlite/vfs gained the package doc comments they were missing, so both finally carry a synopsis on pkg.go.dev. Documentation only; no behavior changes.
    • Add NewConnector, returning a database/sql/driver.Connector for use with sql.OpenDB. It opens the same connections sql.Open("sqlite", dsn) does, from the same registered driver, so every function, collation, connection hook and virtual table module registered through this package applies to them. It exists for callers that need to interpose on the physical connections database/sql opens — tracing, metrics, connection-scoped setup — which sql.Open gives no access to: such a caller can embed the returned Connector, override Connect, and pass its own wrapper to sql.OpenDB. Previously the only way to reach the registered driver was the db, _ := sql.Open("sqlite", ""); drv := db.Driver(); db.Close() idiom, which works only because sql.Open does not connect and this driver does not implement driver.DriverContext; and the only way to get a wrapper into a *sql.DB was sql.Register, which is process-global, panics on a name it has already seen, and cannot be undone, so a library had to invent a unique driver name per configuration. sql.OpenDB registers nothing. Constructing a &sqlite.Driver{} is not an alternative — its fields are unexported, so it carries none of the registrations. NewConnector checks the DSN only as far as it can without opening a database — a query string that does not parse, and conflicting vfs parameters; everything else continues to be validated when the connection is opened, so an unknown parameter or an out-of-range value is reported by Connect rather than at construction. Nothing about the existing sql.Open path changes: *Driver deliberately still does not implement driver.DriverContext, so sql.Open remains lazy and DSN errors continue to surface where they always have. A runnable sample is in examples/connector. Resolves [GitLab issue #253](https://gitlab.com/cznic/sqlite/-/issues/253), thanks Alessandro Segala (@​ItalyPaleAle)!
    • Document that a caller-constructed sqlite.Driver is not the driver this package registers as "sqlite". Its fields are unexported, so it starts with no functions, collations or connection hooks and the only way to give it any is its own RegisterConnectionHook method; the package-level Register* functions always apply to the registered driver. Connections such a Driver...

      Description has been truncated

…pdates

Bumps the all-go-dependencies group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma) | `2.14.0` | `2.27.0` |
| [github.com/asticode/go-astiav](https://github.com/asticode/go-astiav) | `0.41.0` | `0.42.0` |
| [github.com/carapace-sh/carapace](https://github.com/carapace-sh/carapace) | `1.11.6` | `1.15.3` |
| [github.com/chainreactors/libcstx/go](https://github.com/chainreactors/libcstx) | `0.3.2` | `0.4.1` |
| [github.com/charmbracelet/glamour](https://github.com/charmbracelet/glamour) | `0.8.0` | `1.0.0` |
| [github.com/gookit/config/v2](https://github.com/gookit/config) | `2.2.8` | `2.2.9` |
| [github.com/mattn/go-runewidth](https://github.com/mattn/go-runewidth) | `0.0.23` | `0.0.28` |
| [github.com/projectdiscovery/goflags](https://github.com/projectdiscovery/goflags) | `0.1.75` | `0.1.76` |
| [github.com/projectdiscovery/gologger](https://github.com/projectdiscovery/gologger) | `1.1.71` | `1.1.72` |
| [github.com/projectdiscovery/utils](https://github.com/projectdiscovery/utils) | `0.11.1` | `0.11.2` |
| [golang.org/x/image](https://github.com/golang/image) | `0.42.0` | `0.45.0` |
| google.golang.org/protobuf | `1.36.11` | `1.36.12` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.45.0` | `1.57.0` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.1` |



Updates `github.com/alecthomas/chroma/v2` from 2.14.0 to 2.27.0
- [Release notes](https://github.com/alecthomas/chroma/releases)
- [Commits](alecthomas/chroma@v2.14.0...v2.27.0)

Updates `github.com/asticode/go-astiav` from 0.41.0 to 0.42.0
- [Commits](asticode/go-astiav@v0.41.0...v0.42.0)

Updates `github.com/carapace-sh/carapace` from 1.11.6 to 1.15.3
- [Release notes](https://github.com/carapace-sh/carapace/releases)
- [Commits](carapace-sh/carapace@v1.11.6...v1.15.3)

Updates `github.com/chainreactors/libcstx/go` from 0.3.2 to 0.4.1
- [Release notes](https://github.com/chainreactors/libcstx/releases)
- [Commits](chainreactors/libcstx@v0.3.2...v0.4.1)

Updates `github.com/charmbracelet/glamour` from 0.8.0 to 1.0.0
- [Release notes](https://github.com/charmbracelet/glamour/releases)
- [Commits](charmbracelet/glamour@v0.8.0...v1.0.0)

Updates `github.com/gookit/config/v2` from 2.2.8 to 2.2.9
- [Release notes](https://github.com/gookit/config/releases)
- [Commits](gookit/config@v2.2.8...v2.2.9)

Updates `github.com/mattn/go-runewidth` from 0.0.23 to 0.0.28
- [Commits](mattn/go-runewidth@v0.0.23...v0.0.28)

Updates `github.com/projectdiscovery/goflags` from 0.1.75 to 0.1.76
- [Release notes](https://github.com/projectdiscovery/goflags/releases)
- [Commits](projectdiscovery/goflags@v0.1.75...v0.1.76)

Updates `github.com/projectdiscovery/gologger` from 1.1.71 to 1.1.72
- [Release notes](https://github.com/projectdiscovery/gologger/releases)
- [Commits](projectdiscovery/gologger@v1.1.71...v1.1.72)

Updates `github.com/projectdiscovery/utils` from 0.11.1 to 0.11.2
- [Release notes](https://github.com/projectdiscovery/utils/releases)
- [Changelog](https://github.com/projectdiscovery/utils/blob/main/CHANGELOG.md)
- [Commits](projectdiscovery/utils@v0.11.1...v0.11.2)

Updates `golang.org/x/image` from 0.42.0 to 0.45.0
- [Commits](golang/image@v0.42.0...v0.45.0)

Updates `golang.org/x/sys` from 0.46.0 to 0.47.0
- [Commits](golang/sys@v0.46.0...v0.47.0)

Updates `golang.org/x/term` from 0.44.0 to 0.45.0
- [Commits](golang/term@v0.44.0...v0.45.0)

Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12

Updates `modernc.org/sqlite` from 1.45.0 to 1.57.0
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.45.0...v1.57.0)

Updates `github.com/charmbracelet/lipgloss` from 1.1.0 to 1.1.1-0.20250404203927-76690c660834
- [Release notes](https://github.com/charmbracelet/lipgloss/releases)
- [Commits](https://github.com/charmbracelet/lipgloss/commits)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

---
updated-dependencies:
- dependency-name: github.com/alecthomas/chroma/v2
  dependency-version: 2.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: github.com/asticode/go-astiav
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: github.com/carapace-sh/carapace
  dependency-version: 1.15.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: github.com/chainreactors/libcstx/go
  dependency-version: 0.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: github.com/charmbracelet/glamour
  dependency-version: 1.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-go-dependencies
- dependency-name: github.com/gookit/config/v2
  dependency-version: 2.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-dependencies
- dependency-name: github.com/mattn/go-runewidth
  dependency-version: 0.0.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-dependencies
- dependency-name: github.com/projectdiscovery/goflags
  dependency-version: 0.1.76
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-dependencies
- dependency-name: github.com/projectdiscovery/gologger
  dependency-version: 1.1.72
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-dependencies
- dependency-name: github.com/projectdiscovery/utils
  dependency-version: 0.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-dependencies
- dependency-name: golang.org/x/image
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-dependencies
- dependency-name: modernc.org/sqlite
  dependency-version: 1.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
- dependency-name: github.com/charmbracelet/lipgloss
  dependency-version: 1.1.1-0.20250404203927-76690c660834
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-go-dependencies
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 30, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants