Bump the go group across 1 directory with 10 updates by dependabot[bot] · Pull Request #18 · Kroszborg/bridge

dependabot · 2026-11-04T05:45:17Z

Bumps the go group with 10 updates in the /apps/api directory:

Package	From	To
github.com/danielgtaylor/huma/v2	`2.39.1`	`2.40.0`
github.com/go-chi/chi/v5	`5.3.2`	`5.5.0`
github.com/jackc/pgx/v5	`5.11.0`	`5.12.0`
github.com/pressly/goose/v3	`3.28.0`	`3.29.0`
github.com/riverqueue/river	`0.48.0`	`0.51.0`
github.com/riverqueue/river/riverdriver/riverpgxv5	`0.48.0`	`0.51.0`
github.com/riverqueue/river/rivertype	`0.48.0`	`0.51.0`
golang.org/x/crypto	`0.57.0`	`0.58.0`
golang.org/x/sync	`0.23.0`	`0.24.0`
golang.org/x/term	`0.46.0`	`0.47.0`

Updates github.com/danielgtaylor/huma/v2 from 2.39.1 to 2.40.0

Release notes

Sourced from github.com/danielgtaylor/huma/v2's releases.

v2.40.0

Overview

This release adds native support for stdlib UUIDs, cuts compile times for large APIs, and brings a big batch of correctness fixes across request limits, defaults, validation, and the Fiber adapter. It also raises the minimum Go version to 1.26 and includes a few intentional breaking changes, so please read the upgrade notes below.

Upgrade Notes

Minimum Go version is now 1.26. Dependencies have been bumped too, picking up a few vulnerability fixes (#1149)

Raw bodies now have default limits. Non-multipart RawBody operations (e.g. []byte uploads) now get the same default 1 MiB MaxBodyBytes and 5s BodyReadTimeout as regular bodies. Endpoints accepting larger or slower raw uploads should set these explicitly (-1 for unlimited) (#1095)

Multipart now honors MaxBodyBytes. An explicitly set MaxBodyBytes is now enforced on multipart requests. Multipart remains exempt from the defaults, so existing uploads keep working unless you've set a limit (#1094)

Overflowing default tags panic at startup. For example, int8 with default:"128" previously wrapped silently to -128; it now fails at registration (#1142)

Out-of-range bound tags panic at startup. For example, int8 with maximum:"500". int8, int16, uint8 and uint16 fields also now advertise minimum/maximum from their Go type, so generated specs will change (#1143)

Security Fix

A malformed Accept header such as application/json;,b caused a panic during content negotiation. On net/http-based adapters this dropped the request; on Fiber, which doesn't recover handler panics unless the recover middleware is used, it crashed the server process. This affects v2.26.0 onwards, so upgrading is recommended. (#1128)

Native Stdlib UUIDs

On Go 1.27+, fields using the new standard library uuid.UUID type are automatically documented as type: string with format: uuid, with no struct tag needed. (#1051)

Faster Compile Times

huma.Register, sse.Register and the convenience helpers (huma.Get, huma.Post, ...) now keep their generic parts tiny, so Go no longer compiles a full copy of the registration logic for every input/output pair. In a 200-operation benchmark package, build time dropped from 3.38s to 0.64s. There are no API or runtime changes. (#1115, #1117)

New Features

String SSE event IDs via sse.Message.IDString, for UUIDs, cursor tokens and other opaque IDs (#1086)

Schema can be unmarshalled from JSON, including $ref, x- extensions and nullable types, and is ready for Validate once decoded (#1144)

Validation & Defaults Fixes

{"type": "null"} is now validated. Previously it accepted any value, so an anyOf with a null branch skipped the constraints of its other branches (#1120)

Numeric request parameters which overflow the destination Go type (e.g. 300 into an int8) now return 422 instead of silently wrapping (#1096)

default tags on encoding.TextUnmarshaler types (e.g. a duration with default:"10s") are now applied via UnmarshalText instead of panicking (#1126)

Defaults are now applied to absent exploded query arrays (#1116) and missing multipart form values (#1150), and array parameters accept JSON array defaults such as default:"[\"a\",\"b\"]" (#1125)

Value-less query flags followed by other parameters (e.g. ?flag&foo=bar) are now detected correctly (#1097)

PathBuffer.Pop restores the exact offset, fixing wrong error locations after discriminator errors (#1136)

casing.Camel and casing.Join no longer panic or double-apply transforms when a transform removes a part (#1113)

Request Body Fixes

A body of exactly MaxBodyBytes is now accepted instead of returning 413 (#1131)

Multipart file handles are now closed after mime-type validation (#1085)

OpenAPI Fixes

RawBody alongside Body no longer documents an extra application/octet-stream media type (#1134)

The example tag on a Body field is now set as the media type example, since many tools ignore examples next to a $ref (#1101)

Adapter & Autopatch Fixes

humafiber: multiple Set-Cookie headers are now sent as separate header lines instead of being comma-joined (#1137)

humafiber (v2): autopatch now works, as its internal requests get a default Host (#1140)

autopatch: PATCH responses are no longer compressed twice (#1130), and $refs are resolved when making the PUT schema optional (#1080)

Docs UI & Documentation

Updated Scalar (1.76.0), Stoplight Elements (9.0.29) and SwaggerUI (5.34.0). Scalar no longer needs 'unsafe-eval' in its CSP, and its fonts now load (#1145)

Clarified that router-agnostic middleware runs after route resolution (#1088)

... (truncated)

Commits

4035252 fix: apply the default tag to missing multipart form values (#1150)
c8a8e79 docs: clarify router-agnostic middleware runs after route resolution (#1088)
2955ed8 fix: respect MaxBodyBytes limit for raw bodies (#1095)
e83a6e9 fix(multipart): respect MaxBodyBytes limit (#1094)
0e93ae2 fix(humafiber): keep multiple Set-Cookie headers separate (#1137)
e0e7d92 fix(humafiber): default the Host so autopatch works on Fiber v2 (#1140)
8572fc2 chore: bump dependencies and minimum Go to 1.26 (#1149)
1251ac3 fix: accept JSON array defaults on array parameters (#1125)
07fe841 fix(autopatch): prevent double compression of PATCH responses (#1130)
c08b653 feat: support string SSE event IDs (#1086)
Additional commits viewable in compare view

Updates github.com/go-chi/chi/v5 from 5.3.2 to 5.5.0

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.5.0

What's Changed

middleware: add Deprecation (RFC 9745), make Sunset RFC 8594 only by @VojtechVitek in go-chi/chi#1195

middleware: test ClientIPFromHeader does not fall back to other headers by @renanmpimentel in go-chi/chi#1208

middleware: build Maybe handler once by @lowgame in go-chi/chi#1197

middleware: round and clamp Retry-After delays up to whole seconds by @VojtechVitek in go-chi/chi#1217

middleware: parse quoted ContentCharset media parameters by @VojtechVitek in go-chi/chi#1218

middleware: SupressNotFound must not mutate the request's route context by @VojtechVitek in go-chi/chi#1220

New Contributors

@renanmpimentel made their first contribution in go-chi/chi#1208

@lowgame made their first contribution in go-chi/chi#1197

Full Changelog: go-chi/chi@v5.4.0...v5.5.0

v5.4.0

What's Changed

Improve godoc: add links and titles by @dolmen in go-chi/chi#1027

Add Clone method to Context by @VojtechVitek in go-chi/chi#1157

middleware: ContentCharset should skip requests without a body by @VojtechVitek in go-chi/chi#1158

Update compress middleware support Brotli support documentation by @sm3142 in go-chi/chi#1007

fix: panic on Mount() when a router is mounted onto itself by @sk-sanjay01 in go-chi/chi#1159

test(middleware): Improves test coverage by @nszilard in go-chi/chi#700

Remove superfluous import aliases by @JRaspass in go-chi/chi#1166

Bump minimum Go to 1.24, use b.Loop() by @JRaspass in go-chi/chi#1164

Use slices.Backward where appropriate by @JRaspass in go-chi/chi#1165

Replace "interface{}" with "any" by @JRaspass in go-chi/chi#1167

Simplify chi.URLParam, call chi.URLParamFromCtx by @JRaspass in go-chi/chi#1168

middleware: record response status when flushing by @jakezwang in go-chi/chi#1174

middleware: honor Discard when flushing by @LeulTew in go-chi/chi#1185

README: point middleware doc links to chi/v5 by @VojtechVitek in go-chi/chi#1196

middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* by @VojtechVitek in go-chi/chi#1214

Fixes GHSA-j6qf-3m9c-vwj3

New Contributors

@dolmen made their first contribution in go-chi/chi#1027

@sm3142 made their first contribution in go-chi/chi#1007

@sk-sanjay01 made their first contribution in go-chi/chi#1159

@nszilard made their first contribution in go-chi/chi#700

@jakezwang made their first contribution in go-chi/chi#1174

@LeulTew made their first contribution in go-chi/chi#1185

Full Changelog: go-chi/chi@v5.3.2...v5.4.0

Commits

3a33ba5 middleware: SupressNotFound must not mutate the request's route context (#1220)
6075570 middleware: parse quoted ContentCharset media parameters (#1218)
46295d0 middleware: test Retry-After rounding in one table test (#1217)
c6e33a1 middleware: build Maybe handler once (#1197)
c9744a3 middleware: test ClientIPFromHeader does not fall back to other headers (#1208)
fff8bb2 middleware: add Deprecation (RFC 9745), make Sunset RFC 8594 only (#1195)
7f9b744 middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* (#1214)
167e1e3 README: point middleware doc links to chi/v5 (#1196)
3d1777a middleware: honor Discard when flushing (#1185)
b1c9ab4 middleware: record response status when flushing (#1174)
Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.11.0 to 5.12.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@igor-kupczynski).

Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @president-xd.

Features

Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)

Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)

pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)

pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.

pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

Commits

b2ef08b Update changelog for v5.12.0
8199015 Merge commit from fork
5b1a6a0 Merge commit from fork
65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
f2701a0 pgconn: only fall back when Windows service file is missing
db95468 Merge pull request #2696 from k-zshiba/support-oid8
fa2327d Start each query on a new line when joining a simple protocol batch
2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
efc0b74 Merge upstream master into support-oid8
5a17450 pgconn: require AuthenticationOk before ReadyForQuery
Additional commits viewable in compare view

Updates github.com/pressly/goose/v3 from 3.28.0 to 3.29.0

Release notes

Sourced from github.com/pressly/goose/v3's releases.

v3.29.0

Added

Support environ credentials for YDB using connection string parameter use_env_credentials.

Changed

Various dependency upgrades

Changelog

Sourced from github.com/pressly/goose/v3's changelog.

[v3.29.0] - 2026-10-11

Added

Support environ credentials for YDB using connection string parameter use_env_credentials.

Changed

Various dependency upgrades

Commits

8b457ba release: v3.29.0
4dc946a chore: update Go dependencies (#1140)
c088af3 ydb: adds environ credentials support (#1062)
0e5c23d docs: show env command in CLI help (#1132)
d832df3 Send goose version in YDB build-info header (#1063)
d181bdb docs: document ClickHouse dialect (#1127)
See full diff in compare view

Updates github.com/riverqueue/river from 0.48.0 to 0.51.0

Release notes

Sourced from github.com/riverqueue/river's releases.

v0.51.0

Added

Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).

Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).

Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).

Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

v0.50.0

Changed

Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).

Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).

Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).

Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).

Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).

Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).

Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).

Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

v0.49.0

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.32.0 to get a compatible package.

Changed

Internal transaction helpers now reuse existing transactions instead of creating unnecessary savepoints. Callers of transactional APIs must roll back their transaction on error; applications that need partial rollback can create an explicit savepoint around the River call. Set RIVER_USE_LEGACY_SUBTRANSACTIONS=1 (or true) before starting the application to restore savepoints in these helpers, including those used by River Pro. This is a temporary compatibility fallback planned for removal in a future release. [PR #1420](riverqueue/river#1420).

Fixed

Fixed rivertest.Worker to honor a configured Config.JobStuckThreshold for stuck job detection. Previously, it always used an internal 5 second threshold, so the Job appears to be stuck log line was emitted at a different time than it would be under a real client. [PR #1418](riverqueue/river#1418).

Fixed SQLite job cleanup stalling when excluded queues fill the oldest batch, and added support for included queue filters so per-queue retention works on SQLite. [PR #1417](riverqueue/river#1417).

Fixed a unique insert skipped as a duplicate of a job of a different kind (possible with UniqueOpts.ExcludeKind) changing the existing job's kind to its own. [PR #1421](riverqueue/river#1421).

Changelog

Sourced from github.com/riverqueue/river's changelog.

[0.51.0] - 2026-10-31

Added

Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).

Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).

Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).

Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

[0.50.0] - 2026-10-26

Changed

Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).

Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).

Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).

Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).

Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).

Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).

Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).

Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

[0.49.0] - 2026-10-05

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.32.0 to get a compatible package.

Changed

Internal transaction helpers now reuse existing transactions instead of creating unnecessary savepoints. Callers of transactional APIs must roll back their transaction on error; applications that need partial rollback can create an explicit savepoint around the River call. Set RIVER_USE_LEGACY_SUBTRANSACTIONS=1 (or true) before starting the application to restore savepoints in these helpers, including those used by River Pro. This is a temporary compatibility fallback planned for removal in a future release. [PR #1420](riverqueue/river#1420).

Fixed

Fixed rivertest.Worker to honor a configured Config.JobStuckThreshold for stuck job detection. Previously, it always used an internal 5 second threshold, so the Job appears to be stuck log line was emitted at a different time than it would be under a real client. [PR #1418](riverqueue/river#1418).

Fixed SQLite job cleanup stalling when excluded queues fill the oldest batch, and added support for included queue filters so per-queue retention works on SQLite. [PR #1417](riverqueue/river#1417).

Fixed a unique insert skipped as a duplicate of a job of a different kind (possible with UniqueOpts.ExcludeKind) changing the existing job's kind to its own. [PR #1421](riverqueue/river#1421).

Commits

69c0b45 [go] Prepare v0.51.0 (#1571)
737146d Add a Where escape hatch to JobDeleteManyParams (#1570)
e898054 [go, java, js, rust] Alternative implementation for reconciling jobs against ...
4f79f7b Bump crass from 1.0.7 to 1.0.8 in /ruby/rails/riverqueue-rails (#1562)
f995760 [ruby] Prepare v0.15.0 (#1561)
b330cfb [ruby] Add river migrate-get/validate/version subcommands (#1560)
5c2d873 [go] Fix notifier hanging after a listen or unlisten times out (#1559)
53ce383 [go] Fix InsertManyFast and QueueUpdate panics on drivers without listene...
fc6c1d5 [java, js, ruby] bump compatible dependencies (#1553)
012b72c Fix intermittently failing test TestJobCleaner/CustomizableInterval (#1531)
Additional commits viewable in compare view

Updates github.com/riverqueue/river/riverdriver/riverpgxv5 from 0.48.0 to 0.51.0

Release notes

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's releases.

v0.51.0

Added

Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).

Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).

Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).

Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

v0.50.0

Changed

Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).

Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).

Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).

Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).

Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).

Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).

Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).

Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

v0.49.0

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.32.0 to get a compatible package.

Changed

Internal transaction helpers now reuse existing transactions instead of creating unnecessary savepoints. Callers of transactional APIs must roll back their transaction on error; applications that need partial rollback can create an explicit savepoint around the River call. Set RIVER_USE_LEGACY_SUBTRANSACTIONS=1 (or true) before starting the application to restore savepoints in these helpers, including those used by River Pro. This is a temporary compatibility fallback planned for removal in a future release. [PR #1420](riverqueue/river#1420).

Fixed

Fixed rivertest.Worker to honor a configured Config.JobStuckThreshold for stuck job detection. Previously, it always used an internal 5 second threshold, so the Job appears to be stuck log line was emitted at a different time than it would be under a real client. [PR #1418](riverqueue/river#1418).

Fixed SQLite job cleanup stalling when excluded queues fill the oldest batch, and added support for included queue filters so per-queue retention works on SQLite. [PR #1417](riverqueue/river#1417).

Fixed a unique insert skipped as a duplicate of a job of a different kind (possible with UniqueOpts.ExcludeKind) changing the existing job's kind to its own. [PR #1421](riverqueue/river#1421).

Changelog

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's changelog.

[0.51.0] - 2026-10-31

Added

Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).

Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).

Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).

Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

[0.50.0] - 2026-10-26

Changed

Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).

Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run ...
Description has been truncated

Bumps the go group with 10 updates in the /apps/api directory: | Package | From | To | | --- | --- | --- | | [github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma) | `2.39.1` | `2.40.0` | | [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.3.2` | `5.5.0` | | [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.11.0` | `5.12.0` | | [github.com/pressly/goose/v3](https://github.com/pressly/goose) | `3.28.0` | `3.29.0` | | [github.com/riverqueue/river](https://github.com/riverqueue/river) | `0.48.0` | `0.51.0` | | [github.com/riverqueue/river/riverdriver/riverpgxv5](https://github.com/riverqueue/river) | `0.48.0` | `0.51.0` | | [github.com/riverqueue/river/rivertype](https://github.com/riverqueue/river) | `0.48.0` | `0.51.0` | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` | | [golang.org/x/sync](https://github.com/golang/sync) | `0.23.0` | `0.24.0` | | [golang.org/x/term](https://github.com/golang/term) | `0.46.0` | `0.47.0` | Updates `github.com/danielgtaylor/huma/v2` from 2.39.1 to 2.40.0 - [Release notes](https://github.com/danielgtaylor/huma/releases) - [Commits](danielgtaylor/huma@v2.39.1...v2.40.0) Updates `github.com/go-chi/chi/v5` from 5.3.2 to 5.5.0 - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](go-chi/chi@v5.3.2...v5.5.0) Updates `github.com/jackc/pgx/v5` from 5.11.0 to 5.12.0 - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.11.0...v5.12.0) Updates `github.com/pressly/goose/v3` from 3.28.0 to 3.29.0 - [Release notes](https://github.com/pressly/goose/releases) - [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md) - [Commits](pressly/goose@v3.28.0...v3.29.0) Updates `github.com/riverqueue/river` from 0.48.0 to 0.51.0 - [Release notes](https://github.com/riverqueue/river/releases) - [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md) - [Commits](riverqueue/river@v0.48.0...v0.51.0) Updates `github.com/riverqueue/river/riverdriver/riverpgxv5` from 0.48.0 to 0.51.0 - [Release notes](https://github.com/riverqueue/river/releases) - [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md) - [Commits](riverqueue/river@v0.48.0...v0.51.0) Updates `github.com/riverqueue/river/rivertype` from 0.48.0 to 0.51.0 - [Release notes](https://github.com/riverqueue/river/releases) - [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md) - [Commits](riverqueue/river@v0.48.0...v0.51.0) Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0 - [Commits](golang/crypto@v0.57.0...v0.58.0) Updates `golang.org/x/sync` from 0.23.0 to 0.24.0 - [Commits](golang/sync@v0.23.0...v0.24.0) Updates `golang.org/x/term` from 0.46.0 to 0.47.0 - [Commits](golang/term@v0.46.0...v0.47.0) --- updated-dependencies: - dependency-name: github.com/danielgtaylor/huma/v2 dependency-version: 2.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/pressly/goose/v3 dependency-version: 3.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/riverqueue/river dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/riverqueue/river/riverdriver/riverpgxv5 dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/riverqueue/river/rivertype dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: golang.org/x/crypto dependency-version: 0.58.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: golang.org/x/sync dependency-version: 0.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: golang.org/x/term dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-11-11T05:44:41Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 4, 2026

dependabot Bot closed this Nov 11, 2026

dependabot Bot deleted the dependabot/go_modules/apps/api/go-a34e5ce129 branch November 11, 2026 05:44

Navigation Menu

Repository navigation

Bump the go group across 1 directory with 10 updates - #18

Bump the go group across 1 directory with 10 updates#18
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/apps/api/go-a34e5ce129

dependabot Bot commented on behalf of github Nov 4, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Nov 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.40.0

Overview

Upgrade Notes

Security Fix

Native Stdlib UUIDs

Faster Compile Times

New Features

Validation & Defaults Fixes

Request Body Fixes

OpenAPI Fixes

Adapter & Autopatch Fixes

Docs UI & Documentation

v5.5.0

What's Changed

New Contributors

v5.4.0

What's Changed

New Contributors

5.12.0 (October 30, 2026)

Security Fixes

Features

Changes

v3.29.0

Added

Changed

[v3.29.0] - 2026-10-11

Added

Changed

v0.51.0

Added

Fixed

v0.50.0

Changed

Fixed

v0.49.0

Changed

Fixed

[0.51.0] - 2026-10-31

Added

Fixed

[0.50.0] - 2026-10-26

Changed

Fixed

[0.49.0] - 2026-10-05

Changed

Fixed

v0.51.0

Added

Fixed

v0.50.0

Changed

Fixed

v0.49.0

Changed

Fixed

[0.51.0] - 2026-10-31

Added

Fixed

[0.50.0] - 2026-10-26

Changed

Fixed

Uh oh!

dependabot Bot commented on behalf of github Nov 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Nov 4, 2026 •

edited

Loading