[dependabot]

Bumps the go group with 11 updates in the /apps/api directory:

Package	From	To
github.com/danielgtaylor/huma/v2	2.39.1	2.40.0
github.com/go-chi/chi/v5	5.3.2	5.5.0
github.com/jackc/pgx/v5	5.11.0	5.12.0
github.com/pressly/goose/v3	3.28.0	3.29.0
github.com/riverqueue/river	0.48.0	0.51.1
github.com/riverqueue/river/riverdriver/riverpgxv5	0.48.0	0.51.1
github.com/riverqueue/river/rivertype	0.48.0	0.51.1
golang.org/x/crypto	0.57.0	0.58.0
golang.org/x/oauth2	0.37.0	0.38.0
golang.org/x/sync	0.23.0	0.24.0
golang.org/x/term	0.46.0	0.47.0

Updates github.com/danielgtaylor/huma/v2 from 2.39.1 to 2.40.0

Release notes

Sourced from github.com/danielgtaylor/huma/v2's releases.

v2.40.0

Overview

This release adds native support for stdlib UUIDs, cuts compile times for large APIs, and brings a big batch of correctness fixes across request limits, defaults, validation, and the Fiber adapter. It also raises the minimum Go version to 1.26 and includes a few intentional breaking changes, so please read the upgrade notes below.

Upgrade Notes

• Minimum Go version is now 1.26. Dependencies have been bumped too, picking up a few vulnerability fixes (#1149)
• Raw bodies now have default limits. Non-multipart RawBody operations (e.g. []byte uploads) now get the same default 1 MiB MaxBodyBytes and 5s BodyReadTimeout as regular bodies. Endpoints accepting larger or slower raw uploads should set these explicitly (-1 for unlimited) (#1095)
• Multipart now honors MaxBodyBytes. An explicitly set MaxBodyBytes is now enforced on multipart requests. Multipart remains exempt from the defaults, so existing uploads keep working unless you've set a limit (#1094)
• Overflowing default tags panic at startup. For example, int8 with default:"128" previously wrapped silently to -128; it now fails at registration (#1142)
• Out-of-range bound tags panic at startup. For example, int8 with maximum:"500". int8, int16, uint8 and uint16 fields also now advertise minimum/maximum from their Go type, so generated specs will change (#1143)

Security Fix

A malformed Accept header such as application/json;,b caused a panic during content negotiation. On net/http-based adapters this dropped the request; on Fiber, which doesn't recover handler panics unless the recover middleware is used, it crashed the server process. This affects v2.26.0 onwards, so upgrading is recommended. (#1128)

Native Stdlib UUIDs

On Go 1.27+, fields using the new standard library uuid.UUID type are automatically documented as type: string with format: uuid, with no struct tag needed. (#1051)

Faster Compile Times

huma.Register, sse.Register and the convenience helpers (huma.Get, huma.Post, ...) now keep their generic parts tiny, so Go no longer compiles a full copy of the registration logic for every input/output pair. In a 200-operation benchmark package, build time dropped from 3.38s to 0.64s. There are no API or runtime changes. (#1115, #1117)

New Features

• String SSE event IDs via sse.Message.IDString, for UUIDs, cursor tokens and other opaque IDs (#1086)
• Schema can be unmarshalled from JSON, including $ref, x- extensions and nullable types, and is ready for Validate once decoded (#1144)

Validation & Defaults Fixes

• {"type": "null"} is now validated. Previously it accepted any value, so an anyOf with a null branch skipped the constraints of its other branches (#1120)
• Numeric request parameters which overflow the destination Go type (e.g. 300 into an int8) now return 422 instead of silently wrapping (#1096)
• default tags on encoding.TextUnmarshaler types (e.g. a duration with default:"10s") are now applied via UnmarshalText instead of panicking (#1126)
• Defaults are now applied to absent exploded query arrays (#1116) and missing multipart form values (#1150), and array parameters accept JSON array defaults such as default:"[\"a\",\"b\"]" (#1125)
• Value-less query flags followed by other parameters (e.g. ?flag&foo=bar) are now detected correctly (#1097)
• PathBuffer.Pop restores the exact offset, fixing wrong error locations after discriminator errors (#1136)
• casing.Camel and casing.Join no longer panic or double-apply transforms when a transform removes a part (#1113)

Request Body Fixes

• A body of exactly MaxBodyBytes is now accepted instead of returning 413 (#1131)
• Multipart file handles are now closed after mime-type validation (#1085)

OpenAPI Fixes

• RawBody alongside Body no longer documents an extra application/octet-stream media type (#1134)
• The example tag on a Body field is now set as the media type example, since many tools ignore examples next to a $ref (#1101)

Adapter & Autopatch Fixes

• humafiber: multiple Set-Cookie headers are now sent as separate header lines instead of being comma-joined (#1137)
• humafiber (v2): autopatch now works, as its internal requests get a default Host (#1140)
• autopatch: PATCH responses are no longer compressed twice (#1130), and $refs are resolved when making the PUT schema optional (#1080)

Docs UI & Documentation

• Updated Scalar (1.76.0), Stoplight Elements (9.0.29) and SwaggerUI (5.34.0). Scalar no longer needs 'unsafe-eval' in its CSP, and its fonts now load (#1145)
• Clarified that router-agnostic middleware runs after route resolution (#1088)

... (truncated)

Commits

• 4035252 fix: apply the default tag to missing multipart form values (#1150)
• c8a8e79 docs: clarify router-agnostic middleware runs after route resolution (#1088)
• 2955ed8 fix: respect MaxBodyBytes limit for raw bodies (#1095)
• e83a6e9 fix(multipart): respect MaxBodyBytes limit (#1094)
• 0e93ae2 fix(humafiber): keep multiple Set-Cookie headers separate (#1137)
• e0e7d92 fix(humafiber): default the Host so autopatch works on Fiber v2 (#1140)
• 8572fc2 chore: bump dependencies and minimum Go to 1.26 (#1149)
• 1251ac3 fix: accept JSON array defaults on array parameters (#1125)
• 07fe841 fix(autopatch): prevent double compression of PATCH responses (#1130)
• c08b653 feat: support string SSE event IDs (#1086)
• Additional commits viewable in compare view

Updates github.com/go-chi/chi/v5 from 5.3.2 to 5.5.0

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.5.0

What's Changed

• middleware: add Deprecation (RFC 9745), make Sunset RFC 8594 only by @​VojtechVitek in go-chi/chi#1195
• middleware: test ClientIPFromHeader does not fall back to other headers by @​renanmpimentel in go-chi/chi#1208
• middleware: build Maybe handler once by @​lowgame in go-chi/chi#1197
• middleware: round and clamp Retry-After delays up to whole seconds by @​VojtechVitek in go-chi/chi#1217
• middleware: parse quoted ContentCharset media parameters by @​VojtechVitek in go-chi/chi#1218
• middleware: SupressNotFound must not mutate the request's route context by @​VojtechVitek in go-chi/chi#1220

New Contributors

• @​renanmpimentel made their first contribution in go-chi/chi#1208
• @​lowgame made their first contribution in go-chi/chi#1197

Full Changelog: go-chi/chi@v5.4.0...v5.5.0

v5.4.0

What's Changed

• Improve godoc: add links and titles by @​dolmen in go-chi/chi#1027
• Add Clone method to Context by @​VojtechVitek in go-chi/chi#1157
• middleware: ContentCharset should skip requests without a body by @​VojtechVitek in go-chi/chi#1158
• Update compress middleware support Brotli support documentation by @​sm3142 in go-chi/chi#1007
• fix: panic on Mount() when a router is mounted onto itself by @​sk-sanjay01 in go-chi/chi#1159
• test(middleware): Improves test coverage by @​nszilard in go-chi/chi#700
• Remove superfluous import aliases by @​JRaspass in go-chi/chi#1166
• Bump minimum Go to 1.24, use b.Loop() by @​JRaspass in go-chi/chi#1164
• Use slices.Backward where appropriate by @​JRaspass in go-chi/chi#1165
• Replace "interface{}" with "any" by @​JRaspass in go-chi/chi#1167
• Simplify chi.URLParam, call chi.URLParamFromCtx by @​JRaspass in go-chi/chi#1168
• middleware: record response status when flushing by @​jakezwang in go-chi/chi#1174
• middleware: honor Discard when flushing by @​LeulTew in go-chi/chi#1185
• README: point middleware doc links to chi/v5 by @​VojtechVitek in go-chi/chi#1196
• middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* by @​VojtechVitek in go-chi/chi#1214
  • Fixes GHSA-j6qf-3m9c-vwj3

New Contributors

• @​dolmen made their first contribution in go-chi/chi#1027
• @​sm3142 made their first contribution in go-chi/chi#1007
• @​sk-sanjay01 made their first contribution in go-chi/chi#1159
• @​nszilard made their first contribution in go-chi/chi#700
• @​jakezwang made their first contribution in go-chi/chi#1174
• @​LeulTew made their first contribution in go-chi/chi#1185

Full Changelog: go-chi/chi@v5.3.2...v5.4.0

Commits

• 3a33ba5 middleware: SupressNotFound must not mutate the request's route context (#1220)
• 6075570 middleware: parse quoted ContentCharset media parameters (#1218)
• 46295d0 middleware: test Retry-After rounding in one table test (#1217)
• c6e33a1 middleware: build Maybe handler once (#1197)
• c9744a3 middleware: test ClientIPFromHeader does not fall back to other headers (#1208)
• fff8bb2 middleware: add Deprecation (RFC 9745), make Sunset RFC 8594 only (#1195)
• 7f9b744 middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* (#1214)
• 167e1e3 README: point middleware doc links to chi/v5 (#1196)
• 3d1777a middleware: honor Discard when flushing (#1185)
• b1c9ab4 middleware: record response status when flushing (#1174)
• Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.11.0 to 5.12.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

• SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@​igor-kupczynski).
• Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @​president-xd.

Features

• Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)
• Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)
• pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)
• pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

• pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.
• pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

Commits

• b2ef08b Update changelog for v5.12.0
• 8199015 Merge commit from fork
• 5b1a6a0 Merge commit from fork
• 65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
• f2701a0 pgconn: only fall back when Windows service file is missing
• db95468 Merge pull request #2696 from k-zshiba/support-oid8
• fa2327d Start each query on a new line when joining a simple protocol batch
• 2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
• efc0b74 Merge upstream master into support-oid8
• 5a17450 pgconn: require AuthenticationOk before ReadyForQuery
• Additional commits viewable in compare view

Updates github.com/pressly/goose/v3 from 3.28.0 to 3.29.0

Release notes

Sourced from github.com/pressly/goose/v3's releases.

v3.29.0

Added

• Support environ credentials for YDB using connection string parameter use_env_credentials.

Changed

• Various dependency upgrades

Changelog

Sourced from github.com/pressly/goose/v3's changelog.

[v3.29.0] - 2026-10-11

Added

• Support environ credentials for YDB using connection string parameter use_env_credentials.

Changed

• Various dependency upgrades

Commits

• 8b457ba release: v3.29.0
• 4dc946a chore: update Go dependencies (#1140)
• c088af3 ydb: adds environ credentials support (#1062)
• 0e5c23d docs: show env command in CLI help (#1132)
• d832df3 Send goose version in YDB build-info header (#1063)
• d181bdb docs: document ClickHouse dialect (#1127)
• See full diff in compare view

Updates github.com/riverqueue/river from 0.48.0 to 0.51.1

Release notes

Sourced from github.com/riverqueue/river's releases.

v0.51.1

Fixed

• Fixed a client ignoring queue pause, resume, or metadata changes until it restarted when the queue control notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their queues' settings once a minute. [Issue #1579](riverqueue/river#1579).
• Fixed the notifier never reconnecting when its connection went silent without an error, like after a dropped network path, because its health check ping had no timeout. The ping now times out after 10 seconds. [Issue #1579](riverqueue/river#1579).
• Fixed maintenance services logging errors during normal shutdown or leadership loss, including PeriodicJobEnqueuer reporting Error starting transaction: context canceled when stopped during staggered startup. Genuine query timeouts and database failures are still logged, and periodic job transactions now roll back even after cancellation. [PR #1577](riverqueue/river#1577).

v0.51.0

Added

• Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

• Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).
• Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).
• Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).
• Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

v0.50.0

Changed

• Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
• Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

• Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
• Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
• Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
• Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
• Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
• Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
• Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

v0.49.0

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.32.0 to get a compatible package.

Changed

• Internal transaction helpers now reuse existing transactions instead of creating unnecessary savepoints. Callers of transactional APIs must roll back their transaction on error; applications that need partial rollback can create an explicit savepoint around the River call. Set RIVER_USE_LEGACY_SUBTRANSACTIONS=1 (or true) before starting the application to restore savepoints in these helpers, including those used by River Pro. This is a temporary compatibility fallback planned for removal in a future release. [PR #1420](riverqueue/river#1420).

Fixed

• Fixed rivertest.Worker to honor a configured Config.JobStuckThreshold for stuck job detection. Previously, it always used an internal 5 second threshold, so the Job appears to be stuck log line was emitted at a different time than it would be under a real client. [PR #1418](riverqueue/river#1418).
• Fixed SQLite job cleanup stalling when excluded queues fill the oldest batch, and added support for included queue filters so per-queue retention works on SQLite. [PR #1417](riverqueue/river#1417).
• Fixed a unique insert skipped as a duplicate of a job of a different kind (possible with UniqueOpts.ExcludeKind) changing the existing job's kind to its own. [PR #1421](riverqueue/river#1421).

Changelog

Sourced from github.com/riverqueue/river's changelog.

[0.51.1] - 2026-11-05

Fixed

• Fixed a client ignoring queue pause, resume, or metadata changes until it restarted when the queue control notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their queues' settings once a minute. [Issue #1579](riverqueue/river#1579).
• Fixed the notifier never reconnecting when its connection went silent without an error, like after a dropped network path, because its health check ping had no timeout. The ping now times out after 10 seconds. [Issue #1579](riverqueue/river#1579).
• Fixed maintenance services logging errors during normal shutdown or leadership loss, including PeriodicJobEnqueuer reporting Error starting transaction: context canceled when stopped during staggered startup. Genuine query timeouts and database failures are still logged, and periodic job transactions now roll back even after cancellation. [PR #1577](riverqueue/river#1577).

[0.51.0] - 2026-10-31

Added

• Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

• Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).
• Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).
• Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).
• Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

[0.50.0] - 2026-10-26

Changed

• Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
• Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

• Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
• Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
• Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
• Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
• Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
• Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
• Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

[0.49.0] - 2026-10-05

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.32.0 to get a compatible package.

Changed

• Internal transaction helpers now reuse existing transactions instead of creating unnecessary savepoints. Callers of transactional APIs must roll back their transaction on error; applications that need partial rollback can create an explicit savepoint around the River call. Set RIVER_USE_LEGACY_SUBTRANSACTIONS=1 (or true) before starting the application to restore savepoints in these helpers, including those used by River Pro. This is a temporary compatibility fallback planned for removal in a future release. [PR #1420](riverqueue/river#1420).

Fixed

• Fixed rivertest.Worker to honor a configured Config.JobStuckThreshold for stuck job detection. Previously, it always used an internal 5 second threshold, so the Job appears to be stuck log line was emitted at a different time than it would be under a real client. [PR #1418](riverqueue/river#1418).
• Fixed SQLite job cleanup stalling when excluded queues fill the oldest batch, and added support for included queue filters so per-queue retention works on SQLite. [PR #1417](riverqueue/river#1417).

... (truncated)

Commits

• 6c72392 [go, js, rust] Prepare v0.51.1, v0.3.1, and v0.5.1
• 9db53b9 [go, js, rust] Fix context canceled problem in start when stopping (#1577)
• 43e6f22 Poll queue settings as a fallback when a notifier is configured (#1582)
• 578a67f Credit JP for Ruby fixes (#1581)
• a4de726 [rust] Align CLI with Go reference implementation (#1580)
• 1e8fa0d [ruby] Prepare v0.16.0 (#1578)
• f9517e7 [ruby] Helper argument to immediately set output with atomic metadata update ...
• 2f6ac09 [ruby] Miscellaneous ActiveRecord/Sequel database optimizations (#1574)
• a6faf39 [java] Add QUEUE_DEFAULT constant like other languages (#1557)
• 5ebd708 🤖 [rust] Fix race in resumable cursor checkpoint test (#1565)
• Additional commits viewable in compare view

Updates github.com/riverqueue/river/riverdriver/riverpgxv5 from 0.48.0 to 0.51.1

Release notes

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's releases.

v0.51.1

Fixed

• Fixed a client ignoring queue pause, resume, or metadata changes until it restarted when the queue control notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their queues' settings once a minute. [Issue #1579](riverqueue/river#1579).
• Fixed the notifier never reconnecting when its connection went silent without an error, like after a dropped network path, because its health check ping had no timeout. The ping now times out after 10 seconds. [Issue #1579](riverqueue/river#1579).
• Fixed maintenance services logging errors during normal shutdown or leadership loss, including PeriodicJobEnqueuer reporting Error starting transaction: context canceled when stopped during staggered startup. Genuine query timeouts and database failures are still logged, and periodic job transactions now roll back even after cancellation. [PR #1577](riverqueue/river#1577).

v0.51.0

Added

• Added JobDeleteManyParams.Where, an escape hatch for deleting jobs by an arbitrary SQL predicate, like JobListParams.Where does for lists. For example, it can select queued jobs whose args name a given customer. A Where predicate counts as a filter, so it doesn't need UnsafeAll, and each predicate is wrapped in parentheses so that an OR in it can't widen the deletion past other filters or to running jobs. The existing batch limit (100 jobs by default) and Postgres behavior of skipping locked jobs still apply. [PR #1570](riverqueue/river#1570).

Fixed

• Fixed a running job not being cancelled after Client.JobCancel when the cancellation notification was lost, as happens if it's sent while the client's notifier is reconnecting. Clients with a notifier now also check their running jobs for cancellation requests once a minute. Client.JobRetry now clears an earlier attempt's cancellation request so that the retried job isn't cancelled again. [PR #1564](riverqueue/river#1564).
• Fixed Client.InsertManyFast panicking after its transaction committed on a client configured with queues when the driver doesn't support a listener, such as a riverdatabasesql driver created with New instead of NewWithPgxListener. It now wakes producers for the inserted jobs' queues right away, like Client.InsertMany. [PR #1558](riverqueue/river#1558).
• Fixed Client.QueueUpdate without metadata crashing the program when the client works that queue and the driver doesn't support a listener. [PR #1558](riverqueue/river#1558).
• Fixed the notifier's run loop blocking forever when a topic LISTEN or UNLISTEN handed to it finished after its caller had stopped waiting (after 5 seconds, with timed out waiting for interrupt operation), as can happen on a slow or unresponsive connection. Client.Stop then never completed, and neither did a Client.Start that failed this way. [PR #1559](riverqueue/river#1559).

v0.50.0

Changed

• Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
• Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

• Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
• Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
• Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
• Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
• Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
• Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
• Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

v0.49.0

⚠️ If using River Pro, make sure to upgrade it to at least River Pro v0.32.0 to get a compatible package.

Changed

• Internal transaction helpers now reuse existing transactions instead of creating unnecessary savepoints. Callers of transactional APIs must roll back their transaction on error; applications that need partial rollback can create an explicit savepoint around the River call. Set RIVER_USE_LEGACY_SUBTRANSACTIONS=1 (or true) before starting the application to restore savepoints in these helpers, including those used by River Pro. This is a temporary compatibility fallback planned for removal in a future release. [PR #1420](riverqueue/river#1420).

Fixed

• Fixed rivertest.Worker to honor a configured Config.JobStuckThreshold for stuck job detection. Previously, it always used an internal 5 second threshold, so the Job appears to be stuck log line was emitted at a different time than it would be under a real client. [PR #1418](riverqueue/river#1418).
• Fixed SQLite job cleanup stalling when excluded queues fill the oldest batch, and added support for included queue filters so per-queue retention works on SQLite. [PR #1417](riverqueue/river#1417).
• Fixed a unique insert skipped as a duplicate of a job of a different kind (possible with UniqueOpts.ExcludeKind) changing the existing job's kind to its own. [PR #1421](riverqueue/river#1421).

Changelog

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's changelog.

[0.51.1] - 2026-11-05

Fixed

• Fixed a client ig...

  Description has been truncated