build(deps): bump the go-minor-patch group in /backend with 7 updates by dependabot[bot] · Pull Request #9345 · apache/devlake

dependabot · 2026-11-08T14:31:32Z

Bumps the go-minor-patch group in /backend with 7 updates:

Package	From	To
github.com/aws/aws-sdk-go-v2	`1.47.5`	`1.47.6`
github.com/aws/aws-sdk-go-v2/config	`1.33.12`	`1.33.14`
github.com/aws/aws-sdk-go-v2/credentials	`1.20.12`	`1.20.14`
github.com/aws/aws-sdk-go-v2/service/identitystore	`1.49.4`	`1.49.6`
github.com/aws/aws-sdk-go-v2/service/s3	`1.114.6`	`1.114.7`
github.com/go-playground/validator/v10	`10.30.5`	`10.30.6`
github.com/jackc/pgx/v5	`5.11.0`	`5.12.0`

Updates github.com/aws/aws-sdk-go-v2 from 1.47.5 to 1.47.6

Commits

4daf858 Release 2026-11-04
c864988 Regenerated Clients
53fbbad Update endpoints model
5d7f6bf Update API model
0f6300b fix s3 schema-serde compile (#3611)
71605dd update to smithy-go v1.28.8 (#3618)
715cdf0 fix(signer/v4): sort canonical query parameters after URI-encoding them (#3617)
407b01f Release 2026-10-30
e122e2b Regenerated Clients
1ebc631 Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.12 to 1.33.14

Commits

4daf858 Release 2026-11-04
c864988 Regenerated Clients
53fbbad Update endpoints model
5d7f6bf Update API model
0f6300b fix s3 schema-serde compile (#3611)
71605dd update to smithy-go v1.28.8 (#3618)
715cdf0 fix(signer/v4): sort canonical query parameters after URI-encoding them (#3617)
407b01f Release 2026-10-30
e122e2b Regenerated Clients
1ebc631 Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.20.12 to 1.20.14

Commits

021db04 Release 2023-07-13
afb7460 Regenerated Clients
5963c54 Update partitions file
8b263ec Update endpoints model
52bb208 Update API model
34540e9 Merge pull request #2154 from aws/feat-ua
5f1a82d Update API model
b3e5b29 Release 2023-07-07
7f1fba9 Regenerated Clients
10508e0 Update endpoints model
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/identitystore from 1.49.4 to 1.49.6

Commits

d125de3 Release 2024-11-18
fec51f3 Regenerated Clients
fba5997 Update API model
0b8e5c8 Bump smithy-go dependency (#2902)
50ba45c Release 2024-11-15.2
444bdff Regenerated Clients
55ab381 Update endpoints model
94c0837 Update API model
2398a79 Remove elastictranscoder service's integration test (#2901)
93e0f29 Release 2024-11-15
Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.6 to 1.114.7

Commits

4daf858 Release 2026-11-04
c864988 Regenerated Clients
53fbbad Update endpoints model
5d7f6bf Update API model
0f6300b fix s3 schema-serde compile (#3611)
71605dd update to smithy-go v1.28.8 (#3618)
715cdf0 fix(signer/v4): sort canonical query parameters after URI-encoding them (#3617)
407b01f Release 2026-10-30
e122e2b Regenerated Clients
1ebc631 Update endpoints model
Additional commits viewable in compare view

Updates github.com/go-playground/validator/v10 from 10.30.5 to 10.30.6

Release notes

Sourced from github.com/go-playground/validator/v10's releases.

v10.30.6

What's Changed

fix: update the KR and IL postcode patterns to the current national formats by @yu2971512385-ui in go-playground/validator#1644

fix: accept Taiwan six-digit postcodes by @sb123sb123 in go-playground/validator#1642

docs: use the registered fieldcontains tag in usage example by @lazerg in go-playground/validator#1635

fix: fully anchor Costa Rica postcode regex by @sb123sb123 in go-playground/validator#1648

feat: add duration validator for time.ParseDuration strings by @ahmedkamalio in go-playground/validator#1649

chore(deps): bump github.com/go-playground/universal-translator from 0.18.1 to 0.18.2 by @dependabot[bot] in go-playground/validator#1653

feat: Add hostname label validation tag by @KytnaCode in go-playground/validator#1616

chore(deps): bump github.com/go-playground/locales from 0.14.1 to 0.14.2 by @dependabot[bot] in go-playground/validator#1663

Align excluded_without with its stated multi-field contract by @dylanpulver in go-playground/validator#1621

fix: accept Nigeria's 11-character postcodes by @Adeniyikayodee in go-playground/validator#1664

chore(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 by @dependabot[bot] in go-playground/validator#1670

ci: send coverage from the Go 1.26.x leg (step skipped since #1535) by @glaziermag in go-playground/validator#1671

Clarify separators for non-existent directory paths by @yuefdev in go-playground/validator#1672

Add postcode patterns for IE (Ireland), AL (Albania), GI (Gibraltar) and IL (Israel) by @JohannesHepp in go-playground/validator#1629

chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.15 to 1.4.16 by @dependabot[bot] in go-playground/validator#1680

docs: fix stale alias, uuid and snippet details in package docs by @yxshee in go-playground/validator#1679

fix: anchor GB and LI postcode patterns as a whole by @beduldul in go-playground/validator#1646

fix: reject ULIDs outside the 128-bit range by @sergioperezcheco in go-playground/validator#1660

fix: reject duplicate variants in strict BCP47 tags by @guocn in go-playground/validator#1678

Convert to time.Time before asserting in isNeField by @youdie006 in go-playground/validator#1619

Add uuid7 validation tag by @ChrisJr404 in go-playground/validator#1614

New Contributors

@yu2971512385-ui made their first contribution in go-playground/validator#1644

@sb123sb123 made their first contribution in go-playground/validator#1642

@lazerg made their first contribution in go-playground/validator#1635

@KytnaCode made their first contribution in go-playground/validator#1616

@dylanpulver made their first contribution in go-playground/validator#1621

@Adeniyikayodee made their first contribution in go-playground/validator#1664

@glaziermag made their first contribution in go-playground/validator#1671

@yuefdev made their first contribution in go-playground/validator#1672

@JohannesHepp made their first contribution in go-playground/validator#1629

@yxshee made their first contribution in go-playground/validator#1679

@beduldul made their first contribution in go-playground/validator#1646

@sergioperezcheco made their first contribution in go-playground/validator#1660

@guocn made their first contribution in go-playground/validator#1678

@youdie006 made their first contribution in go-playground/validator#1619

@ChrisJr404 made their first contribution in go-playground/validator#1614

Full Changelog: go-playground/validator@v10.30.5...v10.30.6

Commits

19397f2 Add uuid7 validation tag (#1614)
5b09d8d Convert to time.Time before asserting in isNeField (#1619)
563e738 fix: reject duplicate variants in strict BCP47 tags (#1678)
0f885d2 fix: reject ULIDs outside the 128-bit range (#1660)
c9cfe75 fix: anchor GB and LI postcode patterns as a whole (#1646)
29d05a7 docs: fix stale alias, uuid and snippet details in package docs (#1679)
0411012 chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.15 to 1.4.16 (#...
a5843c6 Add postcode patterns for IE (Ireland), AL (Albania), GI (Gibraltar) and IL (...
c29fac1 Clarify separators for non-existent directory paths (#1672)
3b54840 ci: send coverage from the Go 1.26.x leg (step skipped since #1535) (#1671)
Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.11.0 to 5.12.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@igor-kupczynski).

Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @president-xd.

Features

Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)

Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)

pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)

pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.

pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

Commits

b2ef08b Update changelog for v5.12.0
8199015 Merge commit from fork
5b1a6a0 Merge commit from fork
65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
f2701a0 pgconn: only fall back when Windows service file is missing
db95468 Merge pull request #2696 from k-zshiba/support-oid8
fa2327d Start each query on a new line when joining a simple protocol batch
2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
efc0b74 Merge upstream master into support-oid8
5a17450 pgconn: require AuthenticationOk before ReadyForQuery
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-minor-patch group in /backend with 7 updates: | Package | From | To | | --- | --- | --- | | [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.47.5` | `1.47.6` | | [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.33.12` | `1.33.14` | | [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) | `1.20.12` | `1.20.14` | | [github.com/aws/aws-sdk-go-v2/service/identitystore](https://github.com/aws/aws-sdk-go-v2) | `1.49.4` | `1.49.6` | | [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.114.6` | `1.114.7` | | [github.com/go-playground/validator/v10](https://github.com/go-playground/validator) | `10.30.5` | `10.30.6` | | [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.11.0` | `5.12.0` | Updates `github.com/aws/aws-sdk-go-v2` from 1.47.5 to 1.47.6 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@v1.47.5...v1.47.6) Updates `github.com/aws/aws-sdk-go-v2/config` from 1.33.12 to 1.33.14 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@config/v1.33.12...config/v1.33.14) Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.20.12 to 1.20.14 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/sso/v1.20.12...service/sns/v1.20.14) Updates `github.com/aws/aws-sdk-go-v2/service/identitystore` from 1.49.4 to 1.49.6 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/ssm/v1.49.4...service/fsx/v1.49.6) Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.114.6 to 1.114.7 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.114.6...service/s3/v1.114.7) Updates `github.com/go-playground/validator/v10` from 10.30.5 to 10.30.6 - [Release notes](https://github.com/go-playground/validator/releases) - [Commits](go-playground/validator@v10.30.5...v10.30.6) Updates `github.com/jackc/pgx/v5` from 5.11.0 to 5.12.0 - [Release notes](https://github.com/jackc/pgx/releases) - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.11.0...v5.12.0) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2 dependency-version: 1.47.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-version: 1.33.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch - dependency-name: github.com/aws/aws-sdk-go-v2/credentials dependency-version: 1.20.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/identitystore dependency-version: 1.49.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.114.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch - dependency-name: github.com/go-playground/validator/v10 dependency-version: 10.30.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-minor-patch - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Nov 8, 2026

klesh approved these changes Nov 8, 2026

View reviewed changes

klesh merged commit 420a388 into main Nov 8, 2026
10 checks passed

klesh deleted the dependabot/go_modules/backend/go-minor-patch-e96abf5fae branch November 8, 2026 14:56

Navigation Menu

Repository navigation

build(deps): bump the go-minor-patch group in /backend with 7 updates - #9345

build(deps): bump the go-minor-patch group in /backend with 7 updates#9345
klesh merged 1 commit into
mainfrom
dependabot/go_modules/backend/go-minor-patch-e96abf5fae

dependabot Bot commented on behalf of github Nov 8, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 8, 2026

v10.30.6

What's Changed

New Contributors

5.12.0 (October 30, 2026)

Security Fixes

Features

Changes

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant