chore(deps): bump the backend-go-dependencies group across 1 directory with 4 updates by dependabot[bot] · Pull Request #178 · fabriziosalmi/secure-proxy-manager

dependabot · 2026-07-20T17:25:31Z

Bumps the backend-go-dependencies group with 4 updates in the /backend-go directory: github.com/go-chi/chi/v5, github.com/prometheus/client_golang, golang.org/x/crypto and modernc.org/sqlite.

Updates github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.1

What's Changed

Honor Discard() in httpFancyWriter.ReadFrom by @DucMinhNe in go-chi/chi#1110

Tidy build directives by @JRaspass in go-chi/chi#1113

feat(middleware): add text/xml and application/xml to default compressible types by @VojtechVitek in go-chi/chi#1127

Fix defaultLogEntry.Panic not respecting NoColor setting by @doganarif in go-chi/chi#1050

middleware: document printPrettyStack and harden NoColor panic test by @VojtechVitek in go-chi/chi#1131

feat(mux): support http QUERY method ietf rfc10008 by @VojtechVitek in go-chi/chi#1132

ci: pin GitHub Actions to full commit SHAs by @XananasX7 in go-chi/chi#1116

New Contributors

@DucMinhNe made their first contribution in go-chi/chi#1110

@doganarif made their first contribution in go-chi/chi#1050

@XananasX7 made their first contribution in go-chi/chi#1116

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

Commits

8b258c7 ci: pin GitHub Actions to full commit SHAs (#1116)
caf87e6 feat(mux): support http QUERY method ietf rfc10008 (#1132)
7fcb8a2 middleware: document printPrettyStack and harden NoColor panic test (#1131)
878fe71 Fix defaultLogEntry.Panic not respecting NoColor setting (#1050)
d7b767b feat(middleware): add text/xml and application/xml to default compressible ty...
3b50c7c Tidy build directives (#1113)
2b9fca2 Honor Discard() in httpFancyWriter.ReadFrom (#1110)
See full diff in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005

[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030

[BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971

[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889

[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917

[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

build(deps): bump github.com/prometheus/procfs from 0.16.1 to 0.17.0 by @dependabot[bot] in prometheus/client_golang#1839

build(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 by @dependabot[bot] in prometheus/client_golang#1838

prometheus/collectors: use godoc link for runtime/metrics supported metrics by @xieyuschen in prometheus/client_golang#1844

Fix doc typo by @torrca in prometheus/client_golang#1849

Merge release-1.23 into main by @vesari in prometheus/client_golang#1851

build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the github-actions group by @dependabot[bot] in prometheus/client_golang#1852

Refactor LabelNames to return model.LabelNames type for consistency by @yshngg in prometheus/client_golang#1850

remote: simplified Store interface; renamed Handler to WriteHandler by @bwplotka in prometheus/client_golang#1855

feat(api/prometheus): add format_query endpoint for query formatting by @yshngg in prometheus/client_golang#1846

feat(api): add FormatQuery method to Prometheus v1 API by @yshngg in prometheus/client_golang#1856

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

1.24.0 / 2026-07-20

[CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862

[CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051

[CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843

[CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850

[CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855

[FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942

[FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392

[FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902

[FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969

[FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925

[FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856

[FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896

[FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895

[FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890

[ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860

[ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885

[BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961

[BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991

[BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005

[BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030

[BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971

[BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889

[BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917

[BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

Commits

d6087ee release: cut v1.24.1 (#2076)
48dd383 Cut v1.24.0 (#2061)
a725305 Cut v1.24.0-rc.0 (#2058)
77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
34e9a7f Merge pull request #2055 from prombot/repo_sync
43749bc Update common Prometheus files
de19217 examples: improve simple main.go example (#1999)
20355eb fix: correct typos in comments and test error messages (#2049)
4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.53.0 to 0.54.0

Commits

cdce021 go.mod: update golang.org/x dependencies
d9474cc openpgp: make the deprecation message more explicit
7626c50 ssh: verify declared key type matches decoded key in authorized_keys
0471e79 ssh/agent: enforce strict limits on DSA key parameters
6435c37 ssh: sanitize client disconnect messages
7d695da ssh/agent: drain channel stderr in agent forwarders
5b7f841 acme/autocert: fix data race in Manager.createCert
0b316e7 argon2: update RFC 9106 parameter recommendations
55aec0a x509roots/fallback: update bundle
5f2de1a internal: remove wycheproof tests
See full diff in compare view

Updates modernc.org/sqlite from 1.52.0 to 1.54.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

2026-07-20 v1.55.0:

Add github.com/mattn/go-sqlite3-compatible shorthand DSN query parameters to ease migration from that driver: _busy_timeout/_timeout, _foreign_keys/_fk, _journal_mode/_journal, _synchronous/_sync, _auto_vacuum/_vacuum, and _query_only, each setting the correspondingly named PRAGMA. Values are validated against the same set mattn/go-sqlite3 accepts (case-insensitive) and an unrecognized value fails the connection with an error, so a typo such as _synchronous=fu1l or _foreign_keys=yes_please is reported rather than silently downgrading durability or dropping foreign-key enforcement. The keys are applied in a fixed order independent of their order in the DSN — _busy_timeout and _auto_vacuum before any _pragma values (auto_vacuum must be set before the database is first written), the rest after, and _query_only last — and where a key and its alias are both supplied the alias wins, matching mattn/go-sqlite3; selection is by presence rather than by value, so supplying the alias empty (_foreign_keys=on&_fk=) suppresses the PRAGMA rather than deferring to the primary key, again matching that driver. Behavior change to note: prior releases ignored these keys entirely, so a DSN carried over from a mattn/go-sqlite3 setup changes in two ways. A recognized key that previously did nothing now takes effect — _foreign_keys=on begins enforcing constraints against data that may already violate them, _journal_mode=wal persistently converts the database file, and _query_only=1 makes the connection read-only. And a value outside the accepted set now fails the connection with an error where the same DSN previously opened successfully — for example a duration-style _busy_timeout=5s or _timeout=5000ms, neither of which is the integer that key requires. Review such DSNs before upgrading. _pragma is unchanged and no pre-existing parameter changes meaning, though see the following entry for a change in when all of them are validated.

See [GitLab merge request #134](https://gitlab.com/cznic/sqlite/-/merge_requests/134), thanks Toni Spets (@beeper-hifi) and Ian Chechin!

Validate every DSN query parameter before applying any of them. Parameters were previously checked as each was reached, so a DSN whose later parameter was rejected had already executed the PRAGMAs ahead of it. Because PRAGMA journal_mode and PRAGMA auto_vacuum are persistent changes to the database file, a DSN such as file:x.db?_journal_mode=wal&_synchronous=bogus failed the connection and yet left x.db converted to WAL. A failed Open now leaves the database as it found it. This covers the pre-existing _txlock, _timezone, _time_format, _time_integer_format, _inttotime and _texttotime parameters as well as the shorthand keys above: all of them were validated only after the _pragma list had already run, so the same DSN shape — a valid _pragma=journal_mode=wal alongside a misspelled _txlock — converted the file before reporting the error. Only the values accepted for each parameter are unchanged; a DSN that opened successfully before still opens, and one that failed still fails with the same error. _pragma remains the sole exception, since its values are executed verbatim and cannot be checked in advance: a malformed _pragma is still rejected by SQLite as it runs, after any earlier _pragma in the list has taken effect.

2026-07-15 v1.54.0:

Upgrade to SQLite 3.53.3. This also bumps the pinned modernc.org/libc to v1.74.1; as always, downstream modules must pin the exact same modernc.org/libc version this module's go.mod pins (see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177)).

Under the opt-in _texttotime DSN parameter, best-effort parse date-shaped TEXT values from columns SQLite reports with an empty declared type — aggregates and expressions over a date column (MAX(d), COALESCE(d, ...), upper(d), d || ''), subqueries, and typeless real columns (CREATE TABLE t(x)) — into time.Time, instead of delivering them as a raw string that Scan cannot store into a *time.Time. The existing declared DATE/DATETIME/TIME/TIMESTAMP path is unchanged; this only adds the empty-decltype case. The conversion is strictly best-effort: a value that does not parse as a time falls through to the original string, so no Scan that worked before can newly fail. ColumnTypeScanType continues to report string for empty-decltype columns, since the declared type cannot prove the column is temporal. Without _texttotime the behavior is byte-for-byte unchanged. Resolves [GitLab issue #248](https://gitlab.com/cznic/sqlite/-/issues/248).

See [GitLab merge request #133](https://gitlab.com/cznic/sqlite/-/merge_requests/133), thanks Ian Chechin!

2026-06-21 v1.53.0:

Add experimental netbsd/amd64 support, resolving the long-standing build break in [GitLab issue #246](https://gitlab.com/cznic/sqlite/-/issues/246). This target is intentionally not yet listed among the supported platforms in the package documentation: the port had been broken for years and is only now revived, and there is as yet no real-world experience running it under production workloads. Green CI is not the same as battle-tested — so while the full test suite (including the pcache and vec packages and the -race concurrency test) passes on NetBSD 10.1 / Go 1.26.3, and the entire upstream toolchain (libc, cc, ccgo, libz, libtcl8.6, libsqlite3, libsqlite_vec) is green on the NetBSD CI builder, the target is offered for evaluation only. If you run NetBSD, please exercise it with your own workloads and report back via #246; the intent is to promote it to a fully supported platform after a period of broader real-world testing (on the order of a month) elapses without surprises.

Implementation notes: the previously shipped lib/sqlite_netbsd_amd64.go was a stale old-generator transpile that no longer compiled (the mu.enter/mu.leave break in #246); it is replaced by a fresh new-generator transpile consistent with every other platform, and modernc.org/sqlite/vec (sqlite-vec) is vendored and auto-registers on netbsd. Correct operation requires the matching pinned modernc.org/libc, which carries two NetBSD-specific fixes found during this work: the mmap(2) PAD-argument ABI (without it, concurrent WAL access faults with SIGBUS in the WAL-index shared memory) and a working abort(3) (the prior stub left SQLite's crash-recovery writecrash test unable to terminate by signal). As usual, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins.

See [GitLab merge request #82](https://gitlab.com/cznic/sqlite/-/merge_requests/82), thanks Leonardo Taccari (@iamleot) and Thomas Klausner (@wiz)!

Add experimental freebsd/386 and freebsd/arm support. As with the netbsd/amd64 target above, these two 32-bit FreeBSD ports are intentionally not yet listed among the supported platforms in the package documentation: freebsd/386 previously shipped a stale, effectively untested SQLite 3.41 transpile, and freebsd/arm is entirely new, so neither has real-world production mileage yet. Both are now freshly transpiled at SQLite 3.53.2 consistent with every other platform, build cleanly, and pass the full test suite (core, WAL/concurrency, and the vec package) on the FreeBSD CI builders; they are offered for evaluation only. If you run 32-bit FreeBSD, please exercise these targets with your own workloads and report back — the intent is to promote freebsd/386, freebsd/arm, and netbsd/amd64 to fully supported platforms in a future release cycle, once a period of broader real-world testing elapses without surprises.

Implementation notes: correct operation on freebsd/arm requires the matching pinned modernc.org/libc (v1.73.4), which fixes the per-arch mmap(2) off_t encoding for 32-bit FreeBSD; without it the WAL shared-memory mapping faults with SIGBUS under concurrent access, the same class of bug found on the netbsd port. As usual, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins.

See [GitLab merge request #119](https://gitlab.com/cznic/sqlite/-/merge_requests/119), thanks Olivier Cochard-Labbé (@ocochard)!

Add a Go-facing wrapper for SQLITE_CONFIG_PCACHE2. PageCache is the factory and Cache the per-database instance, both idiomatic Go interfaces; Page exposes the raw Buf and Extra pointers that SQLite reads through the C pcache contract. RegisterPageCache and MustRegisterPageCache install the module process-globally before the first sql.Open; subsequent Open calls are gated through a one-shot Xsqlite3_config(SQLITE_CONFIG_PCACHE2) so a too-late Register returns ErrPageCacheTooLate rather than silently falling through to the built-in pcache1. The binding owns the sqlite3_pcache_page stub and re-consults the implementation on every Fetch, reusing the stub only when the returned Page value is unchanged, which keeps a bounded/evicting purgeable cache safe by construction.

See [GitLab merge request #126](https://gitlab.com/cznic/sqlite/-/merge_requests/126), thanks Ian Chechin!

Add modernc.org/sqlite/pcache, the reference page-cache implementation that accompanies the #126 SQLITE_CONFIG_PCACHE2 wrapper. pcache.New returns a *Pool satisfying the PageCache interface; register it once with sqlite.MustRegisterPageCache(pcache.New()) and every connection opened afterwards draws its pages from it. Each Pool.Create mints a fresh per-database Cache: a bounded, LRU-evicting page store that honours the PRAGMA cache_size soft cap and releases the least-recently-unpinned page when it must make room. Page memory — the Buf and Extra buffers SQLite reads through — is allocated with libc.Xmalloc/libc.Xcalloc and therefore lives off the Go heap, which keeps SQLite's interior pointer arithmetic on the page extras from tripping the race detector's checkptr enforcement. Pool.Stats reports aggregate lifetime counters (hits, misses, allocs, evictions, rekeys, truncates, caches) across every cache a Pool has created, so hit/miss/eviction behaviour is observable without instrumenting individual caches. Cross-connection page sharing is out of scope for now; each Create returns an independent per-database cache.

Validated end-to-end against the #126 stress workload (cache_size=16, 4000 BLOB rows with DELETE and incremental_vacuum, integrity_check clean under -race) and benchmarked for the memory-utilization goal tracked in [GitLab issue #204](https://gitlab.com/cznic/sqlite/-/issues/204).

See [GitLab merge request #127](https://gitlab.com/cznic/sqlite/-/merge_requests/127), thanks Ian Chechin!

Tighten the modernc.org/sqlite/pcache reference implementation per cznic's !127 review follow-ups. Adds Stats.EasyRefusals, a per-Pool counter for the cases where FetchCreateEasy returns nil at cap; SQLite reacts to a refusal by spilling dirty pages and retrying with FetchCreateForce, so the new field is a direct proxy for the I/O pressure the strict Easy contract imposes vs pcache1's recycle-without-spill behavior. BenchmarkPoolEvictionChurn was reworked to drive a rotating-residue DELETE (k % 3 = i % 3) and re-insert a matching batch each cycle so the spill pressure recurs and easy-refusals/op scales with b.N instead of capping at the seed's one-time first-cycle cost; both existing benchmarks now report easy-refusals/op alongside the page-allocs/evictions metrics. Stats.Evictions documentation was tightened to match the actual behavior (counts LRU eviction, Unpin(discard=true), Shrink releases, and Unpin(discard=false) trimming back to target after a FetchCreateForce overcommit; bulk frees from Truncate, Rekey collisions, and Destroy are not counted). The TestPoolRoundTripIntegrity comment claiming the workload exercises xRekey ~15 times has been corrected; the SQL surface does not reliably emit xRekey here, and that codepath is covered by the unit tests instead.

See [GitLab merge request #130](https://gitlab.com/cznic/sqlite/-/merge_requests/130), thanks Ian Chechin!

Make modernc.org/sqlite/pcache -race-clean under SQLite's cache=shared mode. The pool already runs correctly under shared-cache because every callback into a given Cache is serialised internally by SQLite's sqlite3BtreeEnter on the BtShared mutex; verified empirically with a lock-free in-flight probe (max-in-flight = 1 on the canonical two-connection workload, 4 on a positive control with goroutines hitting the cache directly). However the Go race detector does not recognise SQLite's libc mutex as a happens-before edge and reports false-positive races on Fetch vs Unpin reads/writes of the per-cache state, which surfaces as DATA RACE failures for any user who registers the pool and runs their suite under -race. A sync.Mutex on the cache type is now taken on every public method (SetSize, PageCount, Fetch, Unpin, Rekey, Truncate, Destroy, Shrink), always. On the common non-shared-cache path the lock is uncontended (one atomic CAS per Lock/Unlock pair, negligible next to the SQLite work it bookends); on the shared-cache path it just rubber-stamps the order SQLite's BtShared mutex already established. A new e2e_test.go TestSharedCacheTwoConns_Integrity drives two sql.Conn against the same cache=shared URI with concurrent writers and asserts PRAGMA integrity_check = ok under -race; passes cleanly with the lock, would surface the false-positive without it. Design notes live in pcache/sharing.go.

See [GitLab merge request #131](https://gitlab.com/cznic/sqlite/-/merge_requests/131), thanks Ian Chechin!

Add a Go wrapper for sqlite3_db_status, the per-connection runtime counters (cache hit/miss/write/spill rates, schema and prepared-statement memory, lookaside usage, deferred foreign keys). DBStatus is an interface implemented by the driver connection and reached through the database/sql escape hatch (*sql.Conn).Raw(), mirroring the existing FileControl surface; DBStatusOp is a distinct typed enum of the SQLITE_DBSTATUS_* verbs so a counter from a different op family will not compile in its place. Status(op, reset) returns the (current, high) pair and optionally resets the counter. This also lets modernc.org/sqlite/pcache measure real I/O instead of the EasyRefusals proxy: the new BenchmarkPoolSpillIO reads the pager-level SQLITE_DBSTATUS_CACHE_SPILL/_CACHE_WRITE counters, which the pager maintains identically for pcache1 and the pool, making the pcache1-vs-pool comparison cznic raised on the !127 review a genuine apples-to-apples measurement. On the rotating-residue eviction-churn workload at cache_size=16 the pool spills ~3.5x more than pcache1 (cache-spill/op 31.96 vs 8.96) for ~3% more page writes (cache-write/op 450 vs 436) at identical hit/miss, quantifying the I/O cost of the strict Easy contract that EasyRefusals only proxied.

See [GitLab merge request #132](https://gitlab.com/cznic/sqlite/-/merge_requests/132), thanks Ian Chechin!

Add an opt-in _dqs DSN query parameter that disables SQLite's double-quoted string literal compatibility quirk on a per-connection basis. When _dqs=0 (or any strconv.ParseBool false value) is supplied, the driver calls sqlite3_db_config with SQLITE_DBCONFIG_DQS_DDL and SQLITE_DBCONFIG_DQS_DML set to off before any statement is prepared, so a double-quoted identifier that fails to resolve raises a parse error instead of silently falling back to a string literal. Absence of the parameter, or _dqs=1, leaves SQLite's default behavior unchanged; existing DSNs continue to work byte-for-byte. Resolves [GitLab issue #61](https://gitlab.com/cznic/sqlite/-/issues/61).

See [GitLab merge request #128](https://gitlab.com/cznic/sqlite/-/merge_requests/128), thanks Ian Chechin!

Add an opt-in _error_rc DSN query parameter for clearer error reporting on open-time failures. When _error_rc=1 (or any strconv.ParseBool true value) is supplied, error strings synthesised from a (rc, db) pair only append sqlite3_errmsg(db) when sqlite3_extended_errcode(db) is consistent with the operation rc (full match first, primary code &0xff as fallback). On mismatch the canonical sqlite3_errstr(rc) is used alone, so an open-time SQLITE_CANTOPEN no longer carries the temporary handle's stale "out of memory" errmsg. Absence of the parameter, or _error_rc=0, preserves the legacy "errstr: errmsg" form byte-for-byte; existing callers that parse error strings are unaffected. The driver's *Error.Code() returns the same SQLite result code in both modes. Parsed before sqlite3_open_v2 so open-time errors are covered. Resolves [GitLab issue #230](https://gitlab.com/cznic/sqlite/-/issues/230).

See [GitLab merge request #129](https://gitlab.com/cznic/sqlite/-/merge_requests/129), thanks Ian Chechin!

2026-06-06 v1.52.0:

Upgrade to SQLite 3.53.2.

Add Backup.Remaining and Backup.PageCount, thin wrappers around the existing sqlite3_backup_remaining and sqlite3_backup_pagecount C symbols. Together they expose the per-Step progress counters that the underlying backup object already maintains, enabling progress reporting during online backups without dropping to modernc.org/sqlite/lib directly.

See [GitLab merge request #122](https://gitlab.com/cznic/sqlite/-/merge_requests/122), thanks Ian Chechin!

Drop the redundant second copy in (*conn).columnText, the path that backs every Rows.Scan into a Go string for a TEXT column. The value's bytes are still copied once out of SQLite-owned memory into a fresh Go buffer; that buffer is then reinterpreted as the result string with unsafe.String rather than copied a second time by the implicit string([]byte) conversion. This removes one allocation per TEXT value per row and roughly halves the bytes allocated on that path; on the new BenchmarkColumnTextScan cases it is ~13–20% faster for payloads of 256 B and larger, with no measurable change for very short strings. Purely internal: no API or behavioral change, and the returned string never aliases SQLite's buffer.

See [GitLab merge request #123](https://gitlab.com/cznic/sqlite/-/merge_requests/123), thanks Ian Chechin!

Cache each result column's declared type once per result set in newRows instead of recomputing it on every row. The TEXT branch of Rows.Next calls ColumnTypeDatabaseTypeName for every TEXT column on every row (independent of any DSN flag), which previously did a libc.GoString + strings.ToUpper each time; that lookup is now a single index into a cached, pre-uppercased []string, and ColumnTypeScanType reads the same cache and drops its per-call strings.ToLower. The declared type is fixed for the lifetime of a prepared statement, so the C round-trip is paid once per column rather than once per column per row, removing exactly 1 alloc + 8 B per TEXT column per row from the Next hot path. The new BenchmarkTextToTimeScan cases show ~7% faster on a 1000-row DATETIME SELECT under _texttotime=1. Purely internal: ColumnTypeDatabaseTypeName and ColumnTypeScanType return identical values, no API or behavioral change.

See [GitLab merge request #124](https://gitlab.com/cznic/sqlite/-/merge_requests/124), thanks Ian Chechin!

Cache, per result column, the parseTimeFormats index that first parsed a TEXT-stored DATE/DATETIME/TIMESTAMP value, and try that format first on later rows instead of re-walking the list from the top. (*conn).parseTime previously ran time.Parse down the format list on every such row; for the canonical SQLite TEXT datetime format every row paid two failed time.Parse attempts — each allocating a *time.ParseError — before the match. On a 1000-row DATETIME TEXT SELECT this cuts ~50% of allocs/op and ~57% of B/op and is ~37% faster. The fall-through chain is preserved exactly: the seven formats are mutually exclusive, so the cached hint can never select a different match than the in-order scan, and the parsed driver.Value is identical to before. Purely internal: no API or behavioral change.

See [GitLab merge request #125](https://gitlab.com/cznic/sqlite/-/merge_requests/125), thanks Ian Chechin!

2026-05-28 v1.51.0:

Pool the []driver.Value slice passed to scalar/aggregate UDF callbacks and to vtab Filter/Insert/Update callbacks, eliminating the dominant per-row allocation on UDF-heavy queries. Benchmarks on a 1000-row, 3-arg noop scalar UDF show ~40% fewer bytes/op and ~15% fewer allocs/op.

Document the matching "arguments are not valid past return" contract on vtab.Cursor.Filter and vtab.Updater.Insert/Update, consistent with the existing rule for FunctionImpl.Scalar / AggregateFunction.Step / WindowInverse.

Resolves [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #114](https://gitlab.com/cznic/sqlite/-/merge_requests/114), thanks Ian Chechin!

... (truncated)

Commits

693ff38 upgrade to SQLite 3.53.3
5d24346 Merge branch 'texttotime-aggregates' into 'master'
892d847 sqlite: document _texttotime empty-decltype upgrade, widen #248 comment, add ...
f2c8758 sqlite: _texttotime best-effort parse for empty-decltype TEXT columns (#248)
6b32d1e CHANGELOG.md: document experimental freebsd/386 + freebsd/arm (#119)
697300f Merge branch 'dbstatus-binding' into 'master'
759639f sqlite: review fixes for !132 — restore #131 CHANGELOG link, correct DBStatus...
40ff027 sqlite: add DBStatus wrapper for sqlite3_db_status + pcache spill-I/O benchmark
6a28fe7 HACKING.md: document CHANGELOG versioning + MR integration flow
adff4b1 Merge branch 'pcache-shared-cache-draft' into 'master'
Additional commits viewable in compare view

…y with 4 updates Bumps the backend-go-dependencies group with 4 updates in the /backend-go directory: [github.com/go-chi/chi/v5](https://github.com/go-chi/chi), [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang), [golang.org/x/crypto](https://github.com/golang/crypto) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite). Updates `github.com/go-chi/chi/v5` from 5.3.0 to 5.3.1 - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](go-chi/chi@v5.3.0...v5.3.1) Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1 - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.1/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.23.2...v1.24.1) Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0 - [Commits](golang/crypto@v0.53.0...v0.54.0) Updates `modernc.org/sqlite` from 1.52.0 to 1.54.0 - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.52.0...v1.54.0) --- updated-dependencies: - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-go-dependencies - dependency-name: github.com/prometheus/client_golang dependency-version: 1.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-go-dependencies - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-go-dependencies - dependency-name: modernc.org/sqlite dependency-version: 1.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 20, 2026

dependabot Bot requested a review from fabriziosalmi as a code owner July 20, 2026 17:25

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 20, 2026

dependabot Bot force-pushed the dependabot/go_modules/backend-go/backend-go-dependencies-855b0008f6 branch from 6dc21fd to 8b2ceff Compare July 27, 2026 17:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the backend-go-dependencies group across 1 directory with 4 updates - #178

chore(deps): bump the backend-go-dependencies group across 1 directory with 4 updates#178
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/backend-go/backend-go-dependencies-855b0008f6

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.3.1

What's Changed

New Contributors

v1.24.1 / 2026-07-23

What's Changed

v1.24.0 - 2026-07-20

Changes

1.24.1 / 2026-07-23

1.24.0 / 2026-07-20

Changelog

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading