build(deps): bump the gomod group with 2 updates

[dependabot]

Bumps the gomod group with 2 updates: github.com/pressly/goose/v3 and github.com/stephenafamo/bob.

Updates github.com/pressly/goose/v3 from 3.27.2 to 3.27.3

Release notes

Sourced from github.com/pressly/goose/v3's releases.

v3.27.3

Changed

• Various dependency upgrades

Changelog

Sourced from github.com/pressly/goose/v3's changelog.

[v3.27.3] - 2026-07-22

Changed

• Various dependency upgrades

Commits

• 520411a release: v3.27.3
• 26403f9 build(deps): update internal/testing dependencies
• abcfbd1 ci: pin GitHub Actions to commit SHAs
• a54dd54 build(deps): bump actions/setup-go from 6 to 7 (#1094)
• 27c2f4f build(deps): update dependencies
• a443d13 fix: capture markdown subsections in release-notes.sh
• See full diff in compare view

Updates github.com/stephenafamo/bob from 0.48.0 to 0.49.0

Release notes

Sourced from github.com/stephenafamo/bob's releases.

v0.49.0

Added

• Added bob.NextUniqueInt() for generating unique SQL alias suffixes (#719). (thanks @​atzedus)
• Code generation now emits a reflection-free scan.Mapper per table (<table>ScanMapper) that scans each result column directly into the struct field by index. The mapper is passed to the model constructor, so every query built from a model — Query(), relationship loaders, and Insert/Update/Delete with RETURNING — scans without the per-row reflection of scan.StructMapper. (thanks @​sandonemaki)
• Generated Where structs now include relationship filters under an R field (e.g. SelectWhere.Pilots.R.HasJets(filters ...bob.Mod[*dialect.SelectQuery])) that filter rows by the existence of related rows, using a correlated EXISTS subquery (semi-join) built from the schema's relationship definitions. The R namespace mirrors the model struct and keeps the filters from colliding with column names. Unlike filtering through SelectJoins, this does not multiply parent rows, so DISTINCT is not needed and Count()/LIMIT-based pagination stay correct (#722). (thanks @​sandonemaki)

Changed

• NewViewx and NewTablex in the psql, mysql and sqlite dialects now take a scan.Mapper[T] argument used for all queries built from the view/table. Pass nil to keep the previous reflection-based scan.StructMapper behaviour. NewView/NewTable are unchanged. (thanks @​sandonemaki)
• JOIN a DISTINCT unnest(...) for composite-key relationship loaders & counts on PostgreSQL. (thanks @​sandonemaki)

Fixed

• Fixed an unused type import (e.g. github.com/google/uuid) in generated models when the type is only referenced through optional wrapper expressions, such as m2m relationship helpers for a join table with a uuid column (#730).
• Fixed the counts plugin's generated C field reusing the relation_tag struct tag, which collided with the relations R field and caused encoding/json to drop both fields when a real tag name was configured. The C field now uses a dedicated relation_tag_count config option (default "-"). (thanks @​jacobmolby)
• Fixed generated join alias suffixes using randInt(), which could produce negative values when maphash.Hash.Sum64() overflowed int64 (#719). Generated join mods now use bob.NextUniqueInt() instead. (thanks @​atzedus)
• Fixed orm.Query.Clone() dropping the Scanner, which made All/One/Cursor/Each on a cloned query panic with a nil pointer dereference. (thanks @​sandonemaki)
• Fixed column_order on * selectors in sql queries in postgres

New Contributors

• @​Leonard013 made their first contribution in stephenafamo/bob#734

Full Changelog: stephenafamo/bob@v0.48.0...v0.49.0

Changelog

Sourced from github.com/stephenafamo/bob's changelog.

[v0.49.0] - 2026-07-20

Added

• Added bob.NextUniqueInt() for generating unique SQL alias suffixes (#719). (thanks @​atzedus)
• Code generation now emits a reflection-free scan.Mapper per table (<table>ScanMapper) that scans each result column directly into the struct field by index. The mapper is passed to the model constructor, so every query built from a model — Query(), relationship loaders, and Insert/Update/Delete with RETURNING — scans without the per-row reflection of scan.StructMapper. (thanks @​sandonemaki)
• Generated Where structs now include relationship filters under an R field (e.g. SelectWhere.Pilots.R.HasJets(filters ...bob.Mod[*dialect.SelectQuery])) that filter rows by the existence of related rows, using a correlated EXISTS subquery (semi-join) built from the schema's relationship definitions. The R namespace mirrors the model struct and keeps the filters from colliding with column names. Unlike filtering through SelectJoins, this does not multiply parent rows, so DISTINCT is not needed and Count()/LIMIT-based pagination stay correct (#722). (thanks @​sandonemaki)

Changed

• NewViewx and NewTablex in the psql, mysql and sqlite dialects now take a scan.Mapper[T] argument used for all queries built from the view/table. Pass nil to keep the previous reflection-based scan.StructMapper behaviour. NewView/NewTable are unchanged. (thanks @​sandonemaki)
• JOIN a DISTINCT unnest(...) for composite-key relationship loaders & counts on PostgreSQL. (thanks @​sandonemaki)

Fixed

• Fixed an unused type import (e.g. github.com/google/uuid) in generated models when the type is only referenced through optional wrapper expressions, such as m2m relationship helpers for a join table with a uuid column (#730).
• Fixed the counts plugin's generated C field reusing the relation_tag struct tag, which collided with the relations R field and caused encoding/json to drop both fields when a real tag name was configured. The C field now uses a dedicated relation_tag_count config option (default "-"). (thanks @​jacobmolby)
• Fixed generated join alias suffixes using randInt(), which could produce negative values when maphash.Hash.Sum64() overflowed int64 (#719). Generated join mods now use bob.NextUniqueInt() instead. (thanks @​atzedus)
• Fixed orm.Query.Clone() dropping the Scanner, which made All/One/Cursor/Each on a cloned query panic with a nil pointer dereference. (thanks @​sandonemaki)
• Fixed column_order on * selectors in sql queries in postgres

Commits

• 13274cf Update CHANGELOG for v0.49.0
• 2786e9c Update stephenafamo/scan package
• eaef8c8 Merge pull request #722 from sandonemaki/semi-join
• f17f649 Update changelog
• 340569e Merge pull request #718 from sandonemaki/perf/loader-eq-any-composite_index
• f64c0cd Merge remote-tracking branch 'upstream/main' into semi-join
• 483878b refactor(gen): move Has{Rel} filters under the Where struct's R field
• c2c9005 Merge pull request #729 from sandonemaki/perf/copy-matching-rows-map
• 37235cc Merge pull request #727 from sandonemaki/perf/loader-through-mapper-byindex
• 7a63c0a Merge pull request #726 from sandonemaki/perf/after-preloader-generics
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Package	Line Rate	Health
Backend (Go)
github.com/Toshik1978/folio/internal/api	80%	➖
github.com/Toshik1978/folio/internal/auth	81%	✔
github.com/Toshik1978/folio/internal/bookfile	85%	✔
github.com/Toshik1978/folio/internal/config	57%	➖
github.com/Toshik1978/folio/internal/covers	87%	✔
github.com/Toshik1978/folio/internal/db	87%	✔
github.com/Toshik1978/folio/internal/db/dbq	77%	➖
github.com/Toshik1978/folio/internal/ebook	84%	✔
github.com/Toshik1978/folio/internal/events	98%	✔
github.com/Toshik1978/folio/internal/googlebooks	87%	✔
github.com/Toshik1978/folio/internal/htmltext	100%	✔
github.com/Toshik1978/folio/internal/ingest	82%	✔
github.com/Toshik1978/folio/internal/logging	93%	✔
github.com/Toshik1978/folio/internal/metasearch	98%	✔
github.com/Toshik1978/folio/internal/metasearch/providers/amazon	87%	✔
github.com/Toshik1978/folio/internal/metasearch/providers/goodreads	90%	✔
github.com/Toshik1978/folio/internal/metasearch/providers/googlebooks	76%	➖
github.com/Toshik1978/folio/internal/metasearch/providers/openlibrary	82%	✔
github.com/Toshik1978/folio/internal/opds	86%	✔
github.com/Toshik1978/folio/internal/server	92%	✔
github.com/Toshik1978/folio/internal/settings	86%	✔
github.com/Toshik1978/folio/internal/sync	83%	✔
Frontend (Web)
web/src	83%	✔
web/src/components	81%	✔
web/src/components.settings	95%	✔
web/src/composables	94%	✔
web/src/pages	89%	✔
web/src/utils	100%	✔
Summary	85% (8167 / 9805)	✔