Skip to content

build(deps): bump the go_modules group across 1 directory with 3 updates - #23

Merged
strahe merged 1 commit into
mainfrom
dependabot/go_modules/go_modules-8f2b5c931b
Sep 22, 2026
Merged

strahe merged 1 commit into
mainfrom
dependabot/go_modules/go_modules-8f2b5c931b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the go_modules group with 3 updates in the / directory: github.com/gofiber/fiber/v2, github.com/jackc/pgx/v5 and github.com/rabbitmq/amqp091-go.

Updates github.com/gofiber/fiber/v2 from 2.52.13 to 2.52.14

Release notes

Sourced from github.com/gofiber/fiber/v2's releases.

v2.52.14

What's Changed

🐛 Bug Fixes

New Contributors

Full Changelog: gofiber/fiber@v2.52.13...v2.52.14

Commits
  • a74500f Update fiber package version to 2.52.14
  • 33c9501 Merge pull request #4495 from terraincognita07/backport-v2-balancer-forward-x...
  • 1b071e1 Merge branch 'v2' into backport-v2-balancer-forward-x-real-ip
  • 6772121 Merge pull request #4498 from gofiber/fix/v2-parser-decoder-global-leak
  • 396416e test(ctx): restore global parser decoder after SetParserDecoder tests
  • da6126b Merge branch 'v2' into backport-v2-balancer-forward-x-real-ip
  • 79d3444 Merge pull request #4497 from gofiber/ci/v2-gotestsum-rerun-fails
  • bd6da95 test(proxy): fix data race and flaky deadline test in v2 CI
  • 493b955 ci: set least-privilege GITHUB_TOKEN permissions on the test workflow
  • 2fbfa7d ci: drop redundant advanced CodeQL workflow (default setup covers it)
  • Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.9.2 (April 18, 2026)

Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)

SQL injection can occur when:

  1. The non-default simple protocol is used.
  2. A dollar quoted string literal is used in the SQL query.
  3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
  4. The value of that placeholder is controllable by the attacker.

e.g.

attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue)

This is unlikely to occur outside of a contrived scenario.

Commits
  • 0aeabbc Release v5.9.2
  • 60644f8 Fix SQL sanitizer bugs with dollar-quoted strings and placeholder overflow
  • a5680bc Merge pull request #2531 from dolmen-go/godoc-add-links
  • e34e452 doc: Add godoc links
  • 08c9bb1 Fix Stringer types encoded as text instead of numeric value in composite fields
  • 96b4dbd Remove unstable test
  • acf88e0 Merge pull request #2526 from abrightwell/abrightwell-min-proto
  • 2f81f1f Update max_protocol_version and min_protocol_version defaults
  • See full diff in compare view

Updates github.com/rabbitmq/amqp091-go from 1.11.0 to 1.13.0

Release notes

Sourced from github.com/rabbitmq/amqp091-go's releases.

v1.13.0

What's Changed

Full Changelog: rabbitmq/amqp091-go@v1.12.0...v1.13.0

v1.12.0

What's Changed

New Contributors

Full Changelog: rabbitmq/amqp091-go@v1.11.0...v1.12.0

Changelog

Sourced from github.com/rabbitmq/amqp091-go's changelog.

v1.13.0 (2026-07-21)

Full Changelog

Implemented enhancements:

  • feat: skip-and-continue topology recovery with per-entity error surfacing #365 (suchitd)
  • Make TopologyRecoveryAllEnabled the default topology recovery mode #362 (suchitd)
  • feature: implement automatic topology recovery #357 (suchitd)

Fixed bugs:

  • Evict auto-delete queues and exchanges from topology store to prevent stale resurrection during recovery #368
  • Data race in Connection.shutdown between buffered listener send goroutine and close(listener) #360
  • fix: reject frames exceeding negotiated frame_max before allocation #369 (suchitd)
  • fix: prevent recursive channel recovery during connection reconnection #367 (suchitd)
  • fix: eliminate multiple data races in Channel and Connection operations #366 (suchitd)
  • fix: forget auto-delete topology on last consumer/binding removal #363 (suchitd)
  • fix: explicitly enforce TLS 1.2 minimum version in tlsConfigFromURI #355 (suchitd)
  • fix: return error when shortstr exceeds 255 bytes #354 (suchitd)
  • fix: enforce AMQP minimum frame size during negotiation #353 (suchitd)
  • fix: URL-encode TLS file paths in URI.String() query string #352 (suchitd)
  • Reject negative prefetch values in Qos #351 (suchitd)
  • fix: redact and zero out plaintext SASL credentials after handshake #350 (suchitd)
  • Avoid notifications blocking reader. #349 (MirahImage)
  • Return error when longstring too long. #347 (MirahImage)
  • Cap body pre-allocation to FrameMax. #346 (MirahImage)
  • Safely handle negative x- field length. #344 (MirahImage)

Merged pull requests:

  • chore(deps): bump actions/setup-go from 6 to 7 in the github-actions group #370 (dependabot[bot])
  • docs: update CLAUDE.md to document automatic recovery and new notify methods #359 (suchitd)
  • chore(deps): bump actions/cache from 5 to 6 in the github-actions group #358 (dependabot[bot])
  • chore(deps): bump actions/checkout from 6 to 7 in the github-actions group #356 (dependabot[bot])

v1.12.0 (2026-06-16)

Full Changelog

Implemented enhancements:

  • Feature: implement automatic connection and channel recovery with state change notifications #339 (suchitd)
  • Add integration test for publish with immediate flag #338 (suchitd)
  • Add integration tests for QueueUnbind and QueuePurge #337 (suchitd)
  • Add integration test for exchange-to-exchange binding and unbinding #336 (suchitd)

Fixed bugs:

  • Fix Client example to work with RabbitMQ 4.3 #341 (suchitd)

... (truncated)

Commits
  • d26d57e Release v1.13.0
  • df5953b Merge pull request #365 from rabbitmq/feature/topology-recovery-skip-failure-...
  • 80e7d1e refactor: extract Channel.reopenIfClosed, fix channel-id leak, add error context
  • 2219a1f fix: infinite recovery loop from skipped, permanently-failing topology entities
  • 3d42358 refactor: remove isRecoverable check in favor of unified recovery shunts
  • cb4e045 Enhance TopologyRecoveryEntity to work with bindings
  • d69d856 feat: skip-and-continue topology recovery with per-entity error surfacing
  • 1b0bfd8 chore(deps): bump actions/setup-go in the github-actions group (#370)
  • 08f7f63 fix: reject frames exceeding negotiated frame_max before allocation (#369)
  • 3a6c497 fix: eliminate multiple data races in Channel and Connection operations (#366)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the go_modules group with 3 updates in the / directory: [github.com/gofiber/fiber/v2](https://github.com/gofiber/fiber), [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) and [github.com/rabbitmq/amqp091-go](https://github.com/rabbitmq/amqp091-go).


Updates `github.com/gofiber/fiber/v2` from 2.52.13 to 2.52.14
- [Release notes](https://github.com/gofiber/fiber/releases)
- [Commits](gofiber/fiber@v2.52.13...v2.52.14)

Updates `github.com/jackc/pgx/v5` from 5.9.1 to 5.9.2
- [Release notes](https://github.com/jackc/pgx/releases)
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.9.1...v5.9.2)

Updates `github.com/rabbitmq/amqp091-go` from 1.11.0 to 1.13.0
- [Release notes](https://github.com/rabbitmq/amqp091-go/releases)
- [Changelog](https://github.com/rabbitmq/amqp091-go/blob/main/CHANGELOG.md)
- [Commits](rabbitmq/amqp091-go@v1.11.0...v1.13.0)

---
updated-dependencies:
- dependency-name: github.com/gofiber/fiber/v2
  dependency-version: 2.52.14
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.9.2
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: github.com/rabbitmq/amqp091-go
  dependency-version: 1.13.0
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 22, 2026
@strahe
strahe merged commit c8bd820 into main Sep 22, 2026
10 checks passed
@strahe
strahe deleted the dependabot/go_modules/go_modules-8f2b5c931b branch September 22, 2026 05:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant