chore(deps): bump the go-dependencies group with 4 updates #143

dependabot · 2025-08-03T09:06:10Z

Bumps the go-dependencies group with 4 updates: github.com/a-h/templ, github.com/golang-migrate/migrate/v4, github.com/jackc/pgx/v5 and github.com/labstack/echo/v4.

Updates github.com/a-h/templ from 0.2.793 to 0.3.924

Release notes

Sourced from github.com/a-h/templ's releases.

v0.3.924

Changelog

799d461 chore: bump version

ef5165e feat: add Ranges to GoComment parser nodes (#1225)

17484e5 fix: stop rebuilding application if text-only changes have occurred in dev mode (#1227)

v0.3.920

Changelog

fedfcd4 Update 04-datastar.md (#1214)

8fd80ac chore(docs): bump docs dependencies

23ccc90 chore: bump chi deps in example

d6338ec chore: bump version

554776e chore: update copilot instructions

542b139 feat: add fragment rendering support (#1216)

39303d6 fix(lsp): suppress gopls warning about editing generated file (#1221, fixes #1200)

732862b fix: add support for spreading non-string attribute values in RenderAttributes (#1213)

79a8e2f refactor: move expressionAttributeValueURL check to separate function (#1206)

e2a87c1 refactor: remove map use when it isn't needed

73832bd refactor: rework generator command (#1211)

v0.3.906

Changelog

c086e47 chore: bump version file

15199ff chore: updated storybook installation command with a features flag (#1185)

27dd1a4 feat: pass stdin to watched commands (#1195)

838a60a feat: push Nix packaging to Flakehub

7df55ec feat: support string types and functions for URL attributes - no longer require templ.SafeURL - fixes #1167 (#1171)

2874448 fix(lsp): prevent LSP panic in cases where elements are nil

c9bd939 fix: comments don't eat newlines (#1186)

f9f9f3a fix: handle live import declaration changes in lazy loader (#1192)

9ad7ba1 fix: prevent request failure notification spam for new files in lazy loader (#1202)

63238fc refactor: allow more flexible parsing of expression attributes (#1197)

780cab0 refactor: don't block if timer runs out (behaviour change from Go 1.23) (#1179)

9b34663 refactor: replace document open count with package reference count in lazy loader (#1187)

v0.3.898

Changelog

b3a6561 chore: bump version [no-ci]

7df55ec feat: support string types and functions for URL attributes - no longer require templ.SafeURL - fixes #1167 (#1171)

2874448 fix(lsp): prevent LSP panic in cases where elements are nil

780cab0 refactor: don't block if timer runs out (behaviour change from Go 1.23) (#1179)

v0.3.894

Changelog

32ee560 chore: bump nix flake

608c516 fix(lsp): set range on invalid parse results, fixes #1176 (#1178)

9fc3954 fix: add nonce attribute to style tag (#1164)

18dda56 refactor: fix linter warnings (#1175)

f74b870 refactor: standardise error messages, fixes #1173 (#1174)

... (truncated)

Commits

799d461 chore: bump version
17484e5 fix: stop rebuilding application if text-only changes have occurred in dev mo...
ef5165e feat: add Ranges to GoComment parser nodes (#1225)
231ce01 docs: fix syntax highlighting in docs [no-ci]
d6338ec chore: bump version
8fd80ac chore(docs): bump docs dependencies
e2a87c1 refactor: remove map use when it isn't needed
39303d6 fix(lsp): suppress gopls warning about editing generated file (#1221, fixes #...
79a8e2f refactor: move expressionAttributeValueURL check to separate function (#1206)
542b139 feat: add fragment rendering support (#1216)
Additional commits viewable in compare view

Updates github.com/golang-migrate/migrate/v4 from 4.18.2 to 4.18.3

Release notes

Sourced from github.com/golang-migrate/migrate/v4's releases.

v4.18.3

Changelog

a4d0a1b Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2

f37ef79 Bump golang.org/x/crypto from 0.31.0 to 0.35.0

5b97c92 Bump golang.org/x/net from 0.33.0 to 0.38.0

e6d84f6 Drop support for Go 1.22 and add support for Go 1.24

fccd197 Mention CLI install instructions in main README

34c2b4a Remove redundant build tags

a868033 Update FAQ.md - typo

7269490 Update golangci-lint version used in GitHub Actions

c5137c4 Update migrate -help output for the readme file

033835a Update to dktest v0.4.5

8b09191 fix: typo limited not limitted

60d73be refactor: replace github.com/pkg/errors with stdlib

36d17ba tests: fix various tests (#1209)

Commits

9023d66 Merge pull request #1244 from alexandear-org/chore-redundant-build-tags
1049490 Merge pull request #1179 from lunfel/master
033835a Update to dktest v0.4.5
329152e Merge pull request #1196 from Rambatino/patch-1
34c2b4a Remove redundant build tags
a3b7633 Merge pull request #1259 from golang-migrate/dependabot/go_modules/golang.org...
5b97c92 Bump golang.org/x/net from 0.33.0 to 0.38.0
3c3ce91 Merge pull request #1258 from golang-migrate/dependabot/go_modules/golang.org...
f37ef79 Bump golang.org/x/crypto from 0.31.0 to 0.35.0
1af841d Merge pull request #1260 from dhui/update_go
Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.7.1 to 5.7.5

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.7.5 (May 17, 2025)

Support sslnegotiation connection option (divyam234)

Update golang.org/x/crypto to v0.37.0. This placates security scanners that were unable to see that pgx did not use the behavior affected by https://pkg.go.dev/vuln/GO-2025-3487.

TraceLog now logs Acquire and Release at the debug level (dave sinclair)

Add support for PGTZ environment variable

Add support for PGOPTIONS environment variable

Unpin memory used by Rows quicker

Remove PlanScan memoization. This resolves a rare issue where scanning could be broken for one type by first scanning another. The problem was in the memoization system and benchmarking revealed that memoization was not providing any meaningful benefit.

5.7.4 (March 24, 2025)

Fix / revert change to scanning JSON null (Felix Röhrich)

5.7.3 (March 21, 2025)

Expose EmptyAcquireWaitTime in pgxpool.Stat (vamshiaruru32)

Improve SQL sanitizer performance (ninedraft)

Fix Scan confusion with json(b), sql.Scanner, and automatic dereferencing (moukoublen, felix-roehrich)

Fix Values() for xml type always returning nil instead of []byte

Add ability to send Flush message in pipeline mode (zenkovev)

Fix pgtype.Timestamp's JSON behavior to match PostgreSQL (pconstantinou)

Better error messages when scanning structs (logicbomb)

Fix handling of error on batch write (bonnefoa)

Match libpq's connection fallback behavior more closely (felix-roehrich)

Add MinIdleConns to pgxpool (djahandarie)

5.7.2 (December 21, 2024)

Fix prepared statement already exists on batch prepare failure

Add commit query to tx options (Lucas Hild)

Fix pgtype.Timestamp json unmarshal (Shean de Montigny-Desautels)

Add message body size limits in frontend and backend (zene)

Add xid8 type

Ensure planning encodes and scans cannot infinitely recurse

Implement pgtype.UUID.String() (Konstantin Grachev)

Switch from ExecParams to Exec in ValidateConnectTargetSessionAttrs functions (Alexander Rumyantsev)

Update golang.org/x/crypto

Fix json(b) columns prefer sql.Scanner interface like database/sql (Ludovico Russo)

Commits

15bca4a Release v5.7.5
1d557f9 Remove PlanScan memoization
de7fe81 Use reflect.TypeFor instead of reflect.TypeOf
d9eb089 Remove unused function
6be24eb Fix comment typo
07871c0 Zero internal baseRows references to allow GC earlier
777e7e5 Merge pull request #2313 from stampy88/tracelog_pool_additions
151bd02 Switched to LogLevelDebug
540fcaa Add support for PGOPTIONS environment variable
3a248e3 Add support for PGTZ environment variable
Additional commits viewable in compare view

Updates github.com/labstack/echo/v4 from 4.12.0 to 4.13.4

Release notes

Sourced from github.com/labstack/echo/v4's releases.

v4.13.4

What's Changed

chore: fix some typos in comment by @zhuhaicity in labstack/echo#2735

CI: test with Go 1.24 by @aldas in labstack/echo#2748

Add support for TLS WebSocket proxy by @t-ibayashi-safie in labstack/echo#2762

Security

Update dependencies for GO-2025-3487, GO-2025-3503 and GO-2025-3595 in labstack/echo#2780

New Contributors

@zhuhaicity made their first contribution in labstack/echo#2735

@t-ibayashi-safie made their first contribution in labstack/echo#2762

Full Changelog: labstack/echo@v4.13.3...v4.13.4

v4.13.3

Security

Update golang.org/x/net dependency GO-2024-3333 in labstack/echo#2722

Full Changelog: labstack/echo@v4.13.2...v4.13.3

v4.13.2 - update dependencies

Security

Update dependencies (dependabot reports https://pkg.go.dev/vuln/GO-2024-3321 by @aldas in labstack/echo#2721

Full Changelog: labstack/echo@v4.13.1...v4.13.2

v4.13.1

Fixes

Fix BindBody ignoring Transfer-Encoding: chunked requests (introduced in #2710) by @178inaba in labstack/echo#2717

Full Changelog: labstack/echo@v4.13.0...v4.13.1

JWT Middleware Removed

BREAKING CHANGE: JWT Middleware Removed from Core

The JWT middleware has been removed from Echo core due to another security vulnerability, CVE-2024-51744. For more details, refer to issue #2699. A drop-in replacement is available in the labstack/echo-jwt repository or see alternative implementation

Important: Direct assignments like token := c.Get("user").(*jwt.Token) will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from "github.com/golang-jwt/jwt" in your handlers to the new middleware version using "github.com/golang-jwt/jwt/v5".

... (truncated)

Changelog

Sourced from github.com/labstack/echo/v4's changelog.

v4.13.4 - 2025-05-22

Enhancements

chore: fix some typos in comment by @zhuhaicity in labstack/echo#2735

CI: test with Go 1.24 by @aldas in labstack/echo#2748

Add support for TLS WebSocket proxy by @t-ibayashi-safie in labstack/echo#2762

Security

Update dependencies for GO-2025-3487, GO-2025-3503 and GO-2025-3595 in labstack/echo#2780

v4.13.3 - 2024-12-19

Security

Update golang.org/x/net dependency GO-2024-3333 in labstack/echo#2722

v4.13.2 - 2024-12-12

Security

Update dependencies (dependabot reports GO-2024-3321) in labstack/echo#2721

v4.13.1 - 2024-12-11

Fixes

Fix BindBody ignoring Transfer-Encoding: chunked requests by @178inaba in labstack/echo#2717

v4.13.0 - 2024-12-04

BREAKING CHANGE JWT Middleware Removed from Core use labstack/echo-jwt instead

The JWT middleware has been removed from Echo core due to another security vulnerability, CVE-2024-51744. For more details, refer to issue #2699. A drop-in replacement is available in the labstack/echo-jwt repository.

Important: Direct assignments like token := c.Get("user").(*jwt.Token) will now cause a panic due to an invalid cast. Update your code accordingly. Replace the current imports from "github.com/golang-jwt/jwt" in your handlers to the new middleware version using "github.com/golang-jwt/jwt/v5".

Background:

The version of golang-jwt/jwt (v3.2.2) previously used in Echo core has been in an unmaintained state for some time. This is not the first vulnerability affecting this library; earlier issues were addressed in [PR #1946](labstack/echo#1946). JWT middleware was marked as deprecated in Echo core as of v4.10.0 on 2022-12-27. If you did not notice that, consider leveraging tools like Staticcheck to catch such deprecations earlier in you dev/CI flow. For bonus points - check out gosec.

We sincerely apologize for any inconvenience caused by this change. While we strive to maintain backward compatibility within Echo core, recurring security issues with third-party dependencies have forced this decision.

... (truncated)

Commits

98ca08e Improve changelog for 4.13.4 (#2783)
f24aaff Revert "CORS: reject requests with 401 for non-preflight request with not mat...
9f50a65 Changelog for 4.13.4 (#2781)
d735cb6 Upgrade dependencies (#2780)
de44c53 Add support for TLS WebSocket proxy (#2762)
c44f628 CI: test with Go 1.24 (#2748)
ce0b12a chore: fix some typos in comment (#2735)
ee3e129 CORS: reject requests with 401 for non-preflight request with not matching or...
45524e3 Update golang.org/x/net dependency [GO-2024-3333](https://pkg.go.dev/vuln/GO-...
692bc2a Update dependencies (dependabot reports https://pkg.go.dev/vuln/GO-2024-3321)...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the go-dependencies group with 4 updates: [github.com/a-h/templ](https://github.com/a-h/templ), [github.com/golang-migrate/migrate/v4](https://github.com/golang-migrate/migrate), [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) and [github.com/labstack/echo/v4](https://github.com/labstack/echo). Updates `github.com/a-h/templ` from 0.2.793 to 0.3.924 - [Release notes](https://github.com/a-h/templ/releases) - [Changelog](https://github.com/a-h/templ/blob/main/.goreleaser.yaml) - [Commits](a-h/templ@v0.2.793...v0.3.924) Updates `github.com/golang-migrate/migrate/v4` from 4.18.2 to 4.18.3 - [Release notes](https://github.com/golang-migrate/migrate/releases) - [Changelog](https://github.com/golang-migrate/migrate/blob/master/.goreleaser.yml) - [Commits](golang-migrate/migrate@v4.18.2...v4.18.3) Updates `github.com/jackc/pgx/v5` from 5.7.1 to 5.7.5 - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.7.1...v5.7.5) Updates `github.com/labstack/echo/v4` from 4.12.0 to 4.13.4 - [Release notes](https://github.com/labstack/echo/releases) - [Changelog](https://github.com/labstack/echo/blob/master/CHANGELOG.md) - [Commits](labstack/echo@v4.12.0...v4.13.4) --- updated-dependencies: - dependency-name: github.com/a-h/templ dependency-version: 0.3.924 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies - dependency-name: github.com/golang-migrate/migrate/v4 dependency-version: 4.18.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.7.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/labstack/echo/v4 dependency-version: 4.13.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2025-09-15T18:38:39Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot rebase.

dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 3, 2025

dependabot bot force-pushed the dependabot/go_modules/go-dependencies-eb308248f5 branch from db8a6e2 to 41845c7 Compare August 11, 2025 18:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): bump the go-dependencies group with 4 updates #143

chore(deps): bump the go-dependencies group with 4 updates #143

Uh oh!

dependabot bot commented on behalf of github Aug 3, 2025 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Sep 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

chore(deps): bump the go-dependencies group with 4 updates #143

Are you sure you want to change the base?

chore(deps): bump the go-dependencies group with 4 updates #143

Uh oh!

Conversation

dependabot bot commented on behalf of github Aug 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.3.924

Changelog

v0.3.920

Changelog

v0.3.906

Changelog

v0.3.898

Changelog

v0.3.894

Changelog

v4.18.3

Changelog

5.7.5 (May 17, 2025)

5.7.4 (March 24, 2025)

5.7.3 (March 21, 2025)

5.7.2 (December 21, 2024)

v4.13.4

What's Changed

New Contributors

v4.13.3

v4.13.2 - update dependencies

v4.13.1

JWT Middleware Removed

BREAKING CHANGE: JWT Middleware Removed from Core

v4.13.4 - 2025-05-22

v4.13.3 - 2024-12-19

v4.13.2 - 2024-12-12

v4.13.1 - 2024-12-11

v4.13.0 - 2024-12-04

Uh oh!

dependabot bot commented on behalf of github Sep 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Aug 3, 2025 •

edited

Loading