[dependabot]

Bumps the go group with 3 updates: github.com/duckdb/duckdb-go/v2, github.com/labstack/echo/v5 and modernc.org/sqlite.

Updates github.com/duckdb/duckdb-go/v2 from 2.10506.0 to 2.20000.0

Release notes

Sourced from github.com/duckdb/duckdb-go/v2's releases.

v2.20000.0

[!IMPORTANT] Upgrades to DuckDB v2.0.0 through duckdb-go-bindings v0.20000.0. The native libraries now come from go.duckdb.org, so setups that restrict GOPROXY must allow it. The Go API is unchanged, but some behavior changes with DuckDB v2: RowsAffected for CREATE TABLE AS, profiling metrics, and dropped rows after a failed appender flush. Custom dynamic and static linking changed too. See Upgrading to DuckDB v2 in the README.

What's Changed

• fix: stop the interrupter goroutine when the wrapped call panics by @​hellower in duckdb/duckdb-go#190
• fix: bind nil elements of LIST and ARRAY parameters by @​hellower in duckdb/duckdb-go#191
• fix: bind nil composites as NULL and reject invalid values by @​mlafeldt in duckdb/duckdb-go#196
• Clarify parameter restrictions in multi-statement queries by @​mlafeldt in duckdb/duckdb-go#198
• Fix missing newlines in table UDF examples by @​mlafeldt in duckdb/duckdb-go#199
• Fix UUID sign bit when constructing bound values by @​mlafeldt in duckdb/duckdb-go#200
• Reject named arguments as positional binding fallbacks by @​mlafeldt in duckdb/duckdb-go#201
• Preserve the local calendar date when encoding DATE by @​mlafeldt in duckdb/duckdb-go#202
• Reject out-of-range DATE values instead of silently wrapping them by @​mlafeldt in duckdb/duckdb-go#203
• Update CI actions and golangci-lint by @​mlafeldt in duckdb/duckdb-go#205
• Run CI on Namespace runners to avoid hours-long queues by @​mlafeldt in duckdb/duckdb-go#206
• Skip macOS x64 tests on PRs by @​mlafeldt in duckdb/duckdb-go#211
• Reject Clear calls on closed appenders by @​mlafeldt in duckdb/duckdb-go#212
• Simplify CI runner and platform setup by @​mlafeldt in duckdb/duckdb-go#214
• Upgrade to DuckDB v2 by @​mlafeldt in duckdb/duckdb-go#217

Full Changelog: duckdb/duckdb-go@v2.10506.0...v2.20000.0

Commits

• bb8380a Merge pull request #217 from mlafeldt/duckdb-v2-bindings
• cd69e0f Document that a failed AppendRow does not append its row
• 76fd883 Verify the shared library the dynamic lib tests download
• 554d7ae Document upgrading to DuckDB v2
• c936ff5 Test dynamic and static linking against the bindings' DuckDB build
• 7863d1a Report dropped appender rows on Close until Clear acknowledges them
• 1ce76d5 Read profiling metrics from DuckDB v2's metric groups
• b4db755 Match DuckDB v2's query logging in TestLogStorage
• bc675d8 Expect CREATE TABLE AS to report its rows as affected
• 725eb6c Return nil for typed NULL UDF arguments instead of aborting
• Additional commits viewable in compare view

Updates github.com/labstack/echo/v5 from 5.4.0 to 5.4.1

Release notes

Sourced from github.com/labstack/echo/v5's releases.

v5.4.1

Security fixes

Upgrade with go get github.com/labstack/echo/v5@v5.4.1.

• Validate the sending peer before accepting X-Real-IP in ExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured. GHSA-h53f-rm2w-w7rg
• Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
• Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
• Preserve the complete request body beyond the BodyDump capture limit and propagate read errors, including BodyLimit overflows. GHSA-x9ff-22gv-65f4, #3105
• Restore the original response writer before returning BodyDump buffers to the pool, preventing writes into a reused buffer during error handling. #3174
• Accept decompressed bodies exactly at the configured limit; keep overflow errors sticky. #3136
• Include the BodyLimit overflow-check correction and static-path hardening already merged since v5.4.0.

Behavior to review when upgrading

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

BodyDump capture limits bound logging only: handlers receive the full request, and clients receive the full response. Applications must still consume request bodies and handle read errors to enforce streaming body limits.

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain.

Other changes

This release also includes ValidateCtx, router fixes for escaped colons, custom methods and parameter storage, binding support for OpenAPI date formats, and documentation updates.

Thanks to @​rm-Umar, @​Duodum, @​irisitymichaelgrundberg, @​Hama1cco, @​jakezwang, @​Shubham-Padkonde and @​rajpreetcodes for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities.

Full changelog: labstack/echo@v5.4.0...v5.4.1

Changelog

Sourced from github.com/labstack/echo/v5's changelog.

Changelog

Commits

• a6a9673 chore: prepare v5.4.1 security release (#3185)
• 1855061 Merge commit from fork
• 8fd0e18 feat(context): add ValidateCtx (#3152)
• 3882266 docs: move support terms to .github/SUPPORT.md (#3165)
• 1836fed docs: refresh README badges (#3164)
• f098cb2 docs: add Support sponsorship terms (#3163)
• 199f7d8 docs: add Used by section, ADOPTERS.md and tidy README (#3161)
• 2968240 fix(router): removing a route with a custom method panics (#3160)
• 4f7bea5 fix(router): grow PathValues for contexts created before a route with more pa...
• 40c22f4 docs(group): explain how group catch-all NotFound routes replace RouteNotFoun...
• Additional commits viewable in compare view

Updates modernc.org/sqlite from 1.60.1 to 1.61.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

• 2026-10-21 v1.61.1:

  • Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!
  • Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.
  • Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!
  • The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.
  • Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

• 2026-10-21 v1.61.0:

  • Upgrade to SQLite 3.54.1, re-vendoring lib/ from modernc.org/libsqlite3 v1.15.2 and vec/ from modernc.org/libsqlite_vec v0.7.0; sqlite-vec stays v0.1.9. The pinned modernc.org/libc becomes v1.79.0; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Add _time_format=string_no_monotonic, opt-in: times are written in the default layout but without Go's monotonic clock reading, the m=+... suffix, so a scanned time matches its row again when bound in WHERE col = ?. The default is unchanged. Resolves [GitLab issue #259](https://gitlab.com/cznic/sqlite/-/issues/259). See [GitLab merge request #142](https://gitlab.com/cznic/sqlite/-/merge_requests/142), thanks 不插电 (@​r27153733)!
  • Each release tag now gets a signed provenance document, linked from its GitLab release; VERIFYING.md says what it proves and how to check one. Tooling only. See [GitLab merge request #141](https://gitlab.com/cznic/sqlite/-/merge_requests/141).
  • Add an opt-in SQLite authorizer per connection: AuthorizerRegisterer, reached through sql.Conn.Raw or installed on every pooled connection from RegisterConnectionHook; existing connections are unchanged. Resolves [GitLab issue #256](https://gitlab.com/cznic/sqlite/-/issues/256). See [GitLab merge request #139](https://gitlab.com/cznic/sqlite/-/merge_requests/139), thanks Tedla Brandsema (@​TedlaBrandsema)!
  • Closing a connection now forgets the pre-update, commit and rollback hooks registered on it; their entries used to linger after Close.
  • With a shared cache, BeginTx now waits for a lock another connection holds instead of failing at once with SQLITE_LOCKED_SHAREDCACHE (262), as executing BEGIN IMMEDIATE did; Commit and Rollback wait likewise while another connection changes the schema. busy_timeout does not bound the wait; the call's context does. See [GitLab merge request #143](https://gitlab.com/cznic/sqlite/-/merge_requests/143), thanks Ian Chechin!
  • PrepareContext and BeginTx with a context that is already done now return the context's error, as ExecContext and QueryContext do. See [GitLab merge request #143](https://gitlab.com/cznic/sqlite/-/merge_requests/143), thanks Ian Chechin!
  • A context that is done before a statement starts running, for example while its arguments are being bound, now stops the statement within 1000 VM steps. SQLite discarded that interrupt, so a long statement ran to completion and only then returned the context's error. See [GitHub pull request #9](modernc-org/sqlite#9), thanks Chris Gianelloni (@​wolf31o2)!
  • A statement waiting for a lock under busy_timeout now stops waiting once its context is done, with the context's error, instead of sleeping on until the timeout; the wait's retry schedule and its bound are otherwise unchanged, and so is a call without a deadline. PrepareContext ended this way returns the context's error too, where it returned SQLITE_BUSY. Resolves [GitLab issue #262](https://gitlab.com/cznic/sqlite/-/issues/262), thanks SirLouen!

• 2026-09-29 v1.60.1:

  • Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

• 2026-09-28 v1.60.0:

  • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
  • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.
  • make vendor now writes vendor.json, the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries; the test suite fails when they no longer match. Tooling only. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).
  • vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.
  • Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.
  • The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.
  • Document three limits of the pluggable page cache on RegisterPageCache and Cache: it cannot be combined with modernc.org/sqlite/vec, PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines. Documentation only.
  • Document in the package documentation that state set on a pooled connection is inherited by the next caller to borrow it, and that a connection reached through sql.Conn.Raw is not safe for concurrent use. Documentation only.
  • Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so anything after a ; runs too. Recommended for any application whose DSN is not a compile-time constant.
  • Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof, which have always worked in a DSN starting with file:, and the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257). Documentation only.
  • Add SECURITY.md, the vulnerability reporting policy: three private channels, what is in scope, that only the latest release is supported, and how a confirmed report is disclosed, including an entry in the Go vulnerability database so govulncheck reports it. IRP.md, linked from it, is the maintainers' incident response plan. Documentation only.
  • Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Documentation only.
  • Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries with all seventeen license texts in full, and a Software Bill of Materials, sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), explained in SBOM.md. Both cover what a module-graph tool cannot see: the transpiled SQLite and sqlite-vec C, and the upstreams modernc.org/libc carries, musl among them. Documentation only.

• 2026-09-15 v1.59.0:

  • Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, memmove, memset, memcmp and strlen with native Go, cutting CPU time on query-heavy workloads by up to a third; see the new Performance section below. As always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does; see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call, removing the last driver-side allocation per invocation. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return. Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).
  • Add regression tests pinning the identity and the pooling of that context. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!
  • Add a Performance section to the package documentation: measured CPU-time ratios of this driver against the same SQLite compiled from C, where the gap comes from, and the two consequences for applications — index the columns that ORDER BY, GROUP BY and WHERE use, and bound the database/sql pool with SetMaxOpenConns.

• 2026-09-01 v1.58.0:

  • Upgrade to SQLite 3.53.4. It carries upstream's own fix for the journal-rollback data-corruption bug, so the local super-journal patch v1.56.0 introduced is dropped; recovery behavior is unchanged. Also bumps the pinned modernc.org/libc to v1.75.6; as always, downstream modules must pin the same version this one does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Add opt-in support for Linux Open File Description (OFD) locks on database files, off by default; without opting in, locking behavior is byte-for-byte that of previous releases. A POSIX record lock is owned by the (process, inode) pair, so any Close of any descriptor of the database file anywhere in the process silently strips SQLite's locks; OFD locks survive that. Enable it process-wide with MODERNC_SQLITE_OFD_LOCK=1 in the environment, or with the new OFDLocking(true) before the first connection is opened; OFDLockingEnabled reports the mode in effect, and the new ErrOFDLockingTooLate and ErrOFDLockingUnavailable report a switch attempted too late and a platform or filesystem without the feature. Why it is process-wide rather than a DSN parameter, what WAL's -shm coordination still uses, and the /proc/locks measurements behind the design are in [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255).

... (truncated)

Commits

• 4df1ebe sqlite, conn, stmt, tx: end a busy_timeout wait when the call's context is done
• 44ae8d4 update dependencies, make vendor: SQLite 3.54.1, libc v1.79.0
• 570dc56 CHANGELOG.md: context cancellation before a statement starts (GitHub PR #9)
• 4eacffe sqlite, conn: keep one cancellation flag per connection
• 4926b7a Merge GitHub pull request #9 'fix/context-cancellation'
• 3587a68 fix: preserve cancellation before SQLite execution
• fd37819 Merge branch 'tx-shared-cache-wait' into 'master'
• 75b4e62 conn: watch the context only while waiting for a shared-cache lock
• 5856ee8 tx, conn: wait for a shared-cache lock in BeginTx, Commit and Rollback, and e...
• 0fc3f90 conn: forget the pre-update, commit and rollback hooks on Close
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

[vishr]

Superseded by #384, which takes the SQLite update; Echo landed in #375. The duckdb-go v2.20000.0 update fails to link against the pinned DuckDB v2.0.0 static archive (duckdb_register_static_extensions is undefined) and needs its own change to scripts/with-duckdb.sh.