[dependabot]

Bumps the go-modules group with 20 updates in the / directory:

Package	From	To
cloud.google.com/go/pubsub/v2	2.7.0	2.8.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity	1.14.1	1.15.0
github.com/aws/aws-sdk-go-v2	1.47.3	1.47.4
github.com/aws/aws-sdk-go-v2/config	1.33.9	1.33.10
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue	1.21.11	1.21.15
github.com/aws/aws-sdk-go-v2/service/cloudwatch	1.73.3	1.75.1
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs	1.89.3	1.90.2
github.com/aws/aws-sdk-go-v2/service/dynamodb	1.70.3	1.72.1
github.com/aws/aws-sdk-go-v2/service/sns	1.47.5	1.47.6
github.com/aws/aws-sdk-go-v2/service/sqs	1.52.4	1.52.6
github.com/dapr/dapr	1.18.16	1.19.0
github.com/dapr/go-sdk	1.15.0	1.16.0
github.com/posthog/posthog-go	1.34.0	1.37.0
github.com/quic-go/quic-go	0.63.0	0.64.1
github.com/rabbitmq/amqp091-go	1.14.0	1.16.0
github.com/rabbitmq/rabbitmq-stream-go-client	1.8.3	1.9.0
github.com/twmb/franz-go	1.22.1	1.22.2
google.golang.org/api	0.287.1	0.288.0
google.golang.org/grpc	1.83.2	1.84.0
modernc.org/sqlite	1.60.1	1.61.0

Updates cloud.google.com/go/pubsub/v2 from 2.7.0 to 2.8.0

Commits

• 2b317b5 chore(main): release pubsub 2.8.0 (#20529)
• ab1da9d feat: update API sources and regenerate (#20728)
• e97e555 chore: release main (#20729)
• d80b4e8 feat(firestore): add x-goog-is-transaction routing header (#20701)
• 3266de7 chore(all): update module github.com/klauspost/compress to v1.18.7 [SECURITY]...
• 79b0fd3 chore: release main (#20702)
• 2f94448 chore(deps): bump github.com/klauspost/compress from 1.16.7 to 1.18.7 in /big...
• 612ddfa chore(deps): bump github.com/klauspost/compress from 1.16.7 to 1.18.7 in /int...
• a279d2a fix(bigtable): raise the accelerator's gRPC message size limits to match the ...
• 2ace946 chore: update librarian version to v0.49.0 (#20722)
• Additional commits viewable in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.1 to 1.15.0

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/azidentity/v1.15.0

1.15.0 (2026-10-14)

Features Added

• ManagedIdentityCredential and DefaultAzureCredential support user-assigned managed identities on Azure Arc when the agent supports them
• WorkloadIdentityCredential supports identity binding mode via WorkloadIdentityCredentialOptions.EnableAzureProxy

Bugs Fixed

• ManagedIdentityCredential verifies the Service Fabric endpoint's certificate against IDENTITY_SERVER_THUMBPRINT and rejects redirects

Other Changes

• On Service Fabric, a custom ClientOptions.Transport must be an *http.Client with a nil Transport or a standard *http.Transport without custom TLS dialing or verification callbacks. Unsupported transports now cause credential construction to fail
• Upgraded dependencies

Commits

• bb7200c Update azcore v1.15.0 release date (#23569)
• d112082 [azopenaiextensions] Pushing release date to Monday (#23565)
• 9522165 [azopenai] 2024-08-01-preview generation (#23554)
• 42922c1 [azeventhubs,azservicebus] Applying retry fix to both eventhubs and servicebu...
• 5df372c Use common OIDC token env vars in post scripts (#23549)
• 1c2a108 BearerTokenPolicy handles CAE claims challenges by default (#23414)
• 8759ee6 [azopenaiextensions] Prepping for release tomorrow (#23551)
• a230ef2 [Search] Remove myself from CODEOWNERS (#23560)
• a743757 Sync eng/common directory with azure-sdk-tools for PR 9106 (#23555)
• 7c2d3a7 Use equality function check for persist oidc token step (#23559)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.4

Commits

• 4aaad74 Release 2026-10-22
• 4c1f2f2 Regenerated Clients
• edb4ad6 Update endpoints model
• 414c9e4 Update API model
• 5bba534 Bump Smithy Go to 1.28.6 (#3600)
• 0d2e6fa Release 2026-10-21
• 0d7e55d Regenerated Clients
• d5bf455 Update endpoints model
• e92707e Update API model
• d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.10

Commits

• 4aaad74 Release 2026-10-22
• 4c1f2f2 Regenerated Clients
• edb4ad6 Update endpoints model
• 414c9e4 Update API model
• 5bba534 Bump Smithy Go to 1.28.6 (#3600)
• 0d2e6fa Release 2026-10-21
• 0d7e55d Regenerated Clients
• d5bf455 Update endpoints model
• e92707e Update API model
• d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue from 1.21.11 to 1.21.15

Commits

• 78fa10a Release 2025-02-05
• 2d65d97 Regenerated Clients
• 64e842d Update endpoints model
• f255e31 Update API model
• 68c4649 Track accountID endpoint mode in user-agent (#3000)
• c45eaac Release 2025-02-04
• 7aecaff Regenerated Clients
• a11e8e1 Update endpoints model
• 91f8178 Update API model
• d59b658 Release 2025-02-03
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/cloudwatch from 1.73.3 to 1.75.1

Commits

• c7c6865 Release 2025-01-30
• 70f736c Regenerated Clients
• 28731c2 Update endpoints model
• 3505e4b Update API model
• 0b4f636 don't sign transfer-encoding header (#2991)
• b820c57 Release 2025-01-29
• 40ddb76 Regenerated Clients
• 2b4adae Update API model
• 78c2be4 Revert "beta: feature/s3/transfermanager (S3 transfer manager v2) (#2988)"
• 5c9d67c beta: feature/s3/transfermanager (S3 transfer manager v2) (#2988)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.89.3 to 1.90.2

Commits

• b01c60e Release 2025-11-12
• 17946cc Regenerated Clients
• a435b3c Update API model
• 1e4148a collapse changelogs
• 86618e5 track allocation improvements from codegen (#3227)
• ab56437 Release 2025-11-11
• 3dcd1d8 Regenerated Clients
• 51e8881 Update API model
• 1ed4f27 add MAINTAINERS.md
• a5136d5 host label
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/dynamodb from 1.70.3 to 1.72.1

Commits

• 19d2a28 Release 2025-01-08
• e153a59 Regenerated Clients
• 349cb94 Update endpoints model
• 740de30 Update API model
• 032b94e fix typo in README (#2914)
• fca0255 Add a changelog section to the PR template (#2950)
• ef36115 Add a workflow for external contributors to add a changelog entry (#2944)
• 7a84d4a drop service/iot1clickdevicesservice and service/iot1clickprojects (#2946)
• 5b873cf Release 2025-01-07
• 13848f9 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/sns from 1.47.5 to 1.47.6

Commits

• 7d7814f Release 2023-12-18
• cbd9807 Regenerated Clients
• 0ef7ef6 Update endpoints model
• b2d0e48 Update API model
• 27acb6b Release 2023-12-15
• d3d958f Regenerated Clients
• b9e42b1 Update endpoints model
• d61965f Update API model
• dca6a24 Release 2023-12-14
• 65183ed Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/sqs from 1.52.4 to 1.52.6

Commits

• d1d210d Release 2024-08-22
• afb0408 Regenerated Clients
• 05f4492 Update partitions file
• 600651a Update endpoints model
• ebaae40 Update API model
• 38fe812 Release 2024-08-21
• b504211 Regenerated Clients
• 02f3045 Update endpoints model
• f7d2cf6 Update API model
• 4d36126 Release 2024-08-20
• Additional commits viewable in compare view

Updates github.com/dapr/dapr from 1.18.16 to 1.19.0

Release notes

Sourced from github.com/dapr/dapr's releases.

Dapr Runtime v1.19.0

Dapr 1.19

We're excited to announce the release of Dapr 1.19!

The main changes in this release:

• Faster workflows, jobs and reminders. In the nightly performance tests against 1.18.0, workflow throughput is up to 40% higher. The p99 latency of actor reminder registration is 71% lower, and the p99 latency of Jobs scheduling is 33% lower. Workflow workers in the Python, Java, .NET and Go SDKs now get only the new events of each turn, not the full history.
• Workflows across apps. A workflow client can now start, get, raise events on, pause, resume, terminate, purge and rerun a workflow that another app owns. Access policies decide which app can do what. A new requires rule allows a schedule only when the caller's history contains the required upstream events. A workflow can also start a detached workflow that outlives it.
• New building blocks (alpha). Binary Store stores large files in Amazon S3 and S3-compatible stores, Azure Blob Storage, Azure Data Lake Storage, Google Cloud Storage and OCI Object Storage. Search and Vector index and query documents and vectors, with Meilisearch components.
• Dapr MCP server (alpha). The Dapr MCP server gives AI agents and IDE assistants the building blocks of a sidecar as Model Context Protocol tools. It ships as a separate binary, on its own release cycle.
• Actors. With actor placement in the Scheduler (opt-in), each reminder goes straight to the host that runs the actor. The cluster then does not need the Placement service. New APIs list and get actor timers over HTTP and gRPC, and list reminders over HTTP. When an actor moves to another host, the old host deletes its timers, so they no longer fire twice.
• Kafka transactions. Kafka pub/sub can make a bulk publish atomic, read only committed records, and run consume-transform-produce in one transaction. All three are opt-in.
• Operations. Logs can go to several destinations, with file rotation and a configurable timestamp format. Workload identity certificates carry the image references of the pod. Every Kubernetes Service that Dapr creates sets appProtocol for service meshes.
• Security. Five security fixes. Four of them, for service invocation, the Scheduler and workflows, also shipped in 1.18.6. The fifth makes the Operator enforce app scopes and configuration assignment, and it also shipped in 1.18.9 and 1.17.18. Four of the five change behavior.

Read Breaking Changes and Deprecation Notices before you upgrade. 1.19 contains behavior changes that can affect an upgrade, mostly in the SDKs.

Thanks to all the new and existing contributors who helped make this release happen.

If you're new to Dapr, visit the getting started page and familiarize yourself with Dapr.

The docs have been updated with all the new features and changes of this release. To get started with new capabilities introduced in this release, go to the Concepts and the Developing applications.

Go to the upgrading Dapr section for steps to upgrade to version 1.19.

Acknowledgements

Thanks to everyone who made this release possible!

@​acroca, @​adam6878, @​Advait2912, @​anneheartrecord, @​anxkhn, @​arturotrenard, @​baltasarblanco, @​CasperGN, @​cicoyle, @​DamienCassou, @​famarting, @​gargsajal9, @​GHX5T-SOL, @​icmp0x8, @​ihopenre-eng, @​javier-aliaga, @​jjcollinge, @​jongep86, @​JoshVanL, @​jslatten, @​kayvonkhosrowpour, @​kshitizj03, @​LiBaoxuan-Neil, @​LilDojd, @​LindseyZ1205, @​lrascao, @​m3nax, @​magic-peach, @​manduinca, @​marcduiker, @​matheusandre1, @​mikeee, @​MrMint, @​MsfPablo, @​mtaghavi2005, @​Mukuwul, @​MyMirelHub, @​nelson-parente, @​olitomlinson, @​pablochacin, @​passuied, @​Psingle20, @​pujitha24, @​RakeshCodeLab, @​Rishabh-git10, @​SaiPisey2, @​SarthakB11, @​seherv, @​sicoyle, @​siri-varma, @​somaz94, @​stywzn, @​tezizzm, @​vip892766gma, @​WhitWaldo, @​yaron2, @​Yash121l

Highlights

These are the v1.19 release highlights:

Faster workflows, jobs and reminders

Compared with the published v1.18.0 run, the nightly performance tests on master show:

• Workflows: throughput is 40% higher in TestWorkflowWithConstantVUs and 32% higher in TestSeriesWorkflowWithMaxVUs.
• Jobs scheduling: p99 latency is 33% lower (39.5 ms to 26.3 ms), and the test now sustains the full requested 1000 QPS (921 QPS on 1.18.0).
• Actor reminder registration: p99 latency is 71% lower (148 ms to 43 ms), at 43% more registrations per second.
• Configuration subscribe: throughput is 67% higher over HTTP and about 2.8x over gRPC. This test varies up to 3x between runs, so treat the gRPC figure as indicative.

Service invocation, state and pub/sub publish show no change beyond run-to-run noise. The figures are medians of 8 runs from 23/09/2026 to 02/10/2026, on the same cluster as the v1.18.0 run.

Changes in this area include:

... (truncated)

Commits

• See full diff in compare view

Updates github.com/dapr/go-sdk from 1.15.0 to 1.16.0

Release notes

Sourced from github.com/dapr/go-sdk's releases.

Release v1.16.0

Automatic Go Dapr client release

Release v1.16.0-rc.2

Automatic Go Dapr client release

Release v1.16.0-rc.1

Automatic Go Dapr client release

Commits

• c90047c Merge pull request #850 from nelson-parente/chore/dapr-1.19.0
• e4f0121 chore: pin SDK version and go.mod for Dapr 1.19.0
• 6f6d55b Merge pull request #849 from nelson-parente/chore/dapr-1.19.0-rc.4-pins
• 9cca693 chore: pin go.mod for Dapr 1.19.0-rc.5
• d62cebd chore: pin go.mod for Dapr 1.19.0-rc.4
• cb62853 Merge pull request #847 from nelson-parente/chore/dapr-1.19.0-rc.3-pins
• 0e4559a chore: pin SDK version and go.mod for Dapr 1.19.0-rc.3
• 6489fe3 Merge pull request #842 from nelson-parente/test/crypto-context-deadline-race
• 3439e1b Merge branch 'main' into test/crypto-context-deadline-race
• 827dab4 Merge pull request #843 from nelson-parente/ci/actor-examples-step-timeout
• Additional commits viewable in compare view

Updates github.com/posthog/posthog-go from 1.34.0 to 1.37.0

Release notes

Sourced from github.com/posthog/posthog-go's releases.

1.37.0

Unreleased

1.36.2

Unreleased

1.36.1

Unreleased

1.36.0

Unreleased

1.35.3

Unreleased

1.35.2

Unreleased

1.35.1

Unreleased

1.35.0

Unreleased

Changelog

Sourced from github.com/posthog/posthog-go's changelog.

1.37.0

Minor Changes

• 729bcf7: Add an opt-in OpenTelemetry enqueue helper that adds active trace and span IDs to exception events.

1.36.2

Patch Changes

• e8c7d37: Fall back to remote feature flag evaluation for regex syntax and character-class semantics that cannot be evaluated consistently with the flags service, including through negated cohorts.

1.36.1

Patch Changes

• 6b734dd: Preserve captured events with non-finite numeric properties by serializing NaN and infinities as null in both capture protocols. Arbitrary structs containing these numbers are replaced with null as a whole property.

1.36.0

Minor Changes

• d170fc5: Local flag evaluation honors experiment holdouts. A flag whose definition carries filters.holdout now resolves a held-out identifier to holdout-<id> before its release conditions, matching the server instead of silently bucketing the identifier into a regular variant.

1.35.3

Patch Changes

• 870af8a: Fix local feature flag string and regex operators to stringify explicit null values as "null", matching the flags service. Flag results and variant selection can change for explicit-null properties; missing properties remain inconclusive and eligible for remote evaluation.

1.35.2

Patch Changes

• de638c7: posthogmcp now sets $exception_source: "mcp.tool_call" on the $exception it emits alongside a failed tool call, and strips caller-supplied reserved exception metadata from MCP events.

1.35.1

Patch Changes

• 88d8397: Allow local feature flag evaluation and definition refreshes from an external cache provider without a secret key, with cache-only readers skipping fetch coordination.

1.35.0

Minor Changes

• c203229: The otel SpanProcessor now adds the PostHog request context from each span's parent context.Context (set with posthog.WithRequestContext or posthog.NewRequestContextMiddleware) to the AI spans it exports: distinct ID, session ID (as $session_id) and properties. Attributes already on a span are kept. With NewRequestContextMiddleware, request metadata such as $ip and $user_agent now appears on the AI spans exported to PostHog. The otel module now depends on the core module.

Commits

• 5d73532 chore: release v1.37.0 [version bump] [skip ci]
• 729bcf7 feat(otel): add opt-in exception trace context (#374)
• 32f2522 chore: release v1.36.2 [version bump] [skip ci]
• e8c7d37 fix(flags): fall back for incompatible local regex evaluation (#387)
• 56aa91d docs: require signed commits in contributor docs (#388)
• aef332c chore: release v1.36.1 [version bump] [skip ci]
• 6b734dd fix: preserve events with non-finite numeric properties (#382)
• 6ffac5a chore(deps): bump the github-actions group with 4 updates (#385)
• 4f9ba34 chore: release v1.36.0 [version bump] [skip ci]
• d170fc5 feat(flags): honor experiment holdouts in local flag evaluation (#360)
• Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.63.0 to 0.64.1

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.64.1

This patch release fixes datagram receive cancellation and stream reset handling.

Notable Fixes

• Conn.ReceiveDatagram now fails immediately if the context is already canceled: #5947
• http3: Stream.ReceiveDatagram and RequestStream.ReceiveDatagram now fail immediately if the context is already canceled: #5948
• Stream reset handling now ignores reliable boundary updates after cancellation: #5950

Changelog

• ignore reliable boundary updates after stream cancellation by @​marten-seemann in quic-go/quic-go#5950
• fail Conn.ReceiveDatagram if the context is already canceled by @​marten-seemann in quic-go/quic-go#5947
• http3: fail Stream.ReceiveDatagram if the context is already canceled by @​marten-seemann in quic-go/quic-go#5948

Full Changelog: quic-go/quic-go@v0.64.0...v0.64.1

v0.64.0

This release improves congestion control and performance, especially on paths with packet reordering:

• Slow-start pacing now uses twice the estimated bandwidth, allowing the sending rate to double each RTT: #5882
• Application-data loss detection now disables packet-threshold detection after a spurious loss, avoiding repeated unnecessary retransmissions caused by packet reordering: #5905
• Application-data loss detection now uses an adaptive time threshold that increases after spurious losses, allowing more time for reordered packets to arrive: #5925
• The congestion controller now restores its congestion window and recovery state after a reduction caused entirely by spurious packet loss: #5923

Notable Fixes

• Congestion recovery now respects send order across Initial, Handshake and application-data packets, fixing incorrect recovery decisions caused by comparing packet numbers from different spaces: #5920
• Connections now fall back to 1200-byte Initial packets on EMSGSIZE when Config.InitialPacketSize is unset, allowing handshakes over paths with smaller MTUs: #5911
• Oversized packets are now rejected before serialization, including Initial packets with excessively large address-validation tokens: #5937
• Path MTU discovery now restarts correctly after connection migration and NAT rebinding: #5887
• Servers now retry unanswered PATH_CHALLENGEs with exponential backoff as more packets arrive on the candidate path, preventing path validation from stalling when a challenge is acknowledged but no PATH_RESPONSE arrives: #5930
• Servers now continue responding to PATH_CHALLENGEs on existing candidate paths when the candidate path limit is reached: #5929
• Writes after closing a SendStream or Stream now return quic.ErrStreamClosed, which is also used as the stream context's cancellation cause: #5885
• Conn.SendDatagram now returns the connection's close error after shutdown, instead of accepting datagrams that will be silently dropped: #5880
• http3: SendDatagram now immediately returns an error after the stream's send side closes, including after STOP_SENDING or connection shutdown: #5884
• http3: request header, response header and trailer buffers now grow as data arrives, avoiding large allocations based solely on a peer's advertised HEADERS frame length: #5886
• Spurious losses are now detected when an ACK only acknowledges packets previously declared lost: #5895
• Spurious losses are now detected when ACKs arrive out of order: #5900
• Path migration now clears the old path's loss history, preventing stale spurious-loss reports and recovery adjustments: #5903
• MTU and path probes no longer trigger spurious-loss reports or adaptive loss-recovery changes: #5906

Notable Changes

• ConnectionStats now exposes CongestionWindow, reporting the local sender's congestion window on the active network path in bytes: #5901
• http3.Stream and http3.RequestStream now expose QlogTrace, allowing applications to add events to the underlying connection's qlog trace: #5935
• http3/qlog.RedactHeaders allows applications to redact HTTP/3 header and trailer values, including pseudo-headers, before they are written to qlog: #5932
• qlog: locally dropped QUIC datagrams are now recorded with quic:datagram_dropped, including drops caused by a full receive buffer or an oversized outgoing datagram: #5907
• qlog: quic:recovery_parameters_set now records initial recovery parameters and changes to loss-detection thresholds, including resets after path migration: #5926

... (truncated)

Commits

• ed90516 http3: fail Stream.ReceiveDatagram if the context is already canceled (#5948)
• 1170056 fail Conn.ReceiveDatagram if the context is already canceled (#5947)
• 5a5e6b7 ignore reliable boundary updates after stream cancellation (#5950)
• 9abbbad retry server path challenges with exponential backoff (#5930)
• 15baf53 only enforce the candidate path limit for new paths (#5929)
• 8754e95 reject oversized packets before serialization (#5937)
• 54cf12e http3: expose the connection's qlog trace on streams (#5935)
• 4b404ee http3/qlog: implement redacting of header fields (#5932)
• 432b156 README: link OSS-Fuzz badge to the introspector (#5928)
• d4981bc qlog initial recovery parameters and loss threshold updates (#5926)
• Additional commits viewable in compare view

Updates github.com/rabbitmq/amqp091-go from 1.14.0 to 1.16.0

Release notes

Sourced from github.com/rabbitmq/amqp091-go's releases.

v1.16.0

What's Changed

• chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#391
• docs: document URI credential percent-encoding requirement (#305) by @​cipherprofessor in rabbitmq/amqp091-go#396
• Surface the broker's connection.close reason from Dial instead of a hardcoded 403 by @​mohammadkshn in rabbitmq/amqp091-go#393
• chore: remove redundant legacy +build tag from fuzz.go by @​cipherprofessor in rabbitmq/amqp091-go#395
• Reader hardening by @​Zerpet in rabbitmq/amqp091-go#397
• chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#398
• Add Fuzzy tests for reader by @​Zerpet in rabbitmq/amqp091-go#399
• chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#401
• Reject heartbeat frames sent on a non-zero channel by @​suchitd in rabbitmq/amqp091-go#402
• Add support for basic cancel ok response by @​Zerpet in rabbitmq/amqp091-go#405
• Reject out-of-range heartbeat in ParseURI by @​suchitd in rabbitmq/amqp091-go#407
• Start recovery watcher only after a successful handshake by @​suchitd in rabbitmq/amqp091-go#409
• chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#410
• Fix golangci-lint v2.15.0 errcheck failures by @​suchitd in rabbitmq/amqp091-go#411

New Contributors

• @​cipherprofessor made their first contribution in rabbitmq/amqp091-go#396
• @​mohammadkshn made their first contribution in rabbitmq/amqp091-go#393

Full Changelog: rabbitmq/amqp091-go@v1.15.0...v1.16.0

v1.15.0

What's Changed

• chore(deps): bump github/codeql-action from 4.37.6 to 4.37.7 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#385
• chore(deps): bump github/codeql-action from 4.37.7 to 4.37.8 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#386
• fix: clone SASL authentication before zeroing credentials post-handshake by @​suchitd in rabbitmq/amqp091-go#388
• fix: preserve caller-provided SASL credentials across Reconnect() by @​suchitd in rabbitmq/amqp091-go#389
• chore(deps): bump github/codeql-action from 4.37.8 to 4.37.9 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#390

Full Changelog: rabbitmq/amqp091-go@v1.14.0...v1.15.0

Changelog

Sourced from github.com/rabbitmq/amqp091-go's changelog.

v1.16.0 (2026-10-19)

Full Changelog

Implemented enhancements:

• Add support for basic cancel ok response #405 (Zerpet)

Fixed bugs:

• Start recovery watcher only after a successful handshake #409 (suchitd)
• Reject out-of-range heartbeat in ParseURI #407 (suchitd)
• Reject heartbeat frames sent on a non-zero channel #402 (suchitd)

Closed issues:

• DialConfig leaks a watchConnection goroutine when the AMQP handshake fails with Recovery enabled #408
• panic: unexpected frame type #400
• v1.13.0: openComplete() zeroes caller-owned SASL credentials, breaking Config reuse across dials #394
• Dial returns 403 "no access to this vhost" when the broker refuses connection.open with 530 NOT_ALLOWED (e.g. user connection limit reached) #392
• Question mark in password breaks connection string parsing #305

Merged pull requests:

• Fix golangci-lint v2.15.0 errcheck failures #411 (suchitd)
• chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 in the github-actions group #410 (dependabot[bot])
• chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 in the github-actions group #401 (dependabot[bot])
• Add Fuzzy tests for reader #399 (Zerpet)
• chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 in the github-actions group #398 (dependabot[bot])
• Reader hardening #397 (Zerpet)
• docs: document URI credential percent-encoding requirement (#305) #396 (cipherprofessor)
• chore: remove redundant legacy +build tag from fuzz.go #395 (cipherprofessor)
• Surface the broker's connection.close reason from Dial instead of a hardcoded 403 #393 (mohammadkshn)
• chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0 in the github-actions group #391 (dependabot[bot])

v1.15.0 (2026-09-15)

Full Changelog

Fixed bugs:

• fix: preserve caller-provided SASL credentials across Reconnect() #389 (suchitd)
• fix: clone SASL authentication before zeroing credentials post-handshake #388 (suchitd)

Closed issues:

• v1.13.0 (#350) zeroes caller-provided PlainAuth.Password, breaking auth on any reconnect that reuses the Config #387

Merged pull requests:

Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.