Skip to content

build(deps): bump the go-modules group with 8 updates - #265

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-modules-f063aae6b2
Closed

build(deps): bump the go-modules group with 8 updates#265
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-modules-f063aae6b2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-modules group with 8 updates:

Package From To
github.com/apache/arrow-adbc/go/adbc 1.6.0 1.12.0
github.com/apache/arrow-go/v18 18.6.0 18.7.0
github.com/buger/jsonparser 1.1.2 1.6.1
github.com/santhosh-tekuri/jsonschema/v6 6.0.1 6.0.3
github.com/twmb/franz-go 1.20.7 1.21.6
github.com/twmb/franz-go/pkg/kmsg 1.12.0 1.13.1
github.com/zeebo/assert 1.3.0 1.3.1
modernc.org/sqlite 1.57.0 1.58.0

Updates github.com/apache/arrow-adbc/go/adbc from 1.6.0 to 1.12.0

Changelog

Sourced from github.com/apache/arrow-adbc/go/adbc's changelog.

ADBC Changelog

ADBC Libraries 0.1.0 (2022-12-25)

Fix

  • python: make package names consistent (#258)
  • c/driver_manager: accept connection options pre-Init (#230)
  • c/driver_manager,c/driver/postgres: fix version inference from Git tags (#184)
  • c/driver/postgres: fix duplicate symbols; add note about PKG_CONFIG_PATH (#169)
  • c/driver/postgres: fix wheel builds (#161)
  • c/validation: validate metadata more fully (#142)
  • c/validation: free schema in partitioning test (#141)
  • c/validation: cast to avoid MSVC warning (#135)

Feat

  • c/driver_manager: allow Arrow data as parameters in DBAPI layer (#245)
  • c/driver/postgres,c/driver/sqlite: add pkg-config/CMake definitions (#231)
  • c/driver/sqlite: add Python SQLite driver bindings (#201)
  • c/driver/sqlite: port SQLite driver to nanoarrow (#196)
  • c/driver_manager: expose ADBC functionality in DBAPI layer (#143)
  • c/driver_manager: don't require ConnectionGetInfo (#150)

Refactor

  • python: allow overriding package version (#236)
  • c: build Googletest if needed (#199)
  • c/driver_manager: remove unnecessary libarrow dependency (#194)
  • c: derive version components from base version (#178)
  • java/driver/jdbc: use upstream JDBC utilities (#167)

... (truncated)

Commits
  • a3f81c6 chore: update versions for 24
  • 9f6237f chore: update CHANGELOG.md for 24
  • 4a0c3e0 build(java/driver/jni): force static linking (#4582)
  • 094f014 chore(dev/release): duplicate, not overwrite, yum repo (#4577)
  • c5f438d ci: release workflow needs contents: write (#4576)
  • 3b93d73 chore(javascript): bump js-yaml (#4571)
  • 822a5ef chore(csharp): Bump Apache.Arrow from 22.1.0 to 23.0.0 (#4335)
  • 84a56fe feat(c/driver): bump vcpkg (and libpq/sqlite) version (#4566)
  • 01a1c65 docs: update foundry urls (#4565)
  • 849e7bb docs(ruby): update Ruby docs to show latest code and fix minor issues (#4552)
  • Additional commits viewable in compare view

Updates github.com/apache/arrow-go/v18 from 18.6.0 to 18.7.0

Release notes

Sourced from github.com/apache/arrow-go/v18's releases.

Apache Arrow Go v18.7.0

What's Changed

... (truncated)

Commits
  • 0716bc6 chore: bump version number (#959)
  • c9791ae Add TimestampWithOffset canonical extension type (#558)
  • 621a4ed fix(array): validate map builder entry lengths (#957)
  • ad2fe2b fix(compute): release temporary arrays in binary view casts (#898)
  • 8a09b91 fix(array): avoid allocating for ReserveData(0) (#895)
  • 76109be fix(compute): handle comparison output offsets (#956)
  • 1476769 fix(parquet): reject truncated bit-packed batches (#943)
  • f228f0a fix(ipc): validate message framing bounds (#955)
  • 936ca0b fix(arrow): validate timestamp timezones (#952)
  • 6e39220 fix(parquet): handle short input in GetBatchBools (#946)
  • Additional commits viewable in compare view

Updates github.com/buger/jsonparser from 1.1.2 to 1.6.1

Release notes

Sourced from github.com/buger/jsonparser's releases.

v1.6.1 — Fastest across all payload sizes (now benchmarks vs gjson + sonic)

🔒 Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

Performance — gjson-style fast-skip

Ported gjson's >'\\' single-comparison fast-skip to three hot loops. The trick skips all non-structural bytes (those > 0x5C) in one unsigned comparison per byte, reducing branch overhead.

Payload Before After Change
Small (190B) 382 ns 339 ns -11.3%
Medium (2.4kB) 3,899 ns 3,141 ns -19.4%
Large (24kB) 20,788 ns 20,114 ns -3.2%

Now benchmarks against gjson and sonic

Added tidwall/gjson (15.5k⭐) and bytedance/sonic (9.6k⭐) to the benchmark suite.

Large payload — the definitive ranking:

Library time/op allocs
jsonparser 20,114 ns 0
gjson 22,756 ns 2
easyjson 33,771 ns 134
sonic 41,053 ns 71
ffjson 59,063 ns 144
encoding/json 130,565 ns 147

jsonparser is the fastest across ALL payload sizes and the only zero-allocation parser.

Full changelog: CHANGELOG.md

v1.6.0 — Append function + zero open known issues

🔒 Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings, 0 open known issues)

New API: Append

// Append to an array without knowing its length
data, _ = jsonparser.Append(data, []byte(`"new_item"`), "items")

Append(data, value, keys...) ([]byte, error) — clean array-append API. Works on top-level and nested arrays. Auto-creates missing paths as single-element arrays. No need for [N] path syntax.

Bug fixes — all known issues resolved

KI Fix
KI-2 ParseInt("-") now returns MalformedValueError (was returning 0, nil)
KI-3 Disposition corrected to fixed (auto-coerce was implemented in v1.3.0)

... (truncated)

Changelog

Sourced from github.com/buger/jsonparser's changelog.

[v1.6.1] — 2026-07-29

Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

Performance — gjson-style fast-skip in hot loops

Ported gjson's >'\\' fast-skip trick to three inner loops in parser.go: stringEndConfig tail, blockEndConfig, and searchKeysConfig. The trick uses a single unsigned comparison (byte > 0x5C) to skip all non-structural bytes in bulk, reducing per-byte branch overhead.

Payload Before After Improvement
Small (190B) 382 ns 339 ns -11.3%
Medium (2.4kB) 3,899 ns 3,141 ns -19.4%
Large (24kB) 20,788 ns 20,114 ns -3.2%

Zero allocations maintained on all paths.

Benchmarks — now includes gjson and sonic

Added tidwall/gjson (15.5k⭐, path-based parser like jsonparser) and bytedance/sonic (9.6k⭐, SIMD-accelerated deserializer) to the benchmark suite.

Final leaderboard (large payload):

Library time/op bytes/op allocs/op
buger/jsonparser 20,114 0 0
tidwall/gjson 22,756 28,672 2
mailru/easyjson 33,771 4,016 134
bytedance/sonic 41,053 31,368 71
pquerna/ffjson 59,063 4,822 144
encoding/json 130,565 4,432 147

jsonparser is the fastest across all payload sizes and the only zero-allocation parser.

[v1.6.0] — 2026-07-29

Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

New API — Append

// Append to an array without knowing its length
data, _ = jsonparser.Append(data, []byte(`"new_item"`), "items")

... (truncated)

Commits
  • 5663ba4 v1.6.1: gjson-style fast-skip optimization + benchmarks vs gjson/sonic
  • caa05b0 perf: gjson-style fast-skip in hot loops + benchmarks vs gjson/sonic
  • f1c83ac docs: remove anniversary article from repo (private draft)
  • 6c82735 docs: ten-year anniversary article with personal backstory and transitive deps
  • 3005d5b v1.6.0: Append function + all KI fixes (zero open known issues)
  • a55c29b v1.5.1: 6.1x large-payload speedup + fresh benchmarks
  • 09dbcf6 perf: SWAR string scan in stringEndConfig (8% large-payload speedup)
  • df5ae5b perf: bound stringEnd backslash scan to string body (5.8x large-payload speedup)
  • ae21251 Add MC/DC witnesses for SYS-REQ-115 (Config) and SYS-REQ-116 (ReaderParser)
  • dfb33c1 docs: complete CHANGELOG with v1.3.0–v1.5.0 entries, all mentioning ReqProof ...
  • Additional commits viewable in compare view

Updates github.com/santhosh-tekuri/jsonschema/v6 from 6.0.1 to 6.0.3

Release notes

Sourced from github.com/santhosh-tekuri/jsonschema/v6's releases.

v6.0.3

bugfixes:

  • empty instLocation for propetyNames and contentSchema
  • fix intLocation for items and additionalItems validation
  • check invalid floats NaN/Inf
  • fix closing quote check in email validation
  • ensure both are numbers in equals validation

features

  • ef59f39: ref like property in custom vocab

v6.0.2

No release notes provided.

Commits
  • b0fc661 ci: upgrade golangci/golangci-lint-action from v4 to v6
  • 3d8c98f ci: upgrade actions/setup-go from v3 to v6
  • b0cc7ab ci: upgrade actions/checkout from v3 to v7
  • 4bdda86 validator/fix: empty instLocation for propetyNames and contentSchema
  • 833329d fix/typo: fix type in error message
  • 180cde3 misc: remove vim swap file (#254)
  • 1a20556 validator/items: fix instanceLocation
  • cfca0e3 validator: check invalid floats NaN/Inf (#249)
  • befd2c1 validator/additionalItems: fix instanceLocation (#253)
  • dfcec1c format/email: add closing quote check (#251)
  • Additional commits viewable in compare view

Updates github.com/twmb/franz-go from 1.20.7 to 1.21.6

Changelog

Sourced from github.com/twmb/franz-go's changelog.

v1.21.6

Some bug fixes (mostly minor - hence the delay for the release) found by users and further Claude audits. I am gearing up for a 1.22 release but some of the features I am planning for are more complicated to review, so it may take a bit of time. Anyway:

  • Previously, rollback from a cooperative group to an eager group was deliberately not supported and there was a data race condition if this happened. It is now technically supported, although you will experience duplicate data. If you want a safe non-duplicate-causing rollback, you need to turn off the entire group, remove the cooperative consumer, and swap the whole group to eager rebalancing.

  • Fixed a panic: close of closed channel on an acks=0 produce connection in a specific edge case (a broker connection dying before the connection was fully established caused the panic).

  • If EndTransaction failed with an unconfirmed outcome (a transport error, exhausted retries, or UNKNOWN_SERVER_ERROR), the documented abort retry was a wire no-op and the next transaction could silently commit the prior "failed" transaction's records under KIP-890 part 2. The producer ID is now flagged for reload, which fence-aborts anything still ongoing broker-side.

  • GroupTransactSession.End could hang forever, ignoring its context, if the group had never joined (e.g. the consumed topic did not exist yet) and the transaction committed no offsets.

  • Previously, if a broker replied to ApiVersions with an error, we ignored it and you would eventually see an unclear error (usually a bare io.EOF, since anything that rejects ApiVersions hangs up right after replying). These errors are now handled correctly.

  • Some niche edge case bugs that are only worth reading about if you're super interested were found in repeated Claude audits and were fixed (check the PR / git history). This includes further KIP-848 "next gen consumer group" fixes.

Relevant commits

  • 582e0f21 bugfix kgo: surface error codes in ApiVersions responses
  • 67ef4c61 bugfix kgo: fix double close of a connection's deadCh on acks=0 produce
  • 3ac2fff1 bugfix kgo: revoke everything when the group protocol downgrades from cooperative to eager
  • 795d5b61 improvement kgo: flatten topic/partition maps in group rebalance logs (thanks @​constanca-m!)
  • 70addc1e improvement kgo: classify retired broker reads as broker dead (thanks @​tomplarge!)
  • 18f9a10f improvement deps: replace golang.org/x/crypto/pbkdf2 with stdlib crypto/pbkdf2 (thanks @​macdewee!)
  • 6ecd2f9f bugfix kgo: recover when an attempted EndTxn outcome is unconfirmed
  • 821f879e bugfix kgo: fix GroupTransactSession.End hanging when the group never joined

v1.21.5

... (truncated)

Commits
  • b881450 Merge pull request #1383 from twmb/cl
  • 34e5c63 update changelog for incoming v1.21.6
  • b8e7523 Merge pull request #1382 from twmb/kgo-drop-software-name-validation
  • b044036 kgo: drop client-side software name/version validation
  • adb3a18 Merge pull request #1381 from twmb/kgo-apiversions-error-code
  • 582e0f2 kgo: surface error codes in ApiVersions responses
  • cc159eb Merge pull request #1380 from RafalKorepta/rk/bump-klauspost-compress-dep
  • 481c394 deps: bump github.com/klauspost/compress to v1.18.7
  • 4176fc0 Merge pull request #1376 from twmb/record-path-allocs
  • 0289a55 kgo: reduce allocations on the fetch and produce paths
  • Additional commits viewable in compare view

Updates github.com/twmb/franz-go/pkg/kmsg from 1.12.0 to 1.13.1

Changelog

Sourced from github.com/twmb/franz-go/pkg/kmsg's changelog.

v1.13.1

This patch release fixes a bug where a producer could enter a deadlock if a topic is deleted and recreated very quickly while producing.

  • 769e02f producer: avoid deadlock when when quickly recreating a topic

v1.13.0

This release contains a few new APIs, two rare bug fixes, updates to plugins, and changes the library to now require 1.18.

Go version

This library has supported Go 1.15 since the beginning. There have been many useful features that this library has not been able to use because of continued backcompat for 1.15. There is really no reason to support such an old version of Go, and Go itself does not support releases prior to 1.18 -- and 1.18 is currently only supported for security backports. Switching to 1.18 allows this library to remove a few 1.15 / 1.16 backcompat files, and allows switching this library from interface{} to any.

Behavior changes

If group consuming fails with an error that looks non-retryable, the error is now injected into polling as a fake errored fetch. Multiple people have ran into problems where their group consumers were failing due to ACLs or due to network issues, and it is hard to detect these failures: you either have to pay close attention to logs, or you have to hook into HookGroupManageError. Now, the error is injected into polling.

Bug fixes

This release contains two bug fixes, one of which is very rare to encounter, and one of which is very easy to encounter but requires configuring the client in a way that (nearly) nobody does.

Rare: If you were using EndAndBeginTransaction, there was an internal race that could result in a deadlock.

Rare configuration: If you configured balancers manually, and you configured CooperativeSticky with any other eager balancer, then the client would internally sometimes think it was eager consuming, and sometimes think it was cooperative consuming. This would result in stuck partitions while consuming.

Features

... (truncated)

Commits
  • 1a59c2d Merge pull request #404 from twmb/bugfix
  • 5e0ba1c document incoming v1.13.1, update readme, fix golangci-lint
  • d984c21 Merge pull request #401 from bgranvea/fix-segment-bench
  • 769e02f producer: avoid deadlock when when quickly recreating a topic
  • 5c2a90c set async commit
  • 8cb298d Merge pull request #399 from twmb/dependabot/go_modules/examples/hooks_and_lo...
  • 1141ce4 Merge pull request #397 from twmb/dependabot/go_modules/examples/hooks_and_lo...
  • d5ef6e0 Merge pull request #398 from twmb/dependabot/go_modules/examples/bench/google...
  • 8215a54 Merge pull request #400 from twmb/dependabot/go_modules/plugin/kprom/google.g...
  • 6fdb469 build(deps): bump google.golang.org/protobuf in /plugin/kprom
  • Additional commits viewable in compare view

Updates github.com/zeebo/assert from 1.3.0 to 1.3.1

Commits

Updates modernc.org/sqlite from 1.57.0 to 1.58.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

  • 2026-09-05 v1.59.0:

    • Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call. After the []driver.Value pooling of #226 this was the last driver-side heap allocation per invocation: one 16-byte object for every Scalar, Step, WindowInverse, WindowValue and Final call. The context now also carries the invocation's sqlite3_context, so accessor methods can be added to it later without touching the trampolines. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return; the documentation on FunctionContext and on the callbacks now says so. On the 1000-row, 3-argument noop scalar UDF benchmark this removes a further 1000 allocs/op (5756 to 4756, and 3756 to 2756 with VolatileArgs) and 16 KB/op; on the reporter's reproducer from #226 it removes about 12% of the remaining allocations (25.3M to 22.4M allocs/op, 553 MB to 505 MB per iteration).
    • Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).
    • Add regression tests for the pooled context: two functions evaluated in one statement must receive two different sqlite3_context values and every callback's context must belong to the invoking connection, checked on two connections held at once and without dereferencing the context, so that a stale one is reported rather than faulted on; eight connections held at once calling a function from their own goroutines, and a function that runs a statement invoking another function, both meant for the race detector. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!

  • 2026-09-01 v1.58.0:

    • Upgrade to SQLite 3.53.4. Upstream's own fix for the journal-rollback data-corruption bug is part of this release, so the local super-journal patch v1.56.0 introduced — and promised to drop once upstream shipped theirs — is dropped; recovery behavior is unchanged. This also bumps the pinned modernc.org/libc to v1.75.6; as always, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins (see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177)).
    • Add opt-in support for Linux Open File Description (OFD) locks on database files. A POSIX record lock is owned by the (process, inode) pair, so the kernel drops every lock the process holds on a database file whenever any descriptor of that file is closed: an os.Open/Close for a hash, a backup check or a metadata probe anywhere in the process — third-party libraries included — silently strips SQLite's transaction locks and leaves the file unprotected against other processes. With OFD locking enabled, the locks belong to the open file description that placed them and survive such a close. Off by default, and staying off until the mode has real-world mileage: without opting in, locking behavior is byte-for-byte that of previous releases. Enable it by setting MODERNC_SQLITE_OFD_LOCK=1 in the environment the process starts with (any value but the empty string or one starting with 0; read once, at library initialization), or from Go with the new OFDLocking(true), which overrides the variable and must run before the first connection is opened; OFDLockingEnabled reports the mode in effect. The switch is deliberately process-wide rather than a DSN parameter: POSIX and OFD locks taken by one process are different owners to the kernel and genuinely conflict, so every connection to a database file inside one process must use the same kind, and a per-DSN knob would advertise a granularity the kernel does not offer (see the discussion in #255). Because the two kinds do not release one another, the mode is frozen at the process's first lock attempt: later attempts to change it return the new ErrOFDLockingTooLate, while querying, and setting the value already in effect, keep working. On kernels older than 3.15, and on filesystems that reject OFD locks, the first lock attempt falls back to POSIX locks for good and OFDLocking returns the new ErrOFDLockingUnavailable from then on, which is also how OFDLockingEnabled turning false reports the fallback; the same error is returned on every platform but Linux, where the API exists but OFD locks do not. Two boundaries to note: the immunity covers the locks on the database file itself, while WAL's -shm coordination stays on POSIX locks; and code in the same process that takes fcntl record locks of its own on a database file — which used to never conflict with SQLite's, while quietly destroying them — now conflicts with them loudly instead. The C side — F_OFD_SETLK routing through a designated per-inode locking descriptor that preserves upstream's unixInodeInfo semantics (last-unlocker release, PENDING piggybacking, unix-excl), guarded to __linux__ — ships in the transpiled sources via libsqlite3!3 and its follow-up hardening, with the OFD lock constants from libc!33; the review rounds, the /proc/locks measurements behind the design, and the Tcl lock/WAL gate that runs both modes are recorded in [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255) and those merge requests.
    • Add the accompanying regression tests. The four OFD scenarios contributed in merge request #136 — lock survival across a rogue os.Close, the interleaved-readers lock lifecycle, the read-only-first designated-descriptor migration, and the failed-first-lock cleanup — run in a re-executed child process with MODERNC_SQLITE_OFD_LOCK=1, since the mode is process-wide and frozen at the first lock so the suite's own process cannot switch; a positive control asserts the variable really switched the mode on before each scenario runs, and the two scenarios whose invariants hold under both modes also run in the parent process's inherited mode. TestOFDLockingSetter exercises the Go call path end to end in a clean child — off by default, enabled before the first connection, the kernel-visible OFDLCK record in /proc/locks as the positive control, frozen after the first lock — and on every other platform the switch is asserted to report itself unavailable.
    • Resolves [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255). See [GitLab merge request #136](https://gitlab.com/cznic/sqlite/-/merge_requests/136), thanks Nathan Herring (@​technosloth), and thanks Gani Georgiev (@​ganigeorgiev) for pressing the opt-in default!

  • 2026-08-19 v1.57.0:

    • Add an opt-in _defensive DSN query parameter that turns on SQLite's defensive mode for the connection, disabling the SQL-level features that let ordinary statements deliberately corrupt the database file. When _defensive=1 (or any strconv.ParseBool true value) is supplied, the driver calls sqlite3_db_config with SQLITE_DBCONFIG_DEFENSIVE immediately after sqlite3_open_v2 and before every other parameter is applied, so the PRAGMAs the driver itself runs, the _pragma list, and every statement the caller prepares are all subject to it. On such a connection PRAGMA writable_schema=ON, PRAGMA journal_mode=OFF and PRAGMA schema_version=N become silent no-ops, and writes to a virtual table's shadow tables (fts5's _data, _idx and so on) and to sqlite_dbpage fail with "table ... may not be modified"; reading those tables, ordinary use of the virtual tables that own them, and VACUUM are unaffected. The flag has no PRAGMA equivalent, so sqlite3_db_config — and therefore a DSN parameter — is the only way to reach it short of dropping to modernc.org/sqlite/lib. The value is parsed before sqlite3_open_v2, so an invalid one fails the connection without creating the database file, and the parameter must appear at most once: a repeated _defensive is an error rather than letting the first value silently win. Absence of the parameter, or _defensive=0, leaves SQLite's default behavior unchanged; existing DSNs continue to work byte-for-byte. Two limits are worth stating plainly, since the name invites more confidence than the flag earns. Defensive mode is a hardening measure, not a sandbox for hostile database files: it is one of several steps SQLite recommends for that purpose, and this build compiles with neither SQLITE_TRUSTED_SCHEMA=0 nor SQLITE_DQS=0 and exposes no authorizer. And it is a property of the connection, not of the database file — a second handle opened on the same file without the parameter is unrestricted.
    • Reject the one DSN combination defensive mode would otherwise swallow in silence. _defensive=1 together with _journal_mode=OFF (or _journal=OFF) now fails the connection instead of opening one in which neither parameter was honoured: SQLite turns PRAGMA journal_mode=OFF into a no-op that still reports success, so the driver would have accepted the mode, executed it, and left the journal untouched without telling anyone. The check runs in the validation phase introduced in v1.55.0, before any statement executes, so a rejected DSN cannot leave the database half-configured. _pragma remains the exception it has always been: _pragma=journal_mode(OFF) alongside _defensive=1 still runs and is still silently ignored by SQLite. Only DSNs using _defensive can be affected, and that parameter is new, so no DSN that opened before changes behavior.
    • See [GitHub pull request #6](modernc-org/sqlite#6), thanks wsman!
    • Ship the sqlite-vec license notice this module has been missing. modernc.org/sqlite/vec has bundled the transpiled sqlite-vec sources since v1.47.0, but the module carried only its own BSD-3-Clause LICENSE and the public-domain SQLite notice. sqlite-vec is Copyright (c) 2024 Alex Garcia, dual-licensed Apache-2.0 OR MIT and used here under MIT, whose terms require the copyright and permission notice to accompany substantial portions of the software — which 2.8 MB of transpiled vec/ plainly is. The notice now ships as LICENSE-SQLITE_VEC in the module root, byte-identical to the LICENSE-MIT in the upstream v0.1.9 archive and named after the file modernc.org/libsqlite_vec extracts it into. Attribution was never absent — vec's package documentation has named the extension, pinned the version and linked upstream — but the license text itself was, and the omission was ours: vendor_libs/main.go copied the per-target transpiles and nothing else. It now copies the notice alongside them and fails the vendoring run if it cannot, so a make vendor can no longer quietly drop it. The vec package documentation gained a License section recording that the package is under a different license from the rest of this module.
    • The SQLite notice is renamed from SQLITE-LICENSE to LICENSE-SQLITE; update any direct links to it. Its contents are unchanged and SQLite remains public domain. The name now matches both the new LICENSE-SQLITE_VEC beside it and the LICENSE-<upstream> convention every other modernc.org repository follows, but it is more than cosmetic: go mod vendor selects the files it copies into a downstream vendor/ tree by matching each name against a fixed list of prefixes — LICENSE among them — so a name merely ending in LICENSE was never propagated. Both bundled notices now travel with the code into vendored builds, which is where the MIT terms on vec/ keep applying. No code changes; no behavior changes.
    • Let a caller-constructed Driver register its own functions, collations and virtual table modules. Driver has always held four categories of registration state, but only RegisterConnectionHook could put anything on a constructed one: functions and collations were reachable through the package-level API alone, and modules through the package-level driver only, which left the modules field written and read through that instance and so process-global state wearing a per-instance field. Driver now has RegisterFunction, RegisterScalarFunction, RegisterDeterministicScalarFunction, RegisterCollationUtf8 and RegisterModule, plus Must* variants of the first four, each registering on that Driver alone; the methods are safe to call concurrently, and the zero Driver is ready to use as-is. vtab.RegisterModule also honours its db argument now: a non-nil db registers on the driver backing it when that driver implements the new vtab.ModuleRegisterer, while a nil db keeps targeting the driver this package registers as sqlite. One existing pattern changes behavior, narrowly and loudly: vtab.RegisterModule(db, ...) where db was opened on a caller-constructed Driver used to discard the db argument and land on the sqlite driver, reaching every connection in the process; it now lands on the constructed driver alone, so a sql.Open("sqlite") connection that used to resolve such a module gets no such module instead. The same pattern is also the one way an existing program could hold one module name on both a constructed Driver and the package-level one: there the first of the two registrations used to win and the second was refused as already registered, whereas now the package-level implementation wins on the constructed Driver's connections regardless of the order they ran in. Reaching that case at all means the program ignored an error the older version returned. Two smaller deviations round out the list: Driver.RegisterModule reports no error for such a collision, and vtab.RegisterModule now validates its name and module arguments before the not-implemented check, so a call with an empty name that returned vtab: RegisterModule not wired into engine outside this driver returns vtab: module name must be non-empty instead. Everything else is additive against v1.56.0: the package-level registration functions target the same driver they always did, connections still receive every module registered through the package-level path whichever Driver opened them, and a db opened on the sqlite driver resolves to that same driver. The isolating change discussed in [GitLab issue #254](https://gitlab.com/cznic/sqlite/-/issues/254) is deliberately not made here.
    • See [GitLab merge request #135](https://gitlab.com/cznic/sqlite/-/merge_requests/135), thanks Ian Chechin!
    • Promote freebsd/386, freebsd/arm and netbsd/amd64 to fully supported platforms. All three are now listed in the package documentation's platform table, which had carried seventeen entries while this module shipped, cross-built and tested twenty. They arrived as experimental in v1.53.0 — netbsd/amd64 reviving a port that had been broken for years, freebsd/386 replacing a stale, effectively untested SQLite 3.41 transpile, and freebsd/arm entirely new — and were deliberately kept out of that table until they had accumulated real-world exposure, with promotion promised once "a period of broader real-world testing … elapses without surprises". That period has elapsed: all three have been in the builder test matrix and in make build_all_targets since v1.53.0, all three pass the full test suite on this release's commit alongside the seventeen platforms already listed, and no open issue reports a defect in any of them. The two netbsd/amd64 build failures filed before the revival, [GitLab issue #202](https://gitlab.com/cznic/sqlite/-/issues/202) and [GitLab issue #234](https://gitlab.com/cznic/sqlite/-/issues/234), no longer reproduce at this commit: Xsqlite3_is_interrupted is present in the sources that target selects, and the mu.enter/mu.leave symbols that broke the build are gone. Documentation only — the transpiled sources under lib/ are byte-for-byte what v1.56.0 shipped, and nothing about how these targets behave changes.

  • 2026-08-03 v1.56.0:

    • Re-vendor the transpiled SQLite sources, picking up modernc.org/libsqlite3's fix for an upstream data-corruption bug in SQLite 3.53.3's journal rollback. The SQLite version is unchanged at 3.53.3; what changes is that the amalgamation is now patched before it is transpiled. 3.53.3 reworked readSuperJournal() to return the super-journal name through a char** out-parameter, and pager_playback() now tests that pointer where it used to test zSuper[0]. A crash during the commit of a multi-database (ATTACH) transaction can leave the super-journal name and its checksum zeroed while the na...

      Description has been truncated

@dependabot
build(deps): bump the go-modules group with 8 updates
3220da3 
Bumps the go-modules group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/apache/arrow-adbc/go/adbc](https://github.com/apache/arrow-adbc) | `1.6.0` | `1.12.0` |
| [github.com/apache/arrow-go/v18](https://github.com/apache/arrow-go) | `18.6.0` | `18.7.0` |
| [github.com/buger/jsonparser](https://github.com/buger/jsonparser) | `1.1.2` | `1.6.1` |
| [github.com/santhosh-tekuri/jsonschema/v6](https://github.com/santhosh-tekuri/jsonschema) | `6.0.1` | `6.0.3` |
| [github.com/twmb/franz-go](https://github.com/twmb/franz-go) | `1.20.7` | `1.21.6` |
| [github.com/twmb/franz-go/pkg/kmsg](https://github.com/twmb/franz-go) | `1.12.0` | `1.13.1` |
| [github.com/zeebo/assert](https://github.com/zeebo/assert) | `1.3.0` | `1.3.1` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.57.0` | `1.58.0` |


Updates `github.com/apache/arrow-adbc/go/adbc` from 1.6.0 to 1.12.0
- [Release notes](https://github.com/apache/arrow-adbc/releases)
- [Changelog](https://github.com/apache/arrow-adbc/blob/main/CHANGELOG.md)
- [Commits](apache/arrow-adbc@go/adbc/v1.6.0...go/adbc/v1.12.0)

Updates `github.com/apache/arrow-go/v18` from 18.6.0 to 18.7.0
- [Release notes](https://github.com/apache/arrow-go/releases)
- [Commits](apache/arrow-go@v18.6.0...v18.7.0)

Updates `github.com/buger/jsonparser` from 1.1.2 to 1.6.1
- [Release notes](https://github.com/buger/jsonparser/releases)
- [Changelog](https://github.com/buger/jsonparser/blob/master/CHANGELOG.md)
- [Commits](buger/jsonparser@v1.1.2...v1.6.1)

Updates `github.com/santhosh-tekuri/jsonschema/v6` from 6.0.1 to 6.0.3
- [Release notes](https://github.com/santhosh-tekuri/jsonschema/releases)
- [Commits](santhosh-tekuri/jsonschema@v6.0.1...v6.0.3)

Updates `github.com/twmb/franz-go` from 1.20.7 to 1.21.6
- [Changelog](https://github.com/twmb/franz-go/blob/master/CHANGELOG.md)
- [Commits](twmb/franz-go@v1.20.7...v1.21.6)

Updates `github.com/twmb/franz-go/pkg/kmsg` from 1.12.0 to 1.13.1
- [Changelog](https://github.com/twmb/franz-go/blob/master/CHANGELOG.md)
- [Commits](twmb/franz-go@v1.12.0...v1.13.1)

Updates `github.com/zeebo/assert` from 1.3.0 to 1.3.1
- [Commits](zeebo/assert@v1.3.0...v1.3.1)

Updates `modernc.org/sqlite` from 1.57.0 to 1.58.0
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.57.0...v1.58.0)

---
updated-dependencies:
- dependency-name: github.com/apache/arrow-adbc/go/adbc
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/apache/arrow-go/v18
  dependency-version: 18.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/buger/jsonparser
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/santhosh-tekuri/jsonschema/v6
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: github.com/twmb/franz-go
  dependency-version: 1.21.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/twmb/franz-go/pkg/kmsg
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
- dependency-name: github.com/zeebo/assert
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-modules
- dependency-name: modernc.org/sqlite
  dependency-version: 1.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 12, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 13, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/go_modules/go-modules-f063aae6b2 branch September 13, 2026 11:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@turbolytics