[dependabot]

Bumps the go-deps group with 24 updates in the / directory:

Package	From	To
github.com/anthropics/anthropic-sdk-go	1.73.0	1.84.0
github.com/getkin/kin-openapi	0.149.0	0.152.0
github.com/nicksnyder/go-i18n/v2	2.6.1	2.7.0
github.com/quic-go/quic-go	0.62.0	0.64.1
github.com/rabbitmq/amqp091-go	1.15.0	1.16.0
github.com/redis/go-redis/v9	9.22.0	9.23.0
go.opentelemetry.io/otel	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp	0.22.0	0.23.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	1.46.0	1.47.0
go.opentelemetry.io/otel/log	0.22.0	1.47.0
go.opentelemetry.io/otel/metric	1.46.0	1.47.0
go.opentelemetry.io/otel/sdk	1.46.0	1.47.0
go.opentelemetry.io/otel/sdk/log	0.22.0	1.47.0
go.opentelemetry.io/otel/sdk/metric	1.46.0	1.47.0
go.opentelemetry.io/otel/trace	1.46.0	1.47.0
golang.org/x/crypto	0.57.0	0.58.0
golang.org/x/net	0.59.0	0.60.0
golang.org/x/sys	0.48.0	0.49.0
golang.org/x/term	0.46.0	0.47.0
golang.org/x/text	0.42.0	0.43.0
google.golang.org/genai	1.71.0	1.76.0
modernc.org/sqlite	1.59.0	1.61.0

Updates github.com/anthropics/anthropic-sdk-go from 1.73.0 to 1.84.0

Release notes

Sourced from github.com/anthropics/anthropic-sdk-go's releases.

v1.84.0

Features

• api: add org webhook endpoints and user profile enforcement events

Chores

• ci: run the changelog check on a standard runner

v1.83.0

Features

• api: add data_refreshed_at and has_more to analytics report pages
• api: add workspace rate-limit updates to the Admin API
• api: make User Profiles generally available
• client: yield server-sent events with unrecognized event names
• google-cloud: use the v1 endpoints and add the organization endpoint

Bug Fixes

• client: close the response body of calls that discard the response
• client: treat x-amz-security-token as a sensitive header

Chores

• ci: fix Go cache restore when go.mod sets a newer toolchain
• ci: skip the changelog check on draft pull requests
• docs: add credential expiry descriptions to the Managed Agents API reference
• docs: add Messages API request descriptions
• docs: correct plugin manifest_version and reach descriptions
• docs: improve Managed Agents memory store descriptions
• docs: improve Managed Agents vault and credential descriptions

v1.82.0

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints
• tests: add tests for custom HTTP clients and trace propagation

... (truncated)

Changelog

Sourced from github.com/anthropics/anthropic-sdk-go's changelog.

1.84.0 (2026-10-20)

Features

• api: add org webhook endpoints and user profile enforcement events

Chores

• ci: run the changelog check on a standard runner

1.83.0 (2026-10-20)

Features

• api: add data_refreshed_at and has_more to analytics report pages
• api: add workspace rate-limit updates to the Admin API
• api: make User Profiles generally available
• client: yield server-sent events with unrecognized event names
• google-cloud: use the v1 endpoints and add the organization endpoint

Bug Fixes

• client: close the response body of calls that discard the response
• client: treat x-amz-security-token as a sensitive header

Chores

• ci: fix Go cache restore when go.mod sets a newer toolchain
• ci: skip the changelog check on draft pull requests
• docs: add credential expiry descriptions to the Managed Agents API reference
• docs: add Messages API request descriptions
• docs: correct plugin manifest_version and reach descriptions
• docs: improve Managed Agents memory store descriptions
• docs: improve Managed Agents vault and credential descriptions

1.82.0 (2026-10-15)

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Chores

• ci: speed up breaking change detection

... (truncated)

Commits

• 1e8e13c release: 1.84.0
• 3208f69 Merge pull request #502 from anthropics/synced/published
• 8f7877b feat(api): add org webhook endpoints and user profile enforcement events
• 4fadf22 codegen metadata
• 26b6a77 codegen metadata
• b632381 chore(ci): run the changelog check on a standard runner
• 4ac8e6e fix(sessions): settle tool calls invalidated by a processed session-wide inte...
• addf728 Merge branch 'main'
• da9a9fb release: 1.83.0
• 645b398 Merge pull request #485 from anthropics/synced/published
• Additional commits viewable in compare view

Updates github.com/getkin/kin-openapi from 0.149.0 to 0.152.0

Release notes

Sourced from github.com/getkin/kin-openapi's releases.

v0.152.0

What's Changed

• openapi2conv: push path-level body/formData parameters into operations by @​Yi-111-a in getkin/kin-openapi#1340
• fix(openapi3): resolve transitive component refs in JSON Schema 2020-12 validation by @​Yi-111-a in getkin/kin-openapi#1342
• openapi3: honor readOnly/writeOnly from allOf schemas in required checks by @​ybai08 in getkin/kin-openapi#1343
• openapi3: resolve $refs of Components.Links by @​fenollp in getkin/kin-openapi#1344
• openapi3: marshal a schema's empty type list as absent rather than null by @​fenollp in getkin/kin-openapi#1345
• openapi3: drop the Header dump from its content/schema error by @​fenollp in getkin/kin-openapi#1346
• openapi3gen: always propagate field tag by @​phooijenga in getkin/kin-openapi#1347
• routers/gorillamux: return an error instead of panicking when registering routes by @​fenollp in getkin/kin-openapi#1348
• openapi3: report $refs to null nodes as unresolved instead of panicking by @​fenollp in getkin/kin-openapi#1349
• openapi3: validate null servers, server variables, tags and components without panicking by @​fenollp in getkin/kin-openapi#1351
• openapi2conv: fix FromV3Parameter panics on binary schema refs and value-less schemas by @​fenollp in getkin/kin-openapi#1352
• openapi3filter: parse integer values as base 10 by @​LuisFigueroaG in getkin/kin-openapi#1353
• openapi3filter: decode spaceDelimited and pipeDelimited query objects by @​ybai08 in getkin/kin-openapi#1350
• Case-sensitive usmarshalling with json/v2 by @​fenollp in getkin/kin-openapi#1355
• openapi3filter: decode deepObject and non-exploded form object properties of urlencoded bodies by @​ybai08 in getkin/kin-openapi#1354
• openapi3: keep $ref siblings on a schema reached through a cycle by @​Yi-111-a in getkin/kin-openapi#1357
• tests: go around encoding/json/v2's randomness in error message by @​fenollp in getkin/kin-openapi#1361
• tests: remove actual network calls from tests by @​fenollp in getkin/kin-openapi#1362
• tests: run more in parallel by @​fenollp in getkin/kin-openapi#1363
• openapi3: ignore reference siblings in OpenAPI 3.0 by @​lucky798213 in getkin/kin-openapi#1268
• openapi3: WalkSchemas and WalkParameters stop on a callback cycle by @​reuvenharrison in getkin/kin-openapi#1364
• openapi3filter: validate response headers described with content by @​LuisFigueroaG in getkin/kin-openapi#1358
• openapi3filter: honor ExcludeRequestQueryParams for path item parameters by @​LuisFigueroaG in getkin/kin-openapi#1365
• openapi3: handle fields next to $ref as OpenAPI 3.0, 3.1 and 3.2 specify by @​fenollp in getkin/kin-openapi#1371
• changelog: fixup rebased messes by @​fenollp in getkin/kin-openapi#1372

New Contributors

• @​ybai08 made their first contribution in getkin/kin-openapi#1343
• @​phooijenga made their first contribution in getkin/kin-openapi#1347

Full Changelog: getkin/kin-openapi@v0.151.0...v0.152.0

v0.151.0

What's Changed

• openapi3: parse $ref slice indices with strconv.Atoi by @​fenollp in getkin/kin-openapi#1324
• openapi3: remove deprecated package-global IncludeOrigin by @​fenollp in getkin/kin-openapi#1325
• openapi3filter: decode and encode +json media types as JSON by @​BogdanYarotsky in getkin/kin-openapi#1326
• openapi3: reject additionalOperations keys that case-vary a fixed method by @​fenollp in getkin/kin-openapi#1328
• openapi3: recognize OpenAPI 3.2.1 by @​fenollp in getkin/kin-openapi#1327
• openapi3filter: set body defaults only for media types with an encoder by @​BogdanYarotsky in getkin/kin-openapi#1329
• openapi3: avoid a race around sliceUniqueItemsChecker by @​fenollp in getkin/kin-openapi#1331
• openapi2: name the response in Responses decoding errors by @​fenollp in getkin/kin-openapi#1332
• openapi3: compare enum values by JSON value by @​fenollp in getkin/kin-openapi#1333
• openapi3: move the built-in schema validator to schema_3point0_validator.go by @​fenollp in getkin/kin-openapi#1335
• modernize by @​fenollp in getkin/kin-openapi#1334
• openapi3filter: report form-urlencoded values that fail to parse instead of dropping them by @​LuisFigueroaG in getkin/kin-openapi#1337
• openapi3filter: follow style and explode when applying query array defaults by @​LuisFigueroaG in getkin/kin-openapi#1336
• openapi3filter: decode anyOf/oneOf/allOf array items in path, header and cookie parameters by @​LuisFigueroaG in getkin/kin-openapi#1338

... (truncated)

Commits

• 2420538 changelog: fixup rebased messes (#1372)
• 52aade8 openapi3: test $ref siblings with the cases of #1271
• 98fd8d4 openapi3: internalize, version and locate the keywords next to a schema $ref
• c59eda0 openapi3: merge the fields next to a path item's $ref with the item it points to
• 11caa38 openapi3: tell apart a $ref being resolved as different kinds of objects
• cb14646 openapi3: marshal the fields written next to a $ref
• 0375a5d openapi3: apply a 3.1 schema's $ref siblings alongside the referenced schema
• 79ac3c4 openapi3: ignore the fields next to a Reference Object's $ref in every version
• 35b08af openapi3filter: honor ExcludeRequestQueryParams for path item parameters (#1365)
• 1b2754d openapi3filter: validate response headers described with content (#1358)
• Additional commits viewable in compare view

Updates github.com/nicksnyder/go-i18n/v2 from 2.6.1 to 2.7.0

Release notes

Sourced from github.com/nicksnyder/go-i18n/v2's releases.

v2.7.0

What's Changed

New

• Add i18n.ParseMessageBytes, Bundle.ParseMessageBytes, and Bundle.MustParseMessageBytes to parse messages from bytes with an explicit language tag and unmarshal func. This supports message files whose names aren't language tags (e.g. locales/en/translation.json). Fixes #347.
• Update plural rules to CLDR v49.

goi18n

• goi18n extract now type-checks the files in each package together, so message fields can reference constants and vars declared in other files of the same package.
• goi18n extract no longer crashes on string() conversions or self-referencing declarations, and resolves each name in a multi-name declaration (const a, b = "x", "y") to its own value.
• goi18n merge now writes the plural forms that are already translated into translate.*.toml, so translators can see the existing wording for better translation context.
• goi18n merge reports a missing other plural form as an error instead of panicking. Fixes #235.

Fixes

• Plural count strings that are empty or have exponents outside [-30, 30] now return an error. Before, an empty string panicked and inputs like "0e300000000" could use up all available memory.

Docs

• README explains what translate.*.toml files contain and when to delete them (fixes #193), and what the hashes in active files are for (refs #294).
• Fix the status badge and remove the retired Go Report Card badge (#407, #411).

Requirements and dependencies

• Go 1.26 or newer is now required (was 1.24).
• Upgrade golang.org/x/text to v0.43.0 and go.yaml.in/yaml/v3 to v3.0.5 (#413).

Full Changelog: nicksnyder/go-i18n@v2.6.1...v2.7.0

Commits

• d2149e6 i18n: add ParseMessageBytes
• dc059a4 goi18n extract: resolve constants with go/types across package files
• 4e2b2f9 CLDR v49
• 240ac46 Explain hashes in active files in README
• 3cabfcb Include translated plural forms in translate files for context
• 721d00e Explain translate.*.toml contents and cleanup in README
• 6c03000 Use the latest Go patch release in CI for stable cache keys
• 8d14838 Check out code before setup-go so the Go cache works
• d1b09b3 Upgrade to Go 1.26 and latest dependencies
• 9a26c9a Report missing other form in goi18n merge instead of panicking
• Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.62.0 to 0.64.1

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.64.1

This patch release fixes datagram receive cancellation and stream reset handling.

Notable Fixes

• Conn.ReceiveDatagram now fails immediately if the context is already canceled: #5947
• http3: Stream.ReceiveDatagram and RequestStream.ReceiveDatagram now fail immediately if the context is already canceled: #5948
• Stream reset handling now ignores reliable boundary updates after cancellation: #5950

Changelog

• ignore reliable boundary updates after stream cancellation by @​marten-seemann in quic-go/quic-go#5950
• fail Conn.ReceiveDatagram if the context is already canceled by @​marten-seemann in quic-go/quic-go#5947
• http3: fail Stream.ReceiveDatagram if the context is already canceled by @​marten-seemann in quic-go/quic-go#5948

Full Changelog: quic-go/quic-go@v0.64.0...v0.64.1

v0.64.0

This release improves congestion control and performance, especially on paths with packet reordering:

• Slow-start pacing now uses twice the estimated bandwidth, allowing the sending rate to double each RTT: #5882
• Application-data loss detection now disables packet-threshold detection after a spurious loss, avoiding repeated unnecessary retransmissions caused by packet reordering: #5905
• Application-data loss detection now uses an adaptive time threshold that increases after spurious losses, allowing more time for reordered packets to arrive: #5925
• The congestion controller now restores its congestion window and recovery state after a reduction caused entirely by spurious packet loss: #5923

Notable Fixes

• Congestion recovery now respects send order across Initial, Handshake and application-data packets, fixing incorrect recovery decisions caused by comparing packet numbers from different spaces: #5920
• Connections now fall back to 1200-byte Initial packets on EMSGSIZE when Config.InitialPacketSize is unset, allowing handshakes over paths with smaller MTUs: #5911
• Oversized packets are now rejected before serialization, including Initial packets with excessively large address-validation tokens: #5937
• Path MTU discovery now restarts correctly after connection migration and NAT rebinding: #5887
• Servers now retry unanswered PATH_CHALLENGEs with exponential backoff as more packets arrive on the candidate path, preventing path validation from stalling when a challenge is acknowledged but no PATH_RESPONSE arrives: #5930
• Servers now continue responding to PATH_CHALLENGEs on existing candidate paths when the candidate path limit is reached: #5929
• Writes after closing a SendStream or Stream now return quic.ErrStreamClosed, which is also used as the stream context's cancellation cause: #5885
• Conn.SendDatagram now returns the connection's close error after shutdown, instead of accepting datagrams that will be silently dropped: #5880
• http3: SendDatagram now immediately returns an error after the stream's send side closes, including after STOP_SENDING or connection shutdown: #5884
• http3: request header, response header and trailer buffers now grow as data arrives, avoiding large allocations based solely on a peer's advertised HEADERS frame length: #5886
• Spurious losses are now detected when an ACK only acknowledges packets previously declared lost: #5895
• Spurious losses are now detected when ACKs arrive out of order: #5900
• Path migration now clears the old path's loss history, preventing stale spurious-loss reports and recovery adjustments: #5903
• MTU and path probes no longer trigger spurious-loss reports or adaptive loss-recovery changes: #5906

Notable Changes

• ConnectionStats now exposes CongestionWindow, reporting the local sender's congestion window on the active network path in bytes: #5901
• http3.Stream and http3.RequestStream now expose QlogTrace, allowing applications to add events to the underlying connection's qlog trace: #5935
• http3/qlog.RedactHeaders allows applications to redact HTTP/3 header and trailer values, including pseudo-headers, before they are written to qlog: #5932
• qlog: locally dropped QUIC datagrams are now recorded with quic:datagram_dropped, including drops caused by a full receive buffer or an oversized outgoing datagram: #5907
• qlog: quic:recovery_parameters_set now records initial recovery parameters and changes to loss-detection thresholds, including resets after path migration: #5926

... (truncated)

Commits

• ed90516 http3: fail Stream.ReceiveDatagram if the context is already canceled (#5948)
• 1170056 fail Conn.ReceiveDatagram if the context is already canceled (#5947)
• 5a5e6b7 ignore reliable boundary updates after stream cancellation (#5950)
• 9abbbad retry server path challenges with exponential backoff (#5930)
• 15baf53 only enforce the candidate path limit for new paths (#5929)
• 8754e95 reject oversized packets before serialization (#5937)
• 54cf12e http3: expose the connection's qlog trace on streams (#5935)
• 4b404ee http3/qlog: implement redacting of header fields (#5932)
• 432b156 README: link OSS-Fuzz badge to the introspector (#5928)
• d4981bc qlog initial recovery parameters and loss threshold updates (#5926)
• Additional commits viewable in compare view

Updates github.com/rabbitmq/amqp091-go from 1.15.0 to 1.16.0

Release notes

Sourced from github.com/rabbitmq/amqp091-go's releases.

v1.16.0

What's Changed

• chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#391
• docs: document URI credential percent-encoding requirement (#305) by @​cipherprofessor in rabbitmq/amqp091-go#396
• Surface the broker's connection.close reason from Dial instead of a hardcoded 403 by @​mohammadkshn in rabbitmq/amqp091-go#393
• chore: remove redundant legacy +build tag from fuzz.go by @​cipherprofessor in rabbitmq/amqp091-go#395
• Reader hardening by @​Zerpet in rabbitmq/amqp091-go#397
• chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#398
• Add Fuzzy tests for reader by @​Zerpet in rabbitmq/amqp091-go#399
• chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#401
• Reject heartbeat frames sent on a non-zero channel by @​suchitd in rabbitmq/amqp091-go#402
• Add support for basic cancel ok response by @​Zerpet in rabbitmq/amqp091-go#405
• Reject out-of-range heartbeat in ParseURI by @​suchitd in rabbitmq/amqp091-go#407
• Start recovery watcher only after a successful handshake by @​suchitd in rabbitmq/amqp091-go#409
• chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#410
• Fix golangci-lint v2.15.0 errcheck failures by @​suchitd in rabbitmq/amqp091-go#411

New Contributors

• @​cipherprofessor made their first contribution in rabbitmq/amqp091-go#396
• @​mohammadkshn made their first contribution in rabbitmq/amqp091-go#393

Full Changelog: rabbitmq/amqp091-go@v1.15.0...v1.16.0

Changelog

Sourced from github.com/rabbitmq/amqp091-go's changelog.

v1.16.0 (2026-10-19)

Full Changelog

Implemented enhancements:

• Add support for basic cancel ok response #405 (Zerpet)

Fixed bugs:

• Start recovery watcher only after a successful handshake #409 (suchitd)
• Reject out-of-range heartbeat in ParseURI #407 (suchitd)
• Reject heartbeat frames sent on a non-zero channel #402 (suchitd)

Closed issues:

• DialConfig leaks a watchConnection goroutine when the AMQP handshake fails with Recovery enabled #408
• panic: unexpected frame type #400
• v1.13.0: openComplete() zeroes caller-owned SASL credentials, breaking Config reuse across dials #394
• Dial returns 403 "no access to this vhost" when the broker refuses connection.open with 530 NOT_ALLOWED (e.g. user connection limit reached) #392
• Question mark in password breaks connection string parsing #305

Merged pull requests:

• Fix golangci-lint v2.15.0 errcheck failures #411 (suchitd)
• chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 in the github-actions group #410 (dependabot[bot])
• chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 in the github-actions group #401 (dependabot[bot])
• Add Fuzzy tests for reader #399 (Zerpet)
• chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 in the github-actions group #398 (dependabot[bot])
• Reader hardening #397 (Zerpet)
• docs: document URI credential percent-encoding requirement (#305) #396 (cipherprofessor)
• chore: remove redundant legacy +build tag from fuzz.go #395 (cipherprofessor)
• Surface the broker's connection.close reason from Dial instead of a hardcoded 403 #393 (mohammadkshn)
• chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0 in the github-actions group #391 (dependabot[bot])

Commits

• 0149b60 Update changelog.md for v1.16.0
• 76fec2b Merge pull request #411 from rabbitmq/fix/errcheck-golangci-lint-v2.15
• e3acbe6 Fix golangci-lint v2.15.0 errcheck failures
• 3aa2215 Release v1.16.0
• ba61a26 Merge pull request #410 from rabbitmq/dependabot/github_actions/github-action...
• 11f9b30 chore(deps): bump github/codeql-action
• e7fe0bd Merge pull request #409 from rabbitmq/fix/dialconfig-watcher-leak-on-failed-open
• 4f11601 Start recovery watcher only after a successful handshake
• c0131b7 Merge pull request #407 from rabbitmq/fix/uri-heartbeat-correctness
• 61d31a1 Reject out-of-range heartbeat in ParseURI
• Additional commits viewable in compare view

Updates github.com/redis/go-redis/v9 from 9.22.0 to 9.23.0

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.23.0

This is a minor release. It contains everything from 9.23.0-beta.1, so these notes cover the full 9.22.0 → 9.23.0 upgrade.

⚠️ Changes to check when you upgrade from 9.22.0:

• Go 1.26 is now the minimum Go version (#4060). The go directive of the root module and of the submodules moved from 1.24 to 1.26, as part of the dependency bumps for govulncheck findings. Projects that build with Go 1.24 or 1.25 must upgrade the toolchain.
• Each Client has a dedicated pipeline connection pool (#4002). This includes failover clients and cluster node clients. Pipeline, TxPipeline, and autopipeline operations use this pool, so they do not compete with regular commands for main-pool connections. The pool is for burst capacity only: it dials only when necessary, an unused pool holds zero connections, and if the pool is full an operation uses the main pool. Set PipelinePoolSize: -1 to get the previous single-pool behavior.
• AutoPipelineOptions.MaxBatchBytes has a default of 128 KiB (before, there was no limit). The default prevents a write/reply deadlock; it is not a throughput control. The buffers of the pipeline pool also have a default of 128 KiB.

⚠️ Changes to experimental APIs since 9.23.0-beta.1 (no effect if you upgrade from 9.22.0):

• AutoPipelineOptions.FullDuplexFastSubmit is removed (#4018). The submit channel is replaced by a queue that takes a full wave of commands in one lock, so the separate fast path is not necessary. Remove the field from your options.
• Options.ClientSideCacheRefreshRecencyWindow is removed (#4034). Refresh-on-invalidate now reads again every cached entry of an invalidated key and does not look at how recently the entry was read. On a write-heavy keyspace this means refresh traffic across the full resident cache. Remove the field from your options.
• LocalCache.LRUClock() is removed (#4034). It returned the recency token that the removed recency window used, and has no replacement. Remove calls to it.
• ClientSideCacheInvalidationBatchWindow served stale values in beta.1 (#4033). Under load the batcher applied only ~15% of invalidations, and the cache served invalidated values with a ~100% hit rate. 9.23.0 applies all of them. If you used this option on beta.1, upgrade.

🚀 Highlights

Full-Duplex Auto-Pipelining (Experimental)

Set AutoPipelineOptions.FullDuplex to enable the full-duplex mode of the automatic pipeliner. The default mode sends one batch per round trip. In full-duplex mode the engine holds one pipeline-pool connection, and a writer goroutine and a reader goroutine move the ordered command stream in both directions at the same time. On a high-latency link each command completes in approximately one round-trip time (RTT) on a single connection. On a 50 ms WAN profile: ~389k ops/s at 52 ms p50, against ~207k ops/s at 116 ms on the half-duplex ordered path.

The mode works on both faces of a standalone Client (AutoPipeline() and AsyncAutoPipeline()), and natively on a ClusterClient when routing goes to masters only. On a cluster, one child engine per master sends each command to the node that owns its slot, and follows MOVED / ASK redirects and retryable replies (LOADING, READONLY, ...) through the usual cluster redirect path. With replica routing (ReadOnly, RouteByLatency, or RouteRandomly), the autopipeliner uses the half-duplex shard flushers, which obey the shard picker. Config().FullDuplex reports the mode in effect.

Options:

• FullDuplexWindow — the maximum number of commands in flight (backpressure).
• FullDuplexIdleTimeout and FullDuplexMaxHold — when the engine returns the held connection to the pool. The pool hooks then do re-authentication and maintenance-notification handoffs.
• MaxFlushDelay — now also used in full-duplex mode (#4014). The writer waits only when enough commands are in flight, so low-concurrency callers keep the 1×RTT behavior. With MaxFlushDelay=250µs at 1024 callers: +22% ops/s and −26% p99. The default is 0, so this is opt-in.
• NumShards — on a standalone Client, the number of full-duplex engines (#4022). See below.

Pipeline() on the full-duplex connection (#4021). Standalone Client only. Before, ap.Pipeline() used a pooled connection for each Exec. It now submits the batch to the engine as one contiguous run (FDPipelined), so replies come back in submit order, as on a dedicated connection. At 256–1024 callers with 10 commands per Exec: +49% to +52% throughput on one socket instead of ~150. Errors, retries, hooks, and metrics behave like an ordinary pipeline. A batch that cannot use the stream (a blocking command, a per-command read timeout, a diverted command, or a batch larger than the queue) falls back to the ordinary pipeline. TxPipeline stays on a pooled connection, because MULTI/EXEC needs connection affinity. On a ClusterClient, ap.Pipeline() is still the ordinary cluster pipeline. A batch that the queue cannot admit now reserves its slots and waits in a first-come line, so single commands cannot starve a long pipeline (#4057, merged as part of #4021) by @​vlady-kotsev.

Several engines on one client (#4022). With FullDuplex, NumShards > 1 now means N engines on one client: one pool, one hook chain, N held connections. Commands route by a hash of their first key, so commands on the same key stay on one connection and keep their order without Unordered. Keyless commands are distributed round-robin. An FDPipelined batch stays on one engine. The pipeline pool must hold at least NumShards connections for each full-duplex autopipeliner. More engines help only under high concurrency: with 10-command pipelines, 8 engines were 30% slower than 1 at 8 callers, equal at about 128 callers, and 2.2× faster at 1024 callers.

The full-duplex path supports blocking commands, Options.Limiter (one admission per written batch), per-command and pipeline hooks, OTel metrics, retry budgets (a NoRetry command is never sent again after it is on the wire), and seamless maintenance handoffs. Limits of the stream model:

• A hook can observe a command, but cannot stop it. A ProcessHook that returns without calling next does not cancel the command on the full-duplex path; the command is already queued on the held connection. Run policy or kill-switch hooks on a plain client or on the half-duplex autopipeliner.
• Diverted commands are not ordered with the stream. The engine diverts blocking commands, connection-hostile commands, and managed HIMPORT commands. On the async face, wait for the result of a diverted command before you submit a command that depends on it.
• Single commands on the full-duplex stream do not use the client-side cache. If CSC is enabled, a cacheable command on the stream does not read or write the cache.
• Duration metrics are recorded per reply. A command that fails before it reaches the reader (lease failure, limiter denial, retry exhaustion, close) calls the error callback but records no operation-duration sample.

rdb := redis.NewClient(&redis.Options{
	Addr: "localhost:6379",
	AutoPipelineOptions: &redis.AutoPipelineOptions{
		FullDuplex: true, // stream commands on one held connection, ~1 RTT each
	},
})
defer rdb.Close()
</tr></table> 

... (truncated)

Changelog

Sourced from github.com/redis/go-redis/v9's changelog.

9.23.0 (2026-10-05)

This is a minor release. It contains everything from 9.23.0-beta.1, so these notes cover the full 9.22.0 → 9.23.0 upgrade. The release adds:

• An experimental full-duplex mode for the automatic pipeliner, now with Pipeline() on the full-duplex connection and several engines on one client.
• Refresh-on-invalidate and miss coalescing for client-side caching, and a faster cache read path.
• Better distribution of cluster reads under latency-based routing.
• Client.EphemeralConn, an opt-in limit on queued autopipeline commands, and many stability fixes.

⚠️ Changes to check when you upgrade from 9.22.0:

• Go 1.26 is now the minimum Go version (#4060). The go directive of the root module and of the submodules moved from 1.24 to 1.26, as part of the dependency bumps for govulncheck findings. Projects that build with Go 1.24 or 1.25 must upgrade the toolchain.
• Each Client has a dedicated pipeline connection pool (#4002). This includes failover clients and cluster node clients. Pipeline, TxPipeline, and autopipeline operations use this pool, so they do not compete with regular commands for main-pool connections. The pool is for burst capacity only: it dials only when necessary, an unused pool holds zero connections, and if the pool is full an operation uses the main pool. Set PipelinePoolSize: -1 to get the previous single-pool behavior.
• AutoPipelineOptions.MaxBatchBytes has a default of 128 KiB (before, there was no limit). The default prevents a write/reply deadlock; it is not a throughput control. The buffers of the pipeline pool also have a default of 128 KiB.

⚠️ Changes to experimental APIs since 9.23.0-beta.1 (no effect if you upgrade from 9.22.0):

• AutoPipelineOptions.FullDuplexFastSubmit is removed (#4018). The submit channel is replaced by a queue that takes a full wave of commands in one lock, so the separate fast path is not necessary. Remove the field from your options.
• Options.ClientSideCacheRefreshRecencyWindow is removed (#4034). Refresh-on-invalidate now reads again every cached entry of an invalidated key and does not look at how recently the entry was read. On a write-heavy keyspace this means refresh traffic across the full resident cache. Remove the field from your options.
• LocalCache.LRUClock() is removed (#4034). It returned the recency token that the removed recency window used, and has no replacement. Remove calls to it.
• ClientSideCacheInvalidationBatchWindow served stale values in beta.1 (#4033). Under load the batcher applied only ~15% of invalidations, and the cache served invalidated values with a ~100% hit rate. 9.23.0 applies all of them. If you used this option on beta.1, upgrade.

🚀 Highlights

Full-Duplex Auto-Pipelining (Experimental)

Set AutoPipelineOptions.FullDuplex to enable the full-duplex mode of the automatic pipeliner. The default mode sends one batch per round trip. In full-duplex mode the engine holds one pipeline-pool connection, and a writer goroutine and a reader goroutine move the ordered command stream in both directions at the same time. On a high-latency link each command completes in approximately one round-trip time (RTT) on a single connection. On a 50 ms WAN profile: ~389k ops/s at 52 ms p50, against ~207k ops/s at 116 ms on the half-duplex ordered path.

The mode works on both faces of a standalone Client (AutoPipeline() and AsyncAutoPipeline()), and natively on a ClusterClient when routing goes to masters only. On a cluster, one child engine per master sends each command to the node that owns its slot, and follows MOVED / ASK redirects and retryable replies (LOADING, READONLY, ...) through the usual cluster redirect path. With replica routing (ReadOnly, RouteByLatency, or RouteRandomly), the autopipeliner uses the half-duplex shard flushers, which obey the shard picker. Config().FullDuplex reports the mode in effect.

Options:

• FullDuplexWindow — the maximum number of commands in flight (backpressure).
• FullDuplexIdleTimeout and FullDuplexMaxHold — when the engine returns the held connection to the pool. The pool hooks then do re-authentication and maintenance-notification handoffs.
• MaxFlushDelay — now also used in full-duplex mode (#4014). The writer waits only when enough commands are in flight, so low-concurrency callers keep the 1×RTT behavior. With MaxFlushDelay=250µs at 1024 callers: +22% ops/s and −26% p99. The default is 0, so this is opt-in.
• NumShards — on a standalone Client, the number of full-duplex engines (#4022). See below.

Pipeline() on the full-duplex connection (#4021). Standalone Client only. Before, ap.Pipeline() used a pooled connection for each Exec. It now submits the batch to the engine as one contiguous run (FDPipelined), so replies come back in submit order, as on a dedicated connection. At 256–1024 callers with 10 commands per Exec: +49% to +52% throughput on one socket instead of ~150. Errors, retries, hooks, and metrics behave like an ordinary pipeline. A batch that cannot use the stream (a blocking command, a per-command read timeout, a diverted command, or a batch larger than the queue) falls back to the ordinary pipeline. TxPipeline stays on a pooled connection, because ...

Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.