[dependabot]

Bumps the go-deps group with 25 updates in the / directory:

Package	From	To
github.com/anthropics/anthropic-sdk-go	1.73.0	1.84.0
github.com/getkin/kin-openapi	0.149.0	0.152.0
github.com/jackc/pgx/v5	5.11.0	5.12.0
github.com/nicksnyder/go-i18n/v2	2.6.1	2.7.0
github.com/quic-go/quic-go	0.62.0	0.65.0
github.com/rabbitmq/amqp091-go	1.15.0	1.16.0
github.com/redis/go-redis/v9	9.22.0	9.23.0
go.opentelemetry.io/otel	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp	0.22.0	0.23.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	1.46.0	1.47.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	1.46.0	1.47.0
go.opentelemetry.io/otel/log	0.22.0	1.47.0
go.opentelemetry.io/otel/metric	1.46.0	1.47.0
go.opentelemetry.io/otel/sdk	1.46.0	1.47.0
go.opentelemetry.io/otel/sdk/log	0.22.0	1.47.0
go.opentelemetry.io/otel/sdk/metric	1.46.0	1.47.0
go.opentelemetry.io/otel/trace	1.46.0	1.47.0
golang.org/x/crypto	0.57.0	0.58.0
golang.org/x/net	0.59.0	0.60.0
golang.org/x/sys	0.48.0	0.49.0
golang.org/x/term	0.46.0	0.47.0
golang.org/x/text	0.42.0	0.43.0
google.golang.org/genai	1.71.0	1.77.0
modernc.org/sqlite	1.59.0	1.61.1

Updates github.com/anthropics/anthropic-sdk-go from 1.73.0 to 1.84.0

Release notes

Sourced from github.com/anthropics/anthropic-sdk-go's releases.

v1.84.0

Features

• api: add org webhook endpoints and user profile enforcement events

Chores

• ci: run the changelog check on a standard runner

v1.83.0

Features

• api: add data_refreshed_at and has_more to analytics report pages
• api: add workspace rate-limit updates to the Admin API
• api: make User Profiles generally available
• client: yield server-sent events with unrecognized event names
• google-cloud: use the v1 endpoints and add the organization endpoint

Bug Fixes

• client: close the response body of calls that discard the response
• client: treat x-amz-security-token as a sensitive header

Chores

• ci: fix Go cache restore when go.mod sets a newer toolchain
• ci: skip the changelog check on draft pull requests
• docs: add credential expiry descriptions to the Managed Agents API reference
• docs: add Messages API request descriptions
• docs: correct plugin manifest_version and reach descriptions
• docs: improve Managed Agents memory store descriptions
• docs: improve Managed Agents vault and credential descriptions

v1.82.0

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Chores

• ci: speed up breaking change detection
• docs: describe headers on Managed Agents and telemetry endpoints
• tests: add tests for custom HTTP clients and trace propagation

... (truncated)

Changelog

Sourced from github.com/anthropics/anthropic-sdk-go's changelog.

1.84.0 (2026-10-20)

Features

• api: add org webhook endpoints and user profile enforcement events

Chores

• ci: run the changelog check on a standard runner

1.83.0 (2026-10-20)

Features

• api: add data_refreshed_at and has_more to analytics report pages
• api: add workspace rate-limit updates to the Admin API
• api: make User Profiles generally available
• client: yield server-sent events with unrecognized event names
• google-cloud: use the v1 endpoints and add the organization endpoint

Bug Fixes

• client: close the response body of calls that discard the response
• client: treat x-amz-security-token as a sensitive header

Chores

• ci: fix Go cache restore when go.mod sets a newer toolchain
• ci: skip the changelog check on draft pull requests
• docs: add credential expiry descriptions to the Managed Agents API reference
• docs: add Messages API request descriptions
• docs: correct plugin manifest_version and reach descriptions
• docs: improve Managed Agents memory store descriptions
• docs: improve Managed Agents vault and credential descriptions

1.82.0 (2026-10-15)

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Chores

• ci: speed up breaking change detection

... (truncated)

Commits

• 1e8e13c release: 1.84.0
• 3208f69 Merge pull request #502 from anthropics/synced/published
• 8f7877b feat(api): add org webhook endpoints and user profile enforcement events
• 4fadf22 codegen metadata
• 26b6a77 codegen metadata
• b632381 chore(ci): run the changelog check on a standard runner
• 4ac8e6e fix(sessions): settle tool calls invalidated by a processed session-wide inte...
• addf728 Merge branch 'main'
• da9a9fb release: 1.83.0
• 645b398 Merge pull request #485 from anthropics/synced/published
• Additional commits viewable in compare view

Updates github.com/getkin/kin-openapi from 0.149.0 to 0.152.0

Release notes

Sourced from github.com/getkin/kin-openapi's releases.

v0.152.0

What's Changed

• openapi2conv: push path-level body/formData parameters into operations by @​Yi-111-a in getkin/kin-openapi#1340
• fix(openapi3): resolve transitive component refs in JSON Schema 2020-12 validation by @​Yi-111-a in getkin/kin-openapi#1342
• openapi3: honor readOnly/writeOnly from allOf schemas in required checks by @​ybai08 in getkin/kin-openapi#1343
• openapi3: resolve $refs of Components.Links by @​fenollp in getkin/kin-openapi#1344
• openapi3: marshal a schema's empty type list as absent rather than null by @​fenollp in getkin/kin-openapi#1345
• openapi3: drop the Header dump from its content/schema error by @​fenollp in getkin/kin-openapi#1346
• openapi3gen: always propagate field tag by @​phooijenga in getkin/kin-openapi#1347
• routers/gorillamux: return an error instead of panicking when registering routes by @​fenollp in getkin/kin-openapi#1348
• openapi3: report $refs to null nodes as unresolved instead of panicking by @​fenollp in getkin/kin-openapi#1349
• openapi3: validate null servers, server variables, tags and components without panicking by @​fenollp in getkin/kin-openapi#1351
• openapi2conv: fix FromV3Parameter panics on binary schema refs and value-less schemas by @​fenollp in getkin/kin-openapi#1352
• openapi3filter: parse integer values as base 10 by @​LuisFigueroaG in getkin/kin-openapi#1353
• openapi3filter: decode spaceDelimited and pipeDelimited query objects by @​ybai08 in getkin/kin-openapi#1350
• Case-sensitive usmarshalling with json/v2 by @​fenollp in getkin/kin-openapi#1355
• openapi3filter: decode deepObject and non-exploded form object properties of urlencoded bodies by @​ybai08 in getkin/kin-openapi#1354
• openapi3: keep $ref siblings on a schema reached through a cycle by @​Yi-111-a in getkin/kin-openapi#1357
• tests: go around encoding/json/v2's randomness in error message by @​fenollp in getkin/kin-openapi#1361
• tests: remove actual network calls from tests by @​fenollp in getkin/kin-openapi#1362
• tests: run more in parallel by @​fenollp in getkin/kin-openapi#1363
• openapi3: ignore reference siblings in OpenAPI 3.0 by @​lucky798213 in getkin/kin-openapi#1268
• openapi3: WalkSchemas and WalkParameters stop on a callback cycle by @​reuvenharrison in getkin/kin-openapi#1364
• openapi3filter: validate response headers described with content by @​LuisFigueroaG in getkin/kin-openapi#1358
• openapi3filter: honor ExcludeRequestQueryParams for path item parameters by @​LuisFigueroaG in getkin/kin-openapi#1365
• openapi3: handle fields next to $ref as OpenAPI 3.0, 3.1 and 3.2 specify by @​fenollp in getkin/kin-openapi#1371
• changelog: fixup rebased messes by @​fenollp in getkin/kin-openapi#1372

New Contributors

• @​ybai08 made their first contribution in getkin/kin-openapi#1343
• @​phooijenga made their first contribution in getkin/kin-openapi#1347

Full Changelog: getkin/kin-openapi@v0.151.0...v0.152.0

v0.151.0

What's Changed

• openapi3: parse $ref slice indices with strconv.Atoi by @​fenollp in getkin/kin-openapi#1324
• openapi3: remove deprecated package-global IncludeOrigin by @​fenollp in getkin/kin-openapi#1325
• openapi3filter: decode and encode +json media types as JSON by @​BogdanYarotsky in getkin/kin-openapi#1326
• openapi3: reject additionalOperations keys that case-vary a fixed method by @​fenollp in getkin/kin-openapi#1328
• openapi3: recognize OpenAPI 3.2.1 by @​fenollp in getkin/kin-openapi#1327
• openapi3filter: set body defaults only for media types with an encoder by @​BogdanYarotsky in getkin/kin-openapi#1329
• openapi3: avoid a race around sliceUniqueItemsChecker by @​fenollp in getkin/kin-openapi#1331
• openapi2: name the response in Responses decoding errors by @​fenollp in getkin/kin-openapi#1332
• openapi3: compare enum values by JSON value by @​fenollp in getkin/kin-openapi#1333
• openapi3: move the built-in schema validator to schema_3point0_validator.go by @​fenollp in getkin/kin-openapi#1335
• modernize by @​fenollp in getkin/kin-openapi#1334
• openapi3filter: report form-urlencoded values that fail to parse instead of dropping them by @​LuisFigueroaG in getkin/kin-openapi#1337
• openapi3filter: follow style and explode when applying query array defaults by @​LuisFigueroaG in getkin/kin-openapi#1336
• openapi3filter: decode anyOf/oneOf/allOf array items in path, header and cookie parameters by @​LuisFigueroaG in getkin/kin-openapi#1338

... (truncated)

Commits

• 2420538 changelog: fixup rebased messes (#1372)
• 52aade8 openapi3: test $ref siblings with the cases of #1271
• 98fd8d4 openapi3: internalize, version and locate the keywords next to a schema $ref
• c59eda0 openapi3: merge the fields next to a path item's $ref with the item it points to
• 11caa38 openapi3: tell apart a $ref being resolved as different kinds of objects
• cb14646 openapi3: marshal the fields written next to a $ref
• 0375a5d openapi3: apply a 3.1 schema's $ref siblings alongside the referenced schema
• 79ac3c4 openapi3: ignore the fields next to a Reference Object's $ref in every version
• 35b08af openapi3filter: honor ExcludeRequestQueryParams for path item parameters (#1365)
• 1b2754d openapi3filter: validate response headers described with content (#1358)
• Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.11.0 to 5.12.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

• SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@​igor-kupczynski).
• Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @​president-xd.

Features

• Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)
• Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)
• pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)
• pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

• pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.
• pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

Commits

• b2ef08b Update changelog for v5.12.0
• 8199015 Merge commit from fork
• 5b1a6a0 Merge commit from fork
• 65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
• f2701a0 pgconn: only fall back when Windows service file is missing
• db95468 Merge pull request #2696 from k-zshiba/support-oid8
• fa2327d Start each query on a new line when joining a simple protocol batch
• 2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
• efc0b74 Merge upstream master into support-oid8
• 5a17450 pgconn: require AuthenticationOk before ReadyForQuery
• Additional commits viewable in compare view

Updates github.com/nicksnyder/go-i18n/v2 from 2.6.1 to 2.7.0

Release notes

Sourced from github.com/nicksnyder/go-i18n/v2's releases.

v2.7.0

What's Changed

New

• Add i18n.ParseMessageBytes, Bundle.ParseMessageBytes, and Bundle.MustParseMessageBytes to parse messages from bytes with an explicit language tag and unmarshal func. This supports message files whose names aren't language tags (e.g. locales/en/translation.json). Fixes #347.
• Update plural rules to CLDR v49.

goi18n

• goi18n extract now type-checks the files in each package together, so message fields can reference constants and vars declared in other files of the same package.
• goi18n extract no longer crashes on string() conversions or self-referencing declarations, and resolves each name in a multi-name declaration (const a, b = "x", "y") to its own value.
• goi18n merge now writes the plural forms that are already translated into translate.*.toml, so translators can see the existing wording for better translation context.
• goi18n merge reports a missing other plural form as an error instead of panicking. Fixes #235.

Fixes

• Plural count strings that are empty or have exponents outside [-30, 30] now return an error. Before, an empty string panicked and inputs like "0e300000000" could use up all available memory.

Docs

• README explains what translate.*.toml files contain and when to delete them (fixes #193), and what the hashes in active files are for (refs #294).
• Fix the status badge and remove the retired Go Report Card badge (#407, #411).

Requirements and dependencies

• Go 1.26 or newer is now required (was 1.24).
• Upgrade golang.org/x/text to v0.43.0 and go.yaml.in/yaml/v3 to v3.0.5 (#413).

Full Changelog: nicksnyder/go-i18n@v2.6.1...v2.7.0

Commits

• d2149e6 i18n: add ParseMessageBytes
• dc059a4 goi18n extract: resolve constants with go/types across package files
• 4e2b2f9 CLDR v49
• 240ac46 Explain hashes in active files in README
• 3cabfcb Include translated plural forms in translate files for context
• 721d00e Explain translate.*.toml contents and cleanup in README
• 6c03000 Use the latest Go patch release in CI for stable cache keys
• 8d14838 Check out code before setup-go so the Go cache works
• d1b09b3 Upgrade to Go 1.26 and latest dependencies
• 9a26c9a Report missing other form in goi18n merge instead of panicking
• Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.62.0 to 0.65.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.65.0

This release updates qlog to the latest IETF drafts, adds explicit stream credit release, and fixes a number of HTTP/3 and connection migration bugs.

• With Config.RequireStreamCreditRelease, completed streams count towards the incoming stream limit until the application calls ReleaseStreamCredit: #5981, #5982
• qlog: events now follow draft-ietf-quic-qlog-quic-events-14 and draft-ietf-quic-qlog-h3-events-14: #6120

Breaking Changes

• http3: HTTPStreamer.HTTPStream now returns (*Stream, error), and no longer sends an implicit 200 response: #5988, #5994

Notable Fixes

• QUIC v2 key updates now use the correct quicv2 ku label: #5973
• Connections using zero-length connection IDs no longer stop receiving packets after version negotiation: #6129
• Switching paths now uses a new connection ID, fixing servers that kept sending to the old address after repeated NAT rebindings: #6015
• Clients now send PATH_RESPONSE on the path the PATH_CHALLENGE was received on: #5980
• Path.Probe now succeeds on an already validated path: #6019
• Reordered and retransmitted NEW_CONNECTION_ID frames are now handled correctly: #6009, #6007
• DATAGRAM frames no longer starve ACKs, control frames and retransmissions: #5970
• CancelRead now unblocks Read and Peek after receiving RESET_STREAM_AT: #6022
• TryWriteAll no longer copies queued data quadratically: #6042, #6043
• http3: canceling the first request to a host no longer cancels the shared dial: #6132
• http3: bodies shorter than the announced Content-Length now fail with io.ErrUnexpectedEOF: #5913
• http3: Content-Length is no longer added to 204 and 304 responses, and is now sent for requests with http.NoBody: #6032, #6029
• http3: response writes that fail partway (e.g. on a write deadline) no longer corrupt the stream: #5993, #6002, #6001, #6003
• http3: canceling an Extended CONNECT request now interrupts waiting for SETTINGS: #6020
• qlog fixes:
  • incorrect or missing values for transport parameters, packet numbers, congestion metrics, timers, connection IDs and lengths: #6050, #6054, #6059, #6060, #6074, #6077, #6091, #6023, #5969
  • stateless resets are logged as remote closures: #6063
  • concurrently recorded events are written in order: #5956
  • traces of connections abandoned after version negotiation are closed: #6130
  • http3: traces no longer close before all events are recorded: #6090, #6083, #6041

Notable Changes

• Multiple DATAGRAM frames are now packed into a single packet: #5961, #5960
• qlog: new connection_state_updated and HTTP/3 stream_type_set events, and tuples for path probing and migration: #6111, #6113, #5977, #5979
• qlog: qlog.RedactIPs redacts IP addresses and ports: #5943
• qlog: HTTP/3 connections now use qlog.DefaultConnectionTracer; http3/qlog.DefaultConnectionTracer is removed: #5966
• Reduced allocations during the handshake: #6096, #6093, #6098, #6097, #6095

Changelog

• ci: bump CodSpeedHQ/action from 5.4.0 to 5.5.0 by @​dependabot[bot] in quic-go/quic-go#5945
• qlogwriter: fix ordering of concurrently recorded events by @​marten-seemann in quic-go/quic-go#5956
• omit the length field of the last DATAGRAM frame in a packet by @​marten-seemann in quic-go/quic-go#5960
• remove obsolete curve ID helpers from handshake tests by @​marten-seemann in quic-go/quic-go#5968
• handshake: remove obsolete session ticket error workaround by @​marten-seemann in quic-go/quic-go#5967
• pack multiple DATAGRAM frames into a packet by @​marten-seemann in quic-go/quic-go#5961
• qlog: register event schemas on init, remove Trace.SupportsSchemas by @​marten-seemann in quic-go/quic-go#5966

... (truncated)

Commits

• aa265c3 http3: don't cancel a shared dial when the first request is canceled (#6132)
• 7c2906f qlog: close the trace of a connection abandoned after version negotiation (#6...
• faa3b83 remove the old connection immediately after version negotiation (#6129)
• 946bda4 ci: use a daily Go build cache for unit and integration tests (#6124)
• 99d6d1e qlog: map packet drop reasons to packet_dropped triggers (#6055)
• 91d541c ci: delete outdated cross-compilation build caches (#6122)
• 3ee97eb README: list tools supporting quic-go (#6123)
• 3316624 ci: run benchmarks for a fixed number of iterations (#6121)
• 220eda8 ci: cancel outdated PR runs (#6118)
• 0bf3ea5 qlog: update event schema URIs to quic-events-14 and h3-events-14 (#6120)
• Additional commits viewable in compare view

Updates github.com/rabbitmq/amqp091-go from 1.15.0 to 1.16.0

Release notes

Sourced from github.com/rabbitmq/amqp091-go's releases.

v1.16.0

What's Changed

• chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#391
• docs: document URI credential percent-encoding requirement (#305) by @​cipherprofessor in rabbitmq/amqp091-go#396
• Surface the broker's connection.close reason from Dial instead of a hardcoded 403 by @​mohammadkshn in rabbitmq/amqp091-go#393
• chore: remove redundant legacy +build tag from fuzz.go by @​cipherprofessor in rabbitmq/amqp091-go#395
• Reader hardening by @​Zerpet in rabbitmq/amqp091-go#397
• chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#398
• Add Fuzzy tests for reader by @​Zerpet in rabbitmq/amqp091-go#399
• chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#401
• Reject heartbeat frames sent on a non-zero channel by @​suchitd in rabbitmq/amqp091-go#402
• Add support for basic cancel ok response by @​Zerpet in rabbitmq/amqp091-go#405
• Reject out-of-range heartbeat in ParseURI by @​suchitd in rabbitmq/amqp091-go#407
• Start recovery watcher only after a successful handshake by @​suchitd in rabbitmq/amqp091-go#409
• chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#410
• Fix golangci-lint v2.15.0 errcheck failures by @​suchitd in rabbitmq/amqp091-go#411

New Contributors

• @​cipherprofessor made their first contribution in rabbitmq/amqp091-go#396
• @​mohammadkshn made their first contribution in rabbitmq/amqp091-go#393

Full Changelog: rabbitmq/amqp091-go@v1.15.0...v1.16.0

Changelog

Sourced from github.com/rabbitmq/amqp091-go's changelog.

v1.16.0 (2026-10-19)

Full Changelog

Implemented enhancements:

• Add support for basic cancel ok response #405 (Zerpet)

Fixed bugs:

• Start recovery watcher only after a successful handshake #409 (suchitd)
• Reject out-of-range heartbeat in ParseURI #407 (suchitd)
• Reject heartbeat frames sent on a non-zero channel #402 (suchitd)

Closed issues:

• DialConfig leaks a watchConnection goroutine when the AMQP handshake fails with Recovery enabled #408
• panic: unexpected frame type #400
• v1.13.0: openComplete() zeroes caller-owned SASL credentials, breaking Config reuse across dials #394
• Dial returns 403 "no access to this vhost" when the broker refuses connection.open with 530 NOT_ALLOWED (e.g. user connection limit reached) #392
• Question mark in password breaks connection string parsing #305

Merged pull requests:

• Fix golangci-lint v2.15.0 errcheck failures #411 (suchitd)
• chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 in the github-actions group #410 (dependabot[bot])
• chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 in the github-actions group #401 (dependabot[bot])
• Add Fuzzy tests for reader #399 (Zerpet)
• chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 in the github-actions group #398 (dependabot[bot])
• Reader hardening #397 (Zerpet)
• docs: document URI credential percent-encoding requirement (#305) #396 (cipherprofessor)
• chore: remove redundant legacy +build tag from fuzz.go #395 (cipherprofessor)
• Surface the broker's connection.close reason from Dial instead of a hardcoded 403 #393 (mohammadkshn)
• chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0 in the github-actions group #391 (dependabot[bot])

Commits

• 0149b60 Update changelog.md for v1.16.0
• 76fec2b Merge pull request #411 from rabbitmq/fix/errcheck-golangci-lint-v2.15
• e3acbe6 Fix golangci-lint v2.15.0 errcheck failures
• 3aa2215 Release v1.16.0
• ba61a26 Merge pull request #410 from rabbitmq/dependabot/github_actions/github-action...
• 11f9b30 chore(deps): bump github/codeql-action
• e7fe0bd Merge pull request #409 from rabbitmq/fix/dialconfig-watcher-leak-on-failed-open
• 4f11601 Start recovery watcher only after a successful handshake
• c0131b7 Merge pull request #407 from rabbitmq/fix/uri-heartbeat-correctness
• 61d31a1 Reject out-of-range heartbeat in ParseURI
• Additional commits viewable in compare view

Updates github.com/redis/go-redis/v9 from 9.22.0 to 9.23.0

Release notes

Sourced from github.com/redis/go-redis/v9's releases.

9.23.0

This is a minor release. It contains everything from 9.23.0-beta.1, so these notes cover the full 9.22.0 → 9.23.0 upgrade.

⚠️ Changes to check when you upgrade from 9.22.0:

• Go 1.26 is now the minimum Go version (#4060). The go directive of the root module and of the submodules moved from 1.24 to 1.26, as part of the dependency bumps for govulncheck findings. Projects that build with Go 1.24 or 1.25 must upgrade the toolchain.
• Each Client has a dedicated pipeline connection pool (#4002). This includes failover clients and cluster node clients. Pipeline, TxPipeline, and autopipeline operations use this pool, so they do not compete with regular commands for main-pool connections. The pool is for burst capacity only: it dials only when necessary, an unused pool holds zero connections, and if the pool is full an operation uses the main pool. Set PipelinePoolSize: -1 to get the previous single-pool behavior.
• AutoPipelineOptions.MaxBatchBytes has a default of 128 KiB (before, there was no limit). The default prevents a write/reply deadlock; it is not a throughput control. The buffers of the pipeline pool also have a default of 128 KiB.

⚠️ Changes to experimental APIs since 9.23.0-beta.1 (no effect if you upgrade from 9.22.0):

• AutoPipelineOptions.FullDuplexFastSubmit is removed (#4018). The submit channel is replaced by a queue that takes a full wave of commands in one lock, so the separate fast path is not necessary. Remove the field from your options.
• Options.ClientSideCacheRefreshRecencyWindow is removed (#4034). Refresh-on-invalidate now reads again every cached entry of an invalidated key and does not look at how recently the entry was read. On a write-heavy keyspace this means refresh traffic across the full resident cache. Remove the field from your options.
• LocalCache.LRUClock() is removed (#4034). It returned the recency token that the removed recency window used, and has no replacement. Remove calls to it.
• ClientSideCacheInvalidationBatchWindow served stale values in beta.1 (#4033). Under load the batcher applied only ~15% of invalidations, and the cache served invalidated values with a ~100% hit rate. 9.23.0 applies all of them. If you used this option on beta.1, upgrade.

🚀 Highlights

Full-Duplex Auto-Pipelining (Experimental)

Set AutoPipelineOptions.FullDuplex to enable the full-duplex mode of the automatic pipeliner. The default mode sends one batch per round trip. In full-duplex mode the engine holds one pipeline-pool connection, and a writer goroutine and a reader goroutine move the ordered command stream in both directions at the same time. On a high-latency link each command completes in approximately one round-trip time (RTT) on a single connection. On a 50 ms WAN profile: ~389k ops/s at 52 ms p50, against ~207k ops/s at 116 ms on the half-duplex ordered path.

The mode works on both faces of a standalone Client (AutoPipeline() and AsyncAutoPipeline()), and natively on a ClusterClient when routing goes to masters only. On a cluster, one child engine per master sends each command to the node that owns its slot, and follows MOVED / ASK redirects and retryable replies (LOADING, READONLY, ...) through the usual cluster redirect path. With replica routing (ReadOnly, RouteByLatency, or RouteRandomly), the autopipeliner uses the half-duplex shard flushers, which obey the shard picker. Config().FullDuplex reports the mode in effect.

Options:

• FullDuplexWindow — the maximum number of commands in flight (backpressure).
• FullDuplexIdleTimeout and FullDuplexMaxHold — when the engine returns the held connection to the pool. The pool hooks then do re-authentication and maintenance-notification handoffs.
• MaxFlushDelay — now also used in full-duplex mode (#4014). The writer waits only when enough commands are in flight, so low-concurrency callers keep the 1×RTT behavior. With MaxFlushDelay=250µs at 1024 callers: +22% ops/s and −26% p99. The default is 0, so this is opt-in.
• NumShards — on a standalone Client, the number of full-duplex engines (#4022). See below.

Pipeline() on the full-duplex connection (#4021). Standalone Client only. Before, ap.Pipeline() used a pooled connection for each Exec. It now submits the batch to the engine as one contiguous run (FDPipelined), so replies come back in submit order, as on a dedicated connection. At 256–1024 callers with 10 commands per Exec: +49% to +52% throughput on one socket instead of ~150. Errors, retries, hooks, and metrics behave like an ordinary pipeline. A batch that cannot use the stream (a blocking command, a per-command read timeout, a diverted command, or a batch larger than the queue) falls back to the ordinary pipeline. TxPipeline stays on a pooled connection, because MULTI/EXEC needs connection affinity. On a ClusterClient, ap.Pipeline() is still the ordinary cluster pipeline. A batch that the queue cannot admit now reserves its slots and waits in a first-come line, so single commands cannot starve a long pipeline (#4057, merged as part of #4021) by @​vlady-kotsev.

Several engines on one client (#4022). With FullDuplex, NumShards > 1 now means N engines on one client: one pool, one hook chain, N held connections. Commands route by a hash of their first key, so commands on the same key stay on one connection and keep their order without Unordered. Keyless commands are distributed round-robin. An FDPipelined batch stays on one engine. The pipeline pool must hold at least NumShards connections for each full-duplex autopipeliner. More engines help only under high concurrency: with 10-command pipelines, 8 engines were 30% slower than 1 at 8 callers, equal at about 128 callers, and 2.2× faster at 1024 callers.

The full-duplex path supports blocking commands, Options.Limiter (one admission per written batch), per-command and pipeline hooks, OTel metrics, retry budgets (a NoRetry command is never sent again after it is on the wire), and seamless maintenance handoffs. Limits of the stream model:

• A hook can observe a command, but cannot stop it. A ProcessHook that returns without calling next does not cancel the command on the full-duplex path; the command is already queued on the held connection. Run policy or kill-switch hooks on a plain client o...

  Description has been truncated