Skip to content

chore(deps): bump the go-deps group across 1 directory with 9 updates - #158

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-d080387d64
Open

chore(deps): bump the go-deps group across 1 directory with 9 updates#158
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/go-deps-d080387d64

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-deps group with 8 updates in the / directory:

Package From To
github.com/anthropics/anthropic-sdk-go 1.61.0 1.66.0
github.com/getkin/kin-openapi 0.146.0 0.147.0
github.com/rabbitmq/amqp091-go 1.13.0 1.14.0
github.com/stretchr/testify 1.11.1 1.12.1
golang.org/x/crypto 0.54.0 0.55.0
golang.org/x/net 0.57.0 0.58.0
google.golang.org/genai 1.66.0 1.69.0
modernc.org/sqlite 1.56.0 1.57.0

Updates github.com/anthropics/anthropic-sdk-go from 1.61.0 to 1.66.0

Release notes

Sourced from github.com/anthropics/anthropic-sdk-go's releases.

v1.66.0

1.66.0 (2026-08-19)

Full Changelog: v1.65.0...v1.66.0

Features

  • api: managed agents web search config and self hosted sandbox memory (694b03a)

v1.65.0

1.65.0 (2026-08-19)

Full Changelog: v1.64.0...v1.65.0

Features

  • api: Files and Skills APIs are now GA; add computer use and browser use toolsets (e7be7af)

v1.64.0

1.64.0 (2026-08-18)

Full Changelog: v1.63.1...v1.64.0

Features

  • api: additions to files and memory stores (5c105da)
  • api: updates to skill, files, and user profiles (a0061d6)

Bug Fixes

  • api: remove unsupported mid_conv_system content block (bced0f9)
  • session-runner: retry tool-result sends for at least the lease TTL (#299) (ebc9533)
  • tool-runner: forward the server-assigned container on follow-up requests (#277) (860620c)
  • toolrunner: don't yield the final message twice from All() (#314) (1e418f0)

Chores

  • internal: remove leftover prism references (a1d9eab)

v1.63.1

1.63.1 (2026-08-13)

Full Changelog: v1.63.0...v1.63.1

Bug Fixes

  • auth: pin token exchange to the configured base URL and skip auth for other origins (#258) (6e4141c)
  • client: apply stop_details from every message_delta when accumulating (#253) (c197a64)

... (truncated)

Changelog

Sourced from github.com/anthropics/anthropic-sdk-go's changelog.

1.66.0 (2026-08-19)

Full Changelog: v1.65.0...v1.66.0

Features

  • api: managed agents web search config and self hosted sandbox memory (694b03a)

1.65.0 (2026-08-19)

Full Changelog: v1.64.0...v1.65.0

Features

  • api: Files and Skills APIs are now GA; add computer use and browser use toolsets (e7be7af)

1.64.0 (2026-08-18)

Full Changelog: v1.63.1...v1.64.0

Features

  • api: additions to files and memory stores (5c105da)
  • api: updates to skill, files, and user profiles (a0061d6)

Bug Fixes

  • api: remove unsupported mid_conv_system content block (bced0f9)
  • session-runner: retry tool-result sends for at least the lease TTL (#299) (ebc9533)
  • tool-runner: forward the server-assigned container on follow-up requests (#277) (860620c)
  • toolrunner: don't yield the final message twice from All() (#314) (1e418f0)

Chores

  • internal: remove leftover prism references (a1d9eab)

1.63.1 (2026-08-13)

Full Changelog: v1.63.0...v1.63.1

Bug Fixes

  • auth: pin token exchange to the configured base URL and skip auth for other origins (#258) (6e4141c)
  • client: apply stop_details from every message_delta when accumulating (#253) (c197a64)
  • client: properly render maxLength and maxItems in generated schemas (84a57f5)
  • sessions: post "(no output)" for empty text tool results instead of an empty text block (#236) (a588842)

... (truncated)

Commits
  • da00f43 release: 1.66.0
  • 2fa6acf feat(api): managed agents web search config and self hosted sandbox memory
  • 3f83bdb release: 1.65.0
  • 46319cb feat(api): Files and Skills APIs are now GA; add computer use and browser use...
  • 9dd6e45 release: 1.64.0
  • 06c97ec fix(toolrunner): don't yield the final message twice from All() (#314)
  • f4b1968 feat(api): updates to skill, files, and user profiles
  • d8e8c20 fix(session-runner): retry tool-result sends for at least the lease TTL (#299)
  • 1774a73 feat(api): additions to files and memory stores
  • 9193f02 codegen metadata
  • Additional commits viewable in compare view

Updates github.com/getkin/kin-openapi from 0.146.0 to 0.147.0

Release notes

Sourced from github.com/getkin/kin-openapi's releases.

v0.147.0

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.146.0...v0.147.0

Commits
  • eda80e2 Merge commit from fork
  • 435c5db openapi3filter: handle deserializing deepObject param with additionalProperti...
  • d33e44e openapi3: stop validation panicking on an uncompilable pattern (#1245)
  • 166ff47 openapi3filter: append only the bytes read in ZipFileBodyDecoder (#1247)
  • f5d61a7 openapi3: export PathItemMethods (#1241)
  • 5d526a9 openapi3: support OAS 3.2 query and additionalOperations (#1240)
  • d5e60c5 openapi3filter: fix for CI (#1237)
  • See full diff in compare view

Updates github.com/rabbitmq/amqp091-go from 1.13.0 to 1.14.0

Release notes

Sourced from github.com/rabbitmq/amqp091-go's releases.

v1.14.0

What's Changed

Full Changelog: rabbitmq/amqp091-go@v1.13.0...v1.14.0

Changelog

Sourced from github.com/rabbitmq/amqp091-go's changelog.

v1.14.0 (2026-08-18)

Full Changelog

Implemented enhancements:

  • refactor: extract shared close prologue into beginClose() #376 (suchitd)

Fixed bugs:

  • Retry consumer recovery instead of cancelling on a failed re-subscribe #380 (lukebakken)
  • Fix auto-recovery correctness gaps #379 (suchitd)
  • Enforce frame size in pre-negotiation state #377 (Zerpet)
  • test: retry cleanup connection after clearing memory alarm #375 (suchitd)
  • fix: eliminate flakiness in TestTLSHandshake #373 (suchitd)
  • fix: close goroutine leaks from Close()/Reconnect() races #372 (suchitd)

Merged pull requests:

  • chore(deps): reduce github-actions dependabot updates to weekly #384 (suchitd)
  • chore(deps): bump github/codeql-action from 4.37.5 to 4.37.6 in the github-actions group #383 (dependabot[bot])
  • docs: update CLAUDE.md with lifecycle/log files and updated recovery details #382 (suchitd)
  • chore(deps): bump github/codeql-action from 4.37.4 to 4.37.5 in the github-actions group #381 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.37.3 to 4.37.4 in the github-actions group #378 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4 to 4.37.3 in the github-actions group #374 (dependabot[bot])
Commits
  • 387d77a Release v1.14.0
  • 20e2bed Merge pull request #384 from rabbitmq/ci/gha-weekly-bump
  • 77f00bf chore(deps): reduce github-actions dependabot updates to weekly
  • b54f1b2 chore(deps): bump github/codeql-action in the github-actions group (#383)
  • 5b9f9b6 Merge pull request #382 from rabbitmq/doc/update-claude-doc
  • 5e65925 docs: update CLAUDE.md with lifecycle/log files and updated recovery details
  • 5e0c0c6 chore(deps): bump github/codeql-action in the github-actions group (#381)
  • c8ca6a4 Merge pull request #380 from lukebakken/fix/topology-recovery-consumer-config...
  • 8a08337 Retry consumer recovery instead of cancelling on a failed re-subscribe
  • bc24532 Merge pull request #379 from rabbitmq/fix/correctness_gaps
  • Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.54.0 to 0.55.0

Commits
  • f44d03d go.mod: update golang.org/x dependencies
  • 5ed4944 crypto/internal/poly1305: provide optimised assembly for riscv64
  • b07833c ssh: return window credit for discarded extended data
  • d701c51 acme: fix nil pointer dereference in pebble test error reporting
  • 999d053 ssh: fix parsing of GSSAPI payloads offering multiple mechanisms
  • 90f76b8 ssh: reject certificate signature keys before recursing
  • b53964a ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs
  • 626e40f ssh: drain stderr on forwarded TCP and Unix channels
  • 31914c6 x509roots/fallback: update bundle
  • f2135b8 all: clean up minor issues found by staticcheck
  • Additional commits viewable in compare view

Updates golang.org/x/net from 0.57.0 to 0.58.0

Commits
  • acc78e0 go.mod: update golang.org/x dependencies
  • 90d10f0 internal/http3: delete invalid Content-Length if declared in server handler
  • 08abf4d internal/http3: infer headers when Content-Encoding is set but is empty
  • 8d10596 http2: avoid deadlocks in wrapped ClientConn state callback
  • 99c3b0a http2/hpack: build the table lookup maps lazily, only for encoders
  • 5a920b1 http3: rework registration to allow using a fake network
  • 7fd2842 quic: return an error from Accept after PacketConn reader exits
  • 825111d quic: avoid busy-loop when keep-alive is blocked by congestion control
  • a02ddfa http/httpproxy: prioritize lowercase proxy environment variables
  • 574e5eb quic: halt conn goroutines on close when listener exits early
  • Additional commits viewable in compare view

Updates golang.org/x/text from 0.40.0 to 0.41.0

Commits
  • acdba66 go.mod: update golang.org/x dependencies
  • 02aa981 secure/precis: fix short destination buffer handling in Nickname profile
  • See full diff in compare view

Updates google.golang.org/genai from 1.66.0 to 1.69.0

Release notes

Sourced from google.golang.org/genai's releases.

v1.69.0

1.69.0 (2026-08-19)

Features

  • Add mode enum (VERBATIM, SMART) to AudioTranscriptionConfig and TranscriptionConfig. (5ca93e0)
  • Add enable_data_retention to ToolParallelAiSearch, Add step_count to ReinforcementTuningHyperParameters, Add BidiGenerateContentSetup (600a8cf)
  • Add IDLE state to live connection status enum and mark REQUIRES_ACTION as deprecated. (2bbd248)

v1.68.0

1.68.0 (2026-08-12)

Features

  • Add interaction_status to LiveServerContent (b701130)

v1.67.0

1.67.0 (2026-08-06)

Features

  • Add TOO_MANY_TOOL_CALLS to FinishReason enum. (e5a3783)
  • Support GoogleMaps Tool grounding_types places and routing (d76fedf)
  • Support HTTP retries in the Go GenAI SDK. (45c6782)

Bug Fixes

  • Add propertyOrdering auto-population for ResponseSchema and ResponseJsonSchema for Dotnet SDK (1e113a5)
Changelog

Sourced from google.golang.org/genai's changelog.

1.69.0 (2026-08-19)

Features

  • Add mode enum (VERBATIM, SMART) to AudioTranscriptionConfig and TranscriptionConfig. (5ca93e0)
  • Add enable_data_retention to ToolParallelAiSearch, Add step_count to ReinforcementTuningHyperParameters, Add BidiGenerateContentSetup (600a8cf)
  • Add IDLE state to live connection status enum and mark REQUIRES_ACTION as deprecated. (2bbd248)

1.68.0 (2026-08-12)

Features

  • Add interaction_status to LiveServerContent (b701130)

1.67.0 (2026-08-06)

Features

  • Add TOO_MANY_TOOL_CALLS to FinishReason enum. (e5a3783)
  • Support GoogleMaps Tool grounding_types places and routing (d76fedf)
  • Support HTTP retries in the Go GenAI SDK. (45c6782)

Bug Fixes

  • Add propertyOrdering auto-population for ResponseSchema and ResponseJsonSchema for Dotnet SDK (1e113a5)
Commits
  • fbdae87 chore(main): release 1.69.0 (#891)
  • 89fc37b chore: Internal Changes
  • 2bbd248 feat: Add IDLE state to live connection status enum and mark REQUIRES_ACTION ...
  • 5ca93e0 feat: Add mode enum (VERBATIM, SMART) to AudioTranscriptionConfig and...
  • 600a8cf feat: Add enable_data_retention to ToolParallelAiSearch, Add step_count to Re...
  • 4f8331d chore(main): release 1.68.0 (#885)
  • e73ee6a test: retry transient errors in the shared integration test clients
  • b701130 feat: Add interaction_status to LiveServerContent
  • 9928e5e chore(main): release 1.67.0 (#873)
  • 1e113a5 fix: Add propertyOrdering auto-population for ResponseSchema and ResponseJson...
  • Additional commits viewable in compare view

Updates modernc.org/sqlite from 1.56.0 to 1.57.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

  • 2026-08-19 v1.57.0:

    • Add an opt-in _defensive DSN query parameter that turns on SQLite's defensive mode for the connection, disabling the SQL-level features that let ordinary statements deliberately corrupt the database file. When _defensive=1 (or any strconv.ParseBool true value) is supplied, the driver calls sqlite3_db_config with SQLITE_DBCONFIG_DEFENSIVE immediately after sqlite3_open_v2 and before every other parameter is applied, so the PRAGMAs the driver itself runs, the _pragma list, and every statement the caller prepares are all subject to it. On such a connection PRAGMA writable_schema=ON, PRAGMA journal_mode=OFF and PRAGMA schema_version=N become silent no-ops, and writes to a virtual table's shadow tables (fts5's _data, _idx and so on) and to sqlite_dbpage fail with "table ... may not be modified"; reading those tables, ordinary use of the virtual tables that own them, and VACUUM are unaffected. The flag has no PRAGMA equivalent, so sqlite3_db_config — and therefore a DSN parameter — is the only way to reach it short of dropping to modernc.org/sqlite/lib. The value is parsed before sqlite3_open_v2, so an invalid one fails the connection without creating the database file, and the parameter must appear at most once: a repeated _defensive is an error rather than letting the first value silently win. Absence of the parameter, or _defensive=0, leaves SQLite's default behavior unchanged; existing DSNs continue to work byte-for-byte. Two limits are worth stating plainly, since the name invites more confidence than the flag earns. Defensive mode is a hardening measure, not a sandbox for hostile database files: it is one of several steps SQLite recommends for that purpose, and this build compiles with neither SQLITE_TRUSTED_SCHEMA=0 nor SQLITE_DQS=0 and exposes no authorizer. And it is a property of the connection, not of the database file — a second handle opened on the same file without the parameter is unrestricted.
    • Reject the one DSN combination defensive mode would otherwise swallow in silence. _defensive=1 together with _journal_mode=OFF (or _journal=OFF) now fails the connection instead of opening one in which neither parameter was honoured: SQLite turns PRAGMA journal_mode=OFF into a no-op that still reports success, so the driver would have accepted the mode, executed it, and left the journal untouched without telling anyone. The check runs in the validation phase introduced in v1.55.0, before any statement executes, so a rejected DSN cannot leave the database half-configured. _pragma remains the exception it has always been: _pragma=journal_mode(OFF) alongside _defensive=1 still runs and is still silently ignored by SQLite. Only DSNs using _defensive can be affected, and that parameter is new, so no DSN that opened before changes behavior.
    • See [GitHub pull request #6](modernc-org/sqlite#6), thanks wsman!
    • Ship the sqlite-vec license notice this module has been missing. modernc.org/sqlite/vec has bundled the transpiled sqlite-vec sources since v1.47.0, but the module carried only its own BSD-3-Clause LICENSE and the public-domain SQLite notice. sqlite-vec is Copyright (c) 2024 Alex Garcia, dual-licensed Apache-2.0 OR MIT and used here under MIT, whose terms require the copyright and permission notice to accompany substantial portions of the software — which 2.8 MB of transpiled vec/ plainly is. The notice now ships as LICENSE-SQLITE_VEC in the module root, byte-identical to the LICENSE-MIT in the upstream v0.1.9 archive and named after the file modernc.org/libsqlite_vec extracts it into. Attribution was never absent — vec's package documentation has named the extension, pinned the version and linked upstream — but the license text itself was, and the omission was ours: vendor_libs/main.go copied the per-target transpiles and nothing else. It now copies the notice alongside them and fails the vendoring run if it cannot, so a make vendor can no longer quietly drop it. The vec package documentation gained a License section recording that the package is under a different license from the rest of this module.
    • The SQLite notice is renamed from SQLITE-LICENSE to LICENSE-SQLITE; update any direct links to it. Its contents are unchanged and SQLite remains public domain. The name now matches both the new LICENSE-SQLITE_VEC beside it and the LICENSE-<upstream> convention every other modernc.org repository follows, but it is more than cosmetic: go mod vendor selects the files it copies into a downstream vendor/ tree by matching each name against a fixed list of prefixes — LICENSE among them — so a name merely ending in LICENSE was never propagated. Both bundled notices now travel with the code into vendored builds, which is where the MIT terms on vec/ keep applying. No code changes; no behavior changes.
    • Let a caller-constructed Driver register its own functions, collations and virtual table modules. Driver has always held four categories of registration state, but only RegisterConnectionHook could put anything on a constructed one: functions and collations were reachable through the package-level API alone, and modules through the package-level driver only, which left the modules field written and read through that instance and so process-global state wearing a per-instance field. Driver now has RegisterFunction, RegisterScalarFunction, RegisterDeterministicScalarFunction, RegisterCollationUtf8 and RegisterModule, plus Must* variants of the first four, each registering on that Driver alone; the methods are safe to call concurrently, and the zero Driver is ready to use as-is. vtab.RegisterModule also honours its db argument now: a non-nil db registers on the driver backing it when that driver implements the new vtab.ModuleRegisterer, while a nil db keeps targeting the driver this package registers as sqlite. One existing pattern changes behavior, narrowly and loudly: vtab.RegisterModule(db, ...) where db was opened on a caller-constructed Driver used to discard the db argument and land on the sqlite driver, reaching every connection in the process; it now lands on the constructed driver alone, so a sql.Open("sqlite") connection that used to resolve such a module gets no such module instead. The same pattern is also the one way an existing program could hold one module name on both a constructed Driver and the package-level one: there the first of the two registrations used to win and the second was refused as already registered, whereas now the package-level implementation wins on the constructed Driver's connections regardless of the order they ran in. Reaching that case at all means the program ignored an error the older version returned. Two smaller deviations round out the list: Driver.RegisterModule reports no error for such a collision, and vtab.RegisterModule now validates its name and module arguments before the not-implemented check, so a call with an empty name that returned vtab: RegisterModule not wired into engine outside this driver returns vtab: module name must be non-empty instead. Everything else is additive against v1.56.0: the package-level registration functions target the same driver they always did, connections still receive every module registered through the package-level path whichever Driver opened them, and a db opened on the sqlite driver resolves to that same driver. The isolating change discussed in [GitLab issue #254](https://gitlab.com/cznic/sqlite/-/issues/254) is deliberately not made here.
    • See [GitLab merge request #135](https://gitlab.com/cznic/sqlite/-/merge_requests/135), thanks Ian Chechin!
    • Promote freebsd/386, freebsd/arm and netbsd/amd64 to fully supported platforms. All three are now listed in the package documentation's platform table, which had carried seventeen entries while this module shipped, cross-built and tested twenty. They arrived as experimental in v1.53.0 — netbsd/amd64 reviving a port that had been broken for years, freebsd/386 replacing a stale, effectively untested SQLite 3.41 transpile, and freebsd/arm entirely new — and were deliberately kept out of that table until they had accumulated real-world exposure, with promotion promised once "a period of broader real-world testing … elapses without surprises". That period has elapsed: all three have been in the builder test matrix and in make build_all_targets since v1.53.0, all three pass the full test suite on this release's commit alongside the seventeen platforms already listed, and no open issue reports a defect in any of them. The two netbsd/amd64 build failures filed before the revival, [GitLab issue #202](https://gitlab.com/cznic/sqlite/-/issues/202) and [GitLab issue #234](https://gitlab.com/cznic/sqlite/-/issues/234), no longer reproduce at this commit: Xsqlite3_is_interrupted is present in the sources that target selects, and the mu.enter/mu.leave symbols that broke the build are gone. Documentation only — the transpiled sources under lib/ are byte-for-byte what v1.56.0 shipped, and nothing about how these targets behave changes.
  • 2026-08-03 v1.56.0:

    • Re-vendor the transpiled SQLite sources, picking up modernc.org/libsqlite3's fix for an upstream data-corruption bug in SQLite 3.53.3's journal rollback. The SQLite version is unchanged at 3.53.3; what changes is that the amalgamation is now patched before it is transpiled. 3.53.3 reworked readSuperJournal() to return the super-journal name through a char** out-parameter, and pager_playback() now tests that pointer where it used to test zSuper[0]. A crash during the commit of a multi-database (ATTACH) transaction can leave the super-journal name and its checksum zeroed while the name length and the trailing magic survive; the checksum is a plain byte sum, so an all-zero name still validates and readSuperJournal() hands back a non-NULL pointer to an empty string. pager_playback() then calls sqlite3OsAccess(pVfs, "", SQLITE_ACCESS_EXISTS), gets ENOENT, and deletes the hot journal without playing it back — leaving the database corrupted. This is not a transpilation artifact: a plain gcc build of the stock 3.53.3 amalgamation fails on the same bytes while 3.53.2 recovers them, and it is what has been making upstream's own test/crash.test fail intermittently, in roughly 2% of runs, on every platform. The patch restores the pre-3.53.3 behaviour of reporting a (nul) super-journal name and will be dropped once upstream ships its own fix. Every supported target carries it.
    • Two targets change beyond that patch. On linux/s390x the regenerated transpile allocates C bit-fields MSB-first, as the big-endian platform ABI requires, rather than LSB-first; this comes from modernc.org/cc/v4 v4.29.1 and touches bit-field accesses throughout the SQLite core, s390x being this module's only big-endian target. On linux/riscv64 the transpile was regenerated on a host running GCC 11.4.0 where the previous one used GCC 13.3.0, which drops a handful of unexported compiler-predefined macro constants (the __FLT16_* family, __DBL_IS_IEC_60559__ and friends) and changes the COMPILER=gcc-13.3.0 entry PRAGMA compile_options reports to COMPILER=gcc-11.4.0; no SQLite code generation differs. Every other target's generated code is byte-identical to v1.55.0 apart from the journal-rollback patch above.
    • Bump the pinned modernc.org/libc to v1.74.4, and the remaining dependencies to their current releases. v1.74.2 and v1.74.3 are retracted upstream — a freeaddrinfo lock leak that deadlocks name resolution — and v1.74.4 is the fix. As always, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins (see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177)).
    • Documentation sweep. openbsd/amd64 and openbsd/arm64 join the supported platforms table in the package documentation: both have been in the builder test matrix since January and are cross-built by make build_all_targets, but had never been listed. The vfs DSN query parameter — which names a VFS registered with SQLite, such as one returned by vfs.New — is now documented alongside the other DSN parameters on Driver.Open. The "Debug and development versions" section no longer describes a GO_GENERATE environment variable and a go generate that this repository has not had since generator.go moved to modernc.org/libsqlite3; it now points at that repository and make vendor instead, and the stale //go:generate directive naming the removed file is dropped with it. modernc.org/sqlite/vec and modernc.org/sqlite/vfs gained the package doc comments they were missing, so both finally carry a synopsis on pkg.go.dev. Documentation only; no behavior changes.
    • Add NewConnector, returning a database/sql/driver.Connector for use with sql.OpenDB. It opens the same connections sql.Open("sqlite", dsn) does, from the same registered driver, so every function, collation, connection hook and virtual table module registered through this package applies to them. It exists for callers that need to interpose on the physical connections database/sql opens — tracing, metrics, connection-scoped setup — which sql.Open gives no access to: such a caller can embed the returned Connector, override Connect, and pass its own wrapper to sql.OpenDB. Previously the only way to reach the registered driver was the db, _ := sql.Open("sqlite", ""); drv := db.Driver(); db.Close() idiom, which works only because sql.Open does not connect and this driver does not implement driver.DriverContext; and the only way to get a wrapper into a *sql.DB was sql.Register, which is process-global, panics on a name it has already seen, and cannot be undone, so a library had to invent a unique driver name per configuration. sql.OpenDB registers nothing. Constructing a &sqlite.Driver{} is not an alternative — its fields are unexported, so it carries none of the registrations. NewConnector checks the DSN only as far as it can without opening a database — a query string that does not parse, and conflicting vfs parameters; everything else continues to be validated when the connection is opened, so an unknown parameter or an out-of-range value is reported by Connect rather than at construction. Nothing about the existing sql.Open path changes: *Driver deliberately still does not implement driver.DriverContext, so sql.Open remains lazy and DSN errors continue to surface where they always have. A runnable sample is in examples/connector. Resolves [GitLab issue #253](https://gitlab.com/cznic/sqlite/-/issues/253), thanks Alessandro Segala (@​ItalyPaleAle)!
    • Document that a caller-constructed sqlite.Driver is not the driver this package registers as "sqlite&qu...

      Description has been truncated

Bumps the go-deps group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/anthropics/anthropic-sdk-go](https://github.com/anthropics/anthropic-sdk-go) | `1.61.0` | `1.66.0` |
| [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) | `0.146.0` | `0.147.0` |
| [github.com/rabbitmq/amqp091-go](https://github.com/rabbitmq/amqp091-go) | `1.13.0` | `1.14.0` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.1` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.54.0` | `0.55.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.57.0` | `0.58.0` |
| [google.golang.org/genai](https://github.com/googleapis/go-genai) | `1.66.0` | `1.69.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.56.0` | `1.57.0` |



Updates `github.com/anthropics/anthropic-sdk-go` from 1.61.0 to 1.66.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-go/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-go/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-go@v1.61.0...v1.66.0)

Updates `github.com/getkin/kin-openapi` from 0.146.0 to 0.147.0
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](getkin/kin-openapi@v0.146.0...v0.147.0)

Updates `github.com/rabbitmq/amqp091-go` from 1.13.0 to 1.14.0
- [Release notes](https://github.com/rabbitmq/amqp091-go/releases)
- [Changelog](https://github.com/rabbitmq/amqp091-go/blob/main/CHANGELOG.md)
- [Commits](rabbitmq/amqp091-go@v1.13.0...v1.14.0)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

Updates `golang.org/x/crypto` from 0.54.0 to 0.55.0
- [Commits](golang/crypto@v0.54.0...v0.55.0)

Updates `golang.org/x/net` from 0.57.0 to 0.58.0
- [Commits](golang/net@v0.57.0...v0.58.0)

Updates `golang.org/x/text` from 0.40.0 to 0.41.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.40.0...v0.41.0)

Updates `google.golang.org/genai` from 1.66.0 to 1.69.0
- [Release notes](https://github.com/googleapis/go-genai/releases)
- [Changelog](https://github.com/googleapis/go-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/go-genai@v1.66.0...v1.69.0)

Updates `modernc.org/sqlite` from 1.56.0 to 1.57.0
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.56.0...v1.57.0)

---
updated-dependencies:
- dependency-name: github.com/anthropics/anthropic-sdk-go
  dependency-version: 1.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.147.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/rabbitmq/amqp091-go
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/crypto
  dependency-version: 0.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/net
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/text
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: google.golang.org/genai
  dependency-version: 1.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: modernc.org/sqlite
  dependency-version: 1.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency updates label Aug 22, 2026
@dependabot
dependabot Bot requested a review from eser as a code owner August 22, 2026 23:53
@dependabot dependabot Bot added go Go service changes dependencies Dependency updates labels Aug 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency updates go Go service changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants