Skip to content

Update Go dependencies #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update Go dependencies #10

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented May 31, 2025 •
edited
Loading

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/a-h/templ v0.3.865 → v0.3.977 age confidence
github.com/golang-jwt/jwt/v5 v5.2.2 → v5.3.0 age confidence
github.com/golang-migrate/migrate/v4 v4.18.3 → v4.19.1 age confidence
github.com/labstack/echo-jwt/v4 v4.3.1 → v4.4.0 age confidence
github.com/labstack/echo/v4 v4.13.4 → v4.15.0 age confidence
github.com/spf13/viper v1.20.1 → v1.21.0 age confidence
github.com/stretchr/testify v1.10.0 → v1.11.1 age confidence
golang.org/x/crypto v0.38.0 → v0.46.0 age confidence
modernc.org/sqlite v1.37.1 → v1.42.2 age confidence

Release Notes

a-h/templ (github.com/a-h/templ)

v0.3.977

Compare Source

Changelog

v0.3.960

Compare Source

Changelog

v0.3.943

Compare Source

Changelog

  • 70af26b chore: bump dependencies
  • 806d9e8 chore: bump version
  • d7f4505 feat: add Range field to Element parser nodes (#​1236)
  • 40be321 feat: don't insert proxy reload script on datastar initiated requests (#​1235)
  • 18fb42a fix: don't attempt to apply prettier if it is not available (#​1246)
  • 71d038e fix: skip parsing of JavaScript regexp literals: /test/ (#​1245)

v0.3.937

Compare Source

Changelog

  • 935033d chore: bump dependencies
  • c6b1acb chore: bump gofiber in example project
  • 9490baa chore: bump version
  • 5397d62 chore: fix linter errors in test
  • 7451ee8 chore: go get ./... && go mod tidy
  • e0a1051 chore: remove linter warning in test
  • 63d8ad2 feat: add Range to HTMLComment nodes (#​1229)
  • 71566a0 feat: add Range to raw elements (RawElement, ScriptElement) (#​1231)
  • 273e0ed feat: format js and css with prettier if prettier is on the $PATH (#​1230)
  • 5151891 refactor: update watcher tests to use public interface of fsnotify to prevent race condition in tests

v0.3.924

Compare Source

Changelog

  • 799d461 chore: bump version
  • ef5165e feat: add Ranges to GoComment parser nodes (#​1225)
  • 17484e5 fix: stop rebuilding application if text-only changes have occurred in dev mode (#​1227)

v0.3.920

Compare Source

Changelog

v0.3.906

Compare Source

Changelog

  • c086e47 chore: bump version file
  • 15199ff chore: updated storybook installation command with a features flag (#​1185)
  • 27dd1a4 feat: pass stdin to watched commands (#​1195)
  • 838a60a feat: push Nix packaging to Flakehub
  • 7df55ec feat: support string types and functions for URL attributes - no longer require templ.SafeURL - fixes #​1167 (#​1171)
  • 2874448 fix(lsp): prevent LSP panic in cases where elements are nil
  • c9bd939 fix: comments don't eat newlines (#​1186)
  • f9f9f3a fix: handle live import declaration changes in lazy loader (#​1192)
  • 9ad7ba1 fix: prevent request failure notification spam for new files in lazy loader (#​1202)
  • 63238fc refactor: allow more flexible parsing of expression attributes (#​1197)
  • 780cab0 refactor: don't block if timer runs out (behaviour change from Go 1.23) (#​1179)
  • 9b34663 refactor: replace document open count with package reference count in lazy loader (#​1187)

v0.3.898

Compare Source

Changelog

  • b3a6561 chore: bump version [no-ci]
  • 7df55ec feat: support string types and functions for URL attributes - no longer require templ.SafeURL - fixes #​1167 (#​1171)
  • 2874448 fix(lsp): prevent LSP panic in cases where elements are nil
  • 780cab0 refactor: don't block if timer runs out (behaviour change from Go 1.23) (#​1179)

v0.3.894

Compare Source

Changelog

v0.3.887

Compare Source

Changelog

  • 78e130a Conditionalize language server preload (#​1118)
  • 4048e76 chore(ci): apply write permissions to code coverage
  • 92ed4a3 chore(ci): bump upload artifact version
  • 3244608 chore(ci): checkout code when uploading coverage
  • 04f35cd chore(ci): replace nix cache github action
  • 2070e14 chore(ci): upload artifact from local directory
  • f1c2a5e chore: bump deps in examples and fuzzing
  • 892b042 chore: bump documentation deps
  • 3201870 chore: bump version
  • e47b18c chore: bump version
  • 99cbb2a chore: bump version with correct pattern
  • 01a7b2c chore: bump version with correct pattern
  • 72844e5 chore: constrain CI/CD workflow permissions to read only (#​1143)
  • 076b696 feat: add support for interpolating primitive types in addition to strings (#​1129)
  • 9f9a1a3 feat: add support for starting gopls in shared daemon mode (#​1142)
  • 5450d27 feat: allow partial parsing for improved LSP support (#​1155)
  • def3450 feat: allow the AST to be modified using a visitor (#​1114)
  • 5d4a06c feat: attribute key expressions (#​1140)
  • d20d8a1 feat: gracefully shutdown on sigterm in -watch mode (#​1147)
  • ea8c58b feat: support ordered attributes (#​1139)
  • 79b4c2c feat: use GOPACKAGESDRIVER to load templ documents lazily (#​1124)
  • 2648793 fix: add error case if attribute key type is not recognised (#​1157)
  • 358110e fix: broken test
  • a59b13a fix: copy attributes, because generating now adjusts a pointer due to #​1114
  • ca6efc4 fix: ignore non js scripting languages in script parser (#​1136)
  • 336d0d6 fix: include all watch patterns in consideration for cmd restart (#​1144)
  • f1aa37d fix: support script variable interpolation for javascript and module types (#​1161)
  • bf42293 fix: write constant attributes as they are in the source templ file (#​1159)
  • 74ab01b refactor: only attempt to update-coverage on push to main, no PRs
golang-jwt/jwt (github.com/golang-jwt/jwt/v5)

v5.3.0

Compare Source

This release is almost identical to to v5.2.3 but now correctly indicates Go 1.21 as minimum requirement.

What's Changed

Full Changelog: golang-jwt/jwt@v5.2.3...v5.3.0

v5.2.3

Compare Source

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v5.2.2...v5.2.3

golang-migrate/migrate (github.com/golang-migrate/migrate/v4)

v4.19.1

Compare Source

v4.19.0

Compare Source

What's Changed

New Contributors

Full Changelog: golang-migrate/migrate@v4.18.3...v4.19.0

labstack/echo-jwt (github.com/labstack/echo-jwt/v4)

v4.4.0

Compare Source

Enhancements

  • Revert 'Return HTTP status 400 if missing JWT' PR to return 401 #​39
  • Updated dependencies #​39
  • Return ErrJWTMissing, ErrJWTInvalid clones so error code could be changed more easily
labstack/echo (github.com/labstack/echo/v4)

v4.15.0

Compare Source

Security

NB: If your application relies on cross-origin or same-site (same subdomain) requests do not blindly push this version to production

The CSRF middleware now supports the Sec-Fetch-Site header as a modern, defense-in-depth approach to CSRF
protection, implementing the OWASP-recommended Fetch Metadata API alongside the traditional token-based mechanism.

How it works:

Modern browsers automatically send the Sec-Fetch-Site header with all requests, indicating the relationship
between the request origin and the target. The middleware uses this to make security decisions:

  • same-origin or none: Requests are allowed (exact origin match or direct user navigation)
  • same-site: Falls back to token validation (e.g., subdomain to main domain)
  • cross-site: Blocked by default with 403 error for unsafe methods (POST, PUT, DELETE, PATCH)

For browsers that don't send this header (older browsers), the middleware seamlessly falls back to
traditional token-based CSRF protection.

New Configuration Options:

  • TrustedOrigins []string: Allowlist specific origins for cross-site requests (useful for OAuth callbacks, webhooks)
  • AllowSecFetchSiteFunc func(echo.Context) (bool, error): Custom logic for same-site/cross-site request validation

Example:

e.Use(middleware.CSRFWithConfig(middleware.CSRFConfig{
    // Allow OAuth callbacks from trusted provider
    TrustedOrigins: []string{"https://oauth-provider.com"},

    // Custom validation for same-site requests
    AllowSecFetchSiteFunc: func(c echo.Context) (bool, error) {
        // Your custom authorization logic here
        return validateCustomAuth(c), nil
        // return true, err  // blocks request with error
        // return true, nil  // allows CSRF request through
        // return false, nil // falls back to legacy token logic
    },
}))

PR: #​2858

Type-Safe Generic Parameter Binding

  • Added generic functions for type-safe parameter extraction and context access by @​aldas in #​2856

    Echo now provides generic functions for extracting path, query, and form parameters with automatic type conversion,
    eliminating manual string parsing and type assertions.

    New Functions:

    • Path parameters: PathParam[T], PathParamOr[T]
    • Query parameters: QueryParam[T], QueryParamOr[T], QueryParams[T], QueryParamsOr[T]
    • Form values: FormParam[T], FormParamOr[T], FormParams[T], FormParamsOr[T]
    • Context store: ContextGet[T], ContextGetOr[T]

    Supported Types:
    Primitives (bool, string, int/uint variants, float32/float64), time.Duration, time.Time
    (with custom layouts and Unix timestamp support), and custom types implementing BindUnmarshaler,
    TextUnmarshaler, or JSONUnmarshaler.

    Example:

    // Before: Manual parsing
idStr := c.Param("id")
id, err := strconv.Atoi(idStr)

// After: Type-safe with automatic parsing
id, err := echo.PathParam[int](c, "id")

// With default values
page, err := echo.QueryParamOr[int](c, "page", 1)
limit, err := echo.QueryParamOr[int](c, "limit", 20)

// Type-safe context access (no more panics from type assertions)
user, err := echo.ContextGet[*User](c, "user")

PR: #​2856

DEPRECATION NOTICE Timeout Middleware Deprecated - Use ContextTimeout Instead

The middleware.Timeout middleware has been deprecated due to fundamental architectural issues that cause
data races. Use middleware.ContextTimeout or middleware.ContextTimeoutWithConfig instead.

Why is this being deprecated?

The Timeout middleware manipulates response writers across goroutine boundaries, which causes data races that
cannot be reliably fixed without a complete architectural redesign. The middleware:

  • Swaps the response writer using http.TimeoutHandler
  • Must be the first middleware in the chain (fragile constraint)
  • Can cause races with other middleware (Logger, metrics, custom middleware)
  • Has been the source of multiple race condition fixes over the years

What should you use instead?

The ContextTimeout middleware (available since v4.12.0) provides timeout functionality using Go's standard
context mechanism. It is:

  • Race-free by design
  • Can be placed anywhere in the middleware chain
  • Simpler and more maintainable
  • Compatible with all other middleware

Migration Guide:

// Before (deprecated):
e.Use(middleware.Timeout())

// After (recommended):
e.Use(middleware.ContextTimeout(30 * time.Second))

Important Behavioral Differences:

  1. Handler cooperation required: With ContextTimeout, your handlers must check context.Done() for cooperative
    cancellation. The old Timeout middleware would send a 503 response regardless of handler cooperation, but had
    data race issues.

  2. Error handling: ContextTimeout returns errors through the standard error handling flow. Handlers that receive
    context.DeadlineExceeded should handle it appropriately:

e.GET("/long-task", func(c echo.Context) error {
    ctx := c.Request().Context()

    // Example: database query with context
    result, err := db.QueryContext(ctx, "SELECT * FROM large_table")
    if err != nil {
        if errors.Is(err, context.DeadlineExceeded) {
            // Handle timeout
            return echo.NewHTTPError(http.StatusServiceUnavailable, "Request timeout")
        }
        return err
    }

    return c.JSON(http.StatusOK, result)
})
  1. Background tasks: For long-running background tasks, use goroutines with context:
e.GET("/async-task", func(c echo.Context) error {
    ctx := c.Request().Context()

    resultCh := make(chan Result, 1)
    errCh := make(chan error, 1)

    go func() {
        result, err := performLongTask(ctx)
        if err != nil {
            errCh <- err
            return
        }
        resultCh <- result
    }()

    select {
    case result := <-resultCh:
        return c.JSON(http.StatusOK, result)
    case err := <-errCh:
        return err
    case <-ctx.Done():
        return echo.NewHTTPError(http.StatusServiceUnavailable, "Request timeout")
    }
})

Enhancements

v4.14.0

Compare Source

middleware.Logger has been deprecated. For request logging, use middleware.RequestLogger or
middleware.RequestLoggerWithConfig.

middleware.RequestLogger replaces middleware.Logger, offering comparable configuration while relying on the
Go standard library’s new slog logger.

The previous default output format was JSON. The new default follows the standard slog logger settings.
To continue emitting request logs in JSON, configure slog accordingly:

slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, nil)))
e.Use(middleware.RequestLogger())

Security

Enhancements

spf13/viper (github.com/spf13/viper)

v1.21.0

Compare Source

What's Changed

Enhancements 🚀
Bug Fixes 🐛
Dependency Updates ⬆️
Other Changes

New Contributors

Full Changelog: spf13/viper@v1.20.0...v1.21.0

stretchr/testify (github.com/stretchr/testify)

v1.11.1

Compare Source

This release fixes #​1785 introduced in v1.11.0 where expected argument values implementing the stringer interface (String() string) with a method which mutates their value, when passed to mock.Mock.On (m.On("Method", <expected>).Return()) or actual argument values passed to mock.Mock.Called may no longer match one another where they previously did match. The behaviour prior to v1.11.0 where the stringer is always called is restored. Future testify releases may not call the stringer method at all in this case.

What's Changed

Full Changelog: stretchr/testify@v1.11.0...v1.11.1

v1.11.0

Compare Source

What's Changed

Functional Changes

v1.11.0 Includes a number of performance improvements.

Fixes
Documentation, Build & CI

New Contributors

Full Changelog: stretchr/testify@v1.10.0...v1.11.0

cznic/sqlite (modernc.org/sqlite)

v1.42.2

Compare Source

v1.42.1

Compare Source

v1.42.0

Compare Source

v1.41.0

Compare Source

v1.40.1

Compare Source

v1.40.0

Compare Source

v1.39.1

Compare Source

v1.39.0

Compare Source

v1.38.2

Compare Source

v1.38.1

Compare Source

v1.38.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/go-dependencies branch from 4e01fad to 624defa Compare June 5, 2025 02:24
@renovate renovate bot changed the title Update module github.com/a-h/templ to v0.3.887 Update module github.com/a-h/templ to v0.3.894 Jun 5, 2025
@renovate
Copy link
Contributor Author

renovate bot commented Jun 6, 2025 •
edited
Loading

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 16 additional dependencies were updated

Details:

Package Change
github.com/davecgh/go-spew v1.1.1 -> v1.1.2-0.20180830191138-d8f796af33cc
github.com/fsnotify/fsnotify v1.8.0 -> v1.9.0
github.com/go-viper/mapstructure/v2 v2.2.1 -> v2.4.0
github.com/pelletier/go-toml/v2 v2.2.3 -> v2.2.4
github.com/pmezard/go-difflib v1.0.0 -> v1.0.1-0.20181226105442-5d4384ee4fb2
github.com/sagikazarmark/locafero v0.7.0 -> v0.11.0
github.com/sourcegraph/conc v0.3.0 -> v0.3.1-0.20240121214520-5f936abd7ae8
github.com/spf13/afero v1.12.0 -> v1.15.0
github.com/spf13/cast v1.7.1 -> v1.10.0
github.com/spf13/pflag v1.0.6 -> v1.0.10
golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 -> v0.0.0-20250620022241-b7579e27df2b
modernc.org/libc v1.65.7 -> v1.66.10
golang.org/x/net v0.40.0 -> v0.47.0
golang.org/x/sys v0.33.0 -> v0.39.0
golang.org/x/text v0.25.0 -> v0.32.0
golang.org/x/time v0.11.0 -> v0.14.0

@renovate renovate bot changed the title Update module github.com/a-h/templ to v0.3.894 Update Go dependencies Jun 6, 2025
@renovate renovate bot force-pushed the renovate/go-dependencies branch 2 times, most recently from cd5f356 to 889152a Compare June 9, 2025 11:57
@renovate renovate bot force-pushed the renovate/go-dependencies branch from 889152a to 2cdb03f Compare June 25, 2025 13:57
@renovate renovate bot force-pushed the renovate/go-dependencies branch 2 times, most recently from 70b74f1 to b516ed1 Compare July 15, 2025 11:41
@renovate renovate bot force-pushed the renovate/go-dependencies branch 3 times, most recently from ec1e14b to 50e313d Compare July 26, 2025 18:14
@renovate renovate bot force-pushed the renovate/go-dependencies branch 2 times, most recently from 57a0710 to 50a86e4 Compare July 30, 2025 16:48
@renovate renovate bot force-pushed the renovate/go-dependencies branch 4 times, most recently from a5cd6d8 to 58efadd Compare August 14, 2025 17:59
@renovate renovate bot force-pushed the renovate/go-dependencies branch from 58efadd to fa59f6e Compare August 15, 2025 18:28
@renovate renovate bot force-pushed the renovate/go-dependencies branch 3 times, most recently from 4da9891 to 2eaf192 Compare August 31, 2025 10:30
@renovate renovate bot force-pushed the renovate/go-dependencies branch 2 times, most recently from 7547461 to c61fffc Compare September 6, 2025 23:50
@renovate renovate bot force-pushed the renovate/go-dependencies branch 2 times, most recently from 02e330a to 870bd00 Compare September 15, 2025 11:47
@renovate renovate bot force-pushed the renovate/go-dependencies branch 3 times, most recently from cf7fbb2 to d303344 Compare October 15, 2025 18:02
@renovate renovate bot force-pushed the renovate/go-dependencies branch 5 times, most recently from b4a7b08 to 35b2bcb Compare November 10, 2025 05:00
@renovate renovate bot force-pushed the renovate/go-dependencies branch 2 times, most recently from 7964cd9 to 3a9151f Compare November 18, 2025 04:01
@renovate renovate bot force-pushed the renovate/go-dependencies branch 2 times, most recently from 8b2ae2f to ce988f9 Compare November 25, 2025 08:59
@renovate renovate bot force-pushed the renovate/go-dependencies branch from ce988f9 to a047984 Compare November 29, 2025 21:32
@renovate renovate bot force-pushed the renovate/go-dependencies branch 2 times, most recently from 6462a09 to fccd862 Compare December 11, 2025 21:57
@renovate
Copy link
Contributor Author

renovate bot commented Dec 11, 2025 •
edited
Loading

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 16 additional dependencies were updated

Details:

Package Change
github.com/davecgh/go-spew v1.1.1 -> v1.1.2-0.20180830191138-d8f796af33cc
github.com/fsnotify/fsnotify v1.8.0 -> v1.9.0
github.com/go-viper/mapstructure/v2 v2.2.1 -> v2.4.0
github.com/pelletier/go-toml/v2 v2.2.3 -> v2.2.4
github.com/pmezard/go-difflib v1.0.0 -> v1.0.1-0.20181226105442-5d4384ee4fb2
github.com/sagikazarmark/locafero v0.7.0 -> v0.11.0
github.com/sourcegraph/conc v0.3.0 -> v0.3.1-0.20240121214520-5f936abd7ae8
github.com/spf13/afero v1.12.0 -> v1.15.0
github.com/spf13/cast v1.7.1 -> v1.10.0
github.com/spf13/pflag v1.0.6 -> v1.0.10
golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 -> v0.0.0-20250620022241-b7579e27df2b
modernc.org/libc v1.65.7 -> v1.66.10
golang.org/x/net v0.40.0 -> v0.48.0
golang.org/x/sys v0.33.0 -> v0.39.0
golang.org/x/text v0.25.0 -> v0.32.0
golang.org/x/time v0.11.0 -> v0.14.0

@renovate renovate bot force-pushed the renovate/go-dependencies branch from fccd862 to dcd8ea0 Compare December 19, 2025 15:33
@renovate renovate bot force-pushed the renovate/go-dependencies branch 3 times, most recently from 431c61c to 0da18ad Compare December 31, 2025 21:25
@renovate renovate bot force-pushed the renovate/go-dependencies branch from 0da18ad to ae0a0f6 Compare January 1, 2026 14:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant