chore(deps): bump the go-modules group across 1 directory with 42 updates

[dependabot]

Bumps the go-modules group with 42 updates in the / directory:

Package	From	To
cloud.google.com/go/pubsub/v2	2.6.1	2.7.0
github.com/Azure/azure-sdk-for-go/sdk/azcore	1.23.0	1.23.1
github.com/Azure/azure-sdk-for-go/sdk/azidentity	1.14.0	1.14.1
github.com/aws/aws-lambda-go	1.54.0	1.55.1
github.com/aws/aws-sdk-go-v2	1.43.5	1.47.1
github.com/aws/aws-sdk-go-v2/config	1.32.36	1.33.6
github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue	1.20.60	1.21.7
github.com/aws/aws-sdk-go-v2/service/cloudwatch	1.66.4	1.73.0
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs	1.82.1	1.88.1
github.com/aws/aws-sdk-go-v2/service/dynamodb	1.63.2	1.69.1
github.com/aws/aws-sdk-go-v2/service/sns	1.42.5	1.47.2
github.com/aws/aws-sdk-go-v2/service/sqs	1.46.5	1.52.1
github.com/dapr/dapr	1.18.2	1.18.4
github.com/getsentry/sentry-go	0.48.0	0.49.0
github.com/jackc/pgx/v5	5.10.0	5.11.0
github.com/mmcdole/gofeed	1.3.0	1.5.0
github.com/modelcontextprotocol/go-sdk	1.6.0	1.8.0
github.com/nats-io/nats.go	1.53.1	1.54.0
github.com/posthog/posthog-go	1.23.0	1.27.0
github.com/quic-go/quic-go	0.61.0	0.63.0
github.com/rabbitmq/amqp091-go	1.13.0	1.15.0
github.com/redis/go-redis/v9	9.21.0	9.22.0
github.com/stretchr/testify	1.12.0	1.12.1
github.com/twmb/franz-go	1.21.6	1.22.0
github.com/twmb/franz-go/pkg/kadm	1.18.0	1.19.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	0.67.0	0.71.0
go.opentelemetry.io/otel	1.45.0	1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	1.45.0	1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	1.45.0	1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	1.45.0	1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	1.45.0	1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	1.45.0	1.46.0
go.opentelemetry.io/otel/exporters/prometheus	0.67.0	0.68.0
go.opentelemetry.io/otel/metric	1.45.0	1.46.0
go.opentelemetry.io/otel/sdk	1.45.0	1.46.0
go.opentelemetry.io/otel/sdk/metric	1.45.0	1.46.0
go.opentelemetry.io/otel/trace	1.45.0	1.46.0
google.golang.org/api	0.285.0	0.287.1
google.golang.org/grpc	1.83.0	1.83.2
k8s.io/apimachinery	0.36.3	0.37.1
k8s.io/client-go	0.36.3	0.37.1
modernc.org/sqlite	1.56.0	1.59.0

Updates cloud.google.com/go/pubsub/v2 from 2.6.1 to 2.7.0

Commits

• 7801736 chore(main): release pubsub 2.7.0 (#20429)
• eb07af9 feat: update API sources and regenerate (#20427)
• 3ab7d13 chore(main): release storage 1.65.1 (#20420)
• 25e6d40 chore: update librarian to v0.39.0 (#20423)
• 0d8983d chore(agentplatform): Remove the tools submodule from AgentPlatform.
• 08d06c0 fix(internal/kokoro): skip testing modules with no Go source files (#20419)
• 081d506 BREAKING_CHANGE(agentplatform): Migrate Memory Bank methods to `client.memory...
• 574d42d chore(storage): remove redundant internal OTEL attributes (#20421)
• dbb5f6f fix(storage): enforce gRPC writer chunk retry deadlines by tying timers to se...
• 54e5a42 chore(main): release spanner 1.95.0 (#20415)
• Additional commits viewable in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.23.0 to 1.23.1

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azcore's releases.

sdk/azcore/v1.23.1

1.23.1 (2026-08-27)

Other Changes

• Upgraded dependencies.

Commits

• d86ae78 Prep azcore for release (#27471)
• 33dd768 [azwebpubsub] Fix GenerateClientAccessURL on the TokenCredential path (#27422)
• a27ca57 Upgrade TypeSpec Go emitter dependencies (#27466)
• af75eb0 [AutoPR sdk-resourcemanager/purestorageblock/armpurestorageblock]-generated-f...
• 8dcff8c [AutoPR sdk-resourcemanager/redisenterprise/armredisenterprise]-generated-fro...
• e4569f1 [AutoPR sdk-resourcemanager/chaos/armchaos]-generated-from-SDK Generation - G...
• 7069bf8 [AutoPR sdk-resourcemanager/horizondb/armhorizondb]-generated-from-SDK Genera...
• 5ceffce Bump gh-aw to v0.86.2 for mgmt review workflow (#27460)
• 663b6ce Enhance azblob perf tests with OAuth, parallel setup, and profiling (#27324)
• cf17431 [AutoPR sdk-resourcemanager/containerservice/armcontainerservice]-generated-f...
• Additional commits viewable in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.0 to 1.14.1

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/azidentity/v1.14.1

1.14.1 (2026-08-27)

Other Changes

• Upgraded dependencies

Commits

• 920e79a Prep azidentity for release (#27473)
• d86ae78 Prep azcore for release (#27471)
• 33dd768 [azwebpubsub] Fix GenerateClientAccessURL on the TokenCredential path (#27422)
• a27ca57 Upgrade TypeSpec Go emitter dependencies (#27466)
• af75eb0 [AutoPR sdk-resourcemanager/purestorageblock/armpurestorageblock]-generated-f...
• 8dcff8c [AutoPR sdk-resourcemanager/redisenterprise/armredisenterprise]-generated-fro...
• e4569f1 [AutoPR sdk-resourcemanager/chaos/armchaos]-generated-from-SDK Generation - G...
• 7069bf8 [AutoPR sdk-resourcemanager/horizondb/armhorizondb]-generated-from-SDK Genera...
• 5ceffce Bump gh-aw to v0.86.2 for mgmt review workflow (#27460)
• 663b6ce Enhance azblob perf tests with OAuth, parallel setup, and profiling (#27324)
• Additional commits viewable in compare view

Updates github.com/aws/aws-lambda-go from 1.54.0 to 1.55.1

Release notes

Sourced from github.com/aws/aws-lambda-go's releases.

v1.55.1

What's Changed

• fix: bypass proxy for Runtime and Extensions API calls by @​benrkia in aws/aws-lambda-go#641

Full Changelog: aws/aws-lambda-go@v1.55.0...v1.55.1

v1.55.0

What's changed

• Bump min go version to 1.26 (#638) — @​maxday
• Enable Go 1.27 compatibility & fix serialization test bugs (#637) — @​djedward
  • Fixed TestMalformedJson to correctly pass a pointer to json.Unmarshal, matching the intended behavior after Go 1.27's JSON library changes.
  • Relaxed error-message matching in tests so both Go 1.27 and earlier versions pass.
  • Hardened flaky integration tests (TestEnableSigterm, TestConcurrencyWithRIE) with polling and increased timeouts.
• Add missing userNotFound field to Cognito auth trigger requests (#630) — @​anzheyazzz
  • Adds 3 missing userNotFound fields to the Cognito auth trigger request events.
• Pin GitHub Actions to commit SHAs (#623) — @​maxday
  • Hardens CI supply-chain security by pinning actions to their SHAs.

Full changelog: aws/aws-lambda-go@v1.54.0...v1.55.0

Commits

• 94b293d Merge pull request #641 from aws/ilbe/proxy-bypass
• 32e2e98 fix: bypass proxy for Runtime and Extensions API calls
• 6800157 feat: bump min go version to 1.26 (#638)
• f0e2311 Fix serialization test bugs and enable Go 1.27 compat (#637)
• 87e344b Merge pull request #630 from aws/fix/cognito-usernotfound-missing-fields
• d6f4d23 Add missing userNotFound field to Cognito auth trigger requests
• 815d21f fix: pin github actions sha (#623)
• See full diff in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.43.5 to 1.47.1

Commits

• 52ba256 Release 2026-09-24
• 21223cd Regenerated Clients
• 84d89bd Update endpoints model
• d9c59ff Update API model
• 8fd86b1 feat: Add aws-chunked response decoding reader (#3563)
• ff3ac6f Release 2026-09-23
• e57d2ff Regenerated Clients
• ef6fdb9 Update endpoints model
• 385ab15 Update API model
• fafcb4f Checksum non-200 HTTP responses (#3564)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.36 to 1.33.6

Commits

• 52ba256 Release 2026-09-24
• 21223cd Regenerated Clients
• 84d89bd Update endpoints model
• d9c59ff Update API model
• 8fd86b1 feat: Add aws-chunked response decoding reader (#3563)
• ff3ac6f Release 2026-09-23
• e57d2ff Regenerated Clients
• ef6fdb9 Update endpoints model
• 385ab15 Update API model
• fafcb4f Checksum non-200 HTTP responses (#3564)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue from 1.20.60 to 1.21.7

Commits

• 284a484 Release 2026-08-20
• c278723 Regenerated Clients
• 626bebc Update API model
• 36c8121 Make x-amz-checksum-* headers on presigner always show up as headers (#3522)
• 283dd70 Expand S3 operations that check for an error inside an HTTP 200 response (wav...
• 27045a8 Fix tmv1 uploadretry flaky test (#3520)
• 228e8ec Release 2026-08-19
• 176298d Regenerated Clients
• 6a05af8 Update API model
• daa38bc Bump Smithy version to 1.73.0 (#3524)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/cloudwatch from 1.66.4 to 1.73.0

Commits

• 8fac7d4 Release 2025-01-15
• 9eff8ac Regenerated Clients
• f47aa72 Update endpoints model
• 5934dd3 Update API model
• 6636822 feat: flexible checksum updates (#2808)
• 4ffbb7c Release 2025-01-14
• 2f70ff4 Regenerated Clients
• 434159f Update endpoints model
• a80fac9 Update API model
• 44e779a fix several waiter issues (#2953)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs from 1.82.1 to 1.88.1

Commits

• 70e9f3d Release 2025-09-10
• e620ecb Regenerated Clients
• b412203 Update endpoints model
• 89f42ef Update API model
• d71b109 Bump smithy go version to allow unused required parameter in endpoint rule se...
• f68827f Release 2025-09-09
• d1748bf Regenerated Clients
• 00307c0 Update endpoints model
• 424be93 Update API model
• 648027e Release 2025-09-08
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/dynamodb from 1.63.2 to 1.69.1

Commits

• fa369bd Release 2026-06-03
• 960ee4d Regenerated Clients
• 4b6df8b Update endpoints model
• 30b15dd Update API model
• e8c72af enable schema-serde (#3421)
• b4d02c5 Release 2026-06-02
• 48e375b Regenerated Clients
• b8a4fc1 Update API model
• e8627b4 Merge pull request #3430 from aws/fix-remove-ioutil
• 4e258a3 chore: update changelog description per review
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/sns from 1.42.5 to 1.47.2

Commits

• ce842a7 Release 2023-12-01
• d40f923 Regenerated Clients
• 3a00ef5 Update API model
• 1f61a06 fix: correct recognition and zeroing of cache-wrapped AnonymousCredentials (#...
• 623d430 fix: correct wrapping of errors in authentication workflow (#2403)
• cb676e7 Release 2023-11-30.2
• 21db1a2 Regenerated Clients
• 833655d Update API model
• fcfb7ac fix: use region overrides in endpoint discovery (#2393)
• f3ea5b8 Release 2023-11-30
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/sqs from 1.46.5 to 1.52.1

Commits

• 10c4487 Release 2024-03-15
• db0b1ab Regenerated Clients
• 92c0060 Update endpoints model
• e5bb86e Update API model
• 49b368e Release 2024-03-14
• 0aa6643 Regenerated Clients
• bb0d403 Update API model
• 7229e9c Merge pull request #2553 from aws/feat-deprec-iotroborunner
• 8fa1496 update changelog
• 4174347 add changelog
• Additional commits viewable in compare view

Updates github.com/dapr/dapr from 1.18.2 to 1.18.4

Release notes

Sourced from github.com/dapr/dapr's releases.

Dapr Runtime v1.18.4

Dapr 1.18.4

This update contains the following bug fixes:

• Workflow left permanently PENDING when its start reminder fails during a scheduler restart
• Workflow stranded permanently PENDING when its start reminder fired before the creation commit
• Workflow left permanently PENDING when a placement rebalance interrupted its start reminder registration during a Scheduler outage
• Parent workflow deadlocked forever when a child workflow created after ContinueAsNew collided with a still-running child's instance ID
• Output binding invocations over gRPC forwarding binary trace metadata to components
• Force purge failed for every workflow when history signing was enabled
• Workflow wrongly failed as tampered when a stale completion arrived after ContinueAsNew or a transient state store fault
• Workflow terminate silently dropped when delivered in the same batch as other events
• Workflow schedule and status waits failed with a stalled-actor error while a workflow was stalled
• Workflow NewGuid and other SDK-derived deterministic values repeated after ContinueAsNew
• Hot-reloaded workflow access policy listed in metadata before it was enforced
• Workflow wrongly failed as tampered when a child workflow creation was rejected under history signing
• Child workflow completion was delivered to the parent before the child committed its own state
• Force purge left the workflow actor serving and writing its stale in-memory state
• A child workflow that continued as new could not report its completion under history signing
• Workflow stuck RUNNING after ContinueAsNew when the new generation's first execution was lost
• Workflow stuck RUNNING under WorkflowsClusteredDeployment when a turn was answered with the previous turn's result
• Pluggable pub/sub components delivered messages to the application one at a time

Workflow left permanently PENDING when its start reminder fails during a scheduler restart

Problem

Creating a workflow while a Scheduler replica was shutting down could leave the new instance permanently stuck in PENDING. The workflow actor commits its state (status PENDING) and then registers the start- reminder that launches execution as a separate Scheduler call. When that call failed with rpc error: code = Unknown desc = cron is closed, the error was treated as permanent: the reminder create was attempted once and dropped, while the committed state remained. The instance then reported PENDING indefinitely, had no reminder registered, never executed, and never transitioned to FAILED, so no error surfaced to monitoring. The same window during a Scheduler restart usually produces Unavailable errors, which were correctly retried; only the narrower mid-shutdown window produced the non-retried Unknown error.

Impact

You were affected if workflows were created while a dapr-scheduler-server replica restarted, including routine rolling upgrades. A single replica restart was sufficient. Affected instances were silently lost: callers polling them saw a healthy-looking PENDING status forever, and the instances could only be recovered by purging and recreating them.

Root Cause

The Scheduler returns its internal cron shutdown error as a plain error, which crosses gRPC with code Unknown. The bounded retry around actor reminder creation classified only Unavailable and DeadlineExceeded as transient, so Unknown was surfaced immediately without any retry, dropping the only signal that could ever start the workflow.

Solution

Workflow reminder creation now retries every error with bounded exponential backoff, except clearly-permanent request errors (InvalidArgument, PermissionDenied, Unauthenticated, FailedPrecondition, Unimplemented, NotFound) and Scheduler storage exhaustion (ResourceExhausted), which requires operator intervention and is surfaced to the caller immediately. The Scheduler now returns etcd space-quota exhaustion with gRPC code ResourceExhausted instead of Unknown, so clients can distinguish it from transient failures. Previously only Unavailable and DeadlineExceeded were retried, so any other transient error, including the Scheduler's shutdown and etcd errors that cross the wire as Unknown, was dropped on the first attempt. This applies to all workflow-related reminder creates (start, timer, activity, and termination reminders), and a genuinely permanent error still surfaces within the bounded retry budget.

... (truncated)

Commits

• 6d1c53f Restore concurrent message dispatch for pluggable pub/sub (#10472) (#10486)
• a8f854b [1.18] workflow: register clustered work-item waiters before dispatch (#10482)
• 1ec6fb8 workflow: keep a committed start driven when its reminder create is abandoned...
• 215b54c workflow: comple child's obligations in order (#10467) (#10476)
• d4b70d0 workflow: persist an abandoned continue-as-new generation as a pending start ...
• cf68f77 e2e: fix tests/apps/actorphp/composer.json (#10480)
• 9a93a23 fix e2e: move the actorphp e2e app off the end-of-life PHP 8.0 image (#10478)...
• 745230e workflow: commit a child's terminal state before notifying its parent (#10460...
• 7784f3d tests: drop the php extension installer from the actorphp image (#10473) (#10...
• a6ded97 [1.18] workflow: stamp synthesized child and activity failures with their sou...
• Additional commits viewable in compare view

Updates github.com/getsentry/sentry-go from 0.48.0 to 0.49.0

Release notes

Sourced from github.com/getsentry/sentry-go's releases.

0.49.0

Breaking Changes 🛠

• removing DisableLogs and DisableMetrics client options. Sending metrics and logs is already gated by the usage of our APIs already, so having a global kill switch is counter intuitive. Users that won't to opt out should just not call the relevant APIs or setup the integrations. by @​giortzisg in #1392

New Features ✨

• add WithProxyoption for OTLP. This allows setting an otlptracehttp.HTTPTransportProxyFunc for the span exporter by @​pierrre in #1377

Bug Fixes 🐛

• (echo) Propagate span through request context by @​EricGusmao in #1385
• Skip recover frames on panic. This changes stacktrace behavior for captured panics, removing sentry.Recover frames to focus on the actual panic frames. The changes might affect issue grouping. by @​giortzisg in #1364

Internal Changes 🔧

Deps

• Bump github.com/labstack/echo/v5 from 5.0.3 to 5.2.0 in /echo by @​dependabot in #1399
• Bump github.com/gorilla/websocket from 1.5.1 to 1.5.3 by @​dependabot in #1397
• Bump getsentry/craft from 2.26.6 to 2.27.2 by @​dependabot in #1381
• Bump actions/setup-go from 6.4.0 to 7.0.0 by @​dependabot in #1382
• Bump actions/checkout from 6.0.3 to 7.0.1 by @​dependabot in #1380
• Bump google.golang.org/grpc to 1.82.1 and golang.org/x/sys to 0.46.0 by @​dependabot in #1375
• Bump golang.org/x/text to v0.39.0 and x/net to v0.56.0 by @​giortzisg in #1374

Changelog

Sourced from github.com/getsentry/sentry-go's changelog.

0.49.0

Breaking Changes 🛠

• removing DisableLogs and DisableMetrics client options. Sending metrics and logs is already gated by the usage of our APIs already, so having a global kill switch is counter intuitive. Users that won't to opt out should just not call the relevant APIs or setup the integrations. by @​giortzisg in #1392

New Features ✨

• add WithProxyoption for OTLP. This allows setting an otlptracehttp.HTTPTransportProxyFunc for the span exporter by @​pierrre in #1377

Bug Fixes 🐛

• (echo) Propagate span through request context by @​EricGusmao in #1385
• Skip recover frames on panic. This changes stacktrace behavior for captured panics, removing sentry.Recover frames to focus on the actual panic frames. The changes might affect issue grouping. by @​giortzisg in #1364

Internal Changes 🔧

Deps

• Bump github.com/labstack/echo/v5 from 5.0.3 to 5.2.0 in /echo by @​dependabot in #1399
• Bump github.com/gorilla/websocket from 1.5.1 to 1.5.3 by @​dependabot in #1397
• Bump getsentry/craft from 2.26.6 to 2.27.2 by @​dependabot in #1381
• Bump actions/setup-go from 6.4.0 to 7.0.0 by @​dependabot in #1382
• Bump actions/checkout from 6.0.3 to 7.0.1 by @​dependabot in #1380
• Bump google.golang.org/grpc to 1.82.1 and golang.org/x/sys to 0.46.0 by @​dependabot in #1375
• Bump golang.org/x/text to v0.39.0 and x/net to v0.56.0 by @​giortzisg in #1374

Commits

• 78b09d1 release: 0.49.0
• eff9f37 build(deps): bump github.com/labstack/echo/v5 from 5.0.3 to 5.2.0 in /echo (#...
• c60a2f6 feat!: remove DisableLogs and DisableMetrics options (#1392)
• c3f2330 build(deps): bump github.com/gorilla/websocket from 1.5.1 to 1.5.3 (#1397)
• 9bb14a7 fix(echo): propagate span through request context (#1385)
• fb9acd8 build(deps): bump getsentry/craft from 2.26.6 to 2.27.2 (#1381)
• 17f540e feat(otel/otlp): add WithProxy option to span exporter (#1377)
• ed9834e build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 (#1382)
• af6d9db build(deps): bump actions/checkout from 6.0.3 to 7.0.1 (#1380)
• 93223f7 build(deps): bump google.golang.org/grpc to 1.82.1 and golang.org/x/sys to 0....
• Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.10.0 to 5.11.0

Release notes

Sourced from github.com/jackc/pgx/v5's releases.

v5.11.0

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

• stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.
• Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.
• pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)
• pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)
• pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

• Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

• pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

• pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

  • timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.
  • timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.
  • Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.
  • time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.
  • Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

  Behavior changes:

  • date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.
  • All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the text format. PostgreSQL never sends out-of-range dates, so this only affects corrupt or hand-built input; the range

... (truncated)

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.11.0 (September 7, 2026)

This release adds direct PostgreSQL type scanning through database/sql on Go 1.27, improves compatibility with libpq connection strings and PostgreSQL date/time values, and includes further decoder hardening. See Changes for connection-string and date/time behavior changes that may affect existing applications.

Features

• stdlib: support Go 1.27's driver.RowsColumnScanner, allowing PostgreSQL types such as arrays and ranges to be scanned directly into Go values without pgtype.Map.SQLScanner. Existing database/sql scalar conversions and sql.Scanner behavior are preserved. The minimum supported Go version remains 1.25.
• Add Rows.TypeMap to expose the type map used to decode rows, including rows created by RowsFromResultReader that have no underlying Conn. Custom implementations of Rows, including mocks, must add this method.
• pgconn: add Config.MaxProtocolMessageBodyLen to configure the maximum incoming protocol message body size (carter-ya)
• pgconn: add ErrReadOnlyConnection, ErrReadWriteConnection, ErrPrimaryConnection, and ErrStandbyConnection sentinel errors for target_session_attrs validation, allowing callers to use errors.Is (Adrian-Stefan Mares)
• pgxpool: accept pool_ping_timeout in connection strings to configure Config.PingTimeout. The default is zero; zero and negative durations mean no timeout (1991santhu)

Changes

• Name-based row-to-struct mapping now matches explicit db tags case-insensitively, with exact matches taking precedence so tags can still distinguish quoted column names that differ only by case (AlisinaDevelo)

• pgconn: resolve the OS user account only when no user is supplied by the connection string, environment, or service file, avoiding unnecessary account lookups and crashes in some restricted container environments. Home-directory defaults for password, service, and TLS files remain available independently of the account lookup. On Unix these now use $HOME rather than the OS account's home directory (Mohamed MAACHE)

• pgtype: date, timestamp and timestamptz text values are now parsed and written by a hand-written parser and encoder for PostgreSQL's ISO date/time format instead of time.Parse and time.Format. Go's layout language cannot express a variable-width year or the BC era, which is the root of the bugs below. The text scan path is roughly 2.5x faster for timestamp and timestamptz. Bug fixes:

  • timestamp and timestamptz no longer silently move February 29 of a BC leap year to March 1 when encoding. time.Date(-4712, 2, 29, ...) was written as 4713-03-01 BC and is now written as 4713-02-29 BC. This affected ordinary four-digit BC years, not only extended-range ones. date was never affected.
  • timestamp and timestamptz can now scan BC leap days. 4713-02-29 BC previously failed with day out of range. date could already scan them.
  • Years past 9999 can now be scanned. 10000-01-02 03:04:05 previously failed to parse, so timestamp and timestamptz values at the high end of PostgreSQL's range were unreadable over the simple protocol and in any other text-format result.
  • time.Time arguments in the simple protocol now encode BC dates correctly, using the same timestamp encoder.
  • Fractional seconds beyond microsecond precision are rounded the way the server rounds them (round half to even, carrying into the rest of the value) instead of being kept at full precision. PostgreSQL never sends more than six fractional digits, so this only affects values from other sources.

  Behavior changes:

  • date now rejects impossible dates instead of normalizing them. 2024-02-30 returned 2024-03-01 and 2024-13-01 returned 2025-01-01; both are now errors. timestamp and timestamptz already rejected them.
  • All three types now reject values outside PostgreSQL's range for that type, in the binary format as well as the

... (truncated)

Commits

• 5e583fa Update changelog for v5.11.0
• 3927116 Apply gofumpt formatting required by lint
• eb07165 Quote filesystem paths in development connection strings
• cf5938f Allow unsigned digit counts in binary numeric encoding
• 3930cf5 Accept PostgreSQL POSIX timezone offsets in text timestamps
• 93261be Prefer exact db tag matches when mapping rows to structs
• e8d8ad1 Merge pull request #2647 from sueun-dev/fix-range-text-quoting-20260906
• 01d2fd3 Merge pull request #2644 from eliranbz/fix-failed-prepare-deallocation
• 9b7e3be Merge pull request Description has been truncated