Skip to content

chore(deps): bump the go-deps group across 1 directory with 7 updates - #245

Merged
AbirAbbas merged 1 commit into
mainfrom
dependabot/go_modules/go-deps-ce2cb35a87
Nov 3, 2026
Merged

chore(deps): bump the go-deps group across 1 directory with 7 updates#245
AbirAbbas merged 1 commit into
mainfrom
dependabot/go_modules/go-deps-ce2cb35a87

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-deps group with 7 updates in the / directory:

Package From To
cloud.google.com/go/kms 1.35.0 1.36.1
github.com/aws/aws-sdk-go-v2 1.47.3 1.47.5
github.com/aws/aws-sdk-go-v2/config 1.33.9 1.33.13
github.com/aws/aws-sdk-go-v2/service/kms 1.61.4 1.62.2
github.com/riverqueue/river 0.49.0 0.50.0
github.com/riverqueue/river/riverdriver/riverpgxv5 0.49.0 0.50.0
github.com/riverqueue/river/rivertype 0.49.0 0.50.0

Updates cloud.google.com/go/kms from 1.35.0 to 1.36.1

Release notes

Sourced from cloud.google.com/go/kms's releases.

video: v1.36.0

1.36.0 (2026-10-29)

Features

video: v1.35.1

1.35.1 (2026-10-28)

Bug Fixes

  • Adds additional validation for REST RPC requests (#20753) (7827181)
Changelog

Sourced from cloud.google.com/go/kms's changelog.

1.36.1 (2025-04-15)

Bug Fixes

  • documentai: Update google.golang.org/api to 0.229.0 (3319672)

1.36.0 (2025-03-19)

Features

  • documentai: Added config options to enable LLM layout parsing (c2ee207)

1.35.3 (2025-03-13)

Bug Fixes

  • documentai: Update golang.org/x/net to 0.37.0 (1144978)

1.35.2 (2025-02-12)

Documentation

  • documentai: Mark fields as unused (7e10021)

1.35.1 (2025-01-02)

Bug Fixes

  • documentai: Update golang.org/x/net to v0.33.0 (e9b0b69)
Commits
  • d630a35 chore: release main (#20255)
  • 00b2a49 feat(bigtable): TTL-on-idle cache for per-resource session.TableAPI (#20263)
  • bf30b2f fix(multiple): correct module go version declaration (#20260)
  • 450585c test(bigquery/storage/managedwriter): remove stale genproto refs (#20261)
  • b32fbd7 feat(bigtable): wire Diverter on Client and route Open* via TableShim (#20256)
  • 35e146e feat(bigtable): rename session pool display to <resource-id>-<PERM> (#20248)
  • 9f7081e feat(google/maps/navconnect/v1): onboard a new library (#20253)
  • fdcefed refactor(bigtable): TableShim adopts proto-native session TableAPI (#20258)
  • 1297143 feat(bigtable): add protoRowToRow conversion helper for TableShim (#20257)
  • 5bca8d2 chore(main): release spanner 1.94.0 (#20167)
  • Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.5

Commits

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.13

Commits

Updates github.com/aws/aws-sdk-go-v2/service/kms from 1.61.4 to 1.62.2

Commits

Updates github.com/riverqueue/river from 0.49.0 to 0.50.0

Release notes

Sourced from github.com/riverqueue/river's releases.

v0.50.0

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Changelog

Sourced from github.com/riverqueue/river's changelog.

[0.50.0] - 2026-10-26

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Commits

Updates github.com/riverqueue/river/riverdriver/riverpgxv5 from 0.49.0 to 0.50.0

Release notes

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's releases.

v0.50.0

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Changelog

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's changelog.

[0.50.0] - 2026-10-26

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Commits

Updates github.com/riverqueue/river/rivertype from 0.49.0 to 0.50.0

Release notes

Sourced from github.com/riverqueue/river/rivertype's releases.

v0.50.0

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Changelog

Sourced from github.com/riverqueue/river/rivertype's changelog.

[0.50.0] - 2026-10-26

Changed

  • Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
  • Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

  • Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
  • Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
  • Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
  • Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
  • Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
  • Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
  • Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the go-deps group across 1 directory with 7 updates
4ea7cc9 
Bumps the go-deps group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) | `1.35.0` | `1.36.1` |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.47.3` | `1.47.5` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.33.9` | `1.33.13` |
| [github.com/aws/aws-sdk-go-v2/service/kms](https://github.com/aws/aws-sdk-go-v2) | `1.61.4` | `1.62.2` |
| [github.com/riverqueue/river](https://github.com/riverqueue/river) | `0.49.0` | `0.50.0` |
| [github.com/riverqueue/river/riverdriver/riverpgxv5](https://github.com/riverqueue/river) | `0.49.0` | `0.50.0` |
| [github.com/riverqueue/river/rivertype](https://github.com/riverqueue/river) | `0.49.0` | `0.50.0` |



Updates `cloud.google.com/go/kms` from 1.35.0 to 1.36.1
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)
- [Commits](googleapis/google-cloud-go@kms/v1.35.0...dlp/v1.36.1)

Updates `github.com/aws/aws-sdk-go-v2` from 1.47.3 to 1.47.5
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.47.3...v1.47.5)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.33.9 to 1.33.13
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.33.9...config/v1.33.13)

Updates `github.com/aws/aws-sdk-go-v2/service/kms` from 1.61.4 to 1.62.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/fsx/v1.61.4...service/rds/v1.62.2)

Updates `github.com/riverqueue/river` from 0.49.0 to 0.50.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.49.0...v0.50.0)

Updates `github.com/riverqueue/river/riverdriver/riverpgxv5` from 0.49.0 to 0.50.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.49.0...v0.50.0)

Updates `github.com/riverqueue/river/rivertype` from 0.49.0 to 0.50.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.49.0...v0.50.0)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/kms
  dependency-version: 1.36.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.47.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/aws/aws-sdk-go-v2/service/kms
  dependency-version: 1.62.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/riverqueue/river
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/riverqueue/river/riverdriver/riverpgxv5
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/riverqueue/river/rivertype
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the area:runtime Suite Go runtime label Nov 2, 2026
@dependabot dependabot Bot added the type:chore Maintenance label Nov 2, 2026
AbirAbbas
AbirAbbas approved these changes Nov 3, 2026
View reviewed changes

@AbirAbbas AbirAbbas left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Go-only bump; Test/Lint (Go), gosec and CodeQL are green on the exact base it lands on. river 0.50's one breaking change (nested resumable steps) doesn't apply since BackAI doesn't use resumable steps, and there's no new river migration. The red pnpm audit is the pre-existing better-auth advisories on main, which #244 fixes.

@AbirAbbas
AbirAbbas merged commit f6dcae6 into main Nov 3, 2026
28 of 30 checks passed
@dependabot
dependabot Bot deleted the dependabot/go_modules/go-deps-ce2cb35a87 branch November 3, 2026 19:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AbirAbbas AbirAbbas AbirAbbas approved these changes
@santoshkumarradha santoshkumarradha Awaiting requested review from santoshkumarradha santoshkumarradha is a code owner

Assignees

No one assigned

Labels

area:runtime Suite Go runtime type:chore Maintenance

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@AbirAbbas