Skip to content

build(deps): bump the all-gomod group across 2 directories with 3 updates - #129

Merged
Thiht merged 1 commit into
mainfrom
dependabot/go_modules/all-gomod-2f086be36a
Oct 26, 2026
Merged

build(deps): bump the all-gomod group across 2 directories with 3 updates#129
Thiht merged 1 commit into
mainfrom
dependabot/go_modules/all-gomod-2f086be36a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-gomod group with 3 updates in the / directory: modernc.org/sqlite, github.com/shopspring/decimal and modernc.org/libc.
Bumps the all-gomod group with 3 updates in the /tests directory: modernc.org/sqlite, github.com/shopspring/decimal and modernc.org/libc.

Updates modernc.org/sqlite from 1.60.1 to 1.61.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

  • 2026-10-21 v1.61.1:

    • Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!
    • Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.
    • Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!
    • The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.
    • Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

  • 2026-10-21 v1.61.0:

  • 2026-09-29 v1.60.1:

    • Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

  • 2026-09-28 v1.60.0:

    • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
    • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.
    • make vendor now writes vendor.json, the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries; the test suite fails when they no longer match. Tooling only. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).
    • vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.
    • Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.
    • The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.
    • Document three limits of the pluggable page cache on RegisterPageCache and Cache: it cannot be combined with modernc.org/sqlite/vec, PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines. Documentation only.
    • Document in the package documentation that state set on a pooled connection is inherited by the next caller to borrow it, and that a connection reached through sql.Conn.Raw is not safe for concurrent use. Documentation only.
    • Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so anything after a ; runs too. Recommended for any application whose DSN is not a compile-time constant.
    • Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof, which have always worked in a DSN starting with file:, and the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257). Documentation only.
    • Add SECURITY.md, the vulnerability reporting policy: three private channels, what is in scope, that only the latest release is supported, and how a confirmed report is disclosed, including an entry in the Go vulnerability database so govulncheck reports it. IRP.md, linked from it, is the maintainers' incident response plan. Documentation only.
    • Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Documentation only.
    • Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries with all seventeen license texts in full, and a Software Bill of Materials, sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), explained in SBOM.md. Both cover what a module-graph tool cannot see: the transpiled SQLite and sqlite-vec C, and the upstreams modernc.org/libc carries, musl among them. Documentation only.

  • 2026-09-15 v1.59.0:

    • Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, memmove, memset, memcmp and strlen with native Go, cutting CPU time on query-heavy workloads by up to a third; see the new Performance section below. As always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does; see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call, removing the last driver-side allocation per invocation. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return. Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).
    • Add regression tests pinning the identity and the pooling of that context. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!
    • Add a Performance section to the package documentation: measured CPU-time ratios of this driver against the same SQLite compiled from C, where the gap comes from, and the two consequences for applications — index the columns that ORDER BY, GROUP BY and WHERE use, and bound the database/sql pool with SetMaxOpenConns.

  • 2026-09-01 v1.58.0:

    • Upgrade to SQLite 3.53.4. It carries upstream's own fix for the journal-rollback data-corruption bug, so the local super-journal patch v1.56.0 introduced is dropped; recovery behavior is unchanged. Also bumps the pinned modernc.org/libc to v1.75.6; as always, downstream modules must pin the same version this one does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Add opt-in support for Linux Open File Description (OFD) locks on database files, off by default; without opting in, locking behavior is byte-for-byte that of previous releases. A POSIX record lock is owned by the (process, inode) pair, so any Close of any descriptor of the database file anywhere in the process silently strips SQLite's locks; OFD locks survive that. Enable it process-wide with MODERNC_SQLITE_OFD_LOCK=1 in the environment, or with the new OFDLocking(true) before the first connection is opened; OFDLockingEnabled reports the mode in effect, and the new ErrOFDLockingTooLate and ErrOFDLockingUnavailable report a switch attempted too late and a platform or filesystem without the feature. Why it is process-wide rather than a DSN parameter, what WAL's -shm coordination still uses, and the /proc/locks measurements behind the design are in [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255).

... (truncated)

Commits
  • 4df1ebe sqlite, conn, stmt, tx: end a busy_timeout wait when the call's context is done
  • 44ae8d4 update dependencies, make vendor: SQLite 3.54.1, libc v1.79.0
  • 570dc56 CHANGELOG.md: context cancellation before a statement starts (GitHub PR #9)
  • 4eacffe sqlite, conn: keep one cancellation flag per connection
  • 4926b7a Merge GitHub pull request #9 'fix/context-cancellation'
  • 3587a68 fix: preserve cancellation before SQLite execution
  • fd37819 Merge branch 'tx-shared-cache-wait' into 'master'
  • 75b4e62 conn: watch the context only while waiting for a shared-cache lock
  • 5856ee8 tx, conn: wait for a shared-cache lock in BeginTx, Commit and Rollback, and e...
  • 0fc3f90 conn: forget the pre-update, commit and rollback hooks on Close
  • Additional commits viewable in compare view

Updates github.com/shopspring/decimal from 1.5.0 to 1.6.0

Release notes

Sourced from github.com/shopspring/decimal's releases.

v1.6.0

What's Changed

New Contributors

Full Changelog: shopspring/decimal@v1.5.0...v1.6.0

Changelog

Sourced from github.com/shopspring/decimal's changelog.

Decimal v1.6.0

BEHAVIOR CHANGES

  • Decimal implements fmt.Formatter. %#v prints Go code that recreates the value, like decimal.New(314, -2), instead of the struct fields, and verbs that don't apply, like %d, print %!d(decimal.Decimal=3.14). %v, %s, %q, %x and fmt.Println print the same as before #463
  • Ln rounds correctly, so some results change in the last digit: Ln of 10 to 5 places is 2.30259, not 2.30258 #471
  • ExpHullAbrham returns overallPrecision significant figures for every input. Negative inputs used to lose digits or return 0, like -50 at precision 10, and large inputs returned extra digits #429 #470
  • Scan converts float32 with NewFromFloat32, so 54.33 stays 54.33 instead of becoming 54.33000183105469. NaN and infinite floats return an error instead of panicking #469
  • On Go 1.10 to 1.12, NewFromFloat can pick a different shortest form in rare cases (golang/go#29491). It still converts back to the same float #431

FEATURES

  • Add BSON Decimal128 support for Decimal and NullDecimal with the official MongoDB Go driver v2, without a new dependency #460
  • Add %f formatting with precision, width and flags, like %.2f and %08.2f #463
  • Add Normalize, which strips trailing zeros so equal decimals also match with reflect.DeepEqual, testify and gomock #464
  • Add Sqrt and SqrtRound #465
  • Add Root and RootRound for n-th roots #473
  • Add NewFromBigFloat constructor #457
  • Scan accepts Decimal, big.Int, *big.Int and all integer sizes, as passed by ClickHouse and other drivers #469

ENHANCEMENTS

  • NewFromFloat and NewFromFloat32 are 3 to 6 times faster. They use strconv instead of a vendored copy of it from 2009, which is removed #431
  • Ln is 3 to 14 times faster #471
  • Slightly faster IsInteger and Ceil #299
  • NewFromString accepts the Unicode minus sign − (U+2212) #428
  • Scanning NULL into a Decimal returns an error that points to NullDecimal or *Decimal #474
  • Document that global settings aren't goroutine-safe, and list them with their per-call alternatives in the README #466
  • README: show how to control the JSON format of one field, add udecimal to the alternative libraries, and update the Go doc and playground links #475 #476 #264
  • Fix doc examples that were wrong or didn't compile #468
  • Fix benchmarks that measured their setup or the wrong function #467

BUGFIXES

  • QuoRem and DivRound panic on precision math.MinInt32 instead of returning a wrong quotient #472
Commits
  • 447b833 docs: changelog for v1.6.0 (#477)
  • 4ce352f fix: reject overflowing division precision (#472)
  • 540b915 docs: add udecimal to the alternative libraries (#476)
  • 5474883 docs: show how to control the JSON format of one field (#475)
  • ddb96d1 fix: clearer error when scanning NULL into a Decimal (#474)
  • 59f775d README: Fix URLs for the official Go pages (#264)
  • 100aebf feat: add Root and RootRound (#473)
  • bed77f5 fix: Ln rounds correctly, computed with error bounds like Pow (#471)
  • 37aad64 feat: add NewFromBigFloat constructor (#457)
  • 78a38f8 perf: NewFromFloat uses strconv, drop the vendored strconv copy (#431)
  • Additional commits viewable in compare view

Updates modernc.org/libc from 1.79.0 to 1.79.1

Commits
  • 80d50b9 etc.go: make TLS.Close free every stack segment and alloca
  • See full diff in compare view

Updates modernc.org/sqlite from 1.60.1 to 1.61.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

  • 2026-10-21 v1.61.1:

    • Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!
    • Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.
    • Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!
    • The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.
    • Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

  • 2026-10-21 v1.61.0:

  • 2026-09-29 v1.60.1:

    • Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

  • 2026-09-28 v1.60.0:

    • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
    • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.
    • make vendor now writes vendor.json, the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries; the test suite fails when they no longer match. Tooling only. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).
    • vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.
    • Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.
    • The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.
    • Document three limits of the pluggable page cache on RegisterPageCache and Cache: it cannot be combined with modernc.org/sqlite/vec, PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines. Documentation only.
    • Document in the package documentation that state set on a pooled connection is inherited by the next caller to borrow it, and that a connection reached through sql.Conn.Raw is not safe for concurrent use. Documentation only.
    • Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so anything after a ; runs too. Recommended for any application whose DSN is not a compile-time constant.
    • Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof, which have always worked in a DSN starting with file:, and the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257). Documentation only.
    • Add SECURITY.md, the vulnerability reporting policy: three private channels, what is in scope, that only the latest release is supported, and how a confirmed report is disclosed, including an entry in the Go vulnerability database so govulncheck reports it. IRP.md, linked from it, is the maintainers' incident response plan. Documentation only.
    • Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Documentation only.
    • Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries with all seventeen license texts in full, and a Software Bill of Materials, sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), explained in SBOM.md. Both cover what a module-graph tool cannot see: the transpiled SQLite and sqlite-vec C, and the upstreams modernc.org/libc carries, musl among them. Documentation only.

  • 2026-09-15 v1.59.0:

    • Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, memmove, memset, memcmp and strlen with native Go, cutting CPU time on query-heavy workloads by up to a third; see the new Performance section below. As always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does; see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call, removing the last driver-side allocation per invocation. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return. Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).
    • Add regression tests pinning the identity and the pooling of that context. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!
    • Add a Performance section to the package documentation: measured CPU-time ratios of this driver against the same SQLite compiled from C, where the gap comes from, and the two consequences for applications — index the columns that ORDER BY, GROUP BY and WHERE use, and bound the database/sql pool with SetMaxOpenConns.

  • 2026-09-01 v1.58.0:

    • Upgrade to SQLite 3.53.4. It carries upstream's own fix for the journal-rollback data-corruption bug, so the local super-journal patch v1.56.0 introduced is dropped; recovery behavior is unchanged. Also bumps the pinned modernc.org/libc to v1.75.6; as always, downstream modules must pin the same version this one does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
    • Add opt-in support for Linux Open File Description (OFD) locks on database files, off by default; without opting in, locking behavior is byte-for-byte that of previous releases. A POSIX record lock is owned by the (process, inode) pair, so any Close of any descriptor of the database file anywhere in the process silently strips SQLite's locks; OFD locks survive that. Enable it process-wide with MODERNC_SQLITE_OFD_LOCK=1 in the environment, or with the new OFDLocking(true) before the first connection is opened; OFDLockingEnabled reports the mode in effect, and the new ErrOFDLockingTooLate and ErrOFDLockingUnavailable report a switch attempted too late and a platform or filesystem without the feature. Why it is process-wide rather than a DSN parameter, what WAL's -shm coordination still uses, and the /proc/locks measurements behind the design are in [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255).

... (truncated)

Commits
  • 4df1ebe sqlite, conn, stmt, tx: end a busy_timeout wait when the call's context is done
  • 44ae8d4 update dependencies, make vendor: SQLite 3.54.1, libc v1.79.0
  • 570dc56 CHANGELOG.md: context cancellation before a statement starts (GitHub PR #9)
  • 4eacffe sqlite, conn: keep one cancellation flag per connection
  • 4926b7a Merge GitHub pull request #9 'fix/context-cancellation'
  • 3587a68 fix: preserve cancellation before SQLite execution
  • fd37819 Merge branch 'tx-shared-cache-wait' into 'master'
  • 75b4e62 conn: watch the context only while waiting for a shared-cache lock
  • 5856ee8 tx, conn: wait for a shared-cache lock in BeginTx, Commit and Rollback, and e...
  • 0fc3f90 conn: forget the pre-update, commit and rollback hooks on Close
  • Additional commits viewable in compare view

Updates github.com/shopspring/decimal from 1.5.0 to 1.6.0

Release notes

Sourced from github.com/shopspring/decimal's releases.

v1.6.0

What's Changed

@dependabot
build(deps): bump the all-gomod group across 2 directories with 3 upd…
9e05c10 
…ates

Bumps the all-gomod group with 3 updates in the / directory: [modernc.org/sqlite](https://gitlab.com/cznic/sqlite), [github.com/shopspring/decimal](https://github.com/shopspring/decimal) and [modernc.org/libc](https://gitlab.com/cznic/libc).
Bumps the all-gomod group with 3 updates in the /tests directory: [modernc.org/sqlite](https://gitlab.com/cznic/sqlite), [github.com/shopspring/decimal](https://github.com/shopspring/decimal) and [modernc.org/libc](https://gitlab.com/cznic/libc).


Updates `modernc.org/sqlite` from 1.60.1 to 1.61.0
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.60.1...v1.61.0)

Updates `github.com/shopspring/decimal` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/shopspring/decimal/releases)
- [Changelog](https://github.com/shopspring/decimal/blob/master/CHANGELOG.md)
- [Commits](shopspring/decimal@v1.5.0...v1.6.0)

Updates `modernc.org/libc` from 1.79.0 to 1.79.1
- [Commits](https://gitlab.com/cznic/libc/compare/v1.79.0...v1.79.1)

Updates `modernc.org/sqlite` from 1.60.1 to 1.61.0
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.60.1...v1.61.0)

Updates `github.com/shopspring/decimal` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/shopspring/decimal/releases)
- [Changelog](https://github.com/shopspring/decimal/blob/master/CHANGELOG.md)
- [Commits](shopspring/decimal@v1.5.0...v1.6.0)

Updates `modernc.org/libc` from 1.79.0 to 1.79.1
- [Commits](https://gitlab.com/cznic/libc/compare/v1.79.0...v1.79.1)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-gomod
- dependency-name: github.com/shopspring/decimal
  dependency-version: 1.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: all-gomod
- dependency-name: modernc.org/libc
  dependency-version: 1.79.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: all-gomod
- dependency-name: modernc.org/sqlite
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-gomod
- dependency-name: github.com/shopspring/decimal
  dependency-version: 1.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: all-gomod
- dependency-name: modernc.org/libc
  dependency-version: 1.79.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: all-gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Oct 26, 2026
@Thiht
Thiht merged commit 54a8b9f into main Oct 26, 2026
2 checks passed
@Thiht
Thiht deleted the dependabot/go_modules/all-gomod-2f086be36a branch October 26, 2026 16:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Thiht