build(deps): bump the all-gomod group across 4 directories with 16 updates

[dependabot]

Bumps the all-gomod group with 16 updates in the / directory:

Package	From	To
golang.org/x/text	0.41.0	0.42.0
github.com/go-sql-driver/mysql	1.10.0	1.10.1
github.com/microsoft/go-mssqldb	1.11.0	1.11.2
modernc.org/sqlite	1.57.0	1.59.0
github.com/containerd/log	0.1.0	0.2.0
github.com/dustin/go-humanize	1.0.1	1.1.0
github.com/ebitengine/purego	0.10.2	0.11.1
github.com/klauspost/compress	1.19.2	1.20.1
github.com/magiconair/properties	1.18.11	1.18.12
github.com/moby/moby/api	1.55.0	1.56.0
github.com/moby/moby/client	0.5.1	0.6.0
github.com/moby/sys/userns	0.2.0	0.2.1
github.com/shirou/gopsutil/v4	4.26.7	4.26.8
golang.org/x/crypto	0.55.0	0.57.0
golang.org/x/sys	0.47.0	0.48.0
modernc.org/libc	1.75.6	1.75.7

Bumps the all-gomod group with 1 update in the /pgx directory: golang.org/x/text.
Bumps the all-gomod group with 1 update in the /sqlx directory: github.com/go-sql-driver/mysql.
Bumps the all-gomod group with 16 updates in the /tests directory:

Package	From	To
golang.org/x/text	0.41.0	0.42.0
github.com/go-sql-driver/mysql	1.10.0	1.10.1
github.com/microsoft/go-mssqldb	1.11.0	1.11.2
modernc.org/sqlite	1.57.0	1.59.0
github.com/containerd/log	0.1.0	0.2.0
github.com/dustin/go-humanize	1.0.1	1.1.0
github.com/ebitengine/purego	0.10.2	0.11.1
github.com/klauspost/compress	1.19.2	1.20.1
github.com/magiconair/properties	1.18.11	1.18.12
github.com/moby/moby/api	1.55.0	1.56.0
github.com/moby/moby/client	0.5.1	0.6.0
github.com/moby/sys/userns	0.2.0	0.2.1
github.com/shirou/gopsutil/v4	4.26.7	4.26.8
golang.org/x/crypto	0.55.0	0.57.0
golang.org/x/sys	0.47.0	0.48.0
modernc.org/libc	1.75.6	1.75.7

Updates golang.org/x/text from 0.41.0 to 0.42.0

Commits

• fafe4a0 go.mod: update golang.org/x dependencies
• f53c316 unicode/norm: don't truncate runes in the recomposition map key
• 37867f6 unicode/norm: let any starter block composition in compose
• 0dd525f unicode/norm: compose non-Hangul runes after a Hangul syllable
• bac26e5 unicode/norm: avoid improper ErrShortDst return in Form.transform
• 4f55186 unicode/norm: simplify short source detection in Form.transform
• a1b6c10 unicode/norm: prevent decomposeSegment from moving backwards
• cd1cbc9 unicode/bidi: panic rather than log.Panicf
• a459614 internal/export/idna: fix conformance with optional validation disabled
• be70a61 internal/export/idna: drop trie field from Profiles
• Additional commits viewable in compare view

Updates github.com/go-sql-driver/mysql from 1.10.0 to 1.10.1

Release notes

Sourced from github.com/go-sql-driver/mysql's releases.

v1.10.1

What's Changed

• dsn: default Net to tcp in NewConfig so Addr-only configs round-trip by @​c-tonneslan in go-sql-driver/mysql#1770
• Add LTS MariaDB 11.8 and 12.3 into the testing matrix by @​pgporada in go-sql-driver/mysql#1774
• Bump actions/checkout from 6 to 7 in the all-dependencies group by @​dependabot[bot] in go-sql-driver/mysql#1777
• ci: pin actions by @​methane in go-sql-driver/mysql#1778
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in go-sql-driver/mysql#1779
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in go-sql-driver/mysql#1780
• Interpolate typed-nil json.RawMessage as NULL by @​oha-4 in go-sql-driver/mysql#1782
• Bump actions/setup-go from 6.5.0 to 7.0.0 in the all-dependencies group by @​dependabot[bot] in go-sql-driver/mysql#1783
• Bump the all-dependencies group across 1 directory with 5 updates by @​dependabot[bot] in go-sql-driver/mysql#1791
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in go-sql-driver/mysql#1794
• Bump the all-dependencies group with 5 updates by @​dependabot[bot] in go-sql-driver/mysql#1795
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in go-sql-driver/mysql#1796
• codeql: remove custom workflow by @​methane in go-sql-driver/mysql#1799
• doc: clarify timeTruncate units and when to use it by @​milanobrtlik in go-sql-driver/mysql#1792
• release v1.10.1 by @​methane in go-sql-driver/mysql#1801

New Contributors

• @​c-tonneslan made their first contribution in go-sql-driver/mysql#1770
• @​oha-4 made their first contribution in go-sql-driver/mysql#1782
• @​milanobrtlik made their first contribution in go-sql-driver/mysql#1792

Full Changelog: go-sql-driver/mysql@v1.10.0...v1.10.1

Changelog

Sourced from github.com/go-sql-driver/mysql's changelog.

v1.10.1 (2026-09-02)

• Fix Config.FormatDSN() dropping Addr when Net is empty. It now uses the default tcp network so configs with only Addr round-trip correctly. (#1770)

• Fix typed-nil json.RawMessage with interpolateParams=true being interpolated as an empty string. It is now interpolated as SQL NULL, matching server-side prepared statements. (#1782)

• Add MariaDB 11.8 and 12.3 to the test matrix. (#1774)

Commits

• 7ca26e8 release v1.10.1 (#1801)
• 87dcb95 doc: clarify timeTruncate units and when to use it (#1792)
• 1d9c421 codeql: remove custom workflow (#1799)
• 532b8e5 Bump the all-dependencies group with 3 updates (#1796)
• fe209cc Bump the all-dependencies group with 5 updates (#1795)
• 03d76c7 Bump the all-dependencies group with 3 updates (#1794)
• c426bd9 Bump the all-dependencies group across 1 directory with 5 updates (#1791)
• 416cd99 Bump actions/setup-go from 6.5.0 to 7.0.0 in the all-dependencies group (#1783)
• b96d415 Interpolate typed-nil json.RawMessage as NULL (#1782)
• dec193d Bump the all-dependencies group with 3 updates (#1780)
• Additional commits viewable in compare view

Updates github.com/microsoft/go-mssqldb from 1.11.0 to 1.11.2

Release notes

Sourced from github.com/microsoft/go-mssqldb's releases.

v1.11.2

1.11.2 (2026-09-23)

Bug Fixes

• accept yes/no for boolean connection string keywords (#468) (0ad75cd)

v1.11.1

1.11.1 (2026-09-23)

Bug Fixes

• drain response tokens on query error to prevent Tx.Query hang (#407) (#410) (1f52296)
• preserve strict encryption in DSN URLs (#452) (ae21d6a)

Reverts

• undo response-cleanup changes from #410 (#469) (46dbf85)

Changelog

Sourced from github.com/microsoft/go-mssqldb's changelog.

1.11.2 (2026-09-23)

Bug Fixes

• accept yes/no for boolean connection string keywords (#468) (0ad75cd)

1.11.1 (2026-09-23)

Bug Fixes

• drain response tokens on query error to prevent Tx.Query hang (#407) (#410) (1f52296)
• preserve strict encryption in DSN URLs (#452) (ae21d6a)

Reverts

• undo response-cleanup changes from #410 (#469) (46dbf85)

Commits

• 2510194 chore(main): release 1.11.2 (#470)
• 0ad75cd fix: accept yes/no for boolean connection string keywords (#468)
• b198a46 chore(main): release 1.11.1 (#456)
• 46dbf85 revert: undo response-cleanup changes from #410 (#469)
• 1f52296 fix: drain response tokens on query error to prevent Tx.Query hang (#407) (#410)
• e722fbd ci: guarantee SQL container password complexity (#457)
• c4ac470 chore(deps): bump the azure-sdk group across 1 directory with 2 updates (#445)
• ae21d6a fix: preserve strict encryption in DSN URLs (#452)
• 5424185 docs: close review criteria gaps found in calibration runs (#446)
• 264a515 docs: add agent skills and PR workflow instructions for automated review (#444)
• See full diff in compare view

Updates modernc.org/sqlite from 1.57.0 to 1.59.0

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

• 2026-09-28 v1.60.0:

  • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
  • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.
  • make vendor now writes vendor.json: the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries. It refuses a dirty sibling checkout, siblings on different modernc.org/libc versions, or a libsqlite_vec built against another libsqlite3. The suite fails when lib/, vec/ or the libc in go.mod no longer match the stamp, so a libc bump goes in the same push as make vendor. Tooling only; the vendored code is unchanged. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).
  • vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.
  • Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.
  • The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.
  • Document three limits of the pluggable page cache: a program importing modernc.org/sqlite/vec cannot call RegisterPageCache (it fails with SQLITE_MISUSE), PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines, serialized by SQLite, so it wants a mutex of its own to run clean under -race. Documentation only.
  • Document two properties of connections in the package documentation: state set on a pooled connection -- PRAGMAs set with Exec, ATTACHed databases, temporary tables, anything registered through sql.Conn.Raw -- is inherited by the next caller to borrow it, and a driver connection reached through Raw is not safe for concurrent use even though every connection is opened SQLITE_OPEN_FULLMUTEX. Documentation only.
  • Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so _pragma=foreign_keys(1);ATTACH 'x.db' AS x also attaches, and creates, x.db; the Driver.Open documentation said "a PRAGMA statement" and now says what actually happens. Enabling it is recommended for any application whose DSN is not a compile-time constant.
  • Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof. Every connection is opened with SQLITE_OPEN_URI, so in a DSN starting with file: these have always worked; only the driver's own keys were listed. The docstring also spells out the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Documentation only.
  • Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257).
  • Add IRP.md, an incident response plan: who runs a response when there are two maintainers in different time zones, how a report is scoped across the three layers this module is built from, the fix path for each, and what to do when a released version is itself the problem -- a published Go module version cannot be recalled, so retract plus a new release is the remedy. Linked from SECURITY.md. Documentation only.
  • Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Contribution guidance previously existed only in GOVERNANCE.md and HACKING.md, neither of which a first-time contributor is likely to open. Documentation only.
  • Add SECURITY.md: report a vulnerability through GitHub private vulnerability reporting, a confidential GitLab issue, or the project's Service Desk address, never a public issue. It states what is in scope -- including transpilation faults, where the generated Go does not faithfully implement the C it came from -- that only the latest release is supported, and that a confirmed report is disclosed through a GitHub advisory, an entry in the Go vulnerability database so govulncheck reports it, and a release note. Documentation only.
  • Ship a Software Bill of Materials: sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), both validated against the published schemas, with SBOM.md explaining what they cover. They name what an SBOM built from the module graph cannot see -- the transpiled SQLite 3.53.4 and sqlite-vec C, and the upstreams modernc.org/libc vendors, musl among them -- and mark every component as linked into your binary, test-only, or compiled into nothing. Documentation only.
  • Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries: the whole Go module graph, the transpiled SQLite and sqlite-vec C that no go.mod names, and the upstreams modernc.org/libc carries in turn, musl among them. It reproduces all seventeen distinct license texts in full and separates what is linked into your binary from what only appears in the module graph. The LICENSE name prefix is what makes go mod vendor carry it into downstream vendor/ trees. Documentation only.

• 2026-09-15 v1.59.0:

  • Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, memmove, memset, memcmp and strlen with native Go, cutting CPU time on query-heavy workloads by up to a third; see the new Performance section below. As always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does; see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call, removing the last driver-side allocation per invocation. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return. Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).
  • Add regression tests pinning the identity and the pooling of that context. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!
  • Add a Performance section to the package documentation: measured CPU-time ratios of this driver against the same SQLite compiled from C, where the gap comes from, and the two consequences for applications — index the columns that ORDER BY, GROUP BY and WHERE use, and bound the database/sql pool with SetMaxOpenConns.

• 2026-09-01 v1.58.0:

  • Upgrade to SQLite 3.53.4. It carries upstream's own fix for the journal-rollback data-corruption bug, so the local super-journal patch v1.56.0 introduced is dropped; recovery behavior is unchanged. Also bumps the pinned modernc.org/libc to v1.75.6; as always, downstream modules must pin the same version this one does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Add opt-in support for Linux Open File Description (OFD) locks on database files, off by default; without opting in, locking behavior is byte-for-byte that of previous releases. A POSIX record lock is owned by the (process, inode) pair, so any Close of any descriptor of the database file anywhere in the process silently strips SQLite's locks; OFD locks survive that. Enable it process-wide with MODERNC_SQLITE_OFD_LOCK=1 in the environment, or with the new OFDLocking(true) before the first connection is opened; OFDLockingEnabled reports the mode in effect, and the new ErrOFDLockingTooLate and ErrOFDLockingUnavailable report a switch attempted too late and a platform or filesystem without the feature. Why it is process-wide rather than a DSN parameter, what WAL's -shm coordination still uses, and the /proc/locks measurements behind the design are in [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255).
  • Resolves [GitLab issue #255](https://gitlab.com/cznic/sqlite/-/issues/255). See [GitLab merge request #136](https://gitlab.com/cznic/sqlite/-/merge_requests/136), thanks Nathan Herring (@​technosloth), and thanks Gani Georgiev (@​ganigeorgiev) for pressing the opt-in default!

• 2026-08-19 v1.57.0:

  • Add an opt-in _defensive DSN query parameter turning on SQLite's defensive mode for the connection. On such a connection PRAGMA writable_schema=ON, PRAGMA journal_mode=OFF and PRAGMA schema_version=N become silent no-ops, and writes to a virtual table's shadow tables and to sqlite_dbpage fail. It is a hardening measure, not a sandbox for hostile database files, for which it is only one of the steps SQLite recommends, and it is a property of the connection, not of the file. Absent, or _defensive=0, nothing changes.
  • Reject _defensive=1 together with _journal_mode=OFF (or _journal=OFF) instead of opening a connection in which neither was honoured: SQLite turns that PRAGMA into a no-op that still reports success. Only DSNs using the new parameter can be affected. See [GitHub pull request #6](modernc-org/sqlite#6), thanks wsman!
  • Ship the sqlite-vec license notice this module has been missing since vec/ arrived in v1.47.0. sqlite-vec is Copyright (c) 2024 Alex Garcia, dual-licensed Apache-2.0 OR MIT and used here under MIT; the text now ships as LICENSE-SQLITE_VEC, and make vendor fails rather than quietly dropping it.
  • The SQLite notice is renamed from SQLITE-LICENSE to LICENSE-SQLITE; update any direct links to it. Its contents are unchanged. The rename is what makes go mod vendor carry both notices into downstream vendor/ trees: it selects license files by name prefix, so a name merely ending in LICENSE was never propagated.
  • Let a caller-constructed Driver register its own functions, collations and virtual table modules, through new RegisterFunction, RegisterScalarFunction, RegisterDeterministicScalarFunction, RegisterCollationUtf8 and RegisterModule methods plus Must* variants, and let vtab.RegisterModule honour its db argument. Behavior change: vtab.RegisterModule(db, ...) where db was opened on a caller-constructed Driver used to discard db and land on the registered sqlite driver, reaching every connection in the process; it now lands on that Driver alone, so a sql.Open("sqlite") connection that used to resolve such a module gets no such module. Everything else is additive, and the isolating change discussed in [GitLab issue #254](https://gitlab.com/cznic/sqlite/-/issues/254) is deliberately not made here. See [GitLab merge request #135](https://gitlab.com/cznic/sqlite/-/merge_requests/135), thanks Ian Chechin!
  • Promote freebsd/386, freebsd/arm and netbsd/amd64 from experimental to fully supported. The package documentation's platform table had carried seventeen entries while this module shipped, cross-built and tested twenty; all three have been in the builder matrix since v1.53.0 and pass the full suite on this release's commit. Documentation only — lib/ is byte-for-byte what v1.56.0 shipped.

• 2026-08-03 v1.56.0:

  • Re-vendor the transpiled sources, picking up modernc.org/libsqlite3's patch for an upstream data-corruption bug in SQLite 3.53.3's journal rollback. A crash during the commit of a multi-database (ATTACH) transaction can leave a hot journal whose zeroed super-journal name still validates, so pager_playback() deletes it without playing it back and leaves the database corrupted. Not a transpilation artifact: a plain gcc build of stock 3.53.3 fails on the same bytes. The SQLite version is unchanged at 3.53.3, every supported target carries the patch, and it will be dropped once upstream ships its own fix.
  • Two targets change beyond that patch. linux/s390x now allocates C bit-fields MSB-first as the big-endian ABI requires, from modernc.org/cc/v4 v4.29.1. linux/riscv64 was regenerated on a host running GCC 11.4.0 rather than 13.3.0, which drops some unreferenced compiler-predefined macro constants and changes what PRAGMA compile_options reports; no SQLite code generation differs. Every other target is byte-identical to v1.55.0 apart from the patch above.
  • Bump the pinned modernc.org/libc to v1.74.4 and the remaining dependencies to their current releases. v1.74.2 and v1.74.3 are retracted upstream over a freeaddrinfo lock leak that deadlocks name resolution, and v1.74.4 is the fix. As always, downstream modules must pin the same modernc.org/libc version this one does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Add NewConnector, returning a database/sql/driver.Connector for use with sql.OpenDB. It opens the same connections sql.Open("sqlite", dsn) does, from the same registered driver, so every function, collation, connection hook and virtual table module registered through this package applies to them. It exists for callers that need to interpose on the physical connections database/sql opens — tracing, metrics, connection-scoped setup — for which the alternative was sql.Register, which is process-global, panics on a repeated name and cannot be undone. A runnable sample is in examples/connector. Resolves [GitLab issue #253](https://gitlab.com/cznic/sqlite/-/issues/253), thanks Alessandro Segala (@​ItalyPaleAle)!
  • Documentation sweep. openbsd/amd64 and openbsd/arm64 join the supported platforms table, the vfs DSN query parameter is documented alongside the others on Driver.Open, the stale go generate and GO_GENERATE instructions are replaced by modernc.org/libsqlite3 and make vendor, and vec and vfs gained the package doc comments they were missing. A caller-constructed sqlite.Driver is now documented as not being the driver this package registers as "sqlite": it carries none of the package-level functions and collations, so it can evaluate upper(x) or date(x) differently. Documentation only.

• 2026-07-20 v1.55.0:

... (truncated)

Commits

• c96a4e6 CHANGELOG.md: document the libc v1.75.7 bump and the Performance section
• 35c446e update dependencies, make vendor
• 9ad02ac Merge branch 'udf-context-tests' into 'master'
• d6d84a9 sqlite: pin the identity and the pooling of the FunctionContext in tests
• 59ec397 doc.go: add a Performance section with measured driver-vs-C ratios
• 51cbcbf Merge branch 'udf-call-pool' into 'master'
• e390a0c sqlite: pool the FunctionContext handed to UDF and aggregate callbacks
• 38af581 doc.go, README.md: point readers at CHANGELOG.md
• 37e55e4 CHANGELOG.md: reconstruct the missing entries for v1.38.1 through v1.44.1 and...
• 2f7234f AUTHORS, CONTRIBUTORS: add Nathan Herring; CHANGELOG.md: credit him by name
• Additional commits viewable in compare view

Updates github.com/containerd/log from 0.1.0 to 0.2.0

Release notes

Sourced from github.com/containerd/log's releases.

v0.2.0

What's Changed

• Update GitHub Actions packages and runners by @​austinvazquez in containerd/log#3
• Update project-checks to v1.2.2 to unblock CI by @​austinvazquez in containerd/log#6
• build(deps): bump actions/setup-go from 5 to 6 in /.github/workflows by @​dependabot[bot] in containerd/log#9
• ci: update golangci-lint to v2.1.6 by @​austinvazquez in containerd/log#5
• ci: update github actions runner images to latest by @​austinvazquez in containerd/log#4
• build(deps): bump actions/checkout from 4 to 6 in /.github/workflows by @​dependabot[bot] in containerd/log#11
• build(deps): bump golangci/golangci-lint-action from 8 to 9 in /.github/workflows by @​dependabot[bot] in containerd/log#10
• chore(deps): bump github.com/sirupsen/logrus v1.9.4 by @​thaJeztah in containerd/log#15
• Add support for using slog for log output by @​dmcgowan in containerd/log#12
• build(deps): bump actions/setup-go from 6 to 7 in /.github/workflows by @​dependabot[bot] in containerd/log#19
• ci: test against module, oldstable, and stable Go versions, update golangci-lint go v2.12, update minimum go to v1.21 by @​thaJeztah in containerd/log#20
• chore(deps): bump github.com/sirupsen/logrus v1.10.0 by @​thaJeztah in containerd/log#16
• vendor: github.com/sirupsen/logrus v1.10.1 by @​thaJeztah in containerd/log#23
• ci: update actions and golangci-lint for go1.27, pin actions by sha by @​thaJeztah in containerd/log#26
• log: allow SetLevel to accept Level values by @​thaJeztah in containerd/log#22
• chore(deps): github.com/sirupsen/logrus v1.10.2 by @​thaJeztah in containerd/log#27
• slog: rewrite level synchronization with Logrus by @​thaJeztah in containerd/log#21
• migrate containerd/pkg/tracing by @​thaJeztah in containerd/log#24
• otel: avoid span lookup for entries without context by @​thaJeztah in containerd/log#28
• otel: add options to configure log level and span error status (WithLevel, WithErrorStatusLevel) by @​thaJeztah in containerd/log#25

New Contributors

• @​austinvazquez made their first contribution in containerd/log#3
• @​dependabot[bot] made their first contribution in containerd/log#9
• @​thaJeztah made their first contribution in containerd/log#15

Full Changelog: containerd/log@v0.1.0...v0.2.0

Commits

• 8b5d653 Merge pull request #25 from thaJeztah/integrate_tracing_improve
• 65e60ca otel: add option to set span error status
• 9c0b6a4 otel: add option to configure log level
• 6fcf9c1 Merge pull request #28 from thaJeztah/handle_nil_contexts
• 2b5e7c3 otel: avoid span lookup for entries without context
• 4ec26d0 Merge pull request #24 from thaJeztah/integrate_tracing
• dd120bd Merge pull request #21 from thaJeztah/rewrite_slog
• dd21ae6 Merge pull request #27 from thaJeztah/bump_logrus
• 18f2de6 log: accept slog-compatible levels in SetLevel
• c474254 slog: improve bridge test coverage
• Additional commits viewable in compare view

Updates github.com/dustin/go-humanize from 1.0.1 to 1.1.0

Commits

• 40736da Fix #105
• 528b6f7 Fix #85
• 2ccb40f Fix #103
• 0509d5b feat: add ParseComma and ParseCommaf with doc comments and epsilon test
• 0a173b2 Increase big coverage
• ca34c61 Bump actions/setup-go from 6.1.0 to 6.3.0
• da71bb0 Bump actions/checkout from 5.0.1 to 6.0.2
• d02cffb si: accept the Greek letter mu as an alias for µ in ParseSI
• 0f3681d Round off coverage of big
• ed94053 Increase bytes parsing coverage
• Additional commits viewable in compare view

Updates github.com/ebitengine/purego from 0.10.2 to 0.11.1

Release notes

Sourced from github.com/ebitengine/purego's releases.

v0.11.1

• Fix SyscallN returning the third input argument as an error code on platforms that do not capture errno; it now returns 0 (#505)
• Fix 64-bit integer callback return values losing their upper 32 bits on 386 (#524)

v0.11.0

• Require Go 1.25 or later (#469)
• Support structs on Windows amd64/arm64, Android, iOS, loong64, and ppc64le (#237, #466, #473, #475)
• Support structs as arguments and return values in callbacks (#225, #418)
• Add NetBSD (amd64, arm64) as a Tier 2 platform (#349)
• Support the ARM soft-float ABI (#490)
• Support linux/s390x without Cgo (#422)
• Support up to 32 arguments on 64-bit platforms (#425)
• Add cstrings.NSStringToString (#438)
• Fix some bugs

Commits

• 15800b5 purego: return 64-bit callback results on 386 (#519)
• fc7e496 purego: clear uncaptured errno in syscall trampolines (#510)
• 11ec78d all: v0.11.0 released
• 63002e0 purego: apply go fix modernizations (#504)
• f389379 all: use range-over-int in counting loops (#503)
• 749871c all: use structs.HostLayout on structs that must match the C ABI (#502)
• a66c0b0 purego: fix returning a C function pointer as a Go func (#500)
• f2f4202 objc: encode 64-bit integers as q and Q (#499)
• 7d5f4c2 .github/workflows: test against Go 1.27 (#498)
• f9d41fc purego: support arm soft-float abi (#494)
• Additional commits viewable in compare view

Updates github.com/klauspost/compress from 1.19.2 to 1.20.1

Release notes

Sourced from github.com/klauspost/compress's releases.

v1.20.1

What's Changed

• zstd: apply reset options to reused frame decoders by @​pellared in klauspost/compress#1226
• flate: Report unexpected EOF for truncated Huffman extra bits by @​rupayon123 in klauspost/compress#1229
• flate: avoid FMA in EstimatedBits for portable rounding by @​malt3 in klauspost/compress#1224
• gzhttp: preserve caller request headers in Transport by @​jakezwang in klauspost/compress#1225
• gzhttp: only decompress a request when gzip is the outermost coding by @​youdie006 in klauspost/compress#1223
• zstd/huff0: Optimizations by @​lizthegrey in klauspost/compress#1203 klauspost/compress#1205 klauspost/compress#1207 klauspost/compress#1204 klauspost/compress#1208 klauspost/compress#1211 klauspost/compress#1209 klauspost/compress#1210
• flate: Speed improvements by @​alex in klauspost/compress#1220 klauspost/compress#1218 klauspost/compress#1216 klauspost/compress#1215 klauspost/compress#1214 klauspost/compress#1217

New Contributors

• @​xingyaner made their first contribution in klauspost/compress#1222
• @​jakezwang made their first contribution in klauspost/compress#1225
• @​youdie006 made their first contribution in klauspost/compress#1223
• @​pellared made their first contribution in klauspost/compress#1226
• @​malt3 made their first contribution in klauspost/compress#1224
• @​rupayon123 made their first contribution in klauspost/compress#1229

Full Changelog: klauspost/compress@v1.20.0...v1.20.1

v1.20.0

What's Changed

• Add lzw reader/writer by @​klauspost in klauspost/compress#1189
• xpress: add Microsoft XPRESS (MS-XCA) decompression by @​MP-GOWTHAM in klauspost/compress#1195
• s2: arm64 assembly encoders, lowered from the amd64 avo program by @​lizthegrey in klauspost/compress#1187
• zstd, huff0: improved arm64 lowering, and narrow two table loads to MOVWQZX by @​lizthegrey in klauspost/compress#1175
• gzhttp: limit jitter hash to jitterBuffer bytes by @​VedantMadane in klauspost/compress#1192
• s2: clamp the Go EncodeBetter skip to match the assembly by @​lizthegrey in

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.51%. Comparing base (9ca05d3) to head (7d48ef9).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #122   +/-   ##
=======================================
  Coverage   90.51%   90.51%           
=======================================
  Files          12       12           
  Lines         274      274           
=======================================
  Hits          248      248           
  Misses         19       19           
  Partials        7        7           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.