fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
bluenviron/mediamtx		minor	1.20.0 → 1.21.0
github.com/go-chi/chi/v5	require	patch	v5.3.1 → v5.3.2
github.com/go-telegram/bot	require	minor	v1.23.0 → v1.25.0
github.com/pressly/goose/v3	require	minor	v3.27.3 → v3.28.0
modernc.org/sqlite	require	minor	v1.56.0 → v1.58.0

---

Release Notes

go-chi/chi (github.com/go-chi/chi/v5)

v5.3.2

Compare Source

What's Changed

• feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @​VojtechVitek in #​1151
• docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @​VojtechVitek in #​1111
• fix: don't drop handlers that collide with a Mount()/Route() pattern by @​VojtechVitek in #​1148
• Don't duplicate methods in Allow: header for 405 responses by @​flimzy in #​1029
• fix(middleware): reject catch-all compress wildcards by @​VojtechVitek in #​1156
  • middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in #​868 and #​1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

go-telegram/bot (github.com/go-telegram/bot)

v1.25.0

Compare Source

• Fix: attachments nested in a rich message are uploaded. buildRequestForm had
  no case for InputRichMessage, so the field fell through to a plain
  json.Marshal and the attach:// references in InputRichMessage.Media and
  in the media InputRichBlock* blocks were serialized without their file parts,
  leaving Telegram nothing to resolve them against (#​298).
• Fix: the thumbnail of an InputMedia is uploaded. InputFileUpload nested in
  an InputMediaVideo, InputMediaAnimation, InputMediaAudio,
  InputMediaDocument or InputPaidMediaVideo was encoded as "@<filename>",
  which is not a Bot API reference, and no file part was written, so the
  thumbnail was silently dropped by Telegram. It is now marshalled as
  attach://<filename> and uploaded under that name. InputFileUpload.MarshalJSON
  emits the same reference everywhere; at the top level of a request the field is
  still sent as its own form part, so that path is unchanged.
• Fix: a typed nil InputFile or InputMedia no longer panics while the form is
  built. A typed nil in a top level InputFile field, in InputMedia /
  InputPaidMedia (single or slice) or in InputRichMessage.Media is reported as
  an error, and a typed nil thumbnail nested in an InputMedia is omitted from
  the encoded media instead of being sent as a null the Bot API rejects.
• Fix: a nested InputFileUpload with an empty Filename is rejected. Filename
  is the attach:// reference and the part name, so an empty one produced
  "thumbnail":"attach://" and an opaque Bad Request from Telegram.
• Fix: InputFileUpload.MarshalJSON and InputFileString.MarshalJSON escape
  their value instead of concatenating it into a JSON string. A Filename or a
  file_id containing a quote or a backslash produced invalid JSON, failing the
  request after the file parts had already been streamed.
• [BREAKING] Fix: two different files sharing a part name are rejected with an
  error instead of both being written. The name of a part is what an attach://
  reference resolves against, so a duplicate — most easily two thumbnails with
  the same Filename — silently made Telegram resolve both references to the
  first file. One file referenced from several entries under a single name still
  works: the part is written once and reused. A file part and a form field of the
  same name are the same ambiguity and are rejected too. A request that built
  before can now fail early, most visibly when an attach:// name matches the
  name of a form field, e.g. attach://media in sendMediaGroup,
  editMessageMedia or sendPaidMedia.

v1.24.0

Compare Source

• Support Bot API 10.3 (August 24, 2026 update):
  • Rich Messages: new RichMessageButton; RichTextButton (via the RichText
    union); RichBlockButtons, RichBlockExpandableBlockQuotation,
    RichBlockDocument and their InputRichBlock* counterparts (via the
    RichBlock / InputRichBlock unions); is_compact on RichBlockTable and
    InputRichBlockTable; tg://document?id= links for InputRichMessageMedia.
  • Ephemeral Messages: new EphemeralMessageParameters (with
    replace_callback_query_message), sent as ephemeral_message_parameters by
    the 13 send methods and sendRichMessage; rich_message on
    editEphemeralMessageText (and text made optional);
    show_caption_above_media on editEphemeralMessageCaption; upload of new
    files in editEphemeralMessageMedia; can_send_welcome_messages on
    ChatAdministratorRights, ChatMemberAdministrator and promoteChatMember.
  • Reply markup: new DisabledButton with the disabled field on
    InlineKeyboardButton; force_reply on InlineKeyboardMarkup and
    ReplyKeyboardMarkup.
  • General: can_stop and keep_on_stop on sendMessageDraft and
    sendRichMessageDraft; new MessageGenerationStopped with the
    stopped_message_generation field on Update (and the matching
    allowed-update constant); new CommunityChatJoined with
    community_chat_joined on Message; text, entities and is_private on
    UniqueGiftInfo.
• Fix: attach:// with a nil reader returns an error instead of panicking.
  addFormFieldInputMediaItem and addFormFieldInputStickerSlice copied the
  reader without checking it, and since the form is built in a goroutine with no
  recover, a missing MediaAttachment or StickerAttachment took the process
  down instead of failing the call (#​296).
• Fix: can_post_stories, can_edit_stories and can_delete_stories are no
  longer marked omitempty on ChatAdministratorRights and
  ChatMemberAdministrator. They are required fields in the Bot API, so they
  are now always sent, matching the rest of the required rights in those types.
  The parameters of the same name on promoteChatMember are optional and are
  unchanged.
• Fix: the getUpdates loop honours retry_after on a 429 instead of its own
  backoff, which starts at 100ms, doubles and caps at 5s. When Telegram asked
  for a longer wait, the bot retried early and earned further 429s (#​289).
• [BREAKING] Fix: Message.ReplyToStore was tagged reply_to_store, a typo of
  the Bot API field reply_to_story, so it was never unmarshalled. The field is
  renamed to ReplyToStory (#​287).
• [BREAKING] Fix: BusinessBotRights.CanDeleteOutgoingMessages was tagged
  can_delete_outgoing_messages, which does not exist in the Bot API. The right
  was dropped on unmarshal and emitted under a key Telegram ignores. The field is
  renamed to CanDeleteSentMessages with the correct
  can_delete_sent_messages tag (#​286).
• [BREAKING] ReceiverUserID and CallbackQueryID are removed from the send
  method params (SendMessageParams, SendPhotoParams, ...); Bot API 10.3
  replaced them with EphemeralMessageParameters.

pressly/goose (github.com/pressly/goose/v3)

v3.28.0

Compare Source

Added

• CLI: azuresql driver for Azure SQL with Microsoft Entra ID (Azure AD) authentication via
  fedauth connection string parameters, e.g.
  goose azuresql "sqlserver://host?database=mydb&fedauth=ActiveDirectoryDefault" status.
  Excluded when building with the no_mssql or no_azuresql tags (#​1109)
• MySQL/MariaDB table-based Locker via lock.NewMySQLTableLocker, the MySQL counterpart to the
  Postgres table locker from #​993, accepting the same TableLockerOption set (#​1075)

Changed

• Minimum Go version is now 1.26

• ClickHouse: new goose_db_version tables are created with ORDER BY (version_id) instead of
  ORDER BY (date). Existing tables are unchanged (#​1085)

• MySQL/TiDB: the tstamp column is now DATETIME instead of TIMESTAMP, which is capped at
  2038-01-19 (#​1053). Only newly created tables are affected; existing tables can be updated with:

  ALTER TABLE goose_db_version MODIFY tstamp datetime NULL DEFAULT CURRENT_TIMESTAMP;

• Various dependency upgrades

Fixed

• goose create returns a clear "file exists" error, including the path, instead of %!w(<nil>)
  when the migration file already exists (#​1104)

cznic/sqlite (modernc.org/sqlite)

v1.58.0

Compare Source

v1.57.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 12 additional dependencies were updated

Details:

Package	Change
go.yaml.in/yaml/v3	v3.0.4 -> v3.0.5
golang.org/x/exp	v0.0.0-20260718201538-764159d718ef -> v0.0.0-20260824195058-e88cd73687aa
golang.org/x/mod	v0.38.0 -> v0.39.0
golang.org/x/net	v0.57.0 -> v0.58.0
golang.org/x/telemetry	v0.0.0-20260708182218-49f421fb7959 -> v0.0.0-20260811182544-a038080d80e5
golang.org/x/text	v0.40.0 -> v0.41.0
golang.org/x/tools	v0.48.0 -> v0.49.0
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260720211330-0afa2a65878a -> v0.0.0-20260831171406-18b4a7587f8a
google.golang.org/grpc	v1.83.1 -> v1.83.2
google.golang.org/protobuf	v1.36.11 -> v1.36.12
modernc.org/libc	v1.74.4 -> v1.75.6
modernc.org/memory	v1.11.0 -> v1.12.1

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.