Skip to content

build(deps): bump the go-deps group across 1 directory with 15 updates - #4527

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/go-deps-b90ed5a50e
Open

build(deps): bump the go-deps group across 1 directory with 15 updates#4527
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/go-deps-b90ed5a50e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-deps group with 9 updates in the / directory:

Package From To
github.com/99designs/gqlgen 0.17.91 0.17.94
github.com/coreos/go-oidc/v3 3.19.0 3.20.0
github.com/nyaruka/phonenumbers 1.8.0 1.8.1
github.com/pelletier/go-toml/v2 2.4.0 2.4.3
github.com/prometheus/client_golang 1.23.2 1.24.1
github.com/riverqueue/river 0.39.0 0.41.0
github.com/riverqueue/river/riverdriver/riverdatabasesql 0.39.0 0.41.0
github.com/slack-go/slack 0.26.0 0.27.0
google.golang.org/grpc 1.81.1 1.82.1

Updates github.com/99designs/gqlgen from 0.17.91 to 0.17.94

Release notes

Sourced from github.com/99designs/gqlgen's releases.

v0.17.94

Upcoming Potentially Breaking Changes Warning

This release has changes in the Federation plugin, introducing opt-in changes that will become the default in the next release (v0.17.95).

When configured, the federation plugin creates an entity resolver that accepts a list of representations, improving performance by reducing the number of individual resolver calls.

// IMPORTANT: The output slice order is critical and must match the input slice order exactly!
func (r *entityResolver) FindUserByIDs(ctx context.Context, reps []*entity.UserByIDsInput) ([]*model.User, error) {
	output := make([]*model.User, len(reps))
	for i, user := range reps {
		output[i] = &model.User{
			ID:   user.ID,
			Name: "User " + user.ID,
		}
	}

return output, nil



}

The @entityResolver directive enables optimization for entity resolver generation in GraphQL federation, and can be opted in by specifying multi: true as in:

type MultiHello @key(fields: "name") @entityResolver(multi: true)

Or you can enable this feature by default by setting the federation.options.entity_resolver_multi flag in your configuration:

federation:
  filename: graph/federation.go
  package: graph
  version: 2
  options:
    entity_resolver_multi: true

What's Changed

... (truncated)

Commits

Updates github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0

Release notes

Sourced from github.com/coreos/go-oidc/v3's releases.

v3.20.0

What's Changed

Full Changelog: coreos/go-oidc@v3.19.0...v3.20.0

Commits
  • 75dfa5c oidc: add constants for "email" and "profile" scopes
  • a89f046 oidc: add API for determining when issuer URLs mismatch
  • 6a69b6d readme: update README and docs
  • f9049c9 oidc: ignore JWKs with unknown signing algorithms rather than failing
  • 2f178e0 SECURITY.md: add a security policy and point to project-level reporting
  • b3bc7da oidc: improve documentation for APIs
  • 0db9053 oidc: modernize with new Go APIs
  • See full diff in compare view

Updates github.com/nyaruka/phonenumbers from 1.8.0 to 1.8.1

Changelog

Sourced from github.com/nyaruka/phonenumbers's changelog.

v1.8.1 (2026-07-15)

  • Fix panic on malformed RFC3966 input where tel: appears after the phone-context
  • Clamp leading-zero count before allocating to bound memory use on untrusted PhoneNumber values
Commits
  • c2e40a9 Update CHANGELOG.md for v1.8.1
  • be30c4c Guard against out-of-range slice and clamp leading-zero allocation
  • See full diff in compare view

Updates github.com/pelletier/go-toml/v2 from 2.4.0 to 2.4.3

Release notes

Sourced from github.com/pelletier/go-toml/v2's releases.

v2.4.3

What's Changed

What's new

Fixed bugs

Documentation

Other changes

New Contributors

Full Changelog: pelletier/go-toml@v2.4.2...v2.4.3

v2.4.2

What's Changed

Fixed bugs

Full Changelog: pelletier/go-toml@v2.4.1...v2.4.2

v2.4.1

What's Changed

Fixed bugs

Full Changelog: pelletier/go-toml@v2.4.0...v2.4.1

Commits
  • 071a36c fix: bound array and inline table nesting depth to prevent stack-overflow DoS...
  • 57fec25 Add RawMessage marshal support to unstable (#1084)
  • 79f82e3 fix: error instead of panic on nil unexported embedded pointer (#1089)
  • a28afed unstable/kind: drop duplicate 'a' from LocalDate comment (#1062)
  • 6fa69af fix: do not recurse forever on recursively embedded structs (#1087)
  • 82b792e fix: report table placement errors with position and key context (#1086)
  • f93de50 perf: avoid interface boxing when decoding date/time values (#1085)
  • 21f8286 Deliver the whole document to a root Unmarshaler (#994) (#1083)
  • 98e94ae Update bundled toml.abnf to TOML 1.1.0 and pin spec-corner behaviour (#1082)
  • 35f78d5 Fix invalid TOML from commented multi-line values (#1081)
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

  • [BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

1.24.0 / 2026-07-20

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927
Commits
  • d6087ee release: cut v1.24.1 (#2076)
  • 48dd383 Cut v1.24.0 (#2061)
  • a725305 Cut v1.24.0-rc.0 (#2058)
  • 77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
  • 78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
  • 34e9a7f Merge pull request #2055 from prombot/repo_sync
  • 43749bc Update common Prometheus files
  • de19217 examples: improve simple main.go example (#1999)
  • 20355eb fix: correct typos in comments and test error messages (#2049)
  • 4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
  • Additional commits viewable in compare view

Updates github.com/riverqueue/river from 0.39.0 to 0.41.0

Release notes

Sourced from github.com/riverqueue/river's releases.

v0.41.0

Added

  • Added rivertype.HookMetricEmit for receiving metrics emitted by River. Initial metrics report the duration of successful job fetches with JobGetAvailableDurationMetric and the number of jobs fetched with JobGetAvailableCountMetric. [PR #1285](riverqueue/river#1285).
  • The riversqlite driver is now tested against Turso, an in-process SQLite-compatible database written in Rust. [PR #1311](riverqueue/river#1311).

Changed

  • Added Config.Plugins for extensions that should be installed as both hooks and middleware. Config.Hooks and Config.Middleware remain available for hook-only and middleware-only registration. [PR #1284](riverqueue/river#1284).
  • Reduce producer keep alive interval from 1 minute to 30 seconds. [PR #1319](riverqueue/river#1319).

Fixed

  • Guard against empty job slice returned by JobSetStateIfRunningMany when a job has been deleted mid-run. [PR #1308](riverqueue/river#1308).
  • Fixed JobRescuer pagination so a full batch of running jobs with disabled or longer worker-specific timeouts can't prevent later stuck jobs from being rescued. [PR #1318](riverqueue/river#1318).
  • If a job fails to unmarshal from JSON during job rescue or job execution, back off using the retry schedule and eventually discard it, similar to any other error that might occur. [PR #1324](riverqueue/river#1324).
  • Fixed JobListOrderByFinalizedAt validation so finalized states are accepted while non-finalized states are rejected. [PR #1327](riverqueue/river#1327).

v0.40.0

⚠️ Version 0.40.0 contains a new database migration, version 7, that rolls up some database cleanups and a few SQLite features:

  • Drop tables river_client and river_client_queue. These were added prospectively, but in the end were never used for anything. [PR #1115](riverqueue/river#1115).
  • Add a default value of 25 to river_job.max_attempts. Go code was previously injecting a max value, so this has no functional effect on existing behavior. [PR #1115](riverqueue/river#1115).
  • Add a default value of CURRENT_TIMESTAMP to river_queue.updated_at. Go code was previously injecting the current time, so this has no functional effect on existing behavior. [PR #1115](riverqueue/river#1115).
  • SQLite only: Convert json columns to jsonb. [PR #1224](riverqueue/river#1224).
  • SQLite only: Add pseudo listen/notify mechanism in a new river_notification table. [PR #1275](riverqueue/river#1275).

For SQLite, running River apps must be stopped briefly while the migration is run and their code upgrade to 0.40.0 so they start reading and inserting new values in jsonb instead of json.

See documentation on running River migrations. If migrating with the CLI, make sure to update it to its latest version:

go install github.com/riverqueue/river/cmd/river@latest
river migrate-up --database-url "$DATABASE_URL"

If not using River's internal migration system, the raw SQL can alternatively be dumped with (or change --database-url to a Postgres URI for Postgres versions):

go install github.com/riverqueue/river/cmd/river@latest
river migrate-get --database-url sqlite:// --version 7 --up > river7.up.sql
river migrate-get --database-url sqlite:// --version 7 --down > river7.down.sql

Added

  • SQLite picks up a new river_notification table that allows River to provide listen/notify-like functionality despite these functions not being supported outside of Postgres. [PR #1275](riverqueue/river#1275).
  • Added JobStuckHandler, giving clients a hook to handle "stuck" jobs (i.e. ones which are passed timeout and haven't responded to context cancellation) and potentially open a new worker slot if so desired. [PR #1291](riverqueue/river#1291).

Changed

... (truncated)

Changelog

Sourced from github.com/riverqueue/river's changelog.

[0.41.0] - 2026-07-23

Added

  • Added rivertype.HookMetricEmit for receiving metrics emitted by River. Initial metrics report the duration of successful job fetches with JobGetAvailableDurationMetric and the number of jobs fetched with JobGetAvailableCountMetric. [PR #1285](riverqueue/river#1285).
  • The riversqlite driver is now tested against Turso, an in-process SQLite-compatible database written in Rust. [PR #1311](riverqueue/river#1311).

Changed

  • Added Config.Plugins for extensions that should be installed as both hooks and middleware. Config.Hooks and Config.Middleware remain available for hook-only and middleware-only registration. [PR #1284](riverqueue/river#1284).
  • Reduce producer keep alive interval from 1 minute to 30 seconds. [PR #1319](riverqueue/river#1319).
  • Add context helpers that name timeouts for easy attribution on where they happened. [PR #1329](riverqueue/river#1329).

Fixed

  • Guard against empty job slice returned by JobSetStateIfRunningMany when a job has been deleted mid-run. [PR #1308](riverqueue/river#1308).
  • Fixed JobRescuer pagination so a full batch of running jobs with disabled or longer worker-specific timeouts can't prevent later stuck jobs from being rescued. [PR #1318](riverqueue/river#1318).
  • If a job fails to unmarshal from JSON during job rescue or job execution, back off using the retry schedule and eventually discard it, similar to any other error that might occur. [PR #1324](riverqueue/river#1324).
  • Fixed JobListOrderByFinalizedAt validation so finalized states are accepted while non-finalized states are rejected. [PR #1327](riverqueue/river#1327).

[0.40.0] - 2026-07-02

⚠️ Version 0.40.0 contains a new database migration, version 7, that rolls up some database cleanups and a few SQLite features:

  • Drop tables river_client and river_client_queue. These were added prospectively, but in the end were never used for anything. [PR #1115](riverqueue/river#1115).
  • Add a default value of 25 to river_job.max_attempts. Go code was previously injecting a max value, so this has no functional effect on existing behavior. [PR #1115](riverqueue/river#1115).
  • Add a default value of CURRENT_TIMESTAMP to river_queue.updated_at. Go code was previously injecting the current time, so this has no functional effect on existing behavior. [PR #1115](riverqueue/river#1115).
  • SQLite only: Convert json columns to jsonb. [PR #1224](riverqueue/river#1224).
  • SQLite only: Add pseudo listen/notify mechanism in a new river_notification table. [PR #1275](riverqueue/river#1275).

For SQLite, running River apps must be stopped briefly while the migration is run and their code upgrade to 0.40.0 so they start reading and inserting new values in jsonb instead of json.

See documentation on running River migrations. If migrating with the CLI, make sure to update it to its latest version:

go install github.com/riverqueue/river/cmd/river@latest
river migrate-up --database-url "$DATABASE_URL"

If not using River's internal migration system, the raw SQL can alternatively be dumped with (or change --database-url to a Postgres URI for Postgres versions):

go install github.com/riverqueue/river/cmd/river@latest
river migrate-get --database-url sqlite:// --version 7 --up > river7.up.sql
river migrate-get --database-url sqlite:// --version 7 --down > river7.down.sql

Added

  • SQLite picks up a new river_notification table that allows River to provide listen/notify-like functionality despite these functions not being supported outside of Postgres. [PR #1275](riverqueue/river#1275).

... (truncated)

Commits
  • 8895dbb Prepare release 0.41.0 (#1328)
  • c31936c Use context helpers more broadly in the codebase (#1329)
  • 20f8b3c Better context timeout error messages (#1277)
  • 37d98e9 Fix various small finalized-related bugs in job listing (#1327)
  • 9f08853 Implement Turso support (basically SQLite) (#1311)
  • f8ae57a Harden JSON unmarshaling in job rescuer + job executor (#1324)
  • 3a26035 Move new pilot functions into a compatibility layer so we don't need immediat...
  • e8d659c Update producer keep alive interval to 30 seconds (#1319)
  • 489824c Make job rescue paginated to protect against full batch of no-rescue jobs (#1...
  • 89cdc01 Promote JobGetStuck into the pilot (#1317)
  • Additional commits viewable in compare view

Updates github.com/riverqueue/river/riverdriver/riverdatabasesql from 0.39.0 to 0.41.0

Release notes

Sourced from github.com/riverqueue/river/riverdriver/riverdatabasesql's releases.

v0.41.0

Added

  • Added rivertype.HookMetricEmit for receiving metrics emitted by River. Initial metrics report the duration of successful job fetches with JobGetAvailableDurationMetric and the number of jobs fetched with JobGetAvailableCountMetric. [PR #1285](riverqueue/river#1285).
  • The riversqlite driver is now tested against Turso, an in-process SQLite-compatible database written in Rust. [PR #1311](riverqueue/river#1311).

Changed

  • Added Config.Plugins for extensions that should be installed as both hooks and middleware. Config.Hooks and Config.Middleware remain available for hook-only and middleware-only registration. [PR #1284](riverqueue/river#1284).
  • Reduce producer keep alive interval from 1 minute to 30 seconds. [PR #1319](riverqueue/river#1319).

Fixed

  • Guard against empty job slice returned by JobSetStateIfRunningMany when a job has been deleted mid-run. [PR #1308](riverqueue/river#1308).
  • Fixed JobRescuer pagination so a full batch of running jobs with disabled or longer worker-specific timeouts can't prevent later stuck jobs from being rescued. [PR #1318](riverqueue/river#1318).
  • If a job fails to unmarshal from JSON during job rescue or job execution, back off using the retry schedule and eventually discard it, similar to any other error that might occur. [PR #1324](riverqueue/river#1324).
  • Fixed JobListOrderByFinalizedAt validation so finalized states are accepted while non-finalized states are rejected. [PR #1327](riverqueue/river#1327).

v0.40.0

⚠️ Version 0.40.0 contains a new database migration, version 7, that rolls up some database cleanups and a few SQLite features:

  • Drop tables river_client and river_client_queue. These were added prospectively, but in the end were never used for anything. [PR #1115](riverqueue/river#1115).
  • Add a default value of 25 to river_job.max_attempts. Go code was previously injecting a max value, so this has no functional effect on existing behavior. [PR #1115](riverqueue/river#1115).
  • Add a default value of CURRENT_TIMESTAMP to river_queue.updated_at. Go code was previously injecting the current time, so this has no functional effect on existing behavior. [PR #1115](riverqueue/river#1115).
  • SQLite only: Convert json columns to jsonb. [PR #1224](riverqueue/river#1224).
  • SQLite only: Add pseudo listen/notify mechanism in a new river_notification table. [PR #1275](riverqueue/river#1275).

For SQLite, running River apps must be stopped briefly while the migration is run and their code upgrade to 0.40.0 so they start reading and inserting new values in jsonb instead of json.

See documentation on running River migrations. If migrating with the CLI, make sure to update it to its latest version:

go install github.com/riverqueue/river/cmd/river@latest
river migrate-up --database-url "$DATABASE_URL"

If not using River's internal migration system, the raw SQL can alternatively be dumped with (or change --database-url to a Postgres URI for Postgres versions):

go install github.com/riverqueue/river/cmd/river@latest
river migrate-get --database-url sqlite:// --version 7 --up > river7.up.sql
river migrate-get --database-url sqlite:// --version 7 --down > river7.down.sql

Added

  • SQLite picks up a new river_notification table that allows River to provide listen/notify-like functionality despite these functions not being supported outside of Postgres. [PR #1275](riverqueue/river#1275).
  • Added JobStuckHandler, giving clients a hook to handle "stuck" jobs (i.e. ones which are passed timeout and haven't responded to context cancellation) and potentially open a new worker slot if so desired. [PR #1291](riverqueue/river#1291).

Changed

... (truncated)

Changelog

Sourced from github.com/riverqueue/river/riverdriver/riverdatabasesql's changelog.

[0.41.0] - 2026-07-23

Added

  • Added rivertype.HookMetricEmit for receiving metrics emitted by River. Initial metrics report the duration of successful job fetches with JobGetAvailableDurationMetric and the number of jobs fetched with JobGetAvailableCountMetric. [PR #1285](riverqueue/river#1285).
  • The riversqlite driver is now tested against Turso, an in-process SQLite-compatible database written in Rust. [PR #1311](riverqueue/river#1311).

Changed

  • Added Config.Plugins for extensions that should be installed as both hooks and middleware. Config.Hooks and Config.Middleware remain ...

    Description has been truncated

@dependabot
build(deps): bump the go-deps group across 1 directory with 15 updates
234a85a 
Bumps the go-deps group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/99designs/gqlgen](https://github.com/99designs/gqlgen) | `0.17.91` | `0.17.94` |
| [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) | `3.19.0` | `3.20.0` |
| [github.com/nyaruka/phonenumbers](https://github.com/nyaruka/phonenumbers) | `1.8.0` | `1.8.1` |
| [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) | `2.4.0` | `2.4.3` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` |
| [github.com/riverqueue/river](https://github.com/riverqueue/river) | `0.39.0` | `0.41.0` |
| [github.com/riverqueue/river/riverdriver/riverdatabasesql](https://github.com/riverqueue/river) | `0.39.0` | `0.41.0` |
| [github.com/slack-go/slack](https://github.com/slack-go/slack) | `0.26.0` | `0.27.0` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.81.1` | `1.82.1` |



Updates `github.com/99designs/gqlgen` from 0.17.91 to 0.17.94
- [Release notes](https://github.com/99designs/gqlgen/releases)
- [Changelog](https://github.com/99designs/gqlgen/blob/master/CHANGELOG.md)
- [Commits](99designs/gqlgen@v0.17.91...v0.17.94)

Updates `github.com/coreos/go-oidc/v3` from 3.19.0 to 3.20.0
- [Release notes](https://github.com/coreos/go-oidc/releases)
- [Commits](coreos/go-oidc@v3.19.0...v3.20.0)

Updates `github.com/nyaruka/phonenumbers` from 1.8.0 to 1.8.1
- [Release notes](https://github.com/nyaruka/phonenumbers/releases)
- [Changelog](https://github.com/nyaruka/phonenumbers/blob/v1.8.1/CHANGELOG.md)
- [Commits](nyaruka/phonenumbers@v1.8.0...v1.8.1)

Updates `github.com/pelletier/go-toml/v2` from 2.4.0 to 2.4.3
- [Release notes](https://github.com/pelletier/go-toml/releases)
- [Commits](pelletier/go-toml@v2.4.0...v2.4.3)

Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.1/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.23.2...v1.24.1)

Updates `github.com/riverqueue/river` from 0.39.0 to 0.41.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.39.0...v0.41.0)

Updates `github.com/riverqueue/river/riverdriver/riverdatabasesql` from 0.39.0 to 0.41.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.39.0...v0.41.0)

Updates `github.com/riverqueue/river/riverdriver/riverpgxv5` from 0.39.0 to 0.41.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.39.0...v0.41.0)

Updates `github.com/riverqueue/river/rivertype` from 0.39.0 to 0.41.0
- [Release notes](https://github.com/riverqueue/river/releases)
- [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md)
- [Commits](riverqueue/river@v0.39.0...v0.41.0)

Updates `github.com/slack-go/slack` from 0.26.0 to 0.27.0
- [Release notes](https://github.com/slack-go/slack/releases)
- [Changelog](https://github.com/slack-go/slack/blob/master/CHANGELOG.md)
- [Commits](slack-go/slack@v0.26.0...v0.27.0)

Updates `github.com/vektah/gqlparser/v2` from 2.5.34 to 2.5.36
- [Release notes](https://github.com/vektah/gqlparser/releases)
- [Commits](vektah/gqlparser@v2.5.34...v2.5.36)

Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0
- [Commits](golang/crypto@v0.53.0...v0.54.0)

Updates `golang.org/x/sys` from 0.46.0 to 0.47.0
- [Commits](golang/sys@v0.46.0...v0.47.0)

Updates `golang.org/x/term` from 0.44.0 to 0.45.0
- [Commits](golang/term@v0.44.0...v0.45.0)

Updates `google.golang.org/grpc` from 1.81.1 to 1.82.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.81.1...v1.82.1)

---
updated-dependencies:
- dependency-name: github.com/99designs/gqlgen
  dependency-version: 0.17.94
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/coreos/go-oidc/v3
  dependency-version: 3.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/nyaruka/phonenumbers
  dependency-version: 1.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/pelletier/go-toml/v2
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/riverqueue/river
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/riverqueue/river/riverdriver/riverdatabasesql
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/riverqueue/river/riverdriver/riverpgxv5
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/riverqueue/river/rivertype
  dependency-version: 0.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/slack-go/slack
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/vektah/gqlparser/v2
  dependency-version: 2.5.36
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: golang.org/x/crypto
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/sys
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/term
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code size/xs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants