Update gomod dependencies - #4681
Conversation
ℹ️ Artifact update noticeFile name: flow/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: flow/pkg/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
Renovate dependency bump review —
|
❌ Test FailureAnalysis: The flow-worker container crashed mid-run (exit code 2, a Go panic) in both failing matrix jobs while all other services stayed healthy, so every mirror stalled in STATUS_SETUP/STATUS_SNAPSHOT and ~135 tests plus the 20-minute package deadline failed as cascading timeouts — a worker crash to investigate, not marginal test timing. |
92fc410 to
196d168
Compare
Dependency bump review — no blocking findingsReviewed per I read the upstream release notes / commit logs for each bumped range and checked the affected call sites in this repo. Summary below. Breaking changes upstream that were checked and do not affect us
Other v2.48.0 behaviour changes, all in the parameter-binding path:
None of these reach us: every ClickHouse query in this repo is string-built and passes zero bound args ( Two genuine wins here:
Behaviour changes worth knowing about
Two notes relevant to the "no sensitive output" rule — both improvements
Remainder (routine, no action)
CI
|
196d168 to
66ca636
Compare
Dependency bump review — no findingsReviewed per Upstream changes that are flagged breaking, but don't affect us
Also in 2.48, several query-parameter binding behavior changes: float params now bound as typed Structured HTTP exceptions (#1910) only change the HTTP protocol path; we connect over native (no
Bumps that are net improvements
Consistency
Analyze/CodeQL and |
66ca636 to
bc67f3e
Compare
Dependency bump review — no findingsReviewed per Breaking changes called out upstream — all verified non-applicable
Fixes we actually benefit from
Log / secret-leak check (REVIEW.md rule 1)Nothing new is printed. Two changes move in the right direction:
Notes, not blockers
At review time |
bc67f3e to
737b477
Compare
Dependency bump review — reviewed, no blocking findingsAll four changed files are Per ClickHouse/clickhouse-go v2.47.0 → v2.48.0 (most impactful dep here)
opentelemetry-go 1.44.0 → 1.45.0 (+ contrib 0.69.0 → 0.70.0)
google.golang.org/grpc 1.82.1 → 1.83.0Contains a security hardening: the server stops reading from connections flooded with queued non-DATA/HEADERS HTTP/2 frames (default 100, tunable via twpayne/go-geos 0.21.0 → 0.22.0Four commits. The relevant one: Smaller ones
One housekeeping noteThe PR body table is stale relative to the diff (it lists |
🔄 Flaky Test DetectedAnalysis: Flaky infrastructure failure: two matrix jobs failed with a transient HTTP 503 from GitHub releases while curl-downloading the Tilt binary in the "Install Tilt" step, so no tests ever ran (the third matrix job on the same commit passed). ✅ Automatically retrying the workflow |
🔄 Flaky Test DetectedAnalysis: TestApiPg/TestResyncWithSnapshotConfigOnPausedPipe timed out after 3 minutes waiting for the terminated flow to be dropped (api_test.go:1851) in only the pg16 matrix job, while the same test passed in the pg17/pg18 jobs and for the MySQL/Maria/Mongo source variants within the failing job — a timing/infra flake on a Renovate dependency-bump PR, not a code regression. ✅ Automatically retrying the workflow |
ba40d89 to
d00e2d1
Compare
Renovate bump review — no findingsReviewed every bumped module against its upstream release notes / commit log for the exact bumped range. There are breaking changes upstream, but none of them touch code paths PeerDB uses. Details below so the analysis is auditable. clickhouse-go v2.47.0 → v2.48.0 (direct, both
|
Dependency bump review — no regressions foundReviewed per I read the upstream release notes and commit logs for the bumped ranges of the direct dependencies with real surface area here, checked the remainder against their changelogs, and traced each behavior change back to how this repo actually uses the library. Nothing found that warrants blocking. Details below for the non-trivial ones. clickhouse-go v2.47.0 → v2.48.0 (largest change in this PR)
opentelemetry-go v1.44.0 → v1.45.0 + contrib v0.69.0 → v0.70.0
grpc-go v1.82.1 → v1.83.0New server-side HTTP/2 frame-flood mitigation: the server stops reading a connection past 100 pending non-DATA/non-HEADERS frames, tunable via grpc-gateway v2.29.0 → v2.30.0Verified generator-only: comparing the pgvector-go v0.4.0 → v0.4.1 — net win for usA real reliability improvement on a hot path. go-geos v0.21.0 → v0.22.0Two behavior-bearing changes: Remaining bumps — routine, no impact
Build/lint/e2e verification is left to CI; the Go toolchain was not runnable in this review environment. |
d00e2d1 to
6980ebc
Compare
|
Dependency-bump review ( Reviewed per Notable upstream changes, and why they do not bite us ClickHouse/clickhouse-go v2.47.0 → v2.48.0 — the release has a documented breaking change to the
opentelemetry-go v1.44.0 → v1.45.0 — the breaking change is twpayne/go-geos v0.21.0 → v0.22.0 — otelgrpc v0.69.0 → v0.70.0 — semconv bumped to v1.42/v1.43, and grpc-go v1.82.1 → v1.83.0 — adds HTTP/2 control-frame flood backpressure: the transport stops reading when more than 100 pending frames (excluding DATA/HEADERS) accumulate. Tunable via pgvector-go v0.4.0 → v0.4.1 — fixes panics in grpc-gateway v2.29.0 → v2.30.0 — runtime bump only. Low-risk remainder — elasticsearch v8.19.7 (typed-API spec sync + test fix), temporal api v1.63.5 (additive proto fields/enums), aws-sdk Other checks
|
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. Upstream regression check (per
|
| Library | Range | Relevant upstream change | Impact |
|---|---|---|---|
ClickHouse/clickhouse-go/v2 |
v2.47.0 → v2.48.0 | #1928 adds QueryFormat/InsertFormat to driver.Conn — flagged breaking |
Breaks implementers only; PeerDB is a pure consumer (no mocks/wrappers implement clickhouse.Conn). Parameter-binding changes (#1894, #1892, #1897, #1899) do not apply — PeerDB builds SQL as strings and passes zero bind args. #1910 (structured *clickhouse.Exception over HTTP) strictly helps isRetryableException in flow/pkg/clickhouse/query_retry.go. |
twpayne/go-geos |
v0.21.0 → v0.22.0 | #243 NewGeometryCollection ownership change, #244 ReleaseCollection, #245 re-enable GEOS_USE_ONLY_R_API |
PeerDB only calls NewGeomFromWKB/NewGeomFromWKT/IsValidReason/ToWKT/ToWKB/SRID. The "drop GEOS < 3.12.1" change landed in v0.21.0, not this range. |
pgvector/pgvector-go |
v0.4.0 → v0.4.1 | Bug-fix only: panics in Parse / DecodeBinary turned into errors |
Improvement for the Vector/HalfVector/SparseVector decode paths in the Postgres connector. |
go.opentelemetry.io/otel* |
v1.44.0 → v1.45.0 | otel/log Kind/Value/KeyValue removed (#8490); WithEndpointURL no longer appends the default signal path (#8538) |
PeerDB does not use the OTel logs SDK and does not call WithEndpointURL — exporters are built with only WithMaxRequestSize(0) and rely on OTEL_EXPORTER_OTLP_* env vars, whose behaviour is unchanged. |
otelgrpc |
v0.69.0 → v0.70.0 | #8904 prefers dial target over resolved peer IP for server.address/server.port |
Client-instrumentation only; PeerDB uses otelgrpc.NewServerHandler. |
google.golang.org/grpc |
v1.82.1 → v1.83.0 | Mostly xDS/ALTS work; #9231 re-adds redacted metadata.MD.String() |
None of xDS, ALTS, or MD.String are used. |
grpc-gateway/v2 |
v2.29.0 → v2.30.0 | #7192, #7191, #7180 | All in the protoc plugin / codegen templates, not the runtime package PeerDB imports. |
spiffe/go-spiffe v2.7.0, felixge/httpsnoop v1.1.0, go-openapi/swag v0.28.0 (jsonpointer/jsonreference v1.0.0) |
indirect | — | No direct imports under flow/; pulled in via k8s.io/apimachinery/kube-openapi. jsonpointer/jsonreference v0.x → v1.0.0 is a legitimate v0→v1 promotion, so the unsuffixed module path is correct. |
AWS SDK (rds/auth, kms, ses), genproto, go.temporal.io/api v1.63.5, elastic/go-elasticsearch v8.19.7, cel.dev/expr, moby/moby/client, andybalholm/brotli, go.yaml.in/yaml/v3 are patch-level with no API surface changes affecting this repo.
One note, not a defect: go.yaml.in/yaml/v3 v3.0.4 is dropped from flow/pkg/go.mod while flow/go.mod bumps it to v3.0.5. These are independent main modules with separate build lists, and the stale v3.0.4 lines left in flow/pkg/go.sum are harmless — only missing go.sum entries break go build/go mod verify.
6980ebc to
e2d2580
Compare
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| google.golang.org/grpc v1.82.1 | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d | ||
| google.golang.org/grpc v1.83.0 |
There was a problem hiding this comment.
grpc-go v1.83.0 substantially widens what counts against the HTTP/2 control-buffer read throttle.
This is the one behavioural change in the bump with production blast radius. In internal/transport/controlbuf.go the marker was inverted:
- v1.82.1:
isTransportResponseFrame()returned true only for items that produce a RST_STREAM (cleanupStream{rst:true},headerFramewithcleanup.rst), against a hardcodedmaxQueuedTransportResponseFrames = 50. In practice almost nothing counted. - v1.83.0: every control-buffer item now embeds
throttledItemexceptclientHeaders,serverHeadersanddataFrame. SoincomingWindowUpdate,outgoingWindowUpdate,registerStream,ping,incomingSettings/outgoingSettings,goAwayandcleanupStream(rst or not) all count, againstmaxQueuedControlBufferItems = envconfig.ControlBufferThrottleLimit(default 100).
controlBuf.throttle() is called from the reader loop of both http2_server.go and http2_client.go, so it applies to the gRPC API server (flow/cmd/api.go:240) and to client transports, including flow worker connections to Temporal.
Failure scenario: a connection streaming large payloads (activity results, workflow histories, or a busy API server) where the loopy writer is momentarily blocked on a backpressured socket. Incoming DATA keeps generating incomingWindowUpdate/outgoingWindowUpdate items; once more than 100 are queued the reader loop stops reading that connection until the queue drains. That surfaces as latency spikes or apparent stalls rather than errors, so no test will catch it — it shows up in production tail latency.
Upstream ships this as a flood / resource-exhaustion mitigation, so keeping it is right. Noting the escape hatch in case worker-to-Temporal latency regresses after deploy: GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT (1-10000, default 100). Upstream marks that env var as temporary, so it is a stopgap rather than a long-term knob.
Also in v1.83.0: an ALTS panic fix on malformed frames, plus xDS/RBAC fixes (not used here). v1.83.0 is the latest release with no follow-up patch, and it has cleared the Renovate minimum release age.
The rest of the bump set was read against upstream notes and commit logs, and is clean: otel 1.45 / contrib 0.70 breaking removals are confined to otel/log, sdk/log/logtest and otelgrpc.WithSpanOptions (none used — we use NewServerHandler + WithMeterProvider), and the new attribute.MAP kind hits no exhaustive attribute.Kind switch in flow/; go-geos 0.22 changes WKBReader.Read to pass the Go slice pointer straight to C (cgo-safe, GEOS does not retain it) and reworks collection ownership, but we only call NewGeomFromWKB/NewGeomFromWKT and the MySQL path already guards len(data) <= 4; pgvector-go 0.4.1 is a straight win (fixes panics in Parse/DecodeBinary on malformed vectors); grpc-gateway 2.30 touches only the openapiv2/v3 generators, not the imported runtime; go-openapi jsonpointer/jsonreference v1.0.0 are API-stability pledges with no code change, and swag 0.26-0.28 are additive with swag/jsonname folded into jsonpointer (hence the jsonname line dropping and pools appearing); the three aws-sdk-go-v2 bumps are Dependency Update only, with smithy-go correctly staying at v1.27.6; temporal api 1.63.5 is additive-only per upstream; go-elasticsearch 8.19.7 is typed-API regeneration; go-spiffe 2.7 tightens X509-SVID verification but is reachable only transitively via go-control-plane; httpsnoop 1.1.0 adds deadline / full-duplex support and is consumed only by otelhttp. No bumped dependency adds log output carrying credentials or PII — two of them remove existing noise (otel no longer logs trace-exporter endpoint config, clickhouse-go removes a stray HTTP compression debug print).
| github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/eventhub/armeventhub v1.3.0 | ||
| github.com/ClickHouse/ch-go v0.74.0 | ||
| github.com/ClickHouse/clickhouse-go/v2 v2.47.0 | ||
| github.com/ClickHouse/clickhouse-go/v2 v2.48.0 |
There was a problem hiding this comment.
clickhouse-go v2.48.0 is tagged as a breaking change upstream — verified PeerDB is not exposed. No action needed; recording the check so it does not have to be re-derived.
Upstream flags #1928 (arbitrary input/output formats) as "breaking change if you depend on the driver.Conn interface". Nothing in this repo implements clickhouse.Conn/driver.Conn — it is only consumed (connectors/clickhouse/clickhouse.go:32,199, pkg/clickhouse/query_retry.go), and adding methods to an interface only breaks implementers. The passing CodeQL Go build confirms it.
The other semantic changes in 2.48.0 all sit in query parameter binding: floats now bound as typed Float literals (#1894), bools rendered true/false (#1892), Map string-key escaping (#1897), fully timezone-aware time formatting (#1904). Every production ClickHouse call goes through peerdb_clickhouse.Exec/Query/QueryRow with no bind args (queries are string-built), so none of those paths are reachable.
Two things worth keeping an eye on:
- #1944 makes
Scanreturn errors when scanning a Tuple into a map, instead of silently succeeding. Production does not scan tuples, but if a ClickHouse e2e assertion does, this bump is what changed its behaviour. - #1902 replaces
resources.ClientMeta.IsSupportedClickHouseVersionwith a plainproto.CheckMinVersion(resources.MinSupportedVersion, ...). It only affects the "unsupported clickhouse version" warn log, but it also drops the clickhouse-go yaml dependency — that is whygo.yaml.in/yaml/v3disappears fromflow/pkg/go.modin this diff. Expected, not an accidental removal; it stays inflow/go.mod, bumped to 3.0.5 via other deps.
The remaining 2.48.0 changes are HTTP-protocol-only (structured exceptions #1910, the formats work, and removal of a stray HTTP compression debug print), and Connect uses the default native protocol, so they do not apply. ch-go is already at the 0.74.0 that 2.48.0 wants, so no follow-up bump is needed.
🔄 Flaky Test DetectedAnalysis: TestApiPg/TestResyncWithSnapshotConfigOnPausedPipe timed out waiting for the resynced ClickHouse table to reach 2 rows (stuck at 1) on only the pg16/ch-lts matrix leg, while the same test passed on pg17 and pg18 for the identical commit — a convergence-timeout flake, not a regression from this Renovate gomod bump. ✅ Automatically retrying the workflow |
Renovate dependency bump reviewScope is Per
Two minor observations, neither actionable:
LGTM. |
a105932 to
db8c5ad
Compare
| github.com/testcontainers/testcontainers-go v0.43.0 | ||
| github.com/twmb/franz-go v1.21.5 | ||
| github.com/stretchr/testify v1.12.0 | ||
| github.com/testcontainers/testcontainers-go v0.44.0 |
There was a problem hiding this comment.
testcontainers-go v0.43.0 → v0.44.0 — this one does change runtime output in our CI. Highest-impact behaviour change in the PR.
#3459 inverts the default logger:
-var defaultLogger Logger = &noopLogger{}
+var defaultLogger Logger = log.New(os.Stderr, "", log.LstdFlags)
- if strings.EqualFold(arg, "-test.v=true") || strings.EqualFold(arg, "-v") {
- defaultLogger = log.New(os.Stderr, "", log.LstdFlags)
+ if strings.EqualFold(arg, "-test.v=false") {
+ defaultLogger = NewNoopLogger()Before: logging was on only for a literal -test.v=true / -v. After: on unless -test.v=false.
Our CI runs tests through gotestsum (.github/workflows/tilt-flow.yml:576), which invokes go test -json — that passes -test.v=test2json to the test binary, matching neither old trigger. So testcontainers was silent in CI before this bump and will now write container lifecycle lines to stderr for the MySQL/MariaDB containers in flow/e2e/mysql.go.
I checked this against .claude/REVIEW.md rule 1 (no new output that can carry secrets), since that container request carries MYSQL_ROOT_PASSWORD/MARIADB_ROOT_PASSWORD (CI_MYSQL_ROOT_PASSWORD, flow/internal/test_env.go:140) and the wait.ForSQL probe builds a DSN embedding root:<password>. It is clean: every Logger.Printf in docker.go at v0.44.0 formats only image names, container IDs, and registry/auth-absence notices — the Env map is never logged, and wait/sql.go neither logs the URL nor includes it in its Description(). The residual exposure would be a wait-retry error string echoing the DSN, which go-sql-driver/mysql does not do.
Net effect: noisier e2e logs, no credential leak. If the extra noise is unwanted, pass -test.v=false or set an explicit noop logger in the e2e helper.
Also in range and useful for us: exec exit code now read only after draining output (#3766), Ryuk startup properly awaited when reusing the reaper (#3761), and container names escaped in the Docker name filter (#3837) — all three are plausible flake sources in the current e2e setup.
| github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/eventhub/armeventhub v1.3.0 | ||
| github.com/ClickHouse/ch-go v0.74.0 | ||
| github.com/ClickHouse/clickhouse-go/v2 v2.47.0 | ||
| github.com/ClickHouse/clickhouse-go/v2 v2.48.0 |
There was a problem hiding this comment.
clickhouse-go v2.47.0 → v2.48.0 — upstream declares a breaking change; verified not hit here.
Release notes flag #1928 (arbitrary input/output formats) as a breaking change if you depend on the driver.Conn interface. This repo only ever consumes clickhouse.Conn (flow/connectors/clickhouse/clickhouse.go:199, plus flow/pkg/clickhouse/query_retry.go and validation.go) and never implements it, so the interface widening is source-compatible here.
Other behaviour changes in this range and their applicability:
- Query-parameter binding changed: floats now bind as typed
Floatliterals (#1894), bools render astrue/false(#1892),Mapstring-key escaping fixed (#1897). PeerDB builds ClickHouse SQL withfmt.Sprintf, and theargs ...anypass-through inflow/pkg/clickhouse/query_retry.gohas no float/bool/map call sites, so no bound-parameter rendering changes. Scanon Tuple-to-map now returns errors instead of silently succeeding (#1944). AllScantargets inflow/connectors/clickhouseandflow/pkg/clickhouseare scalars/strings, so no previously-swallowed error becomes a new failure.- Structured HTTP exceptions (#1910) and the stray HTTP-compression debug print removal (#1937) are HTTP-protocol only;
Connectsets noProtocol, so the native protocol is used. Error classification inflow/alerting/classifier.gokeys off*clickhouse.Exception.Coderather than message text, so the exception-parser rework is not observable there.
No action needed — noting it so the driver.Conn warning in the changelog is not mistaken for an unaddressed break.
| go.temporal.io/api v1.63.4 | ||
| go.temporal.io/sdk v1.47.0 | ||
| go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0 | ||
| go.opentelemetry.io/otel v1.45.0 |
There was a problem hiding this comment.
opentelemetry-go v1.44.0 → v1.45.0 — four breaking changes upstream; none reachable, but one is a latent trap.
Upstream breaking changes and their applicability:
otel/loglosesKind/Value/KeyValueand their constructors, and log bodies/attrs move toattribute.Value(#8490);sdk/log/logtestRecordFactoryloses its attribute-limit fields (#8556). The OTel logs SDK is not used here (metrics + traces only), so no impact.⚠️ The trap:WithEndpointURLinotlpmetrichttp/otlptracehttpno longer appends the default signal path when the URL has no path — it now uses/(#8538). That would silently POST metrics to the wrong path. We are safe only becauseflow/otel_metrics/otel_manager.go:795constructs exporters asotlpmetrichttp.New(ctx, otlpmetrichttp.WithMaxRequestSize(0))and letsOTEL_EXPORTER_OTLP_*_ENDPOINTdrive the endpoint. Anyone addingWithEndpointURLlater needsurl.JoinPath(endpoint, "/v1/metrics")to keep pre-1.45 behaviour.
WithMaxRequestSize(0) — added in 1.44, and the subject of the comment above that call — is untouched in 1.45.
Two fixes in range that are relevant to us: exporter endpoint configuration is no longer included in internal SDK logs (#8438), reducing the chance of an endpoint-embedded credential reaching logs (rule 1); and Retry-After is finally parsed as seconds rather than nanoseconds (#8383) plus HTTP-date support (#8417) — so OTLP HTTP export retry backoff will behave very differently (correctly) against a collector that returns Retry-After.
| google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d | ||
| google.golang.org/grpc v1.83.0 |
There was a problem hiding this comment.
grpc-go v1.82.1 → v1.83.0 — new server-side default that changes behaviour under load.
Security hardening in this release: the server now stops reading from a connection when flooded with HTTP/2 frames, with a default limit of 100 frames (excluding DATA and HEADERS), tunable via GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
This applies to gRPC servers, so it lands on the flow-api gRPC server, not on our Temporal or other outbound gRPC clients. Risk is low — flow-api serves comparatively low-frequency UI/API calls rather than bulk data (replication traffic goes over the native DB protocols, and the OTLP exporter is a client) — but it is a new backpressure path that did not exist in 1.82.1. Worth knowing the env var exists if flow-api ever shows unexplained stalls on connections with many concurrent streams.
The rest of the release is xDS/ALTS RBAC panic and fail-open fixes (unused paths here) plus a Plan 9 build fix.
| golang.org/x/sync v0.22.0 | ||
| golang.org/x/text v0.40.0 | ||
| golang.org/x/tools v0.48.0 | ||
| golang.org/x/text v0.41.0 |
There was a problem hiding this comment.
golang.org/x/text v0.40.0 → v0.41.0 — security fix, argues for merging.
The single functional commit in this range fixes CVE-2026-56851 (golang/go#80112): the secure/precis Nickname profile wrote an interior space to the destination buffer without first checking there was room for both the space and the next rune, so a short destination could cause out-of-bounds writes or incomplete copies. It now returns transform.ErrShortDst.
Reached only transitively here, but it is a memory-safety fix in a text-transform path, so it argues for merging rather than holding this PR.
| golang.org/x/net v0.57.0 // indirect | ||
| go.yaml.in/yaml/v3 v3.0.5 // indirect | ||
| golang.org/x/mod v0.39.0 // indirect | ||
| golang.org/x/net v0.58.0 // indirect |
There was a problem hiding this comment.
golang.org/x/net v0.57.0 → v0.58.0 (indirect) — one silent behaviour change in proxy resolution.
http/httpproxy: prioritize lowercase proxy environment variables. If a deployment sets both HTTP_PROXY and http_proxy (or the HTTPS_/NO_ pairs) to different values, the winner changes after this bump. Anything reaching an external endpoint through net/http in a proxied environment — S3/KMS/SES, BigQuery, Snowflake, Elasticsearch, Slack alerts, OTLP HTTP export — resolves its proxy through this package. Not a code change we need to make; just a deploy-config edge case to be aware of if a customer environment sets both casings inconsistently.
Also in range: dns/dnsmessage gained a boundary check in unpackSVCBResource, where a malformed record header length could exceed the buffer and cause an out-of-bounds slice on the second-pass copy — a memory-safety fix. The remaining commits are quic and internal/http3 work (HTTP/3 server deadlines, keep-alive busy-loop, Config.Clone on nil), none of which this repo uses.
| github.com/stretchr/testify v1.11.1 | ||
| github.com/testcontainers/testcontainers-go v0.43.0 | ||
| github.com/twmb/franz-go v1.21.5 | ||
| github.com/stretchr/testify v1.12.0 |
There was a problem hiding this comment.
testify v1.11.1 → v1.12.0 — test-only, but one change degrades CI failure triage.
#1646 makes assert/require truncate very long objects in failure messages. The e2e suites here diff whole row sets, and per .claude/CLAUDE.md failure traces are what land in ci_peerdb_test_runs.reason — so expect less detail in exactly the output used to debug failing branches. Nothing to fix in this PR; just be aware that a thinner reason column after this merge is the dependency, not a change on our side.
Other changes checked and not applicable: the suite method-signature validation (#1665) and the SetupTest-skip panic fix (#1877) need testify/suite, which this repo does not use; the mock argument-matching revert (#1786) and AssertExpectationsForObjects panic fix (#1795) need testify/mock, also unused. *AssertionFunc types becoming plain aliases (#1563) is source-compatible for callers.
This is also what drops github.com/pmezard/go-difflib from both go.mod files — testify vendored it (#1708), so that removal is expected rather than a lost dependency.
| go.opentelemetry.io/otel/sdk/metric v1.45.0 | ||
| go.opentelemetry.io/otel/trace v1.45.0 | ||
| go.temporal.io/api v1.63.5 | ||
| go.temporal.io/sdk v1.48.0 |
There was a problem hiding this comment.
temporal sdk v1.47.0 → v1.48.0 — no breaks; one fix lands directly on a PeerDB failure mode.
Relevant fix: #2513 prevents workflow task failures when an activity with a custom activity ID completes while its cancellation command is still pending. Given how much of the CDC/QRep orchestration cancels and restarts activities, this is a genuine stability improvement rather than a neutral bump.
Compatibility checked: v1.48.0 adds a reworked go.temporal.io/sdk/interceptor/tracing that backs the new contrib/opentelemetry-v2 module and is explicitly not span-compatible with the v1 tracing interceptor. This PR keeps go.temporal.io/sdk/contrib/opentelemetry v0.8.1 (v1) pinned and unchanged, so emitted span shapes and parenting do not change — no dashboard or trace-query breakage. go.temporal.io/api v1.63.5 is additive-only (adds WORKFLOW_TASK_FAILED_CAUSE_REQUEST_TOO_LARGE, no enum renumbering).
| github.com/twmb/franz-go/plugin/kslog v1.0.0 | ||
| github.com/twpayne/go-geos v0.21.0 | ||
| github.com/urfave/cli/v3 v3.10.1 | ||
| github.com/twpayne/go-geos v0.22.0 |
There was a problem hiding this comment.
go-geos v0.21.0 → v0.22.0 — ownership-semantics change with a CGO double-free flavour; verified not reachable.
There is no GitHub release for this tag; the only functional commits in the range are feat: make NewGeometryCollection take ownership of unowned geoms and feat: support ReleaseCollection. Ownership transfer on a CGO-backed geometry type is exactly the kind of change that turns previously-correct caller code into a use-after-free or double-free.
Not reachable here: all call sites use only the NewGeomFrom* constructors — NewGeomFromWKB (flow/shared/datatypes/geo.go:19, flow/connectors/mysql/qvalue_convert.go:164), NewGeomFromWKT (flow/shared/datatypes/geo.go:39, flow/model/qvalue/equals.go:255 and :267), NewGeomFromGeoJSON (flow/connectors/cockroachdb/changefeed.go:876). NewGeometryCollection and ReleaseCollection are unused repo-wide. Worth remembering if geometry-collection construction is ever added.
| github.com/orcaman/concurrent-map/v2 v2.0.1 | ||
| github.com/pgvector/pgvector-go v0.4.0 | ||
| github.com/pgvector/pgvector-go/pgx v0.4.0 | ||
| github.com/pgvector/pgvector-go v0.4.1 |
There was a problem hiding this comment.
pgvector-go v0.4.0 → v0.4.1 — real robustness win for CDC, worth calling out.
No GitHub release for this tag; the commit log for the range is almost entirely "Fixed panics with Parse methods" (#29), "Fixed panics with DecodeBinary methods", and added length/validation checks for SparseVector and NewSparseVectorFromMap.
That matters here because these decode paths run on input we do not control — vector column values coming off a customer Postgres. Previously a malformed or truncated vector/sparsevec payload could panic inside the decoder rather than surface as an error; now it errors. Good bump to take.
| github.com/aws/aws-sdk-go-v2/config v1.32.37 | ||
| github.com/aws/aws-sdk-go-v2/credentials v1.19.36 | ||
| github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.37 | ||
| github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.14 |
There was a problem hiding this comment.
aws-sdk-go-v2 s3 stack — two fixes worth knowing, plus one note on where Renovate stopped.
feature/s3/transfermanagerv0.3.10 → v0.3.14 fixes a real leak: "Close each file transferred during directory upload/download to avoid leaking file handles" (v0.3.14). Relevant for long-running avro staging uploads.service/s3v1.106.5 → v1.107.2 carries "Forward the original response body Closer in S3 200-error handling instead of wrapping it inio.NopCloser, to avoid issues with TCP connection reuse (observed on CompleteMultipartUpload)" — directly on the multipart path used for staging.- Core
aws-sdk-go-v2v1.43.5 fixes a recorded clock skew persisting on the client even after client and server clocks realign.
Note for whoever merges: upstream service/s3 v1.107.3 extends the "error inside an HTTP 200 response" detection (wave 2/4) and is not in this PR — the renovate/stability-days gate held it back. Not a blocker, it will arrive in the next sweep.
No API-shape changes across these ranges; the s3 bump is a minor only because of an unrelated AWS Backup access-point feature (v1.107.0).
Renovate bump review — summaryReviewed per The three that actually change behaviour for us
Declared-breaking upstream, verified not reachable: Security fixes carried in: CVE-2026-56851 in Robustness fixes on paths we exercise: Checked and clean, no note needed:
CI was still pending when I reviewed, so compile-level verification of the bumps rests on |
|
One correction to the last line of my summary, since it affects how you read the yaml deps: the The Worth noting as a supply-chain direction: this bump moves the testify yaml path from the actively-maintained |
db8c5ad to
010edf1
Compare
Renovate gomod bump — reviewed, looks clean ✅Automated review per Verdict No regressions found that affect how PeerDB uses these libraries. Breaking changes upstream — checked, none apply
Also confirmed no impact from the Fixes worth having
Minor notes (no action needed)
|
010edf1 to
d372d56
Compare
Renovate gomod bump — reviewedReviewed every module bump in Secrets / PII in output (REVIEW.md rule 1)No new stdout/stderr or log output is introduced. If anything it moves the other way: clickhouse-go v2.48.0 removes a stray HTTP-compression debug print, and the unsupported-server-version warning in its Regression review of the notable bumps
Three other changes in the same release that I checked and cleared:
The rest — Note (pre-existing, not introduced by this PR)
CI at review time
|
d372d56 to
05eae0c
Compare
| github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/eventhub/armeventhub v1.3.0 | ||
| github.com/ClickHouse/ch-go v0.74.0 | ||
| github.com/ClickHouse/clickhouse-go/v2 v2.47.0 | ||
| github.com/ClickHouse/clickhouse-go/v2 v2.48.0 |
There was a problem hiding this comment.
clickhouse-go v2.48.0 raises the driver's declared minimum ClickHouse server from ~22.11 to 25.8.0.
v2.48.0 deletes resources/meta.yml and Meta.IsSupportedClickHouseVersion and replaces them with a hardcoded resources.MinSupportedVersion = {25, 8, 0}. conn.dial now does proto.CheckMinVersion(resources.MinSupportedVersion, ...), where v2.47.0 checked against a version list whose greatest entry was 22.11.
Impact is log-only — a Warn("unsupported clickhouse version") on the first connection in the pool, no error — and CI is unaffected since .github/workflows/flow.yml:64 pins LTS at 25.8.28.1. But PeerDB deliberately supports older servers: connectors/clickhouse/staging_s3.go:73-85 gates S3 session tokens on >= 24.3.1, and model/qvalue/kind.go:121 gates JSON on >= 25.3. Self-hosted users on 23.x/24.x will now see this warning on every connector startup. Worth deciding whether to suppress it or raise PeerDB's own documented ClickHouse floor.
The rest of the 2.47→2.48 delta I checked and it is clear for this repo:
driver.ConngainedQueryFormat/InsertFormat; upstream flags this as a breaking change for implementers. Every use here consumes the interface (clickhouse.go:32,199,270,pkg/clickhouse/*,e2e/clickhouse.go:404) and no type implements it, so no compile break.bind.go/query_parameters.gowere substantially rewritten: floats now render ascast(x, 'Float64')for client-side binding, and server-side{name:Type}parameters now send times as epoch, nil as\N, bools astrue/false, and maps as{'k':v}. No impact — every ClickHouse statement in this repo is built withfmt.Sprintfand passes zero bind args (the oneQuerycall with a dynamic query,clickhouse.go:479, passes none).lib/column/tuple.goscannow returns the error it previously swallowed (return reflect.Value{}, nil→err). Only reachable when scanning a Tuple into a Go map, which this repo does not do.
| google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d | ||
| google.golang.org/grpc v1.83.1 |
There was a problem hiding this comment.
grpc-go v1.83.0 turns on a server-side HTTP/2 control-frame throttle by default.
From the v1.83.0 release notes:
server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable
GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
PeerDB runs gRPC servers (flow/cmd/api.go), so this applies to the flow API. It is a security hardening fix and the default is unlikely to affect normal traffic, but it does change read behaviour under load: a peer that accumulates more than 100 pending non-DATA/non-HEADERS frames (SETTINGS / WINDOW_UPDATE / PING / RST_STREAM bursts from many concurrent streams) will have its connection reads paused. Flagging so the env-var escape hatch is known if anyone reports API stalls after this ships.
v1.83.1 on top is xds/RBAC matcher hardening (xds is not used here) plus a transport fix restricting memory overhead when buffering small DATA frames — both safe.
| github.com/stretchr/testify v1.11.1 | ||
| github.com/testcontainers/testcontainers-go v0.43.0 | ||
| github.com/twmb/franz-go v1.21.5 | ||
| github.com/stretchr/testify v1.12.1 |
There was a problem hiding this comment.
testify v1.12.0 truncates very long objects in assertion failure messages (stretchr/testify#1646).
Worth knowing because the e2e suites assert on whole row sets — failure output that previously dumped the full value will now be cut off, making CI failures harder to diagnose from logs alone. No correctness impact, just diagnosability.
Everything else in the v1.11.1→v1.12.1 range is benign here:
*AssertionFunctypes became plain aliases — source-compatible.suitenow validatesTest*method signatures and continues with the valid ones instead of aborting the suite.mockreverted to pre-v1.11.0 argument matching for mutating stringers, and no longer panics on nil expected types.- v1.12.1 swaps
gopkg.in/yaml.v3forgo.yaml.in/yaml/v3and vendors go-difflib/go-spew. That is what dropsgopkg.in/yaml.v3andpmezard/go-difflibfrom the indirect blocks in bothflow/go.modandflow/pkg/go.mod— no first-party file imports either package, so the removals are correct.
|
Renovate gomod bump — dependency regression review No code changes in this PR, so nothing to check against the stdout/stderr/log PII-and-secrets rule. Per CI note: Checked and clear
|
05eae0c to
f7b23fe
Compare
Dependency bump review — no regressions foundReviewed per I read the upstream release notes/commit logs for the bumped ranges. Four bumps carry upstream breaking changes; I checked each against actual usage in this repo and all land in code paths PeerDB does not use:
Other bumps I specifically vetted:
One non-blocking heads-up:
🤖 Generated with Claude Code |
1 participant
This PR contains the following updates:
v2.47.0→v2.48.0v1.43.4→v1.43.6v1.32.35→v1.32.37v1.19.34→v1.19.36v1.6.33→v1.6.37v0.3.10→v0.3.14v1.55.2→v1.55.6v1.106.5→v1.107.2v1.37.2→v1.37.6v1.45.4→v1.45.6v1.27.6→v1.27.8v8.19.6→v8.19.7v2.29.0→v2.30.0v0.4.0→v0.4.1v0.4.0→v0.4.1v0.27.0→v0.29.0v1.11.1→v1.12.1v0.43.0→v0.44.0v1.21.5→v1.21.6v0.21.0→v0.22.0v3.10.1→v3.11.0v0.69.0→v0.70.0v1.44.0→v1.45.0v1.44.0→v1.45.0v1.44.0→v1.45.0v1.44.0→v1.45.0v1.44.0→v1.45.0v1.44.0→v1.45.0v1.44.0→v1.45.0v1.44.0→v1.45.0v1.63.4→v1.63.5v1.47.0→v1.48.0v0.54.0→v0.55.0v0.40.0→v0.41.0v0.48.0→v0.49.0v1.82.1→v1.83.1v1.36.12-0.20260120151049-f2248ac996af→v1.36.12Release Notes
ClickHouse/clickhouse-go (github.com/ClickHouse/clickhouse-go/v2)
v2.48.0Compare Source
What's Changed
Enhancements 🚀
driver.Conninterface. By @kavirajk in #1928Bug fixes 🐛
formatValuehelper for complex types by @kavirajk in #1899Other Changes 🛠
safeLen()linear runtime in exception parser by @kavirajk in #1949New Contributors
Full Changelog: ClickHouse/clickhouse-go@v2.47.0...v2.48.0
aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)
v1.43.6v1.43.5Compare Source
General Highlights
Module Highlights
github.com/aws/aws-sdk-go-v2: v1.41.5github.com/aws/aws-sdk-go-v2/service/accessanalyzer: v1.45.12github.com/aws/aws-sdk-go-v2/service/account: v1.30.5github.com/aws/aws-sdk-go-v2/service/acm: v1.37.23github.com/aws/aws-sdk-go-v2/service/acmpca: v1.46.12github.com/aws/aws-sdk-go-v2/service/aiops: v1.6.21github.com/aws/aws-sdk-go-v2/service/amp: v1.42.9github.com/aws/aws-sdk-go-v2/service/amplify: v1.38.14github.com/aws/aws-sdk-go-v2/service/amplifybackend: v1.32.20github.com/aws/aws-sdk-go-v2/service/amplifyuibuilder: v1.28.20github.com/aws/aws-sdk-go-v2/service/apigateway: v1.39.1github.com/aws/aws-sdk-go-v2/service/apigatewaymanagementapi: v1.29.14github.com/aws/aws-sdk-go-v2/service/apigatewayv2: v1.34.1github.com/aws/aws-sdk-go-v2/service/appconfig: v1.43.13github.com/aws/aws-sdk-go-v2/service/appconfigdata: v1.23.22github.com/aws/aws-sdk-go-v2/service/appfabric: v1.16.21github.com/aws/aws-sdk-go-v2/service/appflow: v1.51.12github.com/aws/aws-sdk-go-v2/service/appintegrations: v1.37.7github.com/aws/aws-sdk-go-v2/service/applicationautoscaling: v1.41.14github.com/aws/aws-sdk-go-v2/service/applicationcostprofiler: v1.27.12github.com/aws/aws-sdk-go-v2/service/applicationdiscoveryservice: v1.35.13github.com/aws/aws-sdk-go-v2/service/applicationinsights: v1.34.20github.com/aws/aws-sdk-go-v2/service/applicationsignals: v1.19.1github.com/aws/aws-sdk-go-v2/service/appmesh: v1.35.12github.com/aws/aws-sdk-go-v2/service/apprunner: v1.39.14github.com/aws/aws-sdk-go-v2/service/appstream: v1.54.4github.com/aws/aws-sdk-go-v2/service/appsync: v1.53.5github.com/aws/aws-sdk-go-v2/service/arcregionswitch: v1.6.3github.com/aws/aws-sdk-go-v2/service/arczonalshift: v1.22.23github.com/aws/aws-sdk-go-v2/service/artifact: v1.15.5github.com/aws/aws-sdk-go-v2/service/athena: v1.57.4github.com/aws/aws-sdk-go-v2/service/auditmanager: v1.46.12github.com/aws/aws-sdk-go-v2/service/autoscaling: v1.64.4github.com/aws/aws-sdk-go-v2/service/autoscalingplans: v1.30.14github.com/aws/aws-sdk-go-v2/service/b2bi: v1.0.0-preview.100github.com/aws/aws-sdk-go-v2/service/backup: v1.54.11github.com/aws/aws-sdk-go-v2/service/backupgateway: v1.26.3github.com/aws/aws-sdk-go-v2/service/backupsearch: v1.6.23github.com/aws/aws-sdk-go-v2/service/batch: v1.63.2github.com/aws/aws-sdk-go-v2/service/bcmdashboards: v1.1.4github.com/aws/aws-sdk-go-v2/service/bcmdataexports: v1.14.0github.com/aws/aws-sdk-go-v2/service/bcmpricingcalculator: v1.10.9github.com/aws/aws-sdk-go-v2/service/bcmrecommendedactions: v1.1.5github.com/aws/aws-sdk-go-v2/service/bedrock: v1.57.1github.com/aws/aws-sdk-go-v2/service/bedrockagent: v1.52.7github.com/aws/aws-sdk-go-v2/service/bedrockagentcore: v1.15.2github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol: v1.25.1github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime: v1.51.8github.com/aws/aws-sdk-go-v2/service/bedrockdataautomation: v1.13.5github.com/aws/aws-sdk-go-v2/service/bedrockdataautomationruntime: v1.10.4github.com/aws/aws-sdk-go-v2/service/bedrockruntime: v1.50.4github.com/aws/aws-sdk-go-v2/service/billing: v1.10.4github.com/aws/aws-sdk-go-v2/service/billingconductor: v1.28.5github.com/aws/aws-sdk-go-v2/service/braket: v1.39.8github.com/aws/aws-sdk-go-v2/service/budgets: v1.43.4github.com/aws/aws-sdk-go-v2/service/chatbot: v1.14.21github.com/aws/aws-sdk-go-v2/service/chime: v1.41.12github.com/aws/aws-sdk-go-v2/service/chimesdkidentity: v1.27.20github.com/aws/aws-sdk-go-v2/service/chimesdkmediapipelines: v1.26.21github.com/aws/aws-sdk-go-v2/service/chimesdkmeetings: v1.33.15github.com/aws/aws-sdk-go-v2/service/chimesdkmessaging: v1.32.17github.com/aws/aws-sdk-go-v2/service/chimesdkvoice: v1.28.13github.com/aws/aws-sdk-go-v2/service/cleanrooms: v1.42.4github.com/aws/aws-sdk-go-v2/service/cleanroomsml: v1.22.5github.com/aws/aws-sdk-go-v2/service/cloud9: v1.33.20github.com/aws/aws-sdk-go-v2/service/cloudcontrol: v1.29.13github.com/aws/aws-sdk-go-v2/service/clouddirectory: v1.30.12github.com/aws/aws-sdk-go-v2/service/cloudformation: v1.71.9github.com/aws/aws-sdk-go-v2/service/cloudfront: v1.60.4github.com/aws/aws-sdk-go-v2/service/cloudfrontkeyvaluestore: v1.12.24github.com/aws/aws-sdk-go-v2/service/cloudhsm: v1.29.21github.com/aws/aws-sdk-go-v2/service/cloudhsmv2: v1.34.21github.com/aws/aws-sdk-go-v2/service/cloudsearch: v1.32.12github.com/aws/aws-sdk-go-v2/service/cloudsearchdomain: v1.28.20github.com/aws/aws-sdk-go-v2/service/cloudtrail: v1.55.9github.com/aws/aws-sdk-go-v2/service/cloudtraildata: v1.17.13github.com/aws/aws-sdk-go-v2/service/cloudwatch: v1.55.3github.com/aws/aws-sdk-go-v2/service/cloudwatchevents: v1.32.23github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.65.0github.com/aws/aws-sdk-go-v2/service/codeartifact: v1.38.21github.com/aws/aws-sdk-go-v2/service/codebuild: v1.68.13github.com/aws/aws-sdk-go-v2/service/codecatalyst: v1.21.12github.com/aws/aws-sdk-go-v2/service/codecommit: v1.33.12github.com/aws/aws-sdk-go-v2/service/codeconnections: v1.10.20github.com/aws/aws-sdk-go-v2/service/codedeploy: v1.35.13github.com/aws/aws-sdk-go-v2/service/codeguruprofiler: v1.29.20github.com/aws/aws-sdk-go-v2/service/codegurureviewer: v1.34.20github.com/aws/aws-sdk-go-v2/service/codegurusecurity: v1.16.24github.com/aws/aws-sdk-go-v2/service/codepipeline: v1.46.21github.com/aws/aws-sdk-go-v2/service/codestarconnections: v1.35.13github.com/aws/aws-sdk-go-v2/service/codestarnotifications: v1.31.21github.com/aws/aws-sdk-go-v2/service/cognitoidentity: v1.33.22github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider: v1.59.3github.com/aws/aws-sdk-go-v2/service/cognitosync: v1.29.12github.com/aws/aws-sdk-go-v2/service/comprehend: v1.40.21github.com/aws/aws-sdk-go-v2/service/comprehendmedical: v1.31.21github.com/aws/aws-sdk-go-v2/service/computeoptimizer: v1.49.8github.com/aws/aws-sdk-go-v2/service/computeoptimizerautomation: v1.0.8github.com/aws/aws-sdk-go-v2/service/configservice: v1.62.1github.com/aws/aws-sdk-go-v2/service/connect: v1.166.1github.com/aws/aws-sdk-go-v2/service/connectcampaigns: v1.20.20github.com/aws/aws-sdk-go-v2/service/connectcampaignsv2: v1.11.4github.com/aws/aws-sdk-go-v2/service/connectcases: v1.39.1github.com/aws/aws-sdk-go-v2/service/connectcontactlens: v1.33.13github.com/aws/aws-sdk-go-v2/service/connecthealth: v1.0.3github.com/aws/aws-sdk-go-v2/service/connectparticipant: v1.36.7github.com/aws/aws-sdk-go-v2/service/controlcatalog: v1.14.9github.com/aws/aws-sdk-go-v2/service/controltower: v1.28.9github.com/aws/aws-sdk-go-v2/service/costandusagereportservice: v1.34.13github.com/aws/aws-sdk-go-v2/service/costexplorer: v1.63.6github.com/aws/aws-sdk-go-v2/service/costoptimizationhub: v1.22.8github.com/aws/aws-sdk-go-v2/service/customerprofiles: v1.57.2github.com/aws/aws-sdk-go-v2/service/databasemigrationservice: v1.61.10github.com/aws/aws-sdk-go-v2/service/databrew: v1.39.14github.com/aws/aws-sdk-go-v2/service/dataexchange: v1.40.14github.com/aws/aws-sdk-go-v2/service/datapipeline: v1.30.20github.com/aws/aws-sdk-go-v2/service/datasync: v1.58.2github.com/aws/aws-sdk-go-v2/service/datazone: v1.54.2github.com/aws/aws-sdk-go-v2/service/dax: v1.29.16github.com/aws/aws-sdk-go-v2/service/deadline: v1.26.2github.com/aws/aws-sdk-go-v2/service/detective: v1.38.13github.com/aws/aws-sdk-go-v2/service/devicefarm: v1.38.8github.com/aws/aws-sdk-go-v2/service/devopsguru: v1.40.12github.com/aws/aws-sdk-go-v2/service/directconnect: v1.38.15github.com/aws/aws-sdk-go-v2/service/directoryservice: v1.38.16github.com/aws/aws-sdk-go-v2/service/directoryservicedata: v1.7.21github.com/aws/aws-sdk-go-v2/service/dlm: v1.35.16github.com/aws/aws-sdk-go-v2/service/docdb: v1.48.13github.com/aws/aws-sdk-go-v2/service/docdbelastic: v1.20.13github.com/aws/aws-sdk-go-v2/service/drs: v1.36.13github.com/aws/aws-sdk-go-v2/service/dsql: v1.12.8github.com/aws/aws-sdk-go-v2/service/dynamodb: v1.57.1github.com/aws/aws-sdk-go-v2/service/dynamodbstreams: v1.32.14Configuration
📅 Schedule: (in timezone Etc/UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.