Bump the go-dependencies group across 1 directory with 2 updates - #55
Merged
Merged
Conversation
Bumps the go-dependencies group with 2 updates in the / directory: [github.com/go-playground/validator/v10](https://github.com/go-playground/validator) and [github.com/riverqueue/river/rivershared](https://github.com/riverqueue/river). Updates `github.com/go-playground/validator/v10` from 10.30.3 to 10.30.4 - [Release notes](https://github.com/go-playground/validator/releases) - [Commits](go-playground/validator@v10.30.3...v10.30.4) Updates `github.com/riverqueue/river/rivershared` from 0.44.0 to 0.47.0 - [Release notes](https://github.com/riverqueue/river/releases) - [Changelog](https://github.com/riverqueue/river/blob/master/CHANGELOG.md) - [Commits](riverqueue/river@v0.44.0...v0.47.0) --- updated-dependencies: - dependency-name: github.com/go-playground/validator/v10 dependency-version: 10.30.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go-dependencies - dependency-name: github.com/riverqueue/river/rivershared dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
bgentry
approved these changes
Sep 8, 2026
bgentry
left a comment
bgentry
left a comment
Contributor
There was a problem hiding this comment.
🤖 Codex review: Approved after dependency security and compatibility review. No blocking finding identified.
Upgrade
| Package | From | To |
|---|---|---|
github.com/go-playground/validator/v10 |
v10.30.3 |
v10.30.4 |
github.com/riverqueue/river/rivershared |
v0.44.0 |
v0.47.0 |
Reviewed head: c1d5a535dc4a00403456c36d8edeafa03eca162b, against base 2030400e7b6437df5e8315c408fc53f14f60a963.
Indirect changes: mimetype 1.4.13 → 1.4.15, go-urn 1.4.0 → 1.5.0, rivertype 0.44.0 → 0.47.0, x/crypto 0.52.0 → 0.55.0, and x/sys 0.45.0 → 0.47.0.
Security review
- A dedicated read-only security subagent inspected all seven old/new module source diffs; I consolidated its findings and verified compatibility on the exact head. All 14 published module artifacts and their go.mod checksums match the PR base/head using the public Go proxy and checksum database. Canonical origins are unchanged. The x/crypto v0.55.0 upstream tag was independently matched to its proxy origin commit.
- Only go.mod/go.sum change. No module additions/removals, same-version checksum rewrites, forks/replacements, exclusions, main-module Go/toolchain changes, vendoring, or generated project changes.
- Reviewed validator's FQDN length enforcement, RFC 8141 URN validation and translations; rivershared's Go 1.26 modernizations (rivertype source is unchanged); go-urn's parser-state fixes and corresponding generated parser; mimetype's bounded OLE2/ZIP/media parsing; x/crypto's authentication, parsing, concurrency and opt-in SSH APIs; and x/sys's syscall/generated metadata changes. No unexpected process execution, credential discovery, network/init hooks, cgo, or binary download behavior identified. Mimetype 1.4.15 skips the retracted 1.4.14 release with its 32-bit overflow issue.
- Checked upstream release context and all Go vulnerability database reports indexed for changed modules. This group includes a confirmed transitive security fix: x/crypto 0.55.0 fixes GO-2026-6303, concerning SSH source-address restrictions.
Compatibility verification
All checks passed in an isolated checkout; the checkout remains unchanged:
go mod verify— all modules verified.go mod tidy -diff— no changes.GOTOOLCHAIN=go1.26.7 go test ./...— all six packages passed.go test -race ./...— all six packages passed with Go 1.27.0.golangci-lint run— v2.13.1, zero issues.go build ./...andgo vet ./...— passed with Go 1.27.0.go list -deps -test ./...— the only imported x/crypto package is sha3; SSH and OpenPGP are absent.- Required GitHub CI also passed: Linux/amd64 tests on Go 1.26.0 and lint v2.13.1 on Go 1.27.1.
Residual risk and verification limits
- x/crypto 0.55.0 still has GO-2026-6354 and GO-2026-6355, SSH deadlocks fixed in 0.56.0, plus the deprecated OpenPGP advisory GO-2026-5932. These packages are absent from this repository's production-and-test import graph, so they do not block this update. Downstream applications importing them need their own assessment.
- CodeQL reported neutral because its Go and Actions baseline configurations were missing; it could not determine alerts introduced by the PR. govulncheck is not installed locally; the package graph establishes absence of the cited affected packages, rather than claiming a full vulnerability scan.
- Static inspection and repository tests do not exhaustively verify every translation, generated constant, assembly instruction, or platform-specific parser path. No separate dependency fuzzing or RISC-V/32-bit runtime testing was performed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the go-dependencies group with 2 updates in the / directory: github.com/go-playground/validator/v10 and github.com/riverqueue/river/rivershared.
Updates
github.com/go-playground/validator/v10from 10.30.3 to 10.30.4Release notes
Sourced from github.com/go-playground/validator/v10's releases.
Commits
dfe35cfci: Fix the linter version (#1617)facf128feat(translations): add Armenian translations (#1604)961375bdocs: clarify fieldexcludes behavior (#1610)74dd82atest: cover startsnotwith/endsnotwith, RegisterStructValidationMapRules, and ...379edc8chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 (#1612)f9944c5fix: use idiomatic "at most" in English max/lte messages (#1600)67e37d6fix(fqdn): enforce maximum DNS name length (#1603)6b571d1chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.13 to 1.4.15 (#...8455180chore(deps): bump github.com/leodido/go-urn from 1.4.0 to 1.5.0 (#1606)fd8bd3cchore(deps): bump actions/setup-go from 6 to 7 (#1601)Updates
github.com/riverqueue/river/riversharedfrom 0.44.0 to 0.47.0Release notes
Sourced from github.com/riverqueue/river/rivershared's releases.
Changelog
Sourced from github.com/riverqueue/river/rivershared's changelog.
Commits
48c0036Prepare release v0.47.0 (#1370)a65e40dAdd hook to support Pro SQLite driver (#1369)195adebPrepare release v0.46.0 (#1367)0d84f5fAdd back more non-listener coverage forriverdatabasesql(#1368)bed0ed3add pgx listeners to database/sql (#1366)eced75dPrepare version v0.45.0 (#1363)43b2b3cFix SQLite filter used in River UI queue count pane (#1360)664f484Bump the go-dependencies group across 9 directories with 2 updates (#1362)269626bFix periodic state advance on insert error (#1359)f748a5cModernize for Go 1.26 (#1357)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions