[dependabot]

Bumps the go-deps group with 3 updates in the / directory: github.com/jackc/pgx/v5, github.com/quic-go/quic-go and golang.org/x/crypto.

Updates github.com/jackc/pgx/v5 from 5.12.0 to 5.13.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.13.0 (November 11, 2026)

This release adds automatic client certificate reloading and temporal precision metadata for database/sql. It also fixes a panic on malformed server responses, unsafe retries after connection failures, and range encoding. See Changes for client certificate configuration behavior that may affect existing applications.

Security Fixes

• Panic in Rows.Values on malformed server responses (GHSA-w9rp-vfrh-q8vv). A server response containing fewer row values than declared fields could cause an index-out-of-range panic in Rows.Values. It now returns an error and closes the rows when the counts differ, including when there are extra values, matching Rows.Scan validation.

Features

• pgconn: reload client certificates and keys configured through sslcert and sslkey for each TLS certificate request, allowing new connections to pick up rotated credentials without recreating the configuration or restarting the application. Files are still validated during configuration parsing. Relative paths retain their parse-time directory, and reloads follow symlinks (Erin Shepherd)
• stdlib: expose fractional seconds precision for timestamp, timestamptz, time, timetz, and interval through ColumnTypePrecisionScale and database/sql.ColumnType.DecimalSize. These return precision 0, the fractional seconds precision as scale, and ok=true. The scale defaults to 6 when no fractional seconds precision is declared; precision 0 means numeric precision is not applicable (Danny Xu)

Changes

• pgconn: file-backed client certificates are no longer stored in the parsed TLSConfig.Certificates slice. Setting TLSConfig.Certificates (including a non-nil empty slice) or TLSConfig.GetClientCertificate overrides automatic reloading. Replacing TLSConfig, including with a direct TLSConfig.Clone, discards the file-backed certificate settings; use pgconn.Config.Copy to preserve them when copying a configuration. Certificate and key files must remain readable for subsequent TLS certificate requests. Encrypted keys reuse the password resolved during configuration parsing; GetSSLPassword is not called again on reload.

Bug Fixes

• pgconn: do not mark a connection-closed error encountered while receiving a response as safe to retry, since the request may already have reached the server. This prevents database/sql from automatically repeating a statement that may already have executed. The error still supports errors.Is(err, pgconn.ErrConnClosed) (Aayush Shah)
• pgconn: skip sending a cancel request when a connection fails during startup, avoiding an unnecessary second connection attempt (felipe stival)
• pgconn: accept unencrypted combined certificate/key PEM files with the certificate before the key, as well as key-first files (Erin Shepherd)
• pgtype: encode Range[any] values returned by RangeCodec.DecodeValue and Rows.Values in both binary and text formats, allowing decoded ranges and multiranges to be reused as query arguments or in CopyFrom (waw666waw666)
• stdlib: report ok=false for the precision and scale of unconstrained numeric columns instead of bogus values (Danny Xu)
• stdlib: report math.MaxInt64 for the lengths of unconstrained varchar, bpchar, and varbit columns instead of negative lengths (PerryLink)

... (truncated)

Commits

• 1e38d71 Update changelog for v5.13.0
• e2bb010 Fix Rows.Values panic on mismatched field counts
• 5b0fd94 Merge pull request #2709 from waw666waw666/fix-range-any-encode
• 427f50d Merge pull request #2715 from v0idpwn/pgconn-no-cancel-on-failed-connect
• 86b4411 Merge pull request #2713 from ksamirdev/fix-append-rows-by-name-bench
• a3b88dc Merge pull request #2714 from PerryLink/stdlib-column-type-length-unbounded
• 2f429e5 Merge pull request #2710 from dajiaohuang/codex/2705-pingtimeout-docs
• 85c3e62 stdlib: close rows in precision and scale test
• 4f41feb stdlib: clarify zero precision for temporal types
• 22ccfd1 stdlib: document temporal precision and scale metadata
• Additional commits viewable in compare view

Updates github.com/quic-go/quic-go from 0.64.1 to 0.65.0

Release notes

Sourced from github.com/quic-go/quic-go's releases.

v0.65.0

This release updates qlog to the latest IETF drafts, adds explicit stream credit release, and fixes a number of HTTP/3 and connection migration bugs.

• With Config.RequireStreamCreditRelease, completed streams count towards the incoming stream limit until the application calls ReleaseStreamCredit: #5981, #5982
• qlog: events now follow draft-ietf-quic-qlog-quic-events-14 and draft-ietf-quic-qlog-h3-events-14: #6120

Breaking Changes

• http3: HTTPStreamer.HTTPStream now returns (*Stream, error), and no longer sends an implicit 200 response: #5988, #5994

Notable Fixes

• QUIC v2 key updates now use the correct quicv2 ku label: #5973
• Connections using zero-length connection IDs no longer stop receiving packets after version negotiation: #6129
• Switching paths now uses a new connection ID, fixing servers that kept sending to the old address after repeated NAT rebindings: #6015
• Clients now send PATH_RESPONSE on the path the PATH_CHALLENGE was received on: #5980
• Path.Probe now succeeds on an already validated path: #6019
• Reordered and retransmitted NEW_CONNECTION_ID frames are now handled correctly: #6009, #6007
• DATAGRAM frames no longer starve ACKs, control frames and retransmissions: #5970
• CancelRead now unblocks Read and Peek after receiving RESET_STREAM_AT: #6022
• TryWriteAll no longer copies queued data quadratically: #6042, #6043
• http3: canceling the first request to a host no longer cancels the shared dial: #6132
• http3: bodies shorter than the announced Content-Length now fail with io.ErrUnexpectedEOF: #5913
• http3: Content-Length is no longer added to 204 and 304 responses, and is now sent for requests with http.NoBody: #6032, #6029
• http3: response writes that fail partway (e.g. on a write deadline) no longer corrupt the stream: #5993, #6002, #6001, #6003
• http3: canceling an Extended CONNECT request now interrupts waiting for SETTINGS: #6020
• qlog fixes:
  • incorrect or missing values for transport parameters, packet numbers, congestion metrics, timers, connection IDs and lengths: #6050, #6054, #6059, #6060, #6074, #6077, #6091, #6023, #5969
  • stateless resets are logged as remote closures: #6063
  • concurrently recorded events are written in order: #5956
  • traces of connections abandoned after version negotiation are closed: #6130
  • http3: traces no longer close before all events are recorded: #6090, #6083, #6041

Notable Changes

• Multiple DATAGRAM frames are now packed into a single packet: #5961, #5960
• qlog: new connection_state_updated and HTTP/3 stream_type_set events, and tuples for path probing and migration: #6111, #6113, #5977, #5979
• qlog: qlog.RedactIPs redacts IP addresses and ports: #5943
• qlog: HTTP/3 connections now use qlog.DefaultConnectionTracer; http3/qlog.DefaultConnectionTracer is removed: #5966
• Reduced allocations during the handshake: #6096, #6093, #6098, #6097, #6095

Changelog

• ci: bump CodSpeedHQ/action from 5.4.0 to 5.5.0 by @​dependabot[bot] in quic-go/quic-go#5945
• qlogwriter: fix ordering of concurrently recorded events by @​marten-seemann in quic-go/quic-go#5956
• omit the length field of the last DATAGRAM frame in a packet by @​marten-seemann in quic-go/quic-go#5960
• remove obsolete curve ID helpers from handshake tests by @​marten-seemann in quic-go/quic-go#5968
• handshake: remove obsolete session ticket error workaround by @​marten-seemann in quic-go/quic-go#5967
• pack multiple DATAGRAM frames into a packet by @​marten-seemann in quic-go/quic-go#5961
• qlog: register event schemas on init, remove Trace.SupportsSchemas by @​marten-seemann in quic-go/quic-go#5966

... (truncated)

Commits

• aa265c3 http3: don't cancel a shared dial when the first request is canceled (#6132)
• 7c2906f qlog: close the trace of a connection abandoned after version negotiation (#6...
• faa3b83 remove the old connection immediately after version negotiation (#6129)
• 946bda4 ci: use a daily Go build cache for unit and integration tests (#6124)
• 99d6d1e qlog: map packet drop reasons to packet_dropped triggers (#6055)
• 91d541c ci: delete outdated cross-compilation build caches (#6122)
• 3ee97eb README: list tools supporting quic-go (#6123)
• 3316624 ci: run benchmarks for a fixed number of iterations (#6121)
• 220eda8 ci: cancel outdated PR runs (#6118)
• 0bf3ea5 qlog: update event schema URIs to quic-events-14 and h3-events-14 (#6120)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.58.0 to 0.59.0

Commits

• 6c966a7 ssh: quote remaining peer-controlled strings in error messages
• bc46121 ssh: fail OpenChannel when the connection is lost
• 7e0915c ssh/test: connect to sshd over a loopback TCP connection
• bfa619e ssh/agent: use a short socket path for ssh-agent in tests
• 4e10f38 go.mod: update golang.org/x dependencies
• a1058eb ssh: remove DSA support
• d580ab7 ssh: report algorithms of the last completed key exchange
• d1f31f6 ssh/knownhosts: skip lines that cannot be parsed
• 04c6b4f ssh: return rest from ParseKnownHosts on parse errors
• 3d426ad ssh: separately count rejected public key queries towards MaxAuthTries
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions