Skip to content

fix(deps): update all non-major go dependencies (release-1.29) - #10437

Merged
mnencia merged 1 commit into
release-1.29from
renovate/release-1.29-all-non-major-go-dependencies
Apr 13, 2026
Merged

fix(deps): update all non-major go dependencies (release-1.29)#10437
mnencia merged 1 commit into
release-1.29from
renovate/release-1.29-all-non-major-go-dependencies

Conversation

@renovate

@renovate renovate Bot commented Apr 13, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/goreleaser/goreleaser v2.14.3 → v2.15.2 age confidence
github.com/jackc/pgx/v5 v5.8.0 → v5.9.1 age confidence
github.com/lib/pq v1.12.0 → v1.12.3 age confidence
golang.org/x/term v0.41.0 → v0.42.0 age confidence
google.golang.org/grpc v1.79.3 → v1.80.0 age confidence

Release Notes

goreleaser/goreleaser (github.com/goreleaser/goreleaser)

v2.15.2

Compare Source

Announcement

Read the official announcement: Announcing GoReleaser v2.15.

Changelog

Bug fixes
Documentation updates
Other work

Full Changelog: goreleaser/goreleaser@v2.15.1...v2.15.2

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

GoReleaser logo

v2.15.1

Compare Source

Announcement

Read the official announcement: Announcing GoReleaser v2.15.

Changelog

Bug fixes
Documentation updates

Full Changelog: goreleaser/goreleaser@v2.15.0...v2.15.1

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

GoReleaser logo

v2.15.0

Compare Source

Announcement

Read the official announcement: Announcing GoReleaser v2.15.

Changelog

New Features
Bug fixes
Documentation updates
Other work

Full Changelog: goreleaser/goreleaser@v2.14.3...v2.15.0

Helping out

This release is only possible thanks to all the support of some awesome people!

Want to be one of them?
You can sponsor, get a Pro License or contribute with code.

Where to go next?

GoReleaser logo

jackc/pgx (github.com/jackc/pgx/v5)

v5.9.1

Compare Source

v5.9.0

Compare Source

lib/pq (github.com/lib/pq)

v1.12.3

Compare Source

  • Send datestyle startup parameter, improving compatbility with database engines
    that use a different default datestyle such as EnterpriseDB (#​1312).

v1.12.2

Compare Source

  • Treat io.ErrUnexpectedEOF as driver.ErrBadConn so database/sql discards the
    connection. Since v1.12.0 this could result in permanently broken connections,
    especially with CockroachDB which frequently sends partial messages (#​1299).

v1.12.1

Compare Source

  • Look for pgpass file in ~/.pgpass instead of ~/.postgresql/pgpass (#​1300).

  • Don't clear password if directly set on pq.Config (#​1302).

grpc/grpc-go (google.golang.org/grpc)

v1.80.0: Release 1.80.0

Compare Source

Behavior Changes

  • balancer: log a warning if a balancer is registered with uppercase letters, as balancer names should be lowercase. In a future release, balancer names will be treated as case-insensitive; see #​5288 for details. (#​8837)
  • xds: update resource error handling and re-resolution logic (#​8907)
    • Re-resolve all LOGICAL_DNS clusters simultaneously when re-resolution is requested.
    • Fail all in-flight RPCs immediately upon receipt of listener or route resource errors, instead of allowing them to complete.

Bug Fixes

  • xds: support the LB policy configured in LOGICAL_DNS cluster resources instead of defaulting to pick_first. (#​8733)
  • credentials/tls: perform per-RPC authority validation against the leaf certificate instead of the entire peer certificate chain. (#​8831)
  • xds: enabling A76 ring hash endpoint keys no longer causes EDS resources with invalid proxy metadata to be NACKed when HTTP CONNECT (gRFC A86) is disabled. (#​8875)
  • xds: validate that the sum of endpoint weights in a locality does not exceed the maximum uint32 value. (#​8899)
  • xds: fix incorrect proto field access in the weighted round robin (WRR) configuration where blackout_period was used instead of weight_expiration_period. (#​8915)
  • xds/rbac: handle addresses with ports in IP matchers. (#​8990)

New Features

  • ringhash: enable gRFC A76 (endpoint hash keys and request hash headers) by default. (#​8922)

Performance Improvements

  • credentials/alts: pool write buffers to reduce memory allocations and usage. (#​8919)
  • grpc: enable the use of pooled write buffers for buffering HTTP/2 frame writes by default. This reduces memory usage when connections are idle. Use the WithSharedWriteBuffer dial option or the SharedWriteBuffer server option to disable this feature. (#​8957)
  • xds/priority: stop caching child LB policies removed from the configuration. This will help reduce memory and cpu usage when localities are constantly switching between priorities. (#​8997)
  • mem: add a faster tiered buffer pool; use the experimental mem.NewBinaryTieredBufferPool function to create such pools. (#​8775)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the automated label Apr 13, 2026
@renovate
renovate Bot requested a review from a team April 13, 2026 07:13
@renovate renovate Bot added do not backport This PR must not be backported - it will be in the next minor release no-issue labels Apr 13, 2026
@renovate

renovate Bot commented Apr 13, 2026

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
golang.org/x/sys v0.42.0 -> v0.43.0
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 -> v0.0.0-20260120221211-b8f7ae30c516

@renovate renovate Bot added the automated label Apr 13, 2026
@mnencia

mnencia commented Apr 13, 2026

Copy link
Copy Markdown
Member

/test

@github-actions

github-actions Bot commented Apr 13, 2026

Copy link
Copy Markdown
Contributor

@mnencia, here's the link to the E2E on CNPG workflow run: https://github.com/cloudnative-pg/cloudnative-pg/actions/runs/24331259306

@dosubot dosubot Bot added the lgtm This PR has been approved by a maintainer label Apr 13, 2026
@mnencia
mnencia merged commit da19b5e into release-1.29 Apr 13, 2026
44 of 51 checks passed
@mnencia
mnencia deleted the renovate/release-1.29-all-non-major-go-dependencies branch April 13, 2026 11:45
@cnpg-bot cnpg-bot added the ok to merge 👌 This PR can be merged label Apr 13, 2026
sdwilsh pushed a commit to sdwilsh/ansible-playbooks that referenced this pull request May 11, 2026
@renovate @sdwilsh
chore(deps): update dependency cloudnative-pg/cloudnative-pg to v1.29.1
1a1f4e9 
##### [\`v1.29.1\`](https://github.com/cloudnative-pg/cloudnative-pg/releases/tag/v1.29.1)

**Release date:** May 8, 2026

##### Security and Supply Chain

- **`CVE-2026-44477` / `GHSA-423p-g724-fr39`: metrics exporter privilege escalation**: the metrics exporter no longer authenticates as the `postgres` superuser. It now uses a dedicated `cnpg_metrics_exporter` role with `pg_monitor` privileges only, closing a chain that let a low-privilege database user gain PostgreSQL superuser. ([`GHSA-423p-g724-fr39`](GHSA-423p-g724-fr39)) <!-- 1.29 1.28 1.25 -->

  Upgrade impact: custom monitoring queries that read user-owned tables, or use `target_databases: '*'` against databases where `PUBLIC CONNECT` has been revoked, need explicit `GRANT` statements to `cnpg_metrics_exporter`. See ["Custom query privileges and safety"](../monitoring.md#custom-query-privileges-and-safety) and ["Manually creating the metrics exporter role"](../monitoring.md#manually-creating-the-metrics-exporter-role) in the monitoring documentation.

  For replica clusters, upgrade the source primary cluster before any replica clusters that consume from it. The `cnpg_metrics_exporter` role is created on the source primary and replicates downstream; a replica cluster upgraded first will scrape against a missing role until the source primary upgrades. The manual-recovery section linked above also covers replica clusters.

- **Schema-qualified catalog references in default monitoring queries**: hardened the shipped monitoring configuration and documentation samples by qualifying every `pg_catalog` object explicitly. Unqualified references resolve through `search_path`, which a database user can manipulate to shadow built-in objects. ([#10576](cloudnative-pg/cloudnative-pg#10576)) <!-- 1.29 1.28 1.25 -->

- **Discoverable SBOM and provenance attestations**: SBOM and SLSA provenance attached to operator container images now follow the OCI 1.1 Referrers spec, so standard registry tooling and supply-chain scanners can discover them automatically. ([#10601](cloudnative-pg/cloudnative-pg#10601)) <!-- 1.29 1.28 1.25 -->

- **CVE remediation in `github.com/jackc/pgx/v5`**: bumped to v5.9.2 to pick up upstream fixes for `CVE-2026-33816` (memory-safety in `pgproto3`) and `GHSA-j88v-2chj-qfwx` (SQL injection via simple-protocol dollar-quoted string handling). ([#10437](cloudnative-pg/cloudnative-pg#10437), [#10499](cloudnative-pg/cloudnative-pg#10499))

- **CVE remediation in the Go runtime**: built with Go 1.26.3 to pick up upstream fixes in `crypto/x509`, `crypto/tls`, `net/http`, and `net` (CVE-2026-32280, CVE-2026-32281, CVE-2026-33810, CVE-2026-33814, CVE-2026-33811, CVE-2026-39825). ([#10463](cloudnative-pg/cloudnative-pg#10463), [#10647](cloudnative-pg/cloudnative-pg#10647)) <!-- 1.29 1.28 1.25 -->

- **Build pipeline hardening**: the Go 1.26.3 bump also addresses CVE-2026-42501 (`cmd/go` module-checksum validation), reducing supply-chain exposure during release builds. The affected code paths are not reachable from the running operator. ([#10647](cloudnative-pg/cloudnative-pg#10647)) <!-- 1.29 1.28 1.25 -->

##### Changes

- Switched TLS peer verification from `VerifyPeerCertificate` to `VerifyConnection`, which runs on every completed handshake (the former is skipped on resumed TLS 1.3 sessions). Session resumption is not enabled in CloudNativePG today, so this has no observable effect, but it future-proofs verification if session caching is introduced later. ([#10478](cloudnative-pg/cloudnative-pg#10478)) <!-- 1.29 1.28 1.25 -->

##### Fixes

- Fixed a failover window where the former primary kept its primary label. If it returned during failover (for example, after a transient network partition), the `-rw` service kept routing to it, replicas could reconnect, and committed writes were lost to `pg_rewind`. The old primary is now labeled `unhealthy` to isolate it from service traffic during failover. ([#10409](cloudnative-pg/cloudnative-pg#10409)) <!-- 1.29 1.28 1.25 -->

- Fixed failover not being triggered when the node hosting the primary becomes unreachable. The operator now reads the pod's `Ready` condition (flipped to `False` by the node controller when the kubelet stops reporting) instead of `ContainersReady`, which stays stale as `True` in that scenario. Combined with the spurious-failover guard ([#10445](cloudnative-pg/cloudnative-pg#10445)), failover triggers only when Kubernetes itself marks the pod not Ready. ([#10448](cloudnative-pg/cloudnative-pg#10448)) <!-- 1.29 1.28 1.25 -->

- Fixed spurious failovers caused by transient failures on the primary's HTTP status endpoint. ([#10445](cloudnative-pg/cloudnative-pg#10445)) <!-- 1.29 1.28 1.25 -->

- Fixed escaping of backslashes and control characters in PostgreSQL configuration values. Previously, such characters in parameters like `log_line_prefix` could corrupt the configuration file or be silently stripped at runtime. ([#10515](cloudnative-pg/cloudnative-pg#10515)) <!-- 1.29 1.28 1.25 -->

- Fixed `restore_command` construction to shell-quote each argument. Values such as a `destinationPath` containing whitespace (for example, `s3://my bucket/wal`) were word-split by the POSIX shell and passed to the WAL restore tool as separate arguments. ([#10518](cloudnative-pg/cloudnative-pg#10518)) <!-- 1.29 1.28 1.25 -->

- Tightened `recoveryTarget` validation in the admission webhook: `targetXID` must now be a non-negative 32-bit integer, and `targetName` must be shorter than 64 bytes and free of ASCII control characters. Malformed values are rejected at admission instead of failing later during PostgreSQL recovery. ([#10565](cloudnative-pg/cloudnative-pg#10565)) <!-- 1.29 1.28 1.25 -->

- Fixed snapshot restores failing when leftover `pgsql_tmp*` directories were present in the data directory. ([#10447](cloudnative-pg/cloudnative-pg#10447)) <!-- 1.29 1.28 1.25 -->

- Fixed a deadlock occurring when PVC storage size and resource requests are changed simultaneously. ([#10427](cloudnative-pg/cloudnative-pg#10427)) <!-- 1.29 1.28 1.25 -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mnencia mnencia mnencia approved these changes
@leonardoce leonardoce leonardoce approved these changes

Assignees

No one assigned

Labels

automated do not backport This PR must not be backported - it will be in the next minor release lgtm This PR has been approved by a maintainer no-issue ok to merge 👌 This PR can be merged

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@mnencia @leonardoce @cnpg-bot