Bump the go-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the go-dependencies group with 6 updates in the / directory:

Package	From	To
github.com/onsi/ginkgo/v2	2.32.1	2.33.0
github.com/onsi/gomega	1.42.1	1.44.0
github.com/pganalyze/pg_query_go/v6	6.2.2	6.2.5
github.com/sirupsen/logrus	1.9.4	1.10.2
golang.org/x/crypto	0.55.0	0.57.0
golang.org/x/tools	0.49.0	0.51.0

Updates github.com/onsi/ginkgo/v2 from 2.32.1 to 2.33.0

Release notes

Sourced from github.com/onsi/ginkgo/v2's releases.

v2.33.0

Features

• The JUnit reporter now records each spec's ReportEntrys as <properties> on its <testcase> element, with the entry's name and its JSON-encoded value. Thanks @​pohly! [23db51a]

Maintenance

• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. See RELEASING.md. [8616ecb]

v2.32.2

2.32.2

Fixes

• fix bug where ginkgo -race -p was taking extra long to exit [c6792b0]

Changelog

Sourced from github.com/onsi/ginkgo/v2's changelog.

2.33.0

Features

• The JUnit reporter now records each spec's ReportEntrys as <properties> on its <testcase> element, with the entry's name and its JSON-encoded value. Thanks @​pohly! [23db51a]

Maintenance

• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. See RELEASING.md. [8616ecb]

2.32.2

Fixes

• fix bug where ginkgo -race -p was taking extra long to exit [c6792b0]

Commits

• 9f94149 v2.33.0
• db78e1b changelog: entries for the JUnit ReportEntry support and the release flow
• 8616ecb ci: release from a single workflow_dispatch button
• d8d9cdd README: add a sponsor badge
• ac70da6 README: dark-mode logo and a docs badge
• 23db51a junit: support ReportEntry
• b9e3bdd v2.32.2
• c6792b0 fix bug where ginkgo -race -p was taking extra long to exit
• See full diff in compare view

Updates github.com/onsi/gomega from 1.42.1 to 1.44.0

Release notes

Sourced from github.com/onsi/gomega's releases.

v1.44.0

Fixes

• BeNumerically compares signed and unsigned integers by value: -1 no longer equals uint64(math.MaxUint64) and uint(5) is now greater than -3 (#925) [26e3c6b]
• BeNumerically("~") no longer overflows when computing the distance between extreme integers (#928) [1955764]
• BeNumerically("==", x, threshold) now honors the threshold for floats, as it already did for integers (#927) [10e2aca]
• HaveKeyWithValue succeeds if any key accepted by the key matcher has a matching value, rather than depending on map iteration order (#929) [ffc577a]
• HaveKey and HaveKeyWithValue treat key and value matcher errors like ContainElement does: a match wins, and an error is only reported when nothing matches (#926) [dc91598]
• MatchJSON no longer treats numbers too large for a float64 as equal to one another (#930) [9d619a5]
• MatchJSON compares integers beyond ±2^53 exactly, so neighboring large integers (e.g. IDs) no longer match; all other numbers are still compared as float64s (#931) [8ef1aa7, 630fe12]
• HaveExactElements reports missing or extra elements that start at index 0, and reports the first extra element's index rather than the last (#934) [af1b777]
• MatchYAML compares every document in a multi-document stream rather than only the first; empty documents (e.g. a leading or trailing ---) are ignored (#933) [2773796]
• MatchXML ignores namespace prefixes: elements and attributes are compared by namespace URI, and the URIs declared on each element must match whatever prefix they are bound to (#932) [c0dbd89, 2565350]

v1.43.1

Maintenance

• Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]

v1.43.0

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

Changelog

Sourced from github.com/onsi/gomega's changelog.

1.44.0

Fixes

• BeNumerically compares signed and unsigned integers by value: -1 no longer equals uint64(math.MaxUint64) and uint(5) is now greater than -3 (#925) [26e3c6b]
• BeNumerically("~") no longer overflows when computing the distance between extreme integers (#928) [1955764]
• BeNumerically("==", x, threshold) now honors the threshold for floats, as it already did for integers (#927) [10e2aca]
• HaveKeyWithValue succeeds if any key accepted by the key matcher has a matching value, rather than depending on map iteration order (#929) [ffc577a]
• HaveKey and HaveKeyWithValue treat key and value matcher errors like ContainElement does: a match wins, and an error is only reported when nothing matches (#926) [dc91598]
• MatchJSON no longer treats numbers too large for a float64 as equal to one another (#930) [9d619a5]
• MatchJSON compares integers beyond ±2^53 exactly, so neighboring large integers (e.g. IDs) no longer match; all other numbers are still compared as float64s (#931) [8ef1aa7, 630fe12]
• HaveExactElements reports missing or extra elements that start at index 0, and reports the first extra element's index rather than the last (#934) [af1b777]
• MatchYAML compares every document in a multi-document stream rather than only the first; empty documents (e.g. a leading or trailing ---) are ignored (#933) [2773796]
• MatchXML ignores namespace prefixes: elements and attributes are compared by namespace URI, and the URIs declared on each element must match whatever prefix they are bound to (#932) [c0dbd89, 2565350]

1.43.1

Maintenance

• Update go.yaml.in/yaml/v3 to v3.0.5 [d547015]
• Releases are now cut by a GitHub Actions workflow (Actions -> Release -> Run workflow) rather than by hand, with changelog entries collected under ## Unreleased as the work happens. Releases still ship the stripped-down tree on master-lite - tests removed and Ginkgo dropped from go.mod - and the workflow now builds it and checks it on every push. See RELEASING.md. [e9dc84d]

1.43.0

Features

Add gomock adaptor extension for using Gomega matchers with gomock

Commits

• c933817 v1.44.0
• 37fa900 v1.44.0 (full)
• 509f2b0 changelog: entries for updated for versions for PostgreSQL minor version #925-#934
• 2565350 fix: MatchXML compares namespace declarations by URI, ignoring the prefix
• 630fe12 fix: MatchJSON only compares integers beyond 2^53 exactly
• c0dbd89 fix: MatchXML ignores namespace prefixes and declarations
• 2773796 fix: MatchYAML compares every document in a multi-document stream
• af1b777 fix: HaveExactElements reports missing/extra elements starting at index 0
• 8ef1aa7 fix: MatchJSON compares numbers exactly
• 9d619a5 fix: MatchJSON reports numbers that do not fit in a float64
• Additional commits viewable in compare view

Updates github.com/pganalyze/pg_query_go/v6 from 6.2.2 to 6.2.5

Changelog

Sourced from github.com/pganalyze/pg_query_go/v6's changelog.

6.2.5 2026-09-30

• Upgrade to libpg_query 17-6.2.5
  • Security fix: Heap out-of-bounds write and read in Normalize (GHSA-6ggm-xmc9-8ffg)
    • When normalizing certain utility statements (e.g. DO ... LANGUAGE, statements with string options, or CREATE/ALTER SUBSCRIPTION ... CONNECTION), Normalize searched the query text for the location of string constants, which could yield wrong locations for crafted input. This could cause out-of-bounds writes and reads on the heap, leaking process memory in the normalized output or crashing the process.
    • Constant locations are now recorded by the parser instead, and the normalizer checks at runtime that constant locations never overlap
    • This adds new location fields to the parse tree output (DefElem.ArgLocation, NotifyStmt.PayloadLocation, CreateSubscriptionStmt.ConninfoLocation and AlterSubscriptionStmt.ConninfoLocation). Like other location fields, these are ignored for fingerprinting.
    • Applications that normalize untrusted query text should upgrade
    • Reported by Paul Gerste (Cure53)
  • Deparser:
    • Add strict checking for unexpected pointer values
      • This ensures that a bad input parse tree doesn't cause the deparser to crash, and instead returns an error
      • Reported by Paul Gerste (Cure53)
    • Preserve parentheses around subscripted array constructors
      • This prevents (ARRAY[...])[...] from being deparsed as invalid SQL
    • Fix handling of constraint key named value in ALTER TABLE
  • Normalize:
    • Add support for NOTIFY statements
    • Avoid undefined behaviour for overly large parameter references
    • Fix compiler warning due to mismatch between int64 and long
• Bump google.golang.org/protobuf from 1.31.0 to 1.33.0 #111

Commits

• 7ac09d4 Release 6.2.5 and update to libpg_query 17-6.2.5 (#150)
• 41be2fe Bump google.golang.org/protobuf from 1.31.0 to 1.33.0 (#111)
• See full diff in compare view

Updates github.com/sirupsen/logrus from 1.9.4 to 1.10.2

Release notes

Sourced from github.com/sirupsen/logrus's releases.

v1.10.2

Logrus v1.10.2

This is a small maintenance release that updates github.com/stretchr/testify to v1.12.1, removing the legacy gopkg.in/yaml.v3 dependency from Logrus' dependency graph. There are no functional changes in this release.

Dependency Changes

• update github.com/stretchr/testify to v1.12.1

Full Changelog: sirupsen/logrus@v1.10.1...v1.10.2

v1.10.1

Logrus v1.10.1

This patch release fixes two issues in field formatting and handling:

• Fix a regression introduced in v1.10.0 where TextFormatter could panic when formatting nil or panicking error and fmt.Stringer values.
• Allow function-backed values implementing error to be used with WithError, WithField, and WithFields.

Dependency Changes

• update github.com/stretchr/testify to v1.12.0

Full Changelog: sirupsen/logrus@v1.10.0...v1.10.1

v1.10.0

Logrus v1.10.0

This release focuses on substantial performance improvements, concurrency correctness, and better interoperability with modern Go logging APIs.

🚀 Performance

Major improvements across TextFormatter, entry handling, and common logger paths:

• ~17% lower geomean runtime across the benchmark suite
• ~27% higher geomean formatter throughput
• Common enabled logging paths are ~30–44% faster
• WithError is ~40% faster
• Chained fields are ~46% faster
• TextFormatter paths are up to ~40% faster
• Allocation counts are reduced by ~25–74% across measured TextFormatter cases, with the largest reductions in colored output

The improvements also show up in complete logger paths:

• Logger + TextFormatter is ~31% faster, with ~24% fewer allocations
• Logger + JSONFormatter is ~21% faster, with ~10% fewer allocations

... (truncated)

Changelog

Sourced from github.com/sirupsen/logrus's changelog.

1.10.2

Changed:

• Update github.com/stretchr/testify to v1.12.1, removing the legacy gopkg.in/yaml.v3 dependency.

1.10.1

Fixes:

• Fix a regression introduced in v1.10.0 where TextFormatter could panic when formatting nil or panicking error and fmt.Stringer values.
• Allow function-backed implementations of error as field values.

1.10.0

Fixes:

• Fix reentrant logging deadlocks in formatter paths.
• Fix race conditions in formatter and entry handling.
• Fix generic Log, Logf, Logln, and LogFn methods unexpectedly panicking when called with PanicLevel. Use the corresponding Panic methods when panic behavior is desired.
• Improve concurrency safety around formatter and hook access.

Features:

• Add slog hook for forwarding Logrus entries to log/slog.
• Add slog.Handler for forwarding log/slog records to a Logrus logger, including levels, fields, groups, context, time, and optional caller reporting. The hook and handler can also be combined to help migrate between Logrus and log/slog.
• Add minimal, composable logging interfaces for each log level. This enables consumers to depend on narrower interfaces, making it easier to substitute or adapt logging implementations.
• Allow Entry.Caller to be set explicitly and preserve it across derived entries, enabling custom caller detection without Logrus overwriting caller information when ReportCaller is enabled.

Changed:

• Raise minimum supported Go version to 1.23.
• TextFormatter now renders []byte values as raw/quoted strings instead of slice-of-ints.
• TextFormatter now uses distinct dimmed colors for debug and trace output.
• TextFormatter now automatically enables colors on Windows terminals with ANSI support, matching the behavior on other platforms.
• Entry.HasCaller is now deprecated in favor of checking Entry.Caller directly.
• Deprecated MutexWrap, which was unintentionally exposed as public API. It remains available as an alias for compatibility but should not be used

... (truncated)

Commits

• 6d6a132 Merge pull request #1586 from thaJeztah/prepare_v1.10.2
• 4f94653 update changelog for v1.10.2
• 87434bb Merge pull request #1585 from thaJeztah/bump_testify
• e7d2120 chore(deps): bump github.com/stretchr/testify v1.12.1
• 8b673a9 Merge pull request #1583 from thaJeztah/release_1.10.1
• 0b920ad Merge pull request #1584 from thaJeztah/more_coverage
• 5e20694 TextFormatter: cover nil pointer method receivers
• 8312732 update changelog for v1.10.1
• e987a40 Merge pull request #1582 from thaJeztah/panic_handler
• 17d574b TextFormatter: recover panics from Error and String methods
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.55.0 to 0.57.0

Commits

• 3f62bf1 go.mod: update golang.org/x dependencies
• 86efde5 ssh: reject unexpected message types on established channels
• a6cdac6 ssh: drop traffic on undecided channels
• 39dc44e ssh: don't skip the source-address critical option in CheckCert
• afebf4c x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+
• 89f4e9b x509roots/fallback: update bundle
• 71488c4 ssh/knownhosts: compare only public key portions for revocation
• 82adefa ssh: synchronize unexpected response test
• c757c98 all: upgrade go directive to at least 1.26.0 [generated]
• 593c81a ssh: correctly ignore pre-banner lines
• Additional commits viewable in compare view

Updates golang.org/x/tools from 0.49.0 to 0.51.0

Commits

• ea2f152 go.mod: update golang.org/x dependencies
• 00443da go/analysis/passes/printf: pin testdata Go versions
• 9ba0a15 internal/refactor/inline: check import accessibility before Go version
• 25196fc cmd/toolstash: check -linkobj files to support early export
• ead0503 gopls/internal/golang: unexport dragon*Question variables
• 5693030 gopls/internal/golang: call arguments mistreated in inlineAllCalls
• 134264d gopls/internal/golang/stubmethods: do not panic when FindByPos fails
• 01d93d7 gopls/internal/golang: slay the dragon: update questions
• 405de39 go/callgraph: fix benchmarks to analyze whole program
• 231a7fa go/ssa, cmd/deadcode: release type information once functions are built
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions