[dependabot]

Bumps the go-deps group with 2 updates: github.com/go-playground/validator/v10 and github.com/jackc/pgx/v5.

Updates github.com/go-playground/validator/v10 from 10.30.5 to 10.30.6

Release notes

Sourced from github.com/go-playground/validator/v10's releases.

v10.30.6

What's Changed

• fix: update the KR and IL postcode patterns to the current national formats by @​yu2971512385-ui in go-playground/validator#1644
• fix: accept Taiwan six-digit postcodes by @​sb123sb123 in go-playground/validator#1642
• docs: use the registered fieldcontains tag in usage example by @​lazerg in go-playground/validator#1635
• fix: fully anchor Costa Rica postcode regex by @​sb123sb123 in go-playground/validator#1648
• feat: add duration validator for time.ParseDuration strings by @​ahmedkamalio in go-playground/validator#1649
• chore(deps): bump github.com/go-playground/universal-translator from 0.18.1 to 0.18.2 by @​dependabot[bot] in go-playground/validator#1653
• feat: Add hostname label validation tag by @​KytnaCode in go-playground/validator#1616
• chore(deps): bump github.com/go-playground/locales from 0.14.1 to 0.14.2 by @​dependabot[bot] in go-playground/validator#1663
• Align excluded_without with its stated multi-field contract by @​dylanpulver in go-playground/validator#1621
• fix: accept Nigeria's 11-character postcodes by @​Adeniyikayodee in go-playground/validator#1664
• chore(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 by @​dependabot[bot] in go-playground/validator#1670
• ci: send coverage from the Go 1.26.x leg (step skipped since #1535) by @​glaziermag in go-playground/validator#1671
• Clarify separators for non-existent directory paths by @​yuefdev in go-playground/validator#1672
• Add postcode patterns for IE (Ireland), AL (Albania), GI (Gibraltar) and IL (Israel) by @​JohannesHepp in go-playground/validator#1629
• chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.15 to 1.4.16 by @​dependabot[bot] in go-playground/validator#1680
• docs: fix stale alias, uuid and snippet details in package docs by @​yxshee in go-playground/validator#1679
• fix: anchor GB and LI postcode patterns as a whole by @​beduldul in go-playground/validator#1646
• fix: reject ULIDs outside the 128-bit range by @​sergioperezcheco in go-playground/validator#1660
• fix: reject duplicate variants in strict BCP47 tags by @​guocn in go-playground/validator#1678
• Convert to time.Time before asserting in isNeField by @​youdie006 in go-playground/validator#1619
• Add uuid7 validation tag by @​ChrisJr404 in go-playground/validator#1614

New Contributors

• @​yu2971512385-ui made their first contribution in go-playground/validator#1644
• @​sb123sb123 made their first contribution in go-playground/validator#1642
• @​lazerg made their first contribution in go-playground/validator#1635
• @​KytnaCode made their first contribution in go-playground/validator#1616
• @​dylanpulver made their first contribution in go-playground/validator#1621
• @​Adeniyikayodee made their first contribution in go-playground/validator#1664
• @​glaziermag made their first contribution in go-playground/validator#1671
• @​yuefdev made their first contribution in go-playground/validator#1672
• @​JohannesHepp made their first contribution in go-playground/validator#1629
• @​yxshee made their first contribution in go-playground/validator#1679
• @​beduldul made their first contribution in go-playground/validator#1646
• @​sergioperezcheco made their first contribution in go-playground/validator#1660
• @​guocn made their first contribution in go-playground/validator#1678
• @​youdie006 made their first contribution in go-playground/validator#1619
• @​ChrisJr404 made their first contribution in go-playground/validator#1614

Full Changelog: go-playground/validator@v10.30.5...v10.30.6

Commits

• 19397f2 Add uuid7 validation tag (#1614)
• 5b09d8d Convert to time.Time before asserting in isNeField (#1619)
• 563e738 fix: reject duplicate variants in strict BCP47 tags (#1678)
• 0f885d2 fix: reject ULIDs outside the 128-bit range (#1660)
• c9cfe75 fix: anchor GB and LI postcode patterns as a whole (#1646)
• 29d05a7 docs: fix stale alias, uuid and snippet details in package docs (#1679)
• 0411012 chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.15 to 1.4.16 (#...
• a5843c6 Add postcode patterns for IE (Ireland), AL (Albania), GI (Gibraltar) and IL (...
• c29fac1 Clarify separators for non-existent directory paths (#1672)
• 3b54840 ci: send coverage from the Go 1.26.x leg (step skipped since #1535) (#1671)
• Additional commits viewable in compare view

Updates github.com/jackc/pgx/v5 from 5.11.0 to 5.12.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

• SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@​igor-kupczynski).
• Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @​president-xd.

Features

• Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)
• Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)
• pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)
• pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

• pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.
• pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

Commits

• b2ef08b Update changelog for v5.12.0
• 8199015 Merge commit from fork
• 5b1a6a0 Merge commit from fork
• 65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
• f2701a0 pgconn: only fall back when Windows service file is missing
• db95468 Merge pull request #2696 from k-zshiba/support-oid8
• fa2327d Start each query on a new line when joining a simple protocol batch
• 2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
• efc0b74 Merge upstream master into support-oid8
• 5a17450 pgconn: require AuthenticationOk before ReadyForQuery
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions