Bumps the production-dependencies group with 5 updates in the / directory:

Package	From	To
github.com/jackc/pgx/v5	5.9.2	5.10.0
github.com/ncruces/go-sqlite3	0.34.1	0.34.4
github.com/tetratelabs/wazero	1.11.0	1.12.0
golang.org/x/sync	0.20.0	0.21.0
google.golang.org/grpc	1.81.0	1.81.1

Updates github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0

Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.10.0 (June 3, 2026)

This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers, contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are sent over TLS when the original connection used TLS.

Features

• Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
• Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
• Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
• Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
• pgxpool: check if connection is expired before acquire (arthurdotwork)

Security Hardening

• Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
• Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
• Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
• Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
• Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
• Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
• Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
• Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
• Fix panic on malformed geometric text; return an error instead (MaIII)

Fixes

• Fix scanning "char" (OID 18) into *string in binary format (luongs3)
• Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
• Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
• Fix data race when context is cancelled during connect
• Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
• pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
• pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
• pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
• Add missing error check of rows.Err to load types (Jen Altavilla)

Commits

• 7293fb1 Update changelog for v5.10.0
• 1ade285 pgconn: document secure connection configuration
• b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
• 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
• b28e65b pgtype: bound array element count against remaining message bytes
• cd1f389 pgtype: bound array binary decode element length against remaining bytes
• ff27b5b pgtype: bound hstore binary decode against malicious server input
• a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
• 44f6173 pgconn: cap server-supplied SCRAM iteration count
• 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
• Additional commits viewable in compare view

Updates github.com/ncruces/go-sqlite3 from 0.34.1 to 0.34.4

Release notes

Sourced from github.com/ncruces/go-sqlite3's releases.

v0.34.4

What's Changed

Updates:

• SQLite 3.43.2
• Vec1 0.6

Improved the dotlk VFS under Linux containers: #392

Full Changelog: ncruces/go-sqlite3@v0.34.3...v0.34.4

Artifact attestations

v0.34.3

What's Changed

Fix a code generation bug: ncruces/wasm2go#31

Improved support for Go 1.27: golang/go#67546

Full Changelog: ncruces/go-sqlite3@v0.34.2...v0.34.3

Artifact attestations

v0.34.2

What's Changed

Fixed issue #389.

Full Changelog: ncruces/go-sqlite3@v0.34.1...v0.34.2

Artifact attestations

Commits

• 174151a SQLite 3.53.2.
• 312b416 Fix #392.
• b7dd234 Deps.
• c5396f1 Reflect.
• 89efb65 Driver scanning API (#377)
• a2be335 Typo.
• ce78ca9 Cleanup.
• 7914383 Fix #389.
• 3bd7753 Update README.md
• 57d9e99 CI.
• Additional commits viewable in compare view

Updates github.com/tetratelabs/wazero from 1.11.0 to 1.12.0

Release notes

Sourced from github.com/tetratelabs/wazero's releases.

v1.12.0

Hi wazero friends! The new release of wazero v1.12.0 has arrived.

This release advances us a few more steps towards Wasm 3.0! See wazero/wazero#2426 for where we currently stand.

Behavioral changes

• 929e4000 Extended Constant Expressions (#2468) @​mpoindexter
• bfb20e0b Exception handling (#2489) @​evacchi
• 2c14bbff Typed references (#2497) @​evacchi
• 8ee25086, a877b1b4 non-blocking IO on custom files (#2476, #2479) @​paralin

Bug fixes

• 2bbd517b Fix fd_prestat_get integer overflow on 32-bit platforms (#2491) @​hanxi
• 0bcb5f2a Ensure i32 operations are masked (#2488) @​evacchi
• dafe2caa Fix error when attempting to invoke a start function imported from a host module (#2475) @​mpoindexter
• f7cf1693 Fix error when importing functions which were re-exported (#2463) @​mpoindexter
• aa7ebad5 Don't use compiler when executable mmap is disabled (#2471) @​anuraaga

Commits

• 2ab480b Remove SQLite (#2502)
• 2c14bbf feat: typed function references spec (#2497)
• 475a1f8 fix: compilation cache should store catch clause table (EH) (#2498)
• a3374cf refactor: wasm.ValueType as type definition + widening (uint64) (#2495)
• 8755611 arm64: fix relocation bug when number of args > 8 (#2492)
• e6dd6c0 Update golang.org/x/sys (#2493)
• 2bbd517 Fix fd_prestat_get integer overflow on 32-bit platforms (#2491)
• bfb20e0 feat: exception handling spec (#2489)
• 5cb4bb3 Revert "Added f4 to community/users.md" (#2490)
• 1dc02f0 Added f4 to community/users.md (#2485)
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.20.0 to 0.21.0

Commits

• 5071ed6 all: fix some comments to improve readability
• See full diff in compare view

Updates google.golang.org/grpc from 1.81.0 to 1.81.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.81.1

Security

• xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per gRFC A41. (#9111)
  • Special Thanks: @​al4an444

Bug Fixes

• otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. (#9081)

Commits

• caf0772 Change version from 1.81.1-dev to 1.81.1 (#9122)
• 6ccbeeb Cherry-pick #9111 into v1.81.x (#9121)
• b33c29e Cherry-pick #9081 into v1.81.x (#9102)
• c45fae6 Change version to 1.81.1-dev (#9063)
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/ncruces/go-sqlite3	[>= 0.33.a, < 0.34]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions