build(deps): bump the go-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the go-dependencies group with 4 updates in the / directory: github.com/amacneil/dbmate/v2, github.com/nats-io/nats-server/v2, golang.org/x/net and golang.org/x/sync.

Updates github.com/amacneil/dbmate/v2 from 2.29.5 to 2.31.0

Release notes

Sourced from github.com/amacneil/dbmate/v2's releases.

v2.31.0

What's Changed

• feat: issue #489 support clickhouse+http/s schemes and --driver flag + env var by @​FatherCandle in amacneil/dbmate#713
• Bump golang from 1.25.5 to 1.25.6 by @​dependabot[bot] in amacneil/dbmate#740
• fix: extract file path from SQLite URL for shell commands by @​eloff in amacneil/dbmate#574
• Add further common Postgres Unix socket URL examples by @​malteneuss in amacneil/dbmate#459
• fix: comment out invalid docker ignore condition in dependabot.yml by @​dossy in amacneil/dbmate#752
• Bump golang from 1.25.6 to 1.26.0 by @​dependabot[bot] in amacneil/dbmate#753
• feat: allow passing extra arguments to mysqldump/pgdump by @​zapotinschii in amacneil/dbmate#694
• bump version to v2.31.0 by @​sofuture in amacneil/dbmate#754

New Contributors

• @​eloff made their first contribution in amacneil/dbmate#574
• @​zapotinschii made their first contribution in amacneil/dbmate#694

Full Changelog: amacneil/dbmate@v2.30.0...v2.31.0

v2.30.0

What's Changed

• Fix clickhouse schema dump with non-default database by @​Flamefork in amacneil/dbmate#676
• Bump js-yaml from 4.1.0 to 4.1.1 in /typescript by @​dependabot[bot] in amacneil/dbmate#741
• Bump alpine from 3.23.2 to 3.23.3 by @​dependabot[bot] in amacneil/dbmate#739
• fix: lib/pq v1.11.1 broke connecting to Supavisor by @​dossy in amacneil/dbmate#750
• New release v2.30.0 by @​sofuture in amacneil/dbmate#745

Full Changelog: amacneil/dbmate@v2.29.5...v2.30.0

Commits

• 5dc429d bump version to v2.31.0 (#754)
• 10ec839 feat: allow passing extra arguments to mysqldump/pgdump (#694)
• e26a6ad Bump golang from 1.25.6 to 1.26.0 (#753)
• 422f30b fix: comment out invalid docker ignore condition in dependabot.yml (#752)
• 285c25a Add further common Postgres Unix socket URL examples (#459)
• ba87f94 fix: extract file path from SQLite URL for shell commands (#574)
• 40de0da Bump golang from 1.25.5 to 1.25.6 (#740)
• 2d62e04 feat: issue #489 support clickhouse+http/s schemes and --driver flag + env va...
• d8ce770 New release v2.30.0 (#745)
• de56b2a fix: lib/pq v1.11.1 broke connecting to Supavisor (#750)
• Additional commits viewable in compare view

Updates github.com/lib/pq from 1.11.1 to 1.11.2

Release notes

Sourced from github.com/lib/pq's releases.

v1.11.2

This fixes two regressions:

• Don't send startup parameters if there is no value, improving compatibility with Supavisor (#1260).

• Don't send dbname as a startup parameter if database=[..] is used in the connection string. It's recommended to use dbname=, as database= is not a libpq option, and only worked by accident previously. (#1261)

#1260: lib/pq#1260 #1261: lib/pq#1261

Changelog

Sourced from github.com/lib/pq's changelog.

v1.11.2 (2026-02-10)

This fixes two regressions:

• Don't send startup parameters if there is no value, improving compatibility with Supavisor (#1260).

• Don't send dbname as a startup parameter if database=[..] is used in the connection string. It's recommended to use dbname=, as database= is not a libpq option, and only worked by accident previously. (#1261)

#1260: lib/pq#1260 #1261: lib/pq#1261

Commits

• 1412805 Don't send empty startup parameters
• 0c529db Don't send dbname= as a startup parameter when database= is used
• See full diff in compare view

Updates github.com/nats-io/nats-server/v2 from 2.12.4 to 2.12.5

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.12.5

Changelog

Refer to the 2.12 Upgrade Guide for backwards compatibility notes with 2.11.x.

Go Version

• 1.25.8

Dependencies

• github.com/nats-io/nkeys v0.4.15 (#7797)
• github.com/klauspost/compress v1.18.4 (#7812)
• golang.org/x/sys v0.42.0 (#7923)
• github.com/antithesishq/antithesis-sdk-go v0.6.0-default-no-op (#7835)
• golang.org/x/crypto v0.48.0 (#7874)
• github.com/nats-io/nats.go v1.49.0 (#7835)
• golang.org/x/time v0.15.0 (#7923)

CVEs

• Fixes CVE-2026-29785 (affects systems with leafnode compression enabled)
• Fixes CVE-2026-27889 (affects systems with WebSockets enabled)

Added

JetStream

• The stream snapshot/backup endpoint now accepts the window_size parameter, to allow improving flow control over slow or unreliable connections (#7839)

Improved

General

• max_conns in the server configuration can now be configured to 0 (zero) to reject all incoming client connections (#7877)

JetStream

• "Catchup for stream" log lines are now more consistent (#7784)
• Raft now only accepts forwarded proposals if caught up as the new leader, limiting potentially unbounded log growth (#7809)
• Raft now correctly refuses concurrent membership changes if forwarded a peer removal from another node (#7809)
• The max_consumers limit of a stream can now be updated after stream creation (#7724)
• The pending messages and bytes are now included in consumer unpin responses (#7815)
• Stream backups/snapshots are now streamed to clients with improved flow control, which should improve throughput and robustness, particularly over unreliable links, reducing the chance of backups failing due to flow control errors (#7828)
• Orphaned stream and consumer checks are now aligned with the metalayer snapshot logic (#7826)
• Wildcard filtering when loading messages is now considerably faster in the memory store (#7840, #7855)
• Metalayer snapshots now take place asynchronously when possible, such that JS API operations are not blocked while the snapshot is taking place (#7827, #7846)
  • This behaviour can be disabled by setting meta_compact_sync: true in the jetstream configuration block
• Consumers with a single subject filter no longer incorrectly use the multi-filter message lookups (#7856)
• The check for colliding stream subjects is now faster (#7870)

... (truncated)

Commits

• 0f6c831 Release v2.12.5
• d9cce39 Update dependencies
• 44d8abd Fix TestMonitorWebsocket
• 55db52b Update to Go 1.25.8
• 358cdc4 Fix int32 overflow of JWT account and user limits
• a1488de Fix panic on LS protocol when compression enabled
• cadc948 Fix panic on X-Forwarded-For empty slice (shouldn't be possible from the wire)
• 6cf715d Fix panic in WebSocket when reading an empty compressed buffer
• 667d14d Fix panic in WebSocket on extremely large payload length
• d82c4b7 Fix panic on title case on empty error message
• Additional commits viewable in compare view

Updates github.com/nats-io/nats.go from 1.48.0 to 1.49.0

Release notes

Sourced from github.com/nats-io/nats.go's releases.

Release v1.49.0

Changelog

ADDED

• Core NATS:
  • IgnoreDiscoveredServers option for skipping advertised servers (#2022)
  • Reconnect to selected server callback option #1958)
  • Set custom server pool (#1958)
• KeyValue:
  • Config() method for KeyValueStatus (#2014)

FIXED

• Core NATS:
  • Only remove requested status listener (#1991)
• JetStream:
  • Cleanup JS Publisher Status Channel (#1993)
• Legacy JetStream:
  • Fix nil pointer dereference in ConsumerInfo. Thanks @​olde-ducke for the contribution (#1987)
• Object store:
  • Use default timeout on object Put when context has no deadline (#2013)

IMPROVED

• Various docs and test improvements across the codebase. Thanks @​jjpinto for the contribution! (#1995, #1996, #1997, #1998, #1999, #2000, #2001, #2002, #2003, #2004, #2005, #2007, #2008, #2009, #2010, #2011, #2012, #2016, #2017, #2018, #2019, #2020)
• Add JetStream migration guide (#2023)

Complete Changes

nats-io/nats.go@v1.48.0...v1.49.0

Commits

• d85a35e Release v1.49.0 (#2025)
• 0d5e984 [IMPROVED] Add JetStream migration guide (#2023)
• fff2d63 [FIXED] Use default timeout on object Put when context has no deadline (#2013)
• ca4790e [IMPROVED] Fix code examples, API signatures and technical typos in jetstream...
• e987dbe [IMPROVED] Fix bug in constant name TimeStampHeader (#2019)
• 5b2c617 [ADDED] Config method for KeyValueStatus (#2014)
• 4667f93 [ADDED] Reconnect to selected server and custom server pool (#1958)
• f89e0bd [ADDED] IgnoreDiscoveredServers option for skipping advertised servers (#2022)
• b9f59ec [IMPROVED] Use correct comparative form in PullMaxBytes validation messages (...
• aa67684 [IMPROVED] Fix doc comments for ListKeysFiltered and ListKeys methods (#2017)
• Additional commits viewable in compare view

Updates golang.org/x/net from 0.50.0 to 0.51.0

Commits

• 60b3f6f internal/http3: prevent Server handler from writing longer body than declared
• b0ca456 internal/http3: fix Write in Server Handler returning the wrong value
• 1558ba7 publicsuffix: update to 2026-02-06
• 4e1c745 internal/http3: make Server response include headers that can be inferred
• 19f580f http2: fix nil panic in typeFrameParser for unassigned frame types
• 818aad7 internal/http3: add server to client trailer header support
• c1bbe1a internal/http3: add client to server trailer header support
• 29181b8 all: remove go1.25 and older build constraints
• 8109305 all: upgrade go directive to at least 1.25.0 [generated]
• 0b37bdf quic: don't run TestStreamsCreateConcurrency in synctest bubble
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.19.0 to 0.20.0

Commits

• ec11c4a errgroup: fix a typo in the documentation
• 1a58307 all: modernize interface{} -> any
• 3172ca5 all: upgrade go directive to at least 1.25.0 [generated]
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.