Sourced from github.com/ClickHouse/clickhouse-go/v2's releases.

v2.50.0

What's Changed

Improvements 🚀

• fix: respect WithAsync in PrepareBatch for Native and HTTP by @​ccoltx in ClickHouse/clickhouse-go#2068

Bug Fixes 🐛

• fix(nullable): clear pointer destinations on null rows by @​014-code in ClickHouse/clickhouse-go#1926
• chore: handle the case where query goes to different replicas by @​kavirajk in ClickHouse/clickhouse-go#2081
• chore: fix potential flaky cases on cloud by @​kavirajk in ClickHouse/clickhouse-go#2083
• chore: careful with logging the DSN url by @​kavirajk in ClickHouse/clickhouse-go#2082

Other Changes 🛠

• chore(deps): bump github.com/moby/moby/client from 0.6.0 to 0.6.2 by @​dependabot[bot] in ClickHouse/clickhouse-go#2065
• chore(deps): bump github.com/shopspring/decimal from 1.4.0 to 1.5.0 by @​dependabot[bot] in ClickHouse/clickhouse-go#2061
• chore: upgrade golang 1.25 -> 1.26 by @​kavirajk in ClickHouse/clickhouse-go#2077
• chore(deps): bump golang.org/x/net from 0.58.0 to 0.61.0 by @​dependabot[bot] in ClickHouse/clickhouse-go#2064
• docs: note that the client works with Cloud and self-hosted by @​mikelewisCH in ClickHouse/clickhouse-go#2075
• chore(deps): bump go.opentelemetry.io/otel/trace from 1.46.0 to 1.47.0 by @​dependabot[bot] in ClickHouse/clickhouse-go#2051

New Contributors

• @​ccoltx made their first contribution in ClickHouse/clickhouse-go#2068
• @​mikelewisCH made their first contribution in ClickHouse/clickhouse-go#2075
• @​014-code made their first contribution in ClickHouse/clickhouse-go#1926

Full Changelog: ClickHouse/clickhouse-go@v2.49.0...v2.50.0

Sourced from github.com/ClickHouse/clickhouse-go/v2's changelog.

v2.50.0, 2026-10-26

What's Changed

Improvements 🚀

• fix: respect WithAsync in PrepareBatch for Native and HTTP by @​ccoltx in ClickHouse/clickhouse-go#2068

Bug Fixes 🐛

• fix(nullable): clear pointer destinations on null rows by @​014-code in ClickHouse/clickhouse-go#1926
• chore: handle the case where query goes to different replicas by @​kavirajk in ClickHouse/clickhouse-go#2081
• chore: fix potential flaky cases on cloud by @​kavirajk in ClickHouse/clickhouse-go#2083
• chore: careful with logging the DSN url by @​kavirajk in ClickHouse/clickhouse-go#2082

Other Changes 🛠

• chore(deps): bump github.com/moby/moby/client from 0.6.0 to 0.6.2 by @​dependabot[bot] in ClickHouse/clickhouse-go#2065
• chore(deps): bump github.com/shopspring/decimal from 1.4.0 to 1.5.0 by @​dependabot[bot] in ClickHouse/clickhouse-go#2061
• chore: upgrade golang 1.25 -> 1.26 by @​kavirajk in ClickHouse/clickhouse-go#2077
• chore(deps): bump golang.org/x/net from 0.58.0 to 0.61.0 by @​dependabot[bot] in ClickHouse/clickhouse-go#2064
• docs: note that the client works with Cloud and self-hosted by @​mikelewisCH in ClickHouse/clickhouse-go#2075
• chore(deps): bump go.opentelemetry.io/otel/trace from 1.46.0 to 1.47.0 by @​dependabot[bot] in ClickHouse/clickhouse-go#2051

New Contributors

• @​ccoltx made their first contribution in ClickHouse/clickhouse-go#2068
• @​mikelewisCH made their first contribution in ClickHouse/clickhouse-go#2075
• @​014-code made their first contribution in ClickHouse/clickhouse-go#1926

Full Changelog: ClickHouse/clickhouse-go@v2.49.0...v2.50.0

• 1c0a5f9 Update release notes
• 619220c Merge pull request #2082 from ClickHouse/kavirajk/redact-parse-in-dsn-parse-e...
• 413454d chore: fix the error message with more clear info
• 7a89b7f chore: handle edge cases with ? param
• 607e42e Merge pull request #2083 from ClickHouse/kavirajk/fix-potential-flaky-tests-c...
• 649884b chore: add agent instructions
• 098f98d chore: fix potential flaky cases on cloud
• 5ff1fe7 chore: do further trace on other edge cases
• 3a57d61 chore: address re-parse comment with tests
• f0fc7b5 Merge pull request #2081 from ClickHouse/kavirajk/fix-flaky-async-tests-on-cloud
• Additional commits viewable in compare view

Sourced from github.com/duckdb/duckdb-go/v2's releases.

v2.20000.0

[!IMPORTANT] Upgrades to DuckDB v2.0.0 through duckdb-go-bindings v0.20000.0. The native libraries now come from go.duckdb.org, so setups that restrict GOPROXY must allow it. The Go API is unchanged, but some behavior changes with DuckDB v2: RowsAffected for CREATE TABLE AS, profiling metrics, and dropped rows after a failed appender flush. Custom dynamic and static linking changed too. See Upgrading to DuckDB v2 in the README.

What's Changed

• fix: stop the interrupter goroutine when the wrapped call panics by @​hellower in duckdb/duckdb-go#190
• fix: bind nil elements of LIST and ARRAY parameters by @​hellower in duckdb/duckdb-go#191
• fix: bind nil composites as NULL and reject invalid values by @​mlafeldt in duckdb/duckdb-go#196
• Clarify parameter restrictions in multi-statement queries by @​mlafeldt in duckdb/duckdb-go#198
• Fix missing newlines in table UDF examples by @​mlafeldt in duckdb/duckdb-go#199
• Fix UUID sign bit when constructing bound values by @​mlafeldt in duckdb/duckdb-go#200
• Reject named arguments as positional binding fallbacks by @​mlafeldt in duckdb/duckdb-go#201
• Preserve the local calendar date when encoding DATE by @​mlafeldt in duckdb/duckdb-go#202
• Reject out-of-range DATE values instead of silently wrapping them by @​mlafeldt in duckdb/duckdb-go#203
• Update CI actions and golangci-lint by @​mlafeldt in duckdb/duckdb-go#205
• Run CI on Namespace runners to avoid hours-long queues by @​mlafeldt in duckdb/duckdb-go#206
• Skip macOS x64 tests on PRs by @​mlafeldt in duckdb/duckdb-go#211
• Reject Clear calls on closed appenders by @​mlafeldt in duckdb/duckdb-go#212
• Simplify CI runner and platform setup by @​mlafeldt in duckdb/duckdb-go#214
• Upgrade to DuckDB v2 by @​mlafeldt in duckdb/duckdb-go#217

Full Changelog: duckdb/duckdb-go@v2.10506.0...v2.20000.0

• bb8380a Merge pull request #217 from mlafeldt/duckdb-v2-bindings
• cd69e0f Document that a failed AppendRow does not append its row
• 76fd883 Verify the shared library the dynamic lib tests download
• 554d7ae Document upgrading to DuckDB v2
• c936ff5 Test dynamic and static linking against the bindings' DuckDB build
• 7863d1a Report dropped appender rows on Close until Clear acknowledges them
• 1ce76d5 Read profiling metrics from DuckDB v2's metric groups
• b4db755 Match DuckDB v2's query logging in TestLogStorage
• bc675d8 Expect CREATE TABLE AS to report its rows as affected
• 725eb6c Return nil for typed NULL UDF arguments instead of aborting
• Additional commits viewable in compare view

Sourced from github.com/googleapis/go-sql-spanner's releases.

v1.28.0

1.28.0 (2026-10-28)

Features

• Add driver support for Spanner Omni connection options (#927) (09e8564)
• Add support for parsing savepoint statements (#922) (7ae7869)

Bug Fixes

• Update all dependencies (#919) (f020b2a)
• Update dependency com.google.errorprone:error_prone_annotations to v2.51.0 (#921) (2d12eda)
• Update dependency io.grpc:grpc-bom to v1.84.3 (#916) (cd72bcb)
• Update dependency io.grpc:grpc-bom to v1.85.1 (#920) (290d0cd)

Sourced from github.com/googleapis/go-sql-spanner's changelog.

1.28.0 (2026-10-28)

Features

• Add driver support for Spanner Omni connection options (#927) (09e8564)
• Add support for parsing savepoint statements (#922) (7ae7869)

Bug Fixes

• Update all dependencies (#919) (f020b2a)
• Update dependency com.google.errorprone:error_prone_annotations to v2.51.0 (#921) (2d12eda)
• Update dependency io.grpc:grpc-bom to v1.84.3 (#916) (cd72bcb)
• Update dependency io.grpc:grpc-bom to v1.85.1 (#920) (290d0cd)

• 3c0bdca chore(main): release 1.28.0 (#918)
• 77a31ed chore: update module github.com/go-jose/go-jose/v4 to v4.1.6 [security] (#928)
• 290d0cd fix: update dependency io.grpc:grpc-bom to v1.85.1 (#920)
• 45639bf chore: update all dependencies to v26 (#926)
• f020b2a fix: update all dependencies (#919)
• 09e8564 feat: add driver support for Spanner Omni connection options (#927)
• ff8b8d0 chore: add SetTransactionActive method (#923)
• 7ae7869 feat: add support for parsing savepoint statements (#922)
• 840ef87 build: pin Ruby grpc to < 1.85 temporarily (#925)
• 2d12eda fix: update dependency com.google.errorprone:error_prone_annotations to v2.51...
• Additional commits viewable in compare view

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

• SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@​igor-kupczynski).
• Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @​president-xd.

Features

• Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)
• Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)
• pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)
• pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

• pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.
• pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

• b2ef08b Update changelog for v5.12.0
• 8199015 Merge commit from fork
• 5b1a6a0 Merge commit from fork
• 65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
• f2701a0 pgconn: only fall back when Windows service file is missing
• db95468 Merge pull request #2696 from k-zshiba/support-oid8
• fa2327d Start each query on a new line when joining a simple protocol batch
• 2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
• efc0b74 Merge upstream master into support-oid8
• 5a17450 pgconn: require AuthenticationOk before ReadyForQuery
• Additional commits viewable in compare view

Sourced from google.golang.org/api's releases.

v0.306.0

0.306.0 (2026-10-20)

Features

• all: Auto-regenerate discovery clients (#3779) (3b5f058)
• all: Auto-regenerate discovery clients (#3781) (795219d)

Bug Fixes

• gensupport: Defer chunk context cancellation until response body is closed (#3782) (ef4e011)

v0.305.0

0.305.0 (2026-10-18)

Features

• all: Auto-regenerate discovery clients (#3774) (d5374f1)
• all: Auto-regenerate discovery clients (#3776) (a306b7a)
• all: Auto-regenerate discovery clients (#3777) (abd2ce1)

Sourced from google.golang.org/api's changelog.

0.306.0 (2026-10-20)

Features

• all: Auto-regenerate discovery clients (#3779) (3b5f058)
• all: Auto-regenerate discovery clients (#3781) (795219d)

Bug Fixes

• gensupport: Defer chunk context cancellation until response body is closed (#3782) (ef4e011)

0.305.0 (2026-10-18)

Features

• all: Auto-regenerate discovery clients (#3774) (d5374f1)
• all: Auto-regenerate discovery clients (#3776) (a306b7a)
• all: Auto-regenerate discovery clients (#3777) (abd2ce1)

• 0d9c67e chore(main): release 0.306.0 (#3780)
• ef4e011 fix(gensupport): defer chunk context cancellation until response body is clos...
• 795219d feat(all): auto-regenerate discovery clients (#3781)
• 0bd75b9 chore(all): update all to ce908d2 (#3778)
• 3b5f058 feat(all): auto-regenerate discovery clients (#3779)
• b51045e chore(main): release 0.305.0 (#3775)
• abd2ce1 feat(all): auto-regenerate discovery clients (#3777)
• a306b7a feat(all): auto-regenerate discovery clients (#3776)
• d5374f1 feat(all): auto-regenerate discovery clients (#3774)
• See full diff in compare view

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

• stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • Special Thanks: @​aryansk
• metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
  • Special Thanks: @​yuyangguo42

Bug Fixes

• transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
• server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • Special Thanks: @​stanhu
• server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
• server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
• xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • Special Thanks: @​winklemad
• client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • Special Thanks: @​nvxbug
• transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
  • Special Thanks: @​buger

• c9ab42c Change version to 1.85.0 (#9434)
• bfb7561 cherry pick (#9433) and (#9563) (#9566)
• 46a2db2 *: update dockerfiles to build using go1.26 to match go.mod (#9548)
• 076bb1c Cherrypick #9533 to v1.85.x. (#9534)
• baaf083 *: update the net package and go version (#9506)
• 678b9b3 Cherrypick #9385 to v1.85.x (#9504)
• 705f9b9 Cherry-pick #9425 into v1.85.x (#9438)
• 1648161 transport: stop read throttling due to controlBuf size, on the client (#9431)
• 1863b59 protoc-gen-go-grpc: Update supported Edition to 2026 (#9426)
• d331f11 server: release mutex while waiting for handlers in stop() (#9394)
• Additional commits viewable in compare view

Sourced from github.com/duckdb/duckdb-go/v2's releases.

v2.20000.0

[!IMPORTANT] Upgrades to DuckDB v2.0.0 through duckdb-go-bindings v0.20000.0. The native libraries now come from go.duckdb.org, so setups that restrict GOPROXY must allow it. The Go API is unchanged, but some behavior changes with DuckDB v2: RowsAffected for CREATE TABLE AS, profiling metrics, and dropped rows after a failed appender flush. Custom dynamic and static linking changed too. See Upgrading to DuckDB v2 in the README.

What's Changed

• fix: stop the interrupter goroutine when the wrapped call panics by @​hellower in duckdb/duckdb-go#190
• fix: bind nil elements of LIST and ARRAY parameters by @​hellower in duckdb/duckdb-go#191
• fix: bind nil composites as NULL and reject invalid values by @​mlafeldt in duckdb/duckdb-go#196
• Clarify parameter restrictions in multi-statement queries by @​mlafeldt in duckdb/duckdb-go#198
• Fix missing newlines in table UDF examples by @​mlafeldt in duckdb/duckdb-go#199
• Fix UUID sign bit when constructing bound values by @​mlafeldt in duckdb/duckdb-go#200
• Reject named arguments as positional binding fallbacks by @​mlafeldt in duckdb/duckdb-go#201
• Preserve the local calendar date when encoding DATE by @​mlafeldt in duckdb/duckdb-go#202
• Reject out-of-range DATE values instead of silently wrapping them by @​mlafeldt in duckdb/duckdb-go#203
• Update CI actions and golangci-lint by @​mlafeldt in duckdb/duckdb-go#205
• Run CI on Namespace runners to avoid hours-long queues by @​mlafeldt in duckdb/duckdb-go#206
• Skip macOS x64 tests on PRs by @​mlafeldt in duckdb/duckdb-go#211
• Reject Clear calls on closed appenders by @​mlafeldt in duckdb/duckdb-go#212
• Simplify CI runner and platform setup by @​mlafeldt in duckdb/duckdb-go#214
• Upgrade to DuckDB v2 by @​mlafeldt in duckdb/duckdb-go#217

Full Changelog: duckdb/duckdb-go@v2.10506.0...v2.20000.0

• bb8380a Merge pull request #217 from mlafeldt/duckdb-v2-bindings
• cd69e0f Document that a failed AppendRow does not append its row
• 76fd883 Verify the shared library the dynamic lib tests download
• 554d7ae Document upgrading to DuckDB v2
• c936ff5 Test dynamic and static linking against the bindings' DuckDB build
• 7863d1a Report dropped appender rows on Close until Clear acknowledges them
• 1ce76d5 Read profiling metrics from DuckDB v2's metric groups
• b4db755 Match DuckDB v2's query logging in TestLogStorage
• bc675d8 Expect CREATE TABLE AS to report its rows as affected
• 725eb6c Return nil for typed NULL UDF arguments instead of aborting
• Additional commits viewable in compare view

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

• SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@​igor-kupczynski).
• Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @​president-xd.

Features

• Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)
• Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)
• pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)
• pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

• pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.
• pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

• b2ef08b Update changelog for v5.12.0
• 8199015 Merge commit from fork
• 5b1a6a0 Merge commit from fork
• 65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
• f2701a0 pgconn: only fall back when Windows service file is missing
• db95468 Merge pull request #2696 from k-zshiba/support-oid8
• fa2327d Start each query on a new line when joining a simple protocol batch
• 2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
• efc0b74 Merge upstream master into support-oid8
• 5a17450 pgconn: require AuthenticationOk before ReadyForQuery
• Additional commits viewable in compare view

Sourced from github.com/jackc/pgx/v5's changelog.

5.12.0 (October 30, 2026)

This release fixes two security vulnerabilities with narrow triggering conditions but serious impact. Affected applications should upgrade to v5.12.0; see Security Fixes below.

It also adds batched transaction startup, client certificate policy controls, and per-query batch timing, and improves connection pool cancellation and type handling. Custom implementations of BatchResults, including mocks, must add the new Tx method.

Security Fixes

• SQL injection in simple-protocol batches (GHSA-j38q-h3ph-jjpq, high severity). In pgx v5 before v5.12.0, SendBatch using the non-default simple protocol could allow arbitrary SQL execution with the application's database privileges when a queued query ends in a -- comment without a newline and the next query has an attacker-controlled string argument on its first line. Batched queries are now separated by a newline to end such comments. Extended-protocol modes are unaffected. Reported by Igor Kupczyński (@​igor-kupczynski).
• Bypass of require_auth and channel_binding=require (GHSA-95fj-3fxw-g62g, high severity). In pgx v5.9.0 through v5.11.0, applications relying on these settings without verifying the server's identity with sslmode=verify-full (or equivalent TLS verification) could accept an impersonating server that skips authentication. The attacker could read queries and parameters and return fabricated results. pgx now enforces authentication completion and required channel binding before accepting the connection. This vulnerability does not bypass TLS server certificate verification. Reported by @​president-xd.

Features

• Add Batch.BeginTx and BatchResults.Tx to begin a transaction as the first query of a batch, saving the round trip for BeginTx. Call Batch.BeginTx before queuing any queries, consume the begin query's result first, and close the batch before using the transaction. With pgxpool.Pool.SendBatch, the connection remains acquired until the transaction is committed or rolled back. Add FailedBatchResults for wrappers that fail before sending a batch (Timo Furrer)
• Add TraceBatchQueryData.ReadStartTime and per-query durations to tracelog batch query entries. These measure result consumption, including application time spent reading rows, rather than server execution alone (Yasser-Ameur)
• pgconn: support the sslcertmode connection parameter, PGSSLCERTMODE environment variable, and Config.SSLCertMode. The default, allow, sends an available client certificate when requested; disable prevents sending one and skips loading certificate/key files; require fails unless the server requests and receives a certificate. require does not guarantee server-side certificate validation, disables TLS session resumption, and stops further host or TLS fallbacks when the certificate requirement fails (k-zshiba)
• pgtype: add support for PostgreSQL 19's oid8 and oid8[] (k-zshiba)

Changes

• pgxpool: background attempts to satisfy MinConns and MinIdleConns now have a 60-second timeout, including connection hooks. Initial background connections preserve the constructor context's values but ignore its cancellation and deadline.
• pgxpool: canceling Acquire during a health-check ping now returns promptly and lets a successful ping return

... (truncated)

• b2ef08b Update changelog for v5.12.0
• 8199015 Merge commit from fork
• 5b1a6a0 Merge commit from fork
• 65a4125 Merge pull request #2697 from b84330808/windows-default-servicefile
• f2701a0 pgconn: only fall back when Windows service file is missing
• db95468 Merge pull request #2696 from k-zshiba/support-oid8
• fa2327d Start each query on a new line when joining a simple protocol batch
• 2283b85 pgconn: read the default service file from %APPDATA%\postgresql on Windows
• efc0b74 Merge upstream master into support-oid8
• 5a17450 pgconn: require AuthenticationOk before ReadyForQuery
• Additional commits viewable in compare view

Sourced from google.golang.org/api's releases.