chore(deps): bump the go-deps group across 1 directory with 3 updates

[dependabot]

Bumps the go-deps group with 3 updates in the / directory: github.com/go-chi/chi/v5, github.com/go-sql-driver/mysql and golang.org/x/crypto.

Updates github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.2

What's Changed

• feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @​VojtechVitek in go-chi/chi#1151
• docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @​VojtechVitek in go-chi/chi#1111
• fix: don't drop handlers that collide with a Mount()/Route() pattern by @​VojtechVitek in go-chi/chi#1148
• Don't duplicate methods in Allow: header for 405 responses by @​flimzy in go-chi/chi#1029
• fix(middleware): reject catch-all compress wildcards by @​VojtechVitek in go-chi/chi#1156
  • middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in go-chi/chi#868 and go-chi/chi#1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

Commits

• 3893906 fix(middleware): reject catch-all compress wildcards "/" and "/*" (#1156)
• 9b6ddcd Don't duplicate methods in Allow: header for 405 responses (#1029)
• 29164f0 fix: don't drop handlers that collide with a Mount()/Route() pattern (#1148)
• bc02284 docs: deployment recipe + verify checklist for ClientIPFromXFFTrustedProxies ...
• 60ecea5 feat(middleware): add text/markdown, text/csv, text/vtt to default compressib...
• See full diff in compare view

Updates github.com/go-sql-driver/mysql from 1.10.0 to 1.10.1

Release notes

Sourced from github.com/go-sql-driver/mysql's releases.

v1.10.1

What's Changed

• dsn: default Net to tcp in NewConfig so Addr-only configs round-trip by @​c-tonneslan in go-sql-driver/mysql#1770
• Add LTS MariaDB 11.8 and 12.3 into the testing matrix by @​pgporada in go-sql-driver/mysql#1774
• Bump actions/checkout from 6 to 7 in the all-dependencies group by @​dependabot[bot] in go-sql-driver/mysql#1777
• ci: pin actions by @​methane in go-sql-driver/mysql#1778
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in go-sql-driver/mysql#1779
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in go-sql-driver/mysql#1780
• Interpolate typed-nil json.RawMessage as NULL by @​oha-4 in go-sql-driver/mysql#1782
• Bump actions/setup-go from 6.5.0 to 7.0.0 in the all-dependencies group by @​dependabot[bot] in go-sql-driver/mysql#1783
• Bump the all-dependencies group across 1 directory with 5 updates by @​dependabot[bot] in go-sql-driver/mysql#1791
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in go-sql-driver/mysql#1794
• Bump the all-dependencies group with 5 updates by @​dependabot[bot] in go-sql-driver/mysql#1795
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in go-sql-driver/mysql#1796
• codeql: remove custom workflow by @​methane in go-sql-driver/mysql#1799
• doc: clarify timeTruncate units and when to use it by @​milanobrtlik in go-sql-driver/mysql#1792
• release v1.10.1 by @​methane in go-sql-driver/mysql#1801

New Contributors

• @​c-tonneslan made their first contribution in go-sql-driver/mysql#1770
• @​oha-4 made their first contribution in go-sql-driver/mysql#1782
• @​milanobrtlik made their first contribution in go-sql-driver/mysql#1792

Full Changelog: go-sql-driver/mysql@v1.10.0...v1.10.1

Changelog

Sourced from github.com/go-sql-driver/mysql's changelog.

v1.10.1 (2026-09-02)

• Fix Config.FormatDSN() dropping Addr when Net is empty. It now uses the default tcp network so configs with only Addr round-trip correctly. (#1770)

• Fix typed-nil json.RawMessage with interpolateParams=true being interpolated as an empty string. It is now interpolated as SQL NULL, matching server-side prepared statements. (#1782)

• Add MariaDB 11.8 and 12.3 to the test matrix. (#1774)

Commits

• 7ca26e8 release v1.10.1 (#1801)
• 87dcb95 doc: clarify timeTruncate units and when to use it (#1792)
• 1d9c421 codeql: remove custom workflow (#1799)
• 532b8e5 Bump the all-dependencies group with 3 updates (#1796)
• fe209cc Bump the all-dependencies group with 5 updates (#1795)
• 03d76c7 Bump the all-dependencies group with 3 updates (#1794)
• c426bd9 Bump the all-dependencies group across 1 directory with 5 updates (#1791)
• 416cd99 Bump actions/setup-go from 6.5.0 to 7.0.0 in the all-dependencies group (#1783)
• b96d415 Interpolate typed-nil json.RawMessage as NULL (#1782)
• dec193d Bump the all-dependencies group with 3 updates (#1780)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.54.0 to 0.57.0

Commits

• 3f62bf1 go.mod: update golang.org/x dependencies
• 86efde5 ssh: reject unexpected message types on established channels
• a6cdac6 ssh: drop traffic on undecided channels
• 39dc44e ssh: don't skip the source-address critical option in CheckCert
• afebf4c x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+
• 89f4e9b x509roots/fallback: update bundle
• 71488c4 ssh/knownhosts: compare only public key portions for revocation
• 82adefa ssh: synchronize unexpected response test
• c757c98 all: upgrade go directive to at least 1.26.0 [generated]
• 593c81a ssh: correctly ignore pre-banner lines
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions