Bump github.com/kataras/pg from 1.0.12-0.20251023123148-39cf20618fe4 to 1.0.14 in /pg

[dependabot]

Bumps github.com/kataras/pg from 1.0.12-0.20251023123148-39cf20618fe4 to 1.0.14.

Release notes

Sourced from github.com/kataras/pg's releases.

v1.0.14

Go 1.27 lets a method declare its own type parameters. Every package-level generic helper in this library existed only because that was impossible before, so they are methods on *DB now and the free functions are gone. If you call pg.QuerySlice, pg.QueryStructs or any of their siblings, this release will not compile until you move the call onto the receiver.

The go directive is go 1.27, a hard floor on the whole build graph: your own module has to declare go 1.27 or later. In return, uuid.UUID from the standard library is a first-class field type, and the JSON paths run on encoding/json/v2.

pgx moves to v5.10.0, picking up an upstream SQL injection fix.

go get github.com/kataras/pg@v1.0.14

The import path is unchanged. No /v2.

Breaking

The generic query helpers are methods

Rewrite pg.X[T](https://github.com/kataras/pg/blob/HEAD/ctx, db, ...) as db.X[T](https://github.com/kataras/pg/blob/HEAD/ctx, ...):

// before
users, err := pg.QuerySlice[User](https://github.com/kataras/pg/blob/HEAD/ctx, db, "SELECT * FROM users WHERE age > $1", 18)
// after
users, err := db.QuerySlice[User](https://github.com/kataras/pg/blob/HEAD/ctx, "SELECT * FROM users WHERE age > $1", 18)

The whole set moved: QuerySlice, QueryTwoSlices, QueryMap, QuerySingle, QueryFunc, QueryStructs, QueryStruct, QueryIter and UpdateOrInsert. In desc, the three scanning helpers became methods on *desc.Table the same way, so desc.RowsToStruct[T](https://github.com/kataras/pg/blob/HEAD/td, rows) is now td.RowsToStruct[T](https://github.com/kataras/pg/blob/HEAD/rows).

pg.NewRepository[T], pg.ScanStructs[T], pg.UnmarshalNotification[T], pg.Ptr and pg.NullIfZero did not move. The last three cannot: their natural receivers (Rows, Notification) are aliases to pgx types, and Go has no methods on non-local types.

pg.InTransaction[R] became DB.InTransactionWrap[R]

A rename, not just a move, because DB.InTransaction already exists and a receiver gets one method per name. The two do different things:

// unchanged
err := db.InTransaction(ctx, func(txDB *pg.DB) error { ... })
</tr></table> 

... (truncated)

Changelog

Sourced from github.com/kataras/pg's changelog.

[1.0.14] - 2026-08-21

Migration to Go 1.27. The go directive is now go 1.27, which is a hard floor on the whole build graph: a module that consumes this one must declare go 1.27 or later itself. The pgx dependency also moves to v5.10.0, which carries an upstream SQL injection fix.

Breaking

• The package-level generic query helpers are now generic methods on *DB, and the functions were removed. Go 1.27 allows a method to declare its own type parameters, which is the only reason these were ever free functions. Rewrite pg.X[T](https://github.com/kataras/pg/blob/main/ctx, db, ...) as db.X[T](https://github.com/kataras/pg/blob/main/ctx, ...): QuerySlice, QueryTwoSlices, QueryMap, QuerySingle, QueryFunc, QueryStructs, QueryStruct, QueryIter and UpdateOrInsert. Likewise desc.RowsToStruct[T](https://github.com/kataras/pg/blob/main/td, rows), desc.RowToStruct and desc.RowsToStructWithTotal became methods on *desc.Table: td.RowsToStruct[T](https://github.com/kataras/pg/blob/main/rows). The break is compile-time.
• pg.InTransaction[R] became DB.InTransactionWrap[R] - a rename, not just a move, because DB.InTransaction already exists and a method name must be unique per receiver. The two are different things: db.InTransaction(ctx, func(*DB) error) is unchanged, while db.InTransactionWrap(ctx, wrap, fn) rebuilds a typed repository wrapper around the transactional *DB.
• NOTIFY payload bytes changed for strings containing <, > or &. The library now marshals with encoding/json/v2, which does not HTML-escape those characters the way v1 did. Payloads still round-trip correctly through UnmarshalNotification and ListenTable; only a non-Go consumer reading the raw channel, or a test comparing raw bytes, can observe it.
• A json:"-," tag on a scanned struct is now an error. v1 read the trailing comma as "a field literally named -"; encoding/json/v2 rejects it as a malformed tag, so a JSON/JSONB column decoding into such a struct now fails instead of populating that field. A bare json:"-" still skips the field, as before. This affects decoding only - desc.LooseTable parses the json tag itself when deriving a column name, so column naming is unchanged.

pg.NewRepository[T], pg.ScanStructs[T], pg.UnmarshalNotification[T], pg.Ptr and pg.NullIfZero are unchanged. The last three cannot become methods at all: their natural receivers (Rows, Notification) are aliases to pgx types, and Go does not allow methods on non-local types.

Added

• The Go 1.27 standard library uuid package is a first-class field type. A uuid.UUID field maps to a uuid column and []uuid.UUID to uuid[], with no type= tag needed; a non-nullable uuid.UUID primary key still gets the automatic DEFAULT gen_random_uuid(), and a zero uuid.UUID is treated as unset so the server generates the value. Previously such a field was silently classified as text, because uuid.UUID satisfies fmt.Stringer and hit that fallback. String-based UUID fields are unaffected, and other 16-byte UUID types (github.com/google/uuid, gofrs/uuid) still need an explicit pg:"type=uuid" tag - matching them by shape would misclassify an MD5 digest, which belongs in bytea.
• DB.NewRepositoryhttps://github.com/kataras/pg/blob/main[https://github.com/kataras/pg/blob/mainThttps://github.com/kataras/pg/blob/main]https://github.com/kataras/pg/blob/main(https://github.com/kataras/pg/blob/main)https://github.com/kataras/pg/blob/mainhttps://github.com/kataras/pg/blob/main https://github.com/kataras/pg/blob/mainahttps://github.com/kataras/pg/blob/mainshttps://github.com/kataras/pg/blob/main https://github.com/kataras/pg/blob/mainahttps://github.com/kataras/pg/blob/main https://github.com/kataras/pg/blob/mainmhttps://github.com/kataras/pg/blob/mainehttps://github.com/kataras/pg/blob/mainthttps://github.com/kataras/pg/blob/mainhhttps://github.com/kataras/pg/blob/mainohttps://github.com/kataras/pg/blob/maindhttps://github.com/kataras/pg/blob/main https://github.com/kataras/pg/blob/mainahttps://github.com/kataras/pg/blob/mainlhttps://github.com/kataras/pg/blob/mainthttps://github.com/kataras/pg/blob/mainehttps://github.com/kataras/pg/blob/mainrhttps://github.com/kataras/pg/blob/mainnhttps://github.com/kataras/pg/blob/mainahttps://github.com/kataras/pg/blob/mainthttps://github.com/kataras/pg/blob/mainihttps://github.com/kataras/pg/blob/mainvhttps://github.com/kataras/pg/blob/mainehttps://github.com/kataras/pg/blob/main https://github.com/kataras/pg/blob/mainthttps://github.com/kataras/pg/blob/mainohttps://github.com/kataras/pg/blob/main https://github.com/kataras/pg/blob/main`https://github.com/kataras/pg/blob/mainphttps://github.com/kataras/pg/blob/mainghttps://github.com/kataras/pg/blob/main.https://github.com/kataras/pg/blob/mainNhttps://github.com/kataras/pg/blob/mainehttps://github.com/kataras/pg/blob/mainwhttps://github.com/kataras/pg/blob/mainRhttps://github.com/kataras/pg/blob/mainehttps://github.com/kataras/pg/blob/mainphttps://github.com/kataras/pg/blob/mainohttps://github.com/kataras/pg/blob/mainshttps://github.com/kataras/pg/blob/mainihttps://github.com/kataras/pg/blob/mainthttps://github.com/kataras/pg/blob/mainohttps://github.com/kataras/pg/blob/mainrhttps://github.com/kataras/pg/blob/mainyhttps://github.com/kataras/pg/blob/main[https://github.com/kataras/pg/blob/mainThttps://github.com/kataras/pg/blob/main]https://github.com/kataras/pg/blob/main(https://github.com/kataras/pg/blob/maindhttps://github.com/kataras/pg/blob/mainbhttps://github.com/kataras/pg/blob/main)https://github.com/kataras/pg/blob/main`.
• nullableScanner now falls back to encoding.TextUnmarshaler for a text-form driver value. This is what makes a nullable uuid.UUID column work: pgx hands a sql.Scanner the canonical uuid string, and a Go string is neither assignable nor convertible to a [16]byte-based type.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}