[dependabot]

Bumps the go group in /backend with 3 updates: github.com/riverqueue/river, github.com/riverqueue/river/riverdriver/riverpgxv5 and github.com/riverqueue/river/rivertype.

Updates github.com/riverqueue/river from 0.49.0 to 0.50.0

Release notes

Sourced from github.com/riverqueue/river's releases.

v0.50.0

Changed

• Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
• Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

• Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
• Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
• Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
• Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
• Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
• Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
• Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

Changelog

Sourced from github.com/riverqueue/river's changelog.

[0.50.0] - 2026-10-26

Changed

• Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
• Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

• Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
• Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
• Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
• Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
• Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
• Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
• Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

Commits

• 3901b3d [go] Prepare v0.50.0 (#1552)
• 4647e69 [rust] Prepare v0.4.0 (#1550)
• dc6af86 [java] Publish complete GitHub release assets for the Maven proxy (#1543)
• c411fc1 [ruby] Prepare v0.14.0 (#1551)
• d89175d [js] Prepare v0.3.0 (#1549)
• 237ff56 [js] Remove automatic global polyfill (#1548)
• 23d2c7e [go, js] bump compatible dependencies (#1545)
• 274c4b1 [js] bump @​types/pg from 8.20.0 to 8.23.1 (#1547)
• 21ec5ea [go, js] refresh periodic schedules after commit (#1540)
• b3a0089 [ruby] open no savepoints inside a transaction (#1544)
• Additional commits viewable in compare view

Updates github.com/riverqueue/river/riverdriver/riverpgxv5 from 0.49.0 to 0.50.0

Release notes

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's releases.

v0.50.0

Changed

• Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
• Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

• Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
• Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
• Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
• Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
• Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
• Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
• Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

Changelog

Sourced from github.com/riverqueue/river/riverdriver/riverpgxv5's changelog.

[0.50.0] - 2026-10-26

Changed

• Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
• Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

• Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
• Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
• Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
• Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
• Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
• Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
• Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

Commits

• 3901b3d [go] Prepare v0.50.0 (#1552)
• 4647e69 [rust] Prepare v0.4.0 (#1550)
• dc6af86 [java] Publish complete GitHub release assets for the Maven proxy (#1543)
• c411fc1 [ruby] Prepare v0.14.0 (#1551)
• d89175d [js] Prepare v0.3.0 (#1549)
• 237ff56 [js] Remove automatic global polyfill (#1548)
• 23d2c7e [go, js] bump compatible dependencies (#1545)
• 274c4b1 [js] bump @​types/pg from 8.20.0 to 8.23.1 (#1547)
• 21ec5ea [go, js] refresh periodic schedules after commit (#1540)
• b3a0089 [ruby] open no savepoints inside a transaction (#1544)
• Additional commits viewable in compare view

Updates github.com/riverqueue/river/rivertype from 0.49.0 to 0.50.0

Release notes

Sourced from github.com/riverqueue/river/rivertype's releases.

v0.50.0

Changed

• Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
• Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

• Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
• Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
• Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
• Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
• Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
• Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
• Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

Changelog

Sourced from github.com/riverqueue/river/rivertype's changelog.

[0.50.0] - 2026-10-26

Changed

• Breaking: Resumable steps can no longer be nested. Calls fail before running child callbacks, preventing unreachable resume points and rolled-back parent checkpoints from being saved again. [PR #1534](riverqueue/river#1534).
• Job deletion through Client.JobDelete, Client.JobDeleteMany, their Tx variants, and the job cleaner now goes through optional pilot hooks, so a pilot can take part in deletes as it already can in cancels and retries. Behavior with the standard pilot is unchanged. [PR #1500](riverqueue/river#1500).

Fixed

• Refresh a durable periodic job's saved row only after its next run time is loaded at startup or committed. When a startup write rolled back, keep-alive could revive an expired row, and the next leader enqueued every run since the row's old next run time. [PR #1540](riverqueue/river#1540).
• Fail retries that omit a saved cursor-only step, while preserving their checkpoints for recovery. Jobs with an existing step marker retain their behavior, including legacy stale cursor entries. [PR #1534](riverqueue/river#1534).
• Fixed SQLite metadata updates recursively merging nested objects and deleting keys set to JSON null. Updates now replace whole top-level values, matching Postgres and preventing completed resumable cursor steps from running again on later retries. [PR #1533](riverqueue/river#1533).
• Fixed resumable transactional checkpoints being saved again after rollback or a failed write, and first-step cursors being lost on error, snooze, or cooperative shutdown. After a successful checkpoint write, the caller's transaction owns that progress; rollback may replay earlier unpersisted steps. The Rust, JavaScript, and Java runtimes now share the applicable behavior, including preserving progress on snooze. [PR #1521](riverqueue/river#1521).
• Fixed AddWorkerSafely leaving a worker's primary kind and earlier aliases registered when a later kind alias conflicts with an existing registration. Failed registrations now leave the worker registry unchanged. [PR #1440](riverqueue/river#1440).
• Fixed the notifier retrying without backoff and flooding logs when the context passed to Client.Start reaches its deadline. [PR #1495](riverqueue/river#1495).
• Fixed JobSnooze accepting negative durations despite documenting that they panic. [PR #1529](riverqueue/river#1529).

Commits

• 3901b3d [go] Prepare v0.50.0 (#1552)
• 4647e69 [rust] Prepare v0.4.0 (#1550)
• dc6af86 [java] Publish complete GitHub release assets for the Maven proxy (#1543)
• c411fc1 [ruby] Prepare v0.14.0 (#1551)
• d89175d [js] Prepare v0.3.0 (#1549)
• 237ff56 [js] Remove automatic global polyfill (#1548)
• 23d2c7e [go, js] bump compatible dependencies (#1545)
• 274c4b1 [js] bump @​types/pg from 8.20.0 to 8.23.1 (#1547)
• 21ec5ea [go, js] refresh periodic schedules after commit (#1540)
• b3a0089 [ruby] open no savepoints inside a transaction (#1544)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions