fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
gcr.io/cloud-sql-connectors/cloud-sql-proxy		minor	2.21.3 → 2.22.0
github.com/getsentry/sentry-go	require	minor	v0.45.1 → v0.46.2
github.com/go-gormigrate/gormigrate/v2	require	patch	v2.1.5 → v2.1.6
golangci/golangci-lint	uses-with	minor	v2.11.4 → v2.12.2
google.golang.org/grpc	require	minor	v1.80.0 → v1.81.1

---

Release Notes

GoogleCloudPlatform/cloud-sql-proxy (gcr.io/cloud-sql-connectors/cloud-sql-proxy)

v2.22.0

Compare Source

Features

• drop support for Bullseye container (#​2600) (60311ab)

getsentry/sentry-go (github.com/getsentry/sentry-go)

v0.46.2: 0.46.2

Compare Source

Bug Fixes 🐛

• Add attachments to new event path by @​giortzisg in #​1295

v0.46.1: 0.46.1

Compare Source

Bug Fixes 🐛

• Correctly capture request body for fasthttp and fiber by @​giortzisg in #​1284
• (http) Avoid async transport shutdown panics by @​giortzisg in #​1288
• (httpclient) Clone request before adding trace headers by @​giortzisg in #​1290
• (scope) Use scoped client for request PII by @​giortzisg in #​1289
• Safe concurrent access for span and scope by @​giortzisg in #​1285

v0.46.0: 0.46.0

Compare Source

Breaking Changes 🛠

• Remove SetExtra by @​giortzisg in #​1274
• Update compatibility policy to align with Go, supporting only the last two major Go versions by @​giortzisg in #​1264
• Drop support for Go 1.24 by @​giortzisg in #​1264

New Features ✨

• Add internal_sdk_error client report on serialization fail by @​giortzisg in #​1273
• Add grpc integration support by @​ribice in #​938
• Re-enable Telemetry Processor by default. To disable the behavior use the DisableTelemetryBuffer flag by @​giortzisg in #​1254
• Simplify client DSN storage to internal/protocol.Dsn and make it safe to access by @​giortzisg in #​1254

Internal Changes 🔧

Deps

• Bump github.com/labstack/echo/v5 from 5.0.0 to 5.0.3 in /echo by @​dependabot in #​1253
• Bump github.com/labstack/echo/v5 from 5.0.0 to 5.0.3 in /crosstest by @​dependabot in #​1272
• Bump golangci-lint action from 2.1.1 to 2.11.4 by @​giortzisg in #​1265
• Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 in /otel by @​dependabot in #​1256
• Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.40.0 to 1.43.0 in /otel/otlp by @​dependabot in #​1255

Other

• Improve ci by @​giortzisg in #​1271
• Add crosstest package by @​giortzisg in #​1269
• Add sentrytest package by @​giortzisg in #​1267

go-gormigrate/gormigrate (github.com/go-gormigrate/gormigrate/v2)

v2.1.6

Compare Source

• chore: bump go 1.25 => 1.26, update go deps
• chore(ci): bump github actions
• chore: bump db images for integration testing
  • postgres: 18 => 19
  • mariadb: 11 => 12
  • mssql/server: 2022 => 2025

golangci/golangci-lint (golangci/golangci-lint)

v2.12.2

Compare Source

Released on 2026-05-06

1. Linters bug fixes
   • gomodguard_v2: fix blocked configuration
   • gomodguard_v2: from 2.1.0 to 2.1.3
   • iface: from 1.4.1 to 1.4.2

v2.12.1

Compare Source

Released on 2026-05-01

1. Linters bug fixes
   • gomodguard_v2: fix panic with migration suggestion
2. Misc.
   • fix install.sh script (if you are still using an URL based on the branch master, please update to use https://golangci-lint.run/install.sh)

v2.12.0

Compare Source

Released on 2026-05-01

1. New linters
   • Add clickhouselint linter https://github.com/ClickHouse/clickhouse-go-linter
2. Linters new features or changes
   • dupl: from f665c8d to c99c5cf (extended detection)
   • funcorder: from 0.5.0 to 0.6.0 (new option: function)
   • goconst: add an option to ignore strings from tests
   • goconst: from 1.8.2 to 1.10.0 (extended detection)
   • gomodguard_v2: from 1.4.1 to 2.1.0 (major version with new configuration)
   • gosec: from 619ce21 to 2.26.1 (new checks: G124, G708, G709, G710)
   • govet: add inline analyzer
   • makezero: from 2.1.0 to 2.2.1 (support slice type aliases)
   • paralleltest: expose checkcleanup option
   • sloglint: from 0.11.1 to 0.12.0 (new options: allowed-keys, custom-funcs)
   • wsl_v5: from 5.6.0 to 5.8.0 (new option: cuddle-max-statements; new checks: after-decl, after-defer, after-expr, after-go, cuddle-group)
3. Linters bug fixes
   • forbidigo: from 2.3.0 to 2.3.1
   • godot: from 1.5.4 to 1.5.6
   • govet-modernize: from 0.43.0 to 0.44.0
   • ireturn: from 0.4.0 to 0.4.1
   • rowserrcheck: from 1.1.1 to c5f79b8
4. Misc.
   • Decrease cache entropy
   • Embed the JSON schema in the binary
   • Filter env vars when cloning the repository with the custom command

grpc/grpc-go (google.golang.org/grpc)

v1.81.1: Release 1.81.1

Compare Source

Security

• xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per gRFC A41. (#​9111)
  • Special Thanks: @​al4an444

v1.81.0: Release 1.81.0

Compare Source

Behavior Changes

• balancer/rls: Switch gauge metrics to asynchronous emission (once per collection cycle) to reduce telemetry noise and align with other gRPC language implementations. (#​8808)

Dependencies

• Minimum supported Go version is now 1.25. (#​8969)

Bug Fixes

• xds: Use the leaf cluster's security config for the TLS handshake instead of the aggregate cluster's config. (#​8956)
• transport: Send a RST_STREAM when receiving an END_STREAM when the stream is not already half-closed. (#​8832)
• xds: Fix ADS resource name validation to prevent a panic. (#​8970)

New Features

• grpc/stats: Add support for custom labels in per-call metrics (gRFC A108). (#​9008)
• xds: Add support for Server Name Indication (SNI) and SAN validation (gRFC A101). Disabled by default. To enable, set GRPC_EXPERIMENTAL_XDS_SNI=true environment variable. (#​9016)
• xds: Add support to control which fields get propagated from ORCA backend metric reports to LRS load reports (gRFC A85). Disabled by default. To enable, set GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION=true. (#​9005)
• xds: Add metrics to track xDS client connectivity and cached resource state (gRFC A78). (#​8807)
• stats/otel: Enhance grpc.subchannel.disconnections metric by adding disconnection reason to the grpc.disconnect_error label (gRFC A94). This provides granular insights into why subchannels are closing. (#​8973)
• mem: Add mem.Buffer.Slice() API to slice the buffer like a slice. (#​8977)
  • Special Thanks: @​ash2k

Performance Improvements

• alts: Pool read buffers to lower memory utilization when sockets are unreadable. (#​8964)
• transport: Pool HTTP/2 framer read buffers to reduce idle memory consumption. Currently limited to Linux for ALTS and non-encrypted transports (TCP, Unix). To disable, set GRPC_GO_EXPERIMENTAL_HTTP_FRAMER_READ_BUFFER_POOLING=false and report any issues. (#​9032)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: client/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 5 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.49.0 -> v0.51.0
golang.org/x/sys	v0.40.0 -> v0.42.0
golang.org/x/text	v0.33.0 -> v0.34.0
google.golang.org/genproto/googleapis/api	v0.0.0-20260120221211-b8f7ae30c516 -> v0.0.0-20260226221140-a57be14db171
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260120221211-b8f7ae30c516 -> v0.0.0-20260226221140-a57be14db171