[dependabot]

Bumps the go-modules group with 5 updates in the / directory:

Package	From	To
github.com/oschwald/maxminddb-golang/v2	2.7.0	2.8.0
golang.org/x/crypto	0.57.0	0.58.0
golang.org/x/net	0.60.0	0.61.0
golang.org/x/sync	0.23.0	0.24.0
golang.org/x/text	0.42.0	0.43.0

Updates github.com/oschwald/maxminddb-golang/v2 from 2.7.0 to 2.8.0

Release notes

Sourced from github.com/oschwald/maxminddb-golang/v2's releases.

2.8.0

• String caching now uses buckets to improve concurrent decoding. On 64-bit systems, the table grows from 64 KiB to 72 KiB and is allocated only when an eligible string is decoded. Entry capacity grows from 4,096 to 7,168, which can also increase retained string memory. Pull request by James Ranson. GitHub #252.
• Standalone mmdbdata.NewDecoder calls now default to no string cache. This reduces setup cost for short-lived decoders. Use the new mmdbdata.WithStringCache() option for repeated reads through a retained decoder or its cursors. Without the option, repeated string reads can allocate more and run slower. Cursors supplied by a Reader continue to share its caching policy.
• Added mmdbdata.Decoder.CursorAt(offset) to read independent records from one buffer without changing the decoder's position. The cursors share its string cache and can be read concurrently while the buffer remains valid and unchanged.
• Reduced maxminddb-gen generation and test time by reusing loaded dependencies during output validation, avoiding duplicate syntax work, and omitting unused parser metadata. Full type checking and generated-output validation remain enabled. Validation normalizes paths from package loaders to avoid false duplicate declarations. GitHub #256.
• Reduced reflection decoding overhead for string struct fields, including fields read through database pointers, while retaining existing validation and custom unmarshaling behavior.
• Shared string-cache handling between map keys and decoded string values.
• Fixed Reader.Verify() accepting invalid UTF-8 values overwritten by duplicate map keys. Verification now checks every encoded string in the data and metadata sections, including overwritten values.
• Fixed maxminddb-gen rejecting fields that use type aliases of supported types, including aliases in nested containers.
• Fixed maxminddb-gen panicking when a byte slice or its elements use an imported type alias.
• Fixed maxminddb-gen emitting inaccessible type names for imported container aliases with private element or map key types. Generated helpers infer those types while retaining allocation, overflow, and size checks.
• Fixed maxminddb-gen emitting private byte aliases in constraints for nested byte slice aliases.
• Fixed maxminddb-gen emitting inaccessible types for imported aliases whose generic arguments contain private types, fields, or methods.

Changelog

Sourced from github.com/oschwald/maxminddb-golang/v2's changelog.

2.8.0 - 2026-10-11

• String caching now uses buckets to improve concurrent decoding. On 64-bit systems, the table grows from 64 KiB to 72 KiB and is allocated only when an eligible string is decoded. Entry capacity grows from 4,096 to 7,168, which can also increase retained string memory. Pull request by James Ranson. GitHub #252.
• Standalone mmdbdata.NewDecoder calls now default to no string cache. This reduces setup cost for short-lived decoders. Use the new mmdbdata.WithStringCache() option for repeated reads through a retained decoder or its cursors. Without the option, repeated string reads can allocate more and run slower. Cursors supplied by a Reader continue to share its caching policy.
• Added mmdbdata.Decoder.CursorAt(offset) to read independent records from one buffer without changing the decoder's position. The cursors share its string cache and can be read concurrently while the buffer remains valid and unchanged.
• Reduced maxminddb-gen generation and test time by reusing loaded dependencies during output validation, avoiding duplicate syntax work, and omitting unused parser metadata. Full type checking and generated-output validation remain enabled. Validation normalizes paths from package loaders to avoid false duplicate declarations. GitHub #256.
• Reduced reflection decoding overhead for string struct fields, including fields read through database pointers, while retaining existing validation and custom unmarshaling behavior.
• Shared string-cache handling between map keys and decoded string values.
• Fixed Reader.Verify() accepting invalid UTF-8 values overwritten by duplicate map keys. Verification now checks every encoded string in the data and metadata sections, including overwritten values.
• Fixed maxminddb-gen rejecting fields that use type aliases of supported types, including aliases in nested containers.
• Fixed maxminddb-gen panicking when a byte slice or its elements use an imported type alias.
• Fixed maxminddb-gen emitting inaccessible type names for imported container aliases with private element or map key types. Generated helpers infer those types while retaining allocation, overflow, and size checks.
• Fixed maxminddb-gen emitting private byte aliases in constraints for nested byte slice aliases.
• Fixed maxminddb-gen emitting inaccessible types for imported aliases whose generic arguments contain private types, fields, or methods.

Commits

• a495bc9 Set release version and date
• aa0e63e Merge pull request #260 from oschwald/perf/generator-type-info
• 2e0ae68 Normalize file paths during generated-package validation
• d77548f Merge main into generator performance branch
• 1c70308 Reduce unused parser work in maxminddb-gen
• 9ce6d1e Reuse loaded packages when validating generated decoders
• df4444b Merge pull request #258 from oschwald/dependabot/go_modules/golang.org/x/tool...
• f1b833d Merge pull request #259 from oschwald/perf/string-field-decoding
• 0e60381 Support type aliases in generated decoder fields
• 7cc1919 Validate overwritten strings during database verification
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.57.0 to 0.58.0

Commits

• 8fdf07b go.mod: update golang.org/x dependencies
• 2437861 salsa20: fix keystream reuse in LoongArch LSX tail
• c3db4df acme: prefer test log helpers in test contexts
• 4e01a84 acme: adds support for profiles draft
• 8f0f111 ssh: check that no Unicode-aware string function is used
• b39ff6d ssh: add certificate algorithms for ML-DSA keys
• 4465db3 ssh: add the ML-DSA public key algorithms
• 83e695b ssh: implement ETM mode for CBC ciphers
• 946083a ssh: only drop a trailing carriage return
• 543dde9 ssh: accept known_hosts entries with a multi-word comment
• Additional commits viewable in compare view

Updates golang.org/x/net from 0.60.0 to 0.61.0

Commits

• c1d31df go.mod: update golang.org/x dependencies
• 8456a20 quic: properly check for allowed frame types in a packet
• See full diff in compare view

Updates golang.org/x/sync from 0.23.0 to 0.24.0

Commits

• 36f2d70 errgroup: modernize the usage of closures in goroutines
• See full diff in compare view

Updates golang.org/x/text from 0.42.0 to 0.43.0

Commits

• ac40b0f go.mod: update golang.org/x dependencies
• 6dcc5b6 unicode/bidi: avoid quadratic behavior in Paragraph.Order and Paragraph.Line
• d0ecd29 secure/bidirule: lazily precompute ASCII table
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!