chore(deps): Bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 in /go in the go_modules group across 1 directory - #2
Closed
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the go_modules group with 1 update in the /go directory: [github.com/jackc/pgx/v5](https://github.com/jackc/pgx). Updates `github.com/jackc/pgx/v5` from 5.9.1 to 5.9.2 - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.9.1...v5.9.2) --- updated-dependencies: - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.9.2 dependency-type: direct:production dependency-group: go_modules ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Author
|
Looks like github.com/jackc/pgx/v5 is no longer updatable, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/go_modules/go/go_modules-dc1255629f
branch
April 23, 2026 16:43
GottZ
added a commit
that referenced
this pull request
May 5, 2026
… power) ComputeGravity backward decay now scales with date age. Older content gets a wider gravity well — a 6-month-old block under "vor 3 monaten" isn't drowned out by a 1-week-old block in the same query window. Future dates keep the existing 1.2× sharper cutoff. Branch Y of the multi-path bench welle (post-v1.0.4, target v1.1.0). Implements Forward Telescoping from B4 #2 / B5 (GottZ Temporal Gravity) in the power-law idiom — vision spec defines σ_back/σ_forward but the linear path uses 1/dist^p, so the equivalent transform is to lower the backward power for older blocks. Forward power untouched. Power profile (base p=1.5): age=1d → 1.49 (≈unchanged) age=30d → 1.24 age=90d → 1.06 age=180d → 0.95 age=365d → 0.86 Tests: - TestComputeGravity_BackwardPowerScalesWithAge: reverse-engineers the effective power from gravity score for 30d/180d/365d back, asserts the expected band. - TestComputeGravity_OlderBoostedMoreThanLinear: 90d-back gravity must exceed 0.005 (pre-Y was 0.00117, post-Y ~0.00919 — 8× boost). - TestComputeGravity_ForwardUnchangedFromBranchY: future 10d still scores 1/10^1.8 (1.2× power preserved). Existing tests stay green: FutureDecaysFaster verifies past>future relation under both old and new code; 30DaysAway/MinDistance bands absorb the modest age-effect. README updated with one-bullet description. Hypothesis (BRANCH-HYPOTHESIS-Y.md): Δ ≈ 0 in current 425-block corpus because all Y-target cases (M-007/009/010/015, L-009/010) are recent (1-26d), where age-factor is small (1.01-1.20). Bench will confirm or surface unexpected interactions. If Δ < 0: branch rejected.
GottZ
added a commit
that referenced
this pull request
May 27, 2026
… power) ComputeGravity backward decay now scales with date age. Older content gets a wider gravity well — a 6-month-old block under "vor 3 monaten" isn't drowned out by a 1-week-old block in the same query window. Future dates keep the existing 1.2× sharper cutoff. Branch Y of the multi-path bench welle (post-v1.0.4, target v1.1.0). Implements Forward Telescoping from B4 #2 / B5 (GottZ Temporal Gravity) in the power-law idiom — vision spec defines σ_back/σ_forward but the linear path uses 1/dist^p, so the equivalent transform is to lower the backward power for older blocks. Forward power untouched. Power profile (base p=1.5): age=1d → 1.49 (≈unchanged) age=30d → 1.24 age=90d → 1.06 age=180d → 0.95 age=365d → 0.86 Tests: - TestComputeGravity_BackwardPowerScalesWithAge: reverse-engineers the effective power from gravity score for 30d/180d/365d back, asserts the expected band. - TestComputeGravity_OlderBoostedMoreThanLinear: 90d-back gravity must exceed 0.005 (pre-Y was 0.00117, post-Y ~0.00919 — 8× boost). - TestComputeGravity_ForwardUnchangedFromBranchY: future 10d still scores 1/10^1.8 (1.2× power preserved). Existing tests stay green: FutureDecaysFaster verifies past>future relation under both old and new code; 30DaysAway/MinDistance bands absorb the modest age-effect. README updated with one-bullet description. Hypothesis (BRANCH-HYPOTHESIS-Y.md): Δ ≈ 0 in current 425-block corpus because all Y-target cases (M-007/009/010/015, L-009/010) are recent (1-26d), where age-factor is small (1.01-1.20). Bench will confirm or surface unexpected interactions. If Δ < 0: branch rejected.
GottZ
added a commit
that referenced
this pull request
Jun 27, 2026
actionRequiresAdmin → actionTier (tierOpen|tierTenantAdmin|tierServerAdmin) + requireTenantAdmin verdrahtet (enforceActionTier-Helfer). Schaltet die dormanten T22/T23/T24-Handler scharf: ein tenant-admin (owner|admin) darf api-key-create/list/delete gegen den EIGENEN Tenant; der feinkörnige Ziel-Tenant- Check liegt im Handler (T22 firstScopeOutsideTenant via context_tenant_scopes, T23 list-Filter tenant_id, T24 404-no-oracle delete). member → 403 (L4 doppelt zu: Action-Tier + kein tenant_role-Write-Param). FAIL-CLOSED-Schnitt (gegen design/05-Primärquelle + Live-Handler verifiziert, W3/W9): NUR api-key-* wird herabgestuft — deren Handler sind tenant-isoliert (L1/L2/L3 zu, Store-Layer tenant_id-WHERE selbst nachgelesen). mcp-client-*, backend-*, blocks-audit/classify-*, tenant-*, tenant-grant-* BLEIBEN server-admin, weil ihre Handler keinen Tenant-Filter tragen (handleMCPClientList nimmt kein AuthResult, handleBackendList ignoriert es, dispatchBlocksAction reicht keins durch) — Herabstufung wäre fail-OPEN. Wahrt die §7-Pausierbarkeits-Invariante: A8 öffnet nur was bereits isoliert ist, nie etwas das heute zu war. dream/gaming-mutation server-global by design (§4.4). Bewusste Abweichung von der §4.4-Tabelle (listet mcp/backend/audit als tenant-admin): §4.4 ist der Endzustand nach T26(A9)/T37/audit-Welle, nicht der heute sichere Schnitt. requireTenantAdmin = IsServerAdmin() || IsTenantAdminOf(ar.TenantID): server-admin short-circuit (§4.3 #2), damit ein degeneriert-leerer TenantID den Betreiber nicht aussperrt; der Leer-Guard bleibt scharf in IsTenantAdminOf für die in-Handler- Payload-Checks (caller-supplied targetTenant). TDD: rot (tenant-admin → 403 bei create/delete, want past-gate) → grün. Verify: 3-Linsen-adversarial (Code-Korrektheit / fail-open / Vollständigkeit, alle positiv) + eigene Store-Layer-Nachverifikation. golangci-lint 0 (Gate-Helfer extrahiert wg. Cyclomatic-Budget), handler+auth+store -short grün. README MT-Absatz fortgeschrieben. Vorbedingung für 03-W5 (T31) + 04-W5 (T37) — R-LEAK8. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GottZ
added a commit
that referenced
this pull request
Jul 5, 2026
…-C1-Fix) Der verifizierte B1-C1-Blocker: nodeAggSQL/edgeAggSQL nahmen nur visibleTypes und scannten die ganze graph_cluster_member — nach einem scope-gescopten DELETE überleben Fremd-Partition-Member, die Re-Aggregation erzeugt deren (cluster_id, scope)-Zeilen erneut und kollidiert mit dem PK (23505) ab Tenant #2. - Options.ScopeFilter (B-E3: Filter in der Aggregation, NICHT ON CONFLICT — das wäre cross-tenant-Überschreibung unter fremdem Typ-Policy-Snapshot). nil = globaler Lauf, verhaltensidentisch zum bisherigen Voll-Replace (TRUNCATE + ungescopte Aggregation). - persist/teardown: Teardown und Aggregation sind ein ATOMARES Paar in derselben advisory-locked Tx — gescopter DELETE (member/node per scope; edge mit AND auf BEIDEN Endpunkt-Scopes, Partition-Semantik = B-W6-loadEdges-Kontrakt und Read-Pfad-Regel) läuft nie ohne die gescopte Aggregation (nodeAggScopedSQL/edgeAggScopedSQL, $2 = Filter über die denormalisierte member.scope-Spalte aus 087). - Input-Purity-Guard: ScopeFilter non-nil + Input-Block außerhalb des Filters => lauter Fehler (Input-Scoping selbst — loadNodes/loadEdges — ist B-W6; bis dahin liefert der Aufrufer geschnittenen Input). - Meta bleibt beim gescopten Lauf unangetastet (057-Singleton würde globale Stats mit Partition-Zahlen überschreiben; per-scope-Meta ist B-W5 / Migration 088). - Cross-Partition-Mischkanten werden von gescopten Läufen bewusst nicht abgeräumt — Lebenszyklus gehört der B-W5/B-W6-Übergangslogik (Kommentar am edgeAggTemplate). - docs/multi-tenancy.md: B-W3-Absatz im 087-Abschnitt. Gates (alle grün, scoped_agg_integration_test.go): - Zwei-Scope-Fixture: private-gescopter Lauf lässt die work-Partition byte-identisch (Snapshot-Vergleich) und wirft keinen PK-Konflikt. - Rot-Probe: gescopter DELETE + UNGESCOPTE nodeAggSQL reproduziert SQLSTATE 23505 (der historische B1-C1-Bruchpfad, in Tx zurückgerollt). - Input-Purity: out-of-filter Input => lauter Fehler. - EXPLAIN-Doku-Probe (B2-MAJOR-2): Pläne der gescopten Aggregation + Teardown geloggt; edge-Zweig nutzt Index-Scans über member-PK + dream_links-PK. Befund: member(scope) hat KEINEN Index — der Teardown-DELETE ist bei 1M+ ein Seq-Scan-Kandidat; Index gehört in die 088-Migration (B-W5), hier keine neue Migration. go build + go test -short (29 Pakete) + overview/store-Integration + golangci-lint 0 issues grün. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GottZ
added a commit
to TurgutKural/ctx
that referenced
this pull request
Aug 2, 2026
The validation cascade checks Index coverage only — an entry without a
relevance_score field decoded to Go's zero value and passed every gate.
Sibling rerank dialects name the score field "score" (mixedbread, some
gateways), so pointing rerank.host at such a backend yielded all-zero
scores with err=nil: sigmoid(0)=0.5 for every document, rerankNorm 1.0
across the board, reranker silently neutralized while RerankWire
reports Wired=true and ReportUsage still charges the lease. The "data"
fallback newly exposes this lattice to the data-shaped backend class;
the same gap pre-existed on the "results" path.
Decode RelevanceScore as *float64 and reject nil entries — error →
caller fails open and keeps the RRF order, with a log line instead of
a silent no-op, matching the documented index-validation contract.
New TestScore_MissingRelevanceScoreFailsOpen covers both container
paths ("results" guards the pre-existing lattice, "data" the one the
fallback newly reaches).
Finding: review dimension "kern" GottZ#2 (PARTIAL — core confirmed by
differential probe Base vs HEAD; the pre-existing results-path gap is
closed by the same pointer check).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
GottZ
added a commit
to TurgutKural/ctx
that referenced
this pull request
Aug 2, 2026
…results "data" is the generic OpenAI-style list container, not a rerank-specific name. Declaring it as []rerankResult made the strict top-level decode fail on any backend that serves valid "results" alongside a non-array "data" field — a regression surface for the primary llama.cpp path over a field we do not even use in that case. Keep Data as json.RawMessage and unmarshal it only when "results" is empty and the fallback actually engages. A non-array "data" without "results" now yields a decode error naming the field and echoing the body snippet, consistent with the schema-break error of the previous wave. "data": null decodes to zero entries and falls through to that same dedicated error. Two new tests pin the llama.cpp non-regression (valid results + foreign data object) and the data-only decode failure. Findings: review dimensions "kern" GottZ#3 + "claims" GottZ#2 (both CONFIRMED), "tests" GottZ#3 (non-regression coverage for the primary path). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
GottZ
added a commit
to TurgutKural/ctx
that referenced
this pull request
Aug 2, 2026
The total_tokens fallback is backend-agnostic, not Voyage-gated: any backend whose usage carries total_tokens without prompt_tokens — Jina- shaped servers that worked fine over the results path included — silently moves from charge=0 + uncharged_calls++ to a real token charge in the MW22 fairness window. Substantively correct (total_tokens is a measurement, not an estimate — C1-conformant), but a silent semantics jump in a meter documented as "missing usage charges 0". Log a one-time INFO when the fallback first engages (rerank runs per query; per-call INFO would be noise) and extend the MW22 paragraph in docs/operations.md so anyone calibrating against the historic token curve finds the switch. Finding: review dimension "downstream" GottZ#2 (CONFIRMED — probe shows identical Jina-shaped response: Base ptoks=0/uncharged, HEAD ptoks=815/charged). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
GottZ
added a commit
that referenced
this pull request
Aug 2, 2026
The validation cascade checks Index coverage only — an entry without a
relevance_score field decoded to Go's zero value and passed every gate.
Sibling rerank dialects name the score field "score" (mixedbread, some
gateways), so pointing rerank.host at such a backend yielded all-zero
scores with err=nil: sigmoid(0)=0.5 for every document, rerankNorm 1.0
across the board, reranker silently neutralized while RerankWire
reports Wired=true and ReportUsage still charges the lease. The "data"
fallback newly exposes this lattice to the data-shaped backend class;
the same gap pre-existed on the "results" path.
Decode RelevanceScore as *float64 and reject nil entries — error →
caller fails open and keeps the RRF order, with a log line instead of
a silent no-op, matching the documented index-validation contract.
New TestScore_MissingRelevanceScoreFailsOpen covers both container
paths ("results" guards the pre-existing lattice, "data" the one the
fallback newly reaches).
Finding: review dimension "kern" #2 (PARTIAL — core confirmed by
differential probe Base vs HEAD; the pre-existing results-path gap is
closed by the same pointer check).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
GottZ
added a commit
that referenced
this pull request
Aug 2, 2026
…results "data" is the generic OpenAI-style list container, not a rerank-specific name. Declaring it as []rerankResult made the strict top-level decode fail on any backend that serves valid "results" alongside a non-array "data" field — a regression surface for the primary llama.cpp path over a field we do not even use in that case. Keep Data as json.RawMessage and unmarshal it only when "results" is empty and the fallback actually engages. A non-array "data" without "results" now yields a decode error naming the field and echoing the body snippet, consistent with the schema-break error of the previous wave. "data": null decodes to zero entries and falls through to that same dedicated error. Two new tests pin the llama.cpp non-regression (valid results + foreign data object) and the data-only decode failure. Findings: review dimensions "kern" #3 + "claims" #2 (both CONFIRMED), "tests" #3 (non-regression coverage for the primary path). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
GottZ
added a commit
that referenced
this pull request
Aug 2, 2026
The total_tokens fallback is backend-agnostic, not Voyage-gated: any backend whose usage carries total_tokens without prompt_tokens — Jina- shaped servers that worked fine over the results path included — silently moves from charge=0 + uncharged_calls++ to a real token charge in the MW22 fairness window. Substantively correct (total_tokens is a measurement, not an estimate — C1-conformant), but a silent semantics jump in a meter documented as "missing usage charges 0". Log a one-time INFO when the fallback first engages (rerank runs per query; per-call INFO would be noise) and extend the MW22 paragraph in docs/operations.md so anyone calibrating against the historic token curve finds the switch. Finding: review dimension "downstream" #2 (CONFIRMED — probe shows identical Jina-shaped response: Base ptoks=0/uncharged, HEAD ptoks=815/charged). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
GottZ
added a commit
to TurgutKural/ctx
that referenced
this pull request
Aug 2, 2026
The total_tokens fallback silently moves total_tokens-only backends from charge=0 + uncharged_calls++ to a real token charge in the MW22 fairness window — the embed twin of the semantics jump the rerank pendant made visible in 4970856. The single production call site (embedcache.go:258 → lease.ReportUsage) charges the lease, llmlog embed rows and the D1a status rollup start carrying values where they were NULL before. Mirror the 4970856 pattern: one-time INFO when the fallback first engages (embeds run per query and per backfill batch — per-call INFO would be noise), extend the MW22 paragraph in docs/operations.md from "rerank backends" to "rerank and embed backends" (the sentence had become false with this PR), and note the embed side of the Voyage dialect in docs/architecture.md. Findings: review dimensions "downstream" GottZ#1/GottZ#2 + "claims" GottZ#2/GottZ#3 (all CONFIRMED — probe shows Base ptoks=0/uncharged, HEAD charged for the identical Voyage-shaped response). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
GottZ
added a commit
that referenced
this pull request
Aug 2, 2026
The total_tokens fallback silently moves total_tokens-only backends from charge=0 + uncharged_calls++ to a real token charge in the MW22 fairness window — the embed twin of the semantics jump the rerank pendant made visible in 4970856. The single production call site (embedcache.go:258 → lease.ReportUsage) charges the lease, llmlog embed rows and the D1a status rollup start carrying values where they were NULL before. Mirror the 4970856 pattern: one-time INFO when the fallback first engages (embeds run per query and per backfill batch — per-call INFO would be noise), extend the MW22 paragraph in docs/operations.md from "rerank backends" to "rerank and embed backends" (the sentence had become false with this PR), and note the embed side of the Voyage dialect in docs/architecture.md. Findings: review dimensions "downstream" #1/#2 + "claims" #2/#3 (all CONFIRMED — probe shows Base ptoks=0/uncharged, HEAD charged for the identical Voyage-shaped response). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the go_modules group with 1 update in the /go directory: github.com/jackc/pgx/v5.
Updates
github.com/jackc/pgx/v5from 5.9.1 to 5.9.2Changelog
Sourced from github.com/jackc/pgx/v5's changelog.
Commits
0aeabbcRelease v5.9.260644f8Fix SQL sanitizer bugs with dollar-quoted strings and placeholder overflowa5680bcMerge pull request #2531 from dolmen-go/godoc-add-linkse34e452doc: Add godoc links08c9bb1Fix Stringer types encoded as text instead of numeric value in composite fields96b4dbdRemove unstable testacf88e0Merge pull request #2526 from abrightwell/abrightwell-min-proto2f81f1fUpdatemax_protocol_versionandmin_protocol_versiondefaultsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.