Bump the dependencies group with 5 updates

[dependabot]

Bumps the dependencies group with 5 updates:

Package	From	To
github.com/fergusstrange/embedded-postgres	1.33.0	1.34.0
go.sia.tech/core	0.19.1-0.20260326151920-bbeb92b26458	0.19.1
go.sia.tech/coreutils	0.21.2-0.20260327081620-0c3739d3b615	0.21.2
go.sia.tech/hostd/v2	2.6.0	2.7.0
go.sia.tech/renterd/v2	2.8.1	2.9.0

Updates github.com/fergusstrange/embedded-postgres from 1.33.0 to 1.34.0

Release notes

Sourced from github.com/fergusstrange/embedded-postgres's releases.

v1.34.0

What's Changed

• Bump V18 from 18.0.0 to 18.3.0 to fix darwin/arm64 by @​nzoschke in fergusstrange/embedded-postgres#166

New Contributors

• @​nzoschke made their first contribution in fergusstrange/embedded-postgres#166

Full Changelog: fergusstrange/embedded-postgres@v1.33.0...v1.34.0

Commits

• 490777e Bump V18 from 18.0.0 to 18.3.0 to fix darwin/arm64 (#166)
• f351010 Update README.md
• See full diff in compare view

Updates go.sia.tech/core from 0.19.1-0.20260326151920-bbeb92b26458 to 0.19.1

Release notes

Sourced from go.sia.tech/core's releases.

0.19.1 (2026-04-10)

Features

• Adds a new error type for "host is shutting down"

Fixes

• Add contract not found error
• Added additional context in error message when the signing threshold of a spend policy wasn't reached.
• Increase maxLen for request and response types including RenterInputs or HostInputs.
• Update mux dependency to v1.5.0.

Changelog

Sourced from go.sia.tech/core's changelog.

0.19.1 (2026-04-10)

Features

• Adds a new error type for "host is shutting down"

Fixes

• Add contract not found error
• Added additional context in error message when the signing threshold of a spend policy wasn't reached.
• Increase maxLen for request and response types including RenterInputs or HostInputs.
• Update mux dependency to v1.5.0.

0.19.0 (2025-12-01)

Breaking Changes

• Changed rhp.BuildSectorProof to accept cached subtrees to reduce disk IO required for sector reads.

Fixes

• Parallelize sector root computation in ReaderRoot.

0.18.1 (2025-11-10)

Fixes

• Fix invalid MaxCollateral validation for partial contract refreshes.

0.18.0 (2025-09-23)

Breaking Changes

• Changed the encoding of rhp.Account to include the ed25519: prefix.

0.17.5 (2025-09-01)

Fixes

• Fix ProtocolVersion marshalling failing.

0.17.4 (2025-08-27)

Fixes

• Add compatibility for old protocol version JSON encoding

0.17.3 (2025-08-21)

Fixes

... (truncated)

Commits

• See full diff in compare view

Updates go.sia.tech/coreutils from 0.21.2-0.20260327081620-0c3739d3b615 to 0.21.2

Release notes

Sourced from go.sia.tech/coreutils's releases.

0.21.2 (2026-04-10)

Features

• RHP4 graceful shutdown

Fixes

• Always cancel read side of QUIC stream when calling stream.Close.
• Fixed an edge case in RPCFreeSectors where the deletion logic would keep a sector root that was supposed to be deleted.
• Pass proper descriptions when closing QUIC connection.
• Fixed excessive "peer relayed a v2 header with unknown parent" log spam by only relaying headers after sync when the synced blocks became the new tip.
• Update Go version to 1.26.0.
• Update mux dependency to v1.5.0.
• Use DEBUG log level instead of ERROR for RPCs failing due to the peer closing the connection on their end.

Changelog

Sourced from go.sia.tech/coreutils's changelog.

0.21.2 (2026-04-10)

Features

• RHP4 graceful shutdown

Fixes

• Always cancel read side of QUIC stream when calling stream.Close.
• Fixed an edge case in RPCFreeSectors where the deletion logic would keep a sector root that was supposed to be deleted.
• Pass proper descriptions when closing QUIC connection.
• Fixed excessive "peer relayed a v2 header with unknown parent" log spam by only relaying headers after sync when the synced blocks became the new tip.
• Update Go version to 1.26.0.
• Update mux dependency to v1.5.0.
• Use DEBUG log level instead of ERROR for RPCs failing due to the peer closing the connection on their end.

0.21.1 (2026-02-25)

Fixes

• Fix edge case where a node incorrectly sends the genesis state to peers while syncing.
• Fix NDF in TestFormContractBasis
• Fix parallelSync stalling when all workers fail.
• Mark peer synced if there are no more blocks to sync.
• Reduced excessive logging in syncer.
• Validate RPCFundAccountsRequest

0.21.0 (2026-02-04)

Breaking Changes

Changed block pruning to an active decision for integrators rather than a passive option

This fixes a race condition on some nodes when chain subscribers are slow where blocks would be removed from the store before they could be indexed.

Fixes

• Enable StreamResetPartialDelivery when listening for QUIC connections.
• Use custom sectorBuffer rather than bytes.Buffer in handleRPCWriteSector.

0.20.1 (2026-01-05)

Fixes

• Fix a race in the goroutine spun up by NewEphemeralContractor.
• Fixed an issue where fully connected peers could get stuck on a stale chain after a reorg.

0.20.0 (2025-12-18)

Breaking Changes

... (truncated)

Commits

• See full diff in compare view

Updates go.sia.tech/hostd/v2 from 2.6.0 to 2.7.0

Release notes

Sourced from go.sia.tech/hostd/v2's releases.

v2.7.0

Features

• Update Go to 1.26.0.

Added consensus pruning

Adds a new experimental config option to enable consensus pruning. With Utreexo, it is no longer required to store every block to fully validate new blocks. This option limits the number of blocks the host will store in its consensus database reducing the size of the consensus database on disk. It is currently defaulted to off. We recommend no less than one day of blocks to ensure protection for deep reorgs (144 blocks on mainnet).

Fixes

• Added config option to disable Merkle proof cache for low-resource systems.
• Fixed revisions and resolutions in the same block causing contracts to be considered "active" forever.
• Remove backup step size limit and don't vacuum backup to speed it up.
• Update coreutils to v0.21.1

v2.7.0-beta.1

Features

• Update Go to 1.26.0.

Added consensus pruning

Adds a new experimental config option to enable consensus pruning. With Utreexo, it is no longer required to store every block to fully validate new blocks. This option limits the number of blocks the host will store in its consensus database reducing the size of the consensus database on disk. It is currently defaulted to off. We recommend no less than one day of blocks to ensure protection for deep reorgs (144 blocks on mainnet).

Fixes

• Added config option to disable Merkle proof cache for low-resource systems.
• Fixed revisions and resolutions in the same block causing contracts to be considered "active" forever.
• Remove backup step size limit and don't vacuum backup to speed it up.
• Update coreutils to v0.21.1

Changelog

Sourced from go.sia.tech/hostd/v2's changelog.

2.7.0 (2026-03-02)

Features

• Update Go to 1.26.0.

Added consensus pruning

Adds a new experimental config option to enable consensus pruning. With Utreexo, it is no longer required to store every block to fully validate new blocks. This option limits the number of blocks the host will store in its consensus database reducing the size of the consensus database on disk. It is currently defaulted to off. We recommend no less than one day of blocks to ensure protection for deep reorgs (144 blocks on mainnet).

Fixes

• Added config option to disable Merkle proof cache for low-resource systems.
• Fixed revisions and resolutions in the same block causing contracts to be considered "active" forever.
• Remove backup step size limit and don't vacuum backup to speed it up.
• Update coreutils from v0.20.1 to v0.21.0.
• Update coreutils to v0.21.1

Commits

• 090d5f3 Merge pull request #915 from SiaFoundation/release
• 36233a3 chore: prepare release 2.7.0
• bcb3b77 address comments
• c430530 pluralize
• 85c35c1 pluralize
• 08bde87 update api docs
• dc52587 Merge pull request #934 from SiaFoundation/alex/remove-scalar
• 08415dd ci: remove openapi-publish workflow
• fd4d48d fix fmt
• cc5b637 replace internal threadgroup with coreutils
• Additional commits viewable in compare view

Updates go.sia.tech/renterd/v2 from 2.8.1 to 2.9.0

Release notes

Sourced from go.sia.tech/renterd/v2's releases.

v2.9.0

Features

• Update Go to 1.26.0.

Fixes

• Ensure all store methods are retry-safe
• Update coreutils from v0.21.0 to v0.21.1

v2.9.0-beta.1

Features

• Update Go to 1.26.0.

Fixes

• Ensure all store methods are retry-safe
• Update coreutils from v0.21.0 to v0.21.1

Changelog

Sourced from go.sia.tech/renterd/v2's changelog.

2.9.0 (2026-03-02)

Features

• Update Go to 1.26.0.

Fixes

• Ensure all store methods are retry-safe
• Update coreutils from v0.21.0 to v0.21.1

Commits

• c8bc75a chore(deps): bump go.sia.tech/web/renterd in the all-dependencies group
• 22bf4f2 ci: remove openapi-publish workflow
• 812f92f fix test using zero account
• e9e59cd deps: update coreutils to v0.21.1
• e16b55c ci: remove Jape Analyzer step
• 25a0634 build: update Dockerfile to Go 1.26
• 12f75fe build: update to Go 1.26
• 0c982b6 add changeset for Go 1.26 update
• e75ff8d ci: update Go test matrix to 1.25/1.26
• e15f4ec chore(deps): bump the all-dependencies group with 4 updates
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	go.sia.tech/​renterd/​v2@​v2.8.1 ⏵ v2.9.0	+1
	go.sia.tech/​hostd/​v2@​v2.6.0 ⏵ v2.7.0	+1
	github.com/​fergusstrange/​embedded-postgres@​v1.33.0 ⏵ v1.34.0
	go.sia.tech/​coreutils@​v0.21.2-0.20260327081620-0c3739d3b615 ⏵ v0.21.2
	go.sia.tech/​core@​v0.19.1-0.20260326151920-bbeb92b26458 ⏵ v0.19.1

View full report