build(deps): bump the dependencies group with 5 updates

[dependabot]

Bumps the dependencies group with 5 updates:

Package	From	To
github.com/mattn/go-sqlite3	1.14.41	1.14.42
go.sia.tech/core	0.19.1-0.20260323200052-1bfa3facc408	0.19.1
go.sia.tech/coreutils	0.21.2-0.20260324142241-8e1a1b8d0f4a	0.21.2
golang.org/x/sys	0.42.0	0.43.0
golang.org/x/term	0.41.0	0.42.0

Updates github.com/mattn/go-sqlite3 from 1.14.41 to 1.14.42

Commits

• 5df13a0 Merge pull request #1387 from mattn/codex/stmt-cache
• e302e5c document that _stmt_cache_size is per connection
• 867dcbf move reset/clear into putCachedStmt and always finalize on failure
• 0e58fa4 simplify prepareWithCache to call prepare instead of duplicating logic
• e9f47da do not bail out on finalize error in closeCachedStmtsLocked
• 325cb8d remove redundant stmtCacheSize check in putCachedStmt
• 061c2a5 check stmtCacheSize before acquiring mutex in takeCachedStmt
• efa9b1c add opt-in statement cache
• See full diff in compare view

Updates go.sia.tech/core from 0.19.1-0.20260323200052-1bfa3facc408 to 0.19.1

Release notes

Sourced from go.sia.tech/core's releases.

0.19.1 (2026-04-10)

Features

• Adds a new error type for "host is shutting down"

Fixes

• Add contract not found error
• Added additional context in error message when the signing threshold of a spend policy wasn't reached.
• Increase maxLen for request and response types including RenterInputs or HostInputs.
• Update mux dependency to v1.5.0.

Changelog

Sourced from go.sia.tech/core's changelog.

0.19.1 (2026-04-10)

Features

• Adds a new error type for "host is shutting down"

Fixes

• Add contract not found error
• Added additional context in error message when the signing threshold of a spend policy wasn't reached.
• Increase maxLen for request and response types including RenterInputs or HostInputs.
• Update mux dependency to v1.5.0.

0.19.0 (2025-12-01)

Breaking Changes

• Changed rhp.BuildSectorProof to accept cached subtrees to reduce disk IO required for sector reads.

Fixes

• Parallelize sector root computation in ReaderRoot.

0.18.1 (2025-11-10)

Fixes

• Fix invalid MaxCollateral validation for partial contract refreshes.

0.18.0 (2025-09-23)

Breaking Changes

• Changed the encoding of rhp.Account to include the ed25519: prefix.

0.17.5 (2025-09-01)

Fixes

• Fix ProtocolVersion marshalling failing.

0.17.4 (2025-08-27)

Fixes

• Add compatibility for old protocol version JSON encoding

0.17.3 (2025-08-21)

Fixes

... (truncated)

Commits

• See full diff in compare view

Updates go.sia.tech/coreutils from 0.21.2-0.20260324142241-8e1a1b8d0f4a to 0.21.2

Release notes

Sourced from go.sia.tech/coreutils's releases.

0.21.2 (2026-04-10)

Features

• RHP4 graceful shutdown

Fixes

• Always cancel read side of QUIC stream when calling stream.Close.
• Fixed an edge case in RPCFreeSectors where the deletion logic would keep a sector root that was supposed to be deleted.
• Pass proper descriptions when closing QUIC connection.
• Fixed excessive "peer relayed a v2 header with unknown parent" log spam by only relaying headers after sync when the synced blocks became the new tip.
• Update Go version to 1.26.0.
• Update mux dependency to v1.5.0.
• Use DEBUG log level instead of ERROR for RPCs failing due to the peer closing the connection on their end.

Changelog

Sourced from go.sia.tech/coreutils's changelog.

0.21.2 (2026-04-10)

Features

• RHP4 graceful shutdown

Fixes

• Always cancel read side of QUIC stream when calling stream.Close.
• Fixed an edge case in RPCFreeSectors where the deletion logic would keep a sector root that was supposed to be deleted.
• Pass proper descriptions when closing QUIC connection.
• Fixed excessive "peer relayed a v2 header with unknown parent" log spam by only relaying headers after sync when the synced blocks became the new tip.
• Update Go version to 1.26.0.
• Update mux dependency to v1.5.0.
• Use DEBUG log level instead of ERROR for RPCs failing due to the peer closing the connection on their end.

0.21.1 (2026-02-25)

Fixes

• Fix edge case where a node incorrectly sends the genesis state to peers while syncing.
• Fix NDF in TestFormContractBasis
• Fix parallelSync stalling when all workers fail.
• Mark peer synced if there are no more blocks to sync.
• Reduced excessive logging in syncer.
• Validate RPCFundAccountsRequest

0.21.0 (2026-02-04)

Breaking Changes

Changed block pruning to an active decision for integrators rather than a passive option

This fixes a race condition on some nodes when chain subscribers are slow where blocks would be removed from the store before they could be indexed.

Fixes

• Enable StreamResetPartialDelivery when listening for QUIC connections.
• Use custom sectorBuffer rather than bytes.Buffer in handleRPCWriteSector.

0.20.1 (2026-01-05)

Fixes

• Fix a race in the goroutine spun up by NewEphemeralContractor.
• Fixed an issue where fully connected peers could get stuck on a stale chain after a reorg.

0.20.0 (2025-12-18)

Breaking Changes

... (truncated)

Commits

• See full diff in compare view

Updates golang.org/x/sys from 0.42.0 to 0.43.0

Commits

• f33a730 windows: support nil security descriptor on GetNamedSecurityInfo
• 493d172 cpu: add runtime import in cpu_darwin_arm64_other.go
• 2c2be75 windows: use syscall.SyscallN in Proc.Call
• a76ec62 cpu: roll back "use IsProcessorFeaturePresent to calculate ARM64 on windows"
• See full diff in compare view

Updates golang.org/x/term from 0.41.0 to 0.42.0

Commits

• 52b71d3 go.mod: update golang.org/x dependencies
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​mattn/​go-sqlite3@​v1.14.41 ⏵ v1.14.42	+1
	golang.org/​x/​sys@​v0.42.0 ⏵ v0.43.0
	go.sia.tech/​coreutils@​v0.21.2-0.20260324142241-8e1a1b8d0f4a ⏵ v0.21.2
	go.sia.tech/​core@​v0.19.1-0.20260323200052-1bfa3facc408 ⏵ v0.19.1
	golang.org/​x/​term@​v0.41.0 ⏵ v0.42.0

View full report