[dependabot]

Bumps the golang-minor-patch group in /reference-apps/golang with 1 update: github.com/rabbitmq/amqp091-go.

Updates github.com/rabbitmq/amqp091-go from 1.15.0 to 1.16.0

Release notes

Sourced from github.com/rabbitmq/amqp091-go's releases.

v1.16.0

What's Changed

• chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#391
• docs: document URI credential percent-encoding requirement (#305) by @​cipherprofessor in rabbitmq/amqp091-go#396
• Surface the broker's connection.close reason from Dial instead of a hardcoded 403 by @​mohammadkshn in rabbitmq/amqp091-go#393
• chore: remove redundant legacy +build tag from fuzz.go by @​cipherprofessor in rabbitmq/amqp091-go#395
• Reader hardening by @​Zerpet in rabbitmq/amqp091-go#397
• chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#398
• Add Fuzzy tests for reader by @​Zerpet in rabbitmq/amqp091-go#399
• chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#401
• Reject heartbeat frames sent on a non-zero channel by @​suchitd in rabbitmq/amqp091-go#402
• Add support for basic cancel ok response by @​Zerpet in rabbitmq/amqp091-go#405
• Reject out-of-range heartbeat in ParseURI by @​suchitd in rabbitmq/amqp091-go#407
• Start recovery watcher only after a successful handshake by @​suchitd in rabbitmq/amqp091-go#409
• chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 in the github-actions group by @​dependabot[bot] in rabbitmq/amqp091-go#410
• Fix golangci-lint v2.15.0 errcheck failures by @​suchitd in rabbitmq/amqp091-go#411

New Contributors

• @​cipherprofessor made their first contribution in rabbitmq/amqp091-go#396
• @​mohammadkshn made their first contribution in rabbitmq/amqp091-go#393

Full Changelog: rabbitmq/amqp091-go@v1.15.0...v1.16.0

Changelog

Sourced from github.com/rabbitmq/amqp091-go's changelog.

v1.16.0 (2026-10-19)

Full Changelog

Implemented enhancements:

• Add support for basic cancel ok response #405 (Zerpet)

Fixed bugs:

• Start recovery watcher only after a successful handshake #409 (suchitd)
• Reject out-of-range heartbeat in ParseURI #407 (suchitd)
• Reject heartbeat frames sent on a non-zero channel #402 (suchitd)

Closed issues:

• DialConfig leaks a watchConnection goroutine when the AMQP handshake fails with Recovery enabled #408
• panic: unexpected frame type #400
• v1.13.0: openComplete() zeroes caller-owned SASL credentials, breaking Config reuse across dials #394
• Dial returns 403 "no access to this vhost" when the broker refuses connection.open with 530 NOT_ALLOWED (e.g. user connection limit reached) #392
• Question mark in password breaks connection string parsing #305

Merged pull requests:

• Fix golangci-lint v2.15.0 errcheck failures #411 (suchitd)
• chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 in the github-actions group #410 (dependabot[bot])
• chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 in the github-actions group #401 (dependabot[bot])
• Add Fuzzy tests for reader #399 (Zerpet)
• chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 in the github-actions group #398 (dependabot[bot])
• Reader hardening #397 (Zerpet)
• docs: document URI credential percent-encoding requirement (#305) #396 (cipherprofessor)
• chore: remove redundant legacy +build tag from fuzz.go #395 (cipherprofessor)
• Surface the broker's connection.close reason from Dial instead of a hardcoded 403 #393 (mohammadkshn)
• chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0 in the github-actions group #391 (dependabot[bot])

Commits

• 0149b60 Update changelog.md for v1.16.0
• 76fec2b Merge pull request #411 from rabbitmq/fix/errcheck-golangci-lint-v2.15
• e3acbe6 Fix golangci-lint v2.15.0 errcheck failures
• 3aa2215 Release v1.16.0
• ba61a26 Merge pull request #410 from rabbitmq/dependabot/github_actions/github-action...
• 11f9b30 chore(deps): bump github/codeql-action
• e7fe0bd Merge pull request #409 from rabbitmq/fix/dialconfig-watcher-leak-on-failed-open
• 4f11601 Start recovery watcher only after a successful handshake
• c0131b7 Merge pull request #407 from rabbitmq/fix/uri-heartbeat-correctness
• 61d31a1 Reject out-of-range heartbeat in ParseURI
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions