pop v6.4.0 - Database Driver And Test Image Pins

gobuffalo/pop v6.4.0 published on 8 September 2026. The tag is a driver and test image pin train from v6.3.0. The notes list no feature work. The delta that matters for data jobs is the bump of pgx/v5, go-sql-driver/mysql, and go-sqlite3, plus the Cockroach and MySQL images used in CI.

The full release notes and downloads are on the GitHub release page. The commit range from v6.3.0 is in the full changelog.

pop talks to Postgres through github.com/jackc/pgx/v5. This tag moves that module from 5.9.1 to 5.10.0 in two Dependabot PRs. pull 863 took it to 5.9.2. pull 871 took it to 5.10.0.

Code that vendors pop for Postgres migrations or ORM access picks up that driver range. The notes do not list a pop API change around it. Treat it as a client library bump. Read the pgx 5.10.0 notes if you care about wire protocol or COPY behavior.

The Cockroach test image moved in the same release. pull 870 bumped cockroachdb/cockroach from latest-v26.1 to latest-v26.2. pull 886 then moved it to latest-v26.3. That is CI coverage, not a new Cockroach dialect. If you run pop against Cockroach 26.x, the project’s own suite now sits on 26.3 images.

The MySQL path is github.com/go-sql-driver/mysql. The release walks it from 1.9.3 to 1.10.1. pull 866 landed 1.10.0. pull 887 landed 1.10.1.

The Docker mysql image used in tests jumped further. It went from 9.6 to 9.7 in pull 864, then from 9.7 to 26.7 in pull 881. That last tag is a CI image pin, not a documented pop dialect change. If local integration tests still pull MySQL 9.x, they no longer match what this repo runs.

SQLite goes through github.com/mattn/go-sqlite3. The notes show a long Dependabot chain from 1.14.42 to 1.14.50: pulls 865, 872, 875, 876, 879, 882, and 884. Patch trains like that usually track SQLite amalgamations and Go module checksums. Rebuild CGO binaries after the bump. Stale go-sqlite3 objects are a common source of “it works in CI, not on the box” reports.

Two Go module pins sit next to the drivers. golang.org/x/net moved from 0.52.0 to 0.55.0 in pull 877. golang.org/x/sync moved from 0.20.0 to 0.22.0 across pull 873 and pull 878. Those are shared libraries, not pop features. x/net bumps often carry HTTP stack fixes. Confirm the resolved versions in go.mod and go.sum after the upgrade.

CI actions moved too. actions/checkout went from 6 to 7 in pull 874. actions/setup-go went from 6 to 7 in pull 880. github.com/stretchr/testify went from 1.11.1 to 1.12.1. That last pin is test only.

Two human PRs sit in the notes. pull 867 and pull 868 deflake tests. The notes do not name which suites or which races. Read those diffs if a job that was red on v6.3.0 is now green, or the reverse.

Every change in the notes except those two deflake PRs is a Dependabot bump. This is a maintenance tag. If a pipeline uses pop as the write path for Postgres, MySQL, SQLite, or Cockroach, the risk is the driver and image pins, not a new query builder.

The GitHub notes have no breaking API callout and no migration step. The practical work is a go get of github.com/gobuffalo/pop at v6.4.0, a tidy, and a run of the project’s own database tests against those backends. If the app already pins pgx/v5 or go-sql-driver/mysql in go.mod, check for a version conflict after tidy. A replace directive that holds an older driver will hide this release.