Skip to content

deps: bump the go-deps group across 1 directory with 24 updates - #438

Merged
EricAndrechek merged 2 commits into
mainfrom
dependabot/go_modules/go-deps-8159e38900
Aug 10, 2026
Merged

deps: bump the go-deps group across 1 directory with 24 updates#438
EricAndrechek merged 2 commits into
mainfrom
dependabot/go_modules/go-deps-8159e38900

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the go-deps group with 13 updates in the / directory:

Package From To
github.com/ClickHouse/clickhouse-go/v2 2.46.0 2.48.0
github.com/MicahParks/keyfunc/v3 3.8.0 3.8.1
github.com/dgraph-io/ristretto/v2 2.4.0 2.4.2
github.com/go-chi/chi/v5 5.3.0 5.3.1
github.com/nats-io/nats-server/v2 2.14.2 2.14.4
github.com/prometheus/client_golang 1.23.2 1.24.1
go.opentelemetry.io/contrib/bridges/otelslog 0.19.0 0.20.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp 0.69.0 0.70.0
go.opentelemetry.io/contrib/instrumentation/runtime 0.69.0 0.70.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc 0.20.0 0.21.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc 1.44.0 1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc 1.44.0 1.45.0
go.opentelemetry.io/otel/exporters/prometheus 0.66.0 0.67.0

Updates github.com/ClickHouse/clickhouse-go/v2 from 2.46.0 to 2.48.0

Release notes

Sourced from github.com/ClickHouse/clickhouse-go/v2's releases.

v2.48.0

What's Changed

Enhancements 🚀

Bug fixes 🐛

Other Changes 🛠

New Contributors

Full Changelog: ClickHouse/clickhouse-go@v2.47.0...v2.48.0

v2.47.0

... (truncated)

Changelog

Sourced from github.com/ClickHouse/clickhouse-go/v2's changelog.

v2.48.0, 2026-08-04

What's Changed

Enhancements 🚀

Bug fixes 🐛

Other Changes 🛠

New Contributors

Full Changelog: ClickHouse/clickhouse-go@v2.47.0...v2.48.0

v2.47.0, 2026-06-26

... (truncated)

Commits
  • 69b5195 Update release notes
  • bbc3549 Merge pull request #1949 from ClickHouse/kavirajk/perf-exception-parser
  • 46e0fe9 chore: review remarks
  • 222cf04 chore: doc string fixes
  • 41bfcca perf: make safeLen() linear runtime in exception parser
  • 8fd6f43 Merge pull request #1944 from fallintoplace/fix/tuple-map-scan-error
  • d502655 Merge pull request #1947 from ClickHouse/pr-review-fable
  • 6f469c9 use fable for code review
  • 95ae021 fix: return errors when scanning Tuple maps
  • b67d227 Merge pull request #1937 from fallintoplace/remove-http-compression-debug-output
  • Additional commits viewable in compare view

Updates github.com/MicahParks/keyfunc/v3 from 3.8.0 to 3.8.1

Commits

Updates github.com/dgraph-io/ristretto/v2 from 2.4.0 to 2.4.2

Release notes

Sourced from github.com/dgraph-io/ristretto/v2's releases.

v2.4.2

Fixed

  • Revert eager pre-allocation of the sampledLFU keyCosts map (#482), which allocated NumCounters/10 map buckets at boot and caused a large RSS regression for caches with high NumCounters (#494, fixes #493)

Full Changelog: dgraph-io/ristretto@v2.4.1...v2.4.2

v2.4.1

Changed

  • Pre-allocate keyCosts map in sampledLFU (#482)

Fixed

  • Handle mremap size mismatch on Linux s390x (#491)

Full Changelog: dgraph-io/ristretto@v2.4.0...v2.4.1

Changelog

Sourced from github.com/dgraph-io/ristretto/v2's changelog.

[v2.4.2] - 2026-07-07

Fixed

  • Revert eager pre-allocation of the sampledLFU keyCosts map (#482), which allocated NumCounters/10 map buckets at boot and caused a large RSS regression for caches with high NumCounters

Full Changelog: dgraph-io/ristretto@v2.4.1...v2.4.2

[v2.4.1] - 2026-07-06

Changed

  • Pre-allocate keyCosts map in sampledLFU (#482)

Fixed

  • Handle mremap size mismatch on Linux s390x (#491)

Full Changelog: dgraph-io/ristretto@v2.4.0...v2.4.1

Commits
  • 8d05e8a fix: revert eager sampledLFU keyCosts pre-allocation (#482) (#494)
  • e89d89a chore: prepare release v2.4.1 (#492)
  • fe05eab fix: handle mremap size mismatch on Linux s390x
  • bb27952 chore(ci): add stale Action (#488)
  • 7aac03a docs: add contributing guide and code of conduct
  • b483e0c perf: pre-allocate keyCosts map in sampledLFU
  • 469a1a0 Update trunk conf
  • 3ac041b chore: update ci-ristretto-tests.yml
  • See full diff in compare view

Updates github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.1

What's Changed

New Contributors

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

Commits
  • 8b258c7 ci: pin GitHub Actions to full commit SHAs (#1116)
  • caf87e6 feat(mux): support http QUERY method ietf rfc10008 (#1132)
  • 7fcb8a2 middleware: document printPrettyStack and harden NoColor panic test (#1131)
  • 878fe71 Fix defaultLogEntry.Panic not respecting NoColor setting (#1050)
  • d7b767b feat(middleware): add text/xml and application/xml to default compressible ty...
  • 3b50c7c Tidy build directives (#1113)
  • 2b9fca2 Honor Discard() in httpFancyWriter.ReadFrom (#1110)
  • See full diff in compare view

Updates github.com/nats-io/nats-server/v2 from 2.14.2 to 2.14.4

Release notes

Sourced from github.com/nats-io/nats-server/v2's releases.

Release v2.14.4

Changelog

Refer to the 2.14 Upgrade Guide for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped.

Go Version

Dependencies

  • github.com/klauspost/compress v1.19.0 (#8385)
  • golang.org/x/crypto v0.54.0 (#8385)
  • golang.org/x/sys v0.47.0 (#8385)
  • github.com/antithesishq/antithesis-sdk-go v0.7.2-default-no-op (#8385)

Improved

JetStream

  • The Raft transport layer has been decoupled, improves testing but does not change server behaviour (#8181)
  • The disk concurrency semaphore has been increased to 4096 slots, up from the previous CPU-scaled count (#8336)
  • The disk concurrency semaphore can now be configured with the max_concurrent_io option in the jetstream config block (#8336)
  • Filestore underlying block cache buffers are now recycled to the pool when the weak reference is collected by the GC, which should smooth out memory usage with some usage patterns (#8395)
  • Calculating and looking up sequences in delete maps for file-backed streams with large numbers of interior deletes is now faster and holds locks for less time (#8403)
  • Inserts, iterations and deletes in AVL sequence sets are now faster in many cases, which speeds up the tracking of interior deletes (#8406)
  • Stream snapshots now attempt to determine the correct encode buffer size up front, avoiding many unnecessary allocations on streams with large numbers of interior deletes (#8405)
  • Reduced memory usage of the structure that is used to track subjects within a stream (#8412)

Fixed

General

  • allow_non_tls will no longer log an incorrect message at startup claiming that TLS is required (#8420)
  • Combining no_auth_user with auth callouts will no longer skip authentication checks when no CONNECT message is sent
  • JWT validation no longer crashes the server with whitespace-only permissions
  • Several paths that enforce the permissions of queue subscriptions no longer treat the whole permission as a subject literal
  • Several JetStream and MQTT endpoints now correctly guard against null values in JSON
  • Fixed an authentication bypass with TLS verify_and_map authenticating users with blank passwords

Monitoring

  • The healthz endpoint will now skip and no longer report on expired JWT accounts (#8379, thanks to @​ByapakSigdel)
  • The varz endpoint will now correctly report JetStream limits after they were changed via a config reload (#8394)

JetStream

  • Malformed cluster replicated acks or delivered updates are now correctly rejected by the decoder (#8284, thanks to @​uwezkhan)
  • Malformed cluster replicated skip or reset updates are now correctly rejected by the decoder (#8345, thanks to @​uwezkhan)
  • Empty cluster replicated entries are now correctly ignored (#8347, thanks to @​uwezkhan)

... (truncated)

Commits
  • bbd6dc5 Release v2.14.4
  • 7d26d07 Update to Go 1.26.5/1.25.12
  • c7163b2 Release v2.14.4-RC.4
  • ee56a6c Cherry-picks for 2.14.4-RC.4 (#147)
  • 725f008 [FIXED] Certificate users authenticatable by username on other listeners
  • 566e772 [FIXED] Block MQTT subscriptions to internal MQTT subjects
  • 43607c4 [FIXED] Consumer assignment proposed without a raft group
  • 3b90b2c [FIXED] Panic setting up a stream source/mirror on malformed create response
  • f44c537 [FIXED] Panic decoding MQTT retained messages, sessions and JS API replies
  • c6c7061 [FIXED] Panic decoding counter source with null entry
  • Additional commits viewable in compare view

Updates github.com/prometheus/client_golang from 1.23.2 to 1.24.1

Release notes

Sourced from github.com/prometheus/client_golang's releases.

v1.24.1 / 2026-07-23

Small bugfix release for promhttp.

What's Changed

[BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

Full Changelog: prometheus/client_golang@v1.24.0...v1.24.1

v1.24.0 - 2026-07-20

Changes

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927

... (truncated)

Changelog

Sourced from github.com/prometheus/client_golang's changelog.

1.24.1 / 2026-07-23

  • [BUGFIX] promhttp: Fix panic on requests with nil URL. #2065

1.24.0 / 2026-07-20

  • [CHANGE] Minimum required Go version is now 1.25, only the two latest Go versions (1.25 and 1.26) are supported from now on. #1862
  • [CHANGE] prometheus: Name validation now always uses the UTF-8 scheme instead of the deprecated model.NameValidationScheme global. Default behavior is unchanged; code that set NameValidationScheme = LegacyValidation no longer gets legacy enforcement at metric, label, and push-grouping construction. #2051
  • [CHANGE] api/prometheus/v1: Support matchers (matches[] parameter) in Rules method (Rules(ctx context.Context, matches []string) (RulesResult, error)). #1843
  • [CHANGE] api/prometheus/v1: Refactor LabelNames method to return model.LabelNames instead of []string for consistency across the API. #1850
  • [CHANGE] exp/api/remote: Simplify Store interface, rename Handler to WriteHandler, and encapsulate write response handling. #1855
  • [FEATURE] prometheus: Add new Go 1.26 runtime metrics (/sched/goroutines-created:goroutines, /sched/goroutines/not-in-go:goroutines, /sched/goroutines/runnable:goroutines, /sched/goroutines/running:goroutines, /sched/goroutines/waiting:goroutines, /sched/threads/total:threads). #1942
  • [FEATURE] prometheus: Add WithUnit(unit string) option and explicit OpenMetrics unit support in CounterOpts, GaugeOpts, SummaryOpts, and HistogramOpts. #1392
  • [FEATURE] prometheus: Expose descriptor construction error through public Err() method on Desc. #1902
  • [FEATURE] promhttp: Add opt-in HandlerOpts.CoalesceGather to deduplicate concurrent Gather calls so overlapping scrapes share one collection cycle, preventing goroutine pile-up when the scrape rate outpaces collection time. #1969
  • [FEATURE] promhttp: HTTP handlers created by promhttp package now support metrics filtering by providing one or more name[] query parameters. The default behavior when none are provided remains the same, returning all metrics. #1925
  • [FEATURE] api/prometheus/v1: Add query formatting endpoint support (/format_query) and FormatQuery(ctx context.Context, query string) (string, error) method. #1846, #1856
  • [FEATURE] api/prometheus/v1: Add support for /status/tsdb/blocks endpoint via TSDBBlocks(ctx context.Context) ([]TSDBBlock, error) method. #1896
  • [FEATURE] exp/api/remote: Export BackoffConfig to allow customization when using WithAPIBackoff. #1895
  • [FEATURE] exp/api/remote: Add RetryCallBack to allow custom logging or handling on retry attempts in the remote write client. #1888, #1890
  • [ENHANCEMENT] prometheus/collectors/version: Allow specifying custom labels when registering the version collector. #1860
  • [ENHANCEMENT] api: Use cloned http.DefaultTransport when constructing default HTTP clients to prevent accidental mutations of shared global transport state. #1885
  • [BUGFIX] prometheus: Recover from collector panics during Gather() and return an error instead of crashing the process. #1961
  • [BUGFIX] prometheus: Fix cpu-seconds unit suffix handling for metric go_cpu_classes_gc_mark_assist_cpu_seconds. #1991
  • [BUGFIX] promhttp: InstrumentHandlerDuration and InstrumentHandlerCounter no longer panic when given an observer/counter that does not implement ExemplarObserver/ExemplarAdder (e.g. a SummaryVec). The exemplar is dropped and the value is recorded via the plain Observe/Add path, matching the safe-cast already used by Timer.ObserveDurationWithExemplar. #2005
  • [BUGFIX] api/prometheus/v1: Fall back to GET requests when POST requests return 403 Forbidden or method not allowed. #2030
  • [BUGFIX] api: Respect context cancellation inside httpClient.Do. #1971
  • [BUGFIX] exp/api/remote: Fix compression buffer pooling where compressed buffers were released prematurely, causing corrupted remote-write payloads. #1889
  • [BUGFIX] exp/api/remote: Reject malformed snappy payloads declaring huge decoded sizes. Enforce a 32MB decoded-size limit to prevent OOM from oversized remote-write requests. #1917
  • [BUGFIX] exp/api/remote: Ensure remote write v2 headers cannot be returned on v1 requests. #1927
Commits
  • d6087ee release: cut v1.24.1 (#2076)
  • 48dd383 Cut v1.24.0 (#2061)
  • a725305 Cut v1.24.0-rc.0 (#2058)
  • 77c584f build(deps): update all Go dependencies in all go.mod files (#2059)
  • 78262a7 feat(promhttp): add CoalesceGather option to deduplicate concurrent Gather ca...
  • 34e9a7f Merge pull request #2055 from prombot/repo_sync
  • 43749bc Update common Prometheus files
  • de19217 examples: improve simple main.go example (#1999)
  • 20355eb fix: correct typos in comments and test error messages (#2049)
  • 4cd2d3a test: fix two flaky tests (darwin start_time regex, memstats HeapReleased dri...
  • Additional commits viewable in compare view

Updates github.com/testcontainers/testcontainers-go from 0.42.0 to 0.43.0

Release notes

Sourced from github.com/testcontainers/testcontainers-go's releases.

v0.43.0

What's Changed

⚠️ Breaking Changes

  • chore(wait)!: change url callback in wait.ForSQL to accept network.Port (#3650) @​thaJeztah

Users of wait.ForSQL need to follow the new API contract, using Moby's network.Port instead of string when building the callback function to check the URL. Please see https://golang.testcontainers.org/features/wait/sql/

Users implementing their own testcontainers.ImageProvider need to implement the new PullImageWithPlatform method introduced by this PR.

🚀 Features

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

📦 Dependency updates

@dependabot
deps: bump the go-deps group across 1 directory with 24 updates
0f9cc96 
Bumps the go-deps group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/ClickHouse/clickhouse-go/v2](https://github.com/ClickHouse/clickhouse-go) | `2.46.0` | `2.48.0` |
| [github.com/MicahParks/keyfunc/v3](https://github.com/MicahParks/keyfunc) | `3.8.0` | `3.8.1` |
| [github.com/dgraph-io/ristretto/v2](https://github.com/dgraph-io/ristretto) | `2.4.0` | `2.4.2` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.3.0` | `5.3.1` |
| [github.com/nats-io/nats-server/v2](https://github.com/nats-io/nats-server) | `2.14.2` | `2.14.4` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.2` | `1.24.1` |
| [go.opentelemetry.io/contrib/bridges/otelslog](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.19.0` | `0.20.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.69.0` | `0.70.0` |
| [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.69.0` | `0.70.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc](https://github.com/open-telemetry/opentelemetry-go) | `0.20.0` | `0.21.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.44.0` | `1.45.0` |
| [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go) | `0.66.0` | `0.67.0` |



Updates `github.com/ClickHouse/clickhouse-go/v2` from 2.46.0 to 2.48.0
- [Release notes](https://github.com/ClickHouse/clickhouse-go/releases)
- [Changelog](https://github.com/ClickHouse/clickhouse-go/blob/main/CHANGELOG.md)
- [Commits](ClickHouse/clickhouse-go@v2.46.0...v2.48.0)

Updates `github.com/MicahParks/keyfunc/v3` from 3.8.0 to 3.8.1
- [Release notes](https://github.com/MicahParks/keyfunc/releases)
- [Commits](MicahParks/keyfunc@v3.8.0...v3.8.1)

Updates `github.com/dgraph-io/ristretto/v2` from 2.4.0 to 2.4.2
- [Release notes](https://github.com/dgraph-io/ristretto/releases)
- [Changelog](https://github.com/dgraph-io/ristretto/blob/main/CHANGELOG.md)
- [Commits](dgraph-io/ristretto@v2.4.0...v2.4.2)

Updates `github.com/go-chi/chi/v5` from 5.3.0 to 5.3.1
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.3.0...v5.3.1)

Updates `github.com/nats-io/nats-server/v2` from 2.14.2 to 2.14.4
- [Release notes](https://github.com/nats-io/nats-server/releases)
- [Changelog](https://github.com/nats-io/nats-server/blob/main/RELEASES.md)
- [Commits](nats-io/nats-server@v2.14.2...v2.14.4)

Updates `github.com/prometheus/client_golang` from 1.23.2 to 1.24.1
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.1/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.23.2...v1.24.1)

Updates `github.com/testcontainers/testcontainers-go` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/testcontainers/testcontainers-go/releases)
- [Commits](testcontainers/testcontainers-go@v0.42.0...v0.43.0)

Updates `go.opentelemetry.io/contrib/bridges/otelslog` from 0.19.0 to 0.20.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@v0.19.0...v0.20.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.69.0 to 0.70.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.69.0...zpages/v0.70.0)

Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from 0.69.0 to 0.70.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.69.0...zpages/v0.70.0)

Updates `go.opentelemetry.io/otel` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc` from 0.20.0 to 0.21.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v0.20.0...log/v0.21.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.66.0 to 0.67.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@metric/x/v0.66.0...metric/x/v0.67.0)

Updates `go.opentelemetry.io/otel/log` from 0.20.0 to 0.21.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v0.20.0...log/v0.21.0)

Updates `go.opentelemetry.io/otel/metric` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/sdk/log` from 0.20.0 to 0.21.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v0.20.0...log/v0.21.0)

Updates `go.opentelemetry.io/otel/sdk/metric` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/otel/trace` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.44.0...v1.45.0)

Updates `go.opentelemetry.io/proto/otlp` from 1.10.0 to 1.11.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-proto-go/releases)
- [Commits](open-telemetry/opentelemetry-proto-go@v1.10.0...v1.11.0)

Updates `golang.org/x/sync` from 0.21.0 to 0.22.0
- [Commits](golang/sync@v0.21.0...v0.22.0)

Updates `google.golang.org/grpc` from 1.81.1 to 1.83.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.81.1...v1.83.0)

---
updated-dependencies:
- dependency-name: github.com/ClickHouse/clickhouse-go/v2
  dependency-version: 2.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/MicahParks/keyfunc/v3
  dependency-version: 3.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/dgraph-io/ristretto/v2
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/nats-io/nats-server/v2
  dependency-version: 2.14.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-deps
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: github.com/testcontainers/testcontainers-go
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/contrib/bridges/otelslog
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-version: 0.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/contrib/instrumentation/runtime
  dependency-version: 0.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/otel/exporters/prometheus
  dependency-version: 0.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/otel/log
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/otel/metric
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/otel/sdk/log
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/otel/sdk/metric
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: go.opentelemetry.io/proto/otlp
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: golang.org/x/sync
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 10, 2026
@dependabot
dependabot Bot requested review from a team and EricAndrechek August 10, 2026 16:08
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 10, 2026
@dependabot dependabot Bot added the go Pull requests that update go code label Aug 10, 2026
@github-actions github-actions Bot added area/infra CI, build, deploy, Docker, release and removed go Pull requests that update go code labels Aug 10, 2026
@EricAndrechek

EricAndrechek commented Aug 10, 2026

Copy link
Copy Markdown
Member

This is the PR that unblocks every branch in the repo. It needs a one-line fix to land; diagnosis and the fix are below.

Why everything is red right now

make verify runs govulncheck as part of the Lint job, and three Go advisories have landed since the last merge to main (2026-07-09):

Advisory Module On main Fixed in
GO-2026-6061 google.golang.org/grpc 1.81.1 1.82.1
GO-2026-5970 golang.org/x/text 0.37.0 0.39.0
GO-2026-5841 github.com/klauspost/compress 1.18.6 1.18.7

Every branch cut from main inherits all three and fails Lint identically, regardless of what it changed — and the same gate fails locally in make ci, so nothing could be pushed either. This PR clears all three (grpc 1.83.0, x/text 0.40.0, klauspost/compress 1.19.1).

What was breaking this PR

go.opentelemetry.io/otel/log v0.20 → v0.21 is a breaking API change: the package's own log.Value / log.KeyValue type system was removed in favour of the standard attribute.Value / attribute.KeyValue, and Record.SetBody now takes an attribute.Value.

Exactly one line in the tree uses it, which is why both Lint and Unit tests failed on the same symbol:

internal/observability/provider_test.go:101:22: undefined: otellog.StringValue

Fixed by swapping that call to attribute.StringValue and adding the import. Non-test code is unaffected — internal/observability/logger.go goes through the otelslog bridge, which absorbs the change internally.

Verification (locally, with the fix applied)

  • go tool govulncheck -scan package ./... → "No vulnerabilities found." (was 3)
  • go build ./... clean, internal/observability tests pass
  • Lint, unit, integration, SDK and docs all green

The only local red is tests/e2e/sdk/batching.test.ts, which is pre-existing and unrelated to this bump — clean main at c816e34 fails the identical test with the identical 20s timeout, and this branch's E2E tests job passed on GitHub's Linux runners. Raising that one test's timeout locally makes it pass and pushes a different test over its bound, so it's per-operation latency on macOS/APFS (the sibling test's own comment records 5104ms observed on APFS), not a regression here.

Note on the rest of the queue

@EricAndrechek EricAndrechek mentioned this pull request Aug 10, 2026
Merged
@EricAndrechek @claude
fix(observability): migrate test to otel/log v0.21 attribute values
93c6e72 
otel/log v0.21.0 removes the package's own log.Value / log.KeyValue type
system in favour of the standard attribute.Value / attribute.KeyValue;
Record.SetBody now takes an attribute.Value. The go-deps group bump moves
otel/log 0.20.0 -> 0.21.0, so the one call site using otellog.StringValue
stopped compiling, failing both Lint (golangci typecheck) and Unit tests.

Non-test code is unaffected: logger.go emits through the otelslog bridge,
which absorbs the change internally.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFfYUaPp3Pv3gLjniiHCpm
@github-actions github-actions Bot added go Pull requests that update go code area/observability Metrics, logs, traces, health, profiling labels Aug 10, 2026
@github-code-quality

github-code-quality Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: Go

Go

The overall coverage in commit 93c6e72 in the dependabot/go_module... branch remains at 90%, unchanged from commit c816e34 in the main branch.

@EricAndrechek EricAndrechek mentioned this pull request Aug 10, 2026
Closed
@EricAndrechek
EricAndrechek merged commit 4f599bd into main Aug 10, 2026
20 checks passed
@EricAndrechek
EricAndrechek deleted the dependabot/go_modules/go-deps-8159e38900 branch August 10, 2026 19:04
@github-project-automation github-project-automation Bot moved this from Backlog to Done in WaveHouse Task Board Aug 10, 2026
This was referenced Aug 10, 2026
Merged
Open
Closed
Closed
Merged
EricAndrechek added a commit that referenced this pull request Aug 11, 2026
@EricAndrechek @claude
fix(ci): cache Go modules once, not once per compile flavor (#446)
f9643a0 
## Why

The repo hit **10.53 GB against GitHub's hard 10 GB Actions cache cap**
after #438's 24-module bump. Past the cap GitHub LRU-evicts, so warm
entries disappear mid-run and builds get slower and less predictable —
silently.

`setup-env` cached the Go module cache and build cache together under a
per-flavor key:

```yaml
path: |
  ~/go/pkg/mod        # pure function of go.sum — identical for every flavor
  ~/.cache/go-build   # genuinely flavor-specific
key: gobuild-v2-<os>-go<suffix>-<go.sum hash>
```

`~/go/pkg/mod` measures **1.6 GB on disk** for the current `go.sum` and
is byte-identical across all five suffixes, so it was stored five times
over — five entries of ~0.9–1.2 GB each, **~5.2 GB per generation**. Two
live generations is the *normal* steady state (a bump mints a new set
while the previous is still warm), so ~10 GB was the expected footprint.
#438 tipped it over:

```
1210MB  gobuild-v2-Linux-go-lint-136f5059…
1068MB  gobuild-v2-Linux-go-unit-136f5059…
1067MB  gobuild-v2-Linux-go-integration-136f5059…
1058MB  gobuild-v2-Linux-go-unit-1a18a4a1…      <- previous generation
1033MB  gobuild-v2-Linux-go-e2e-cov-136f5059…
 929MB  gobuild-v2-Linux-go-cov-1a18a4a1…       <- previous generation
 928MB  gobuild-v2-Linux-go-cov-136f5059…
```

The action's header already noted the duplication — *"Cross-suffix
restore-keys still share the (identical) module cache on a cold start"*
— without drawing the sizing conclusion.

## What

Split the one cache into two:

| | key | path | scope |
| --- | --- | --- | --- |
| modules | `gomod-v1-<os>-<go.mod+go.sum hash>` | `~/go/pkg/mod` |
**unsuffixed** — one entry, every Go job |
| build objects | `gobuild-v3-<os>-go<suffix>-<go.mod+go.sum hash>` |
`~/.cache/go-build` | per compile flavor, as before |

**Measured on this branch's own runs: 5.18 GB → 1.05 GB per generation**
(a 4.9× reduction) — `gomod-v1` at 0.48 GB plus five `gobuild-v3`
entries totalling 0.57 GB (25–152 MB each). Two generations now fit with
room to spare.

All sizes are stored-archive bytes ÷ 2³⁰, the unit the README's own
usage check prints.

(The 0.48 GB module entry is a cold first save with no restore-key
fallback; it drifts up as superseded module versions accumulate through
the restore→save chain, so budget nearer ~1 GB for it in steady state.)

Two details worth review attention:

- **`v3` on the build key is required.** Saves fire only on an exact-key
miss, so without the bump the old `v2` entry — which still contains the
module cache — would exact-hit forever and the new, smaller content
would never be saved. Same reasoning as the v2 bump documented at the
top of the action.
- **`gobuild-v3` drops the bare-prefix restore-key.**
`gobuild-v2-<os>-go-` existed to borrow *another flavor's* copy of the
shared module cache on a cold start. That job now belongs to `gomod-v1`,
and another flavor's build objects aren't reusable here, so the fallback
would only restore bytes that get thrown away.

`gomod-v1` keeps a prefix restore-key: a bump moves a handful of
modules, so a stale generation is still worth restoring and `go mod
download` fetches only the delta.

**Both keys hash `go.mod` as well as `go.sum`** (CodeRabbit review).
`GOTOOLCHAIN=auto` lands the toolchain in
`~/go/pkg/mod/golang.org/toolchain` and `go.sum` records no entry for it
— this repo's `go.sum` has zero `golang.org/toolchain` lines. A
`go`-directive bump would therefore leave a `go.sum`-only key
byte-identical (verified: `bcc16701da2c001f` before and after `go
1.26.5` → `1.27.0`), exact-hit a toolchain-less archive, and — saves
firing only on an exact-key *miss* — never save the freshly fetched
toolchain, re-downloading it every run until some unrelated dependency
bump moved `go.sum`. The same bump also invalidates every cached build
object, since the compiler build ID feeds every action hash.

## The sixth copy (from review)

Consolidating five copies left a sixth outside `setup-env` entirely:
`actions/setup-go` caches `~/go/pkg/mod` + `~/.cache/go-build` by
default, so `publish-dev.yml` carries a live **0.97 GB** entry (keyed on
the root `go.mod` — setup-go hashed `go.sum` through v6.2.0 and `go.mod`
from v6.3.0,
[actions/setup-go#705](actions/setup-go#705)) —
larger than the `gomod-v1` entry this PR consolidates to, and a direct
violation of the sizing rule the PR introduces. It is re-saved on each
cache miss (every dependency bump), so the cost is ~1.95 GB across the
two generations the repo holds in steady state. `release.yml` carried
the same default.

Both now pass `cache: false`, matching the call
`goreleaser-validate.yml` already made.

**But `publish-dev.yml` re-caches the half that pays for itself.**
Reviewing this surfaced a measured regression: across its last 20 runs,
GoReleaser takes **36–246 s with setup-go's cache warm and 401–446 s
cold** — zero overlap between the two groups. Dropping it outright would
cost **roughly 2.5–7 minutes (mean delta ≈4.8 min) on every push to
main**, and the value is entirely in the `~/.cache/go-build` half
(8-target cross-compile), not the module tree.

So that job now caches `~/.cache/go-build` alone under
`gobuild-v3-<os>-go-release-` (~0.5 GB instead of ~0.97 GB). The
duplicate module tree — the actual #443 complaint — is gone; the
cross-compile stays warm.

**And it keeps the module tree warm too.** The 36–246 s timings were
measured with setup-go's *bundled* entry, which held `~/go/pkg/mod` as
well — so caching only the build half would have left the module tree
cold on every push (~90 modules, ~112 MB re-downloaded) and landed the
job above its own documented range. `publish-dev` therefore also
**restores** `gomod-v1` via `actions/cache/restore`: read-only, reading
`ci.yml`'s entry from `main`'s scope. It writes nothing, so it costs 0
GB of budget and — importantly — cannot write a partial module tree to
the key every `ci.yml` Go job shares. The `-release` suffix keeps those
objects separate from CI's native-only flavors, which can't use them.

`release.yml` keeps the plain opt-out — and re-enabling it there would
be strictly negative, not merely unhelpful: cache writes are scoped to
the ref that made them, so a save from `refs/tags/v1.0.0` can never be
read by `refs/tags/v1.0.1`, by `main`, or by a PR — only by a re-run of
that same tag. It would be a ~1 GB entry per release that nothing but a
retry can ever read. If release wall-clock ever matters, the lever is
`actions/cache/restore` (restore-only) on `publish-dev`'s key.

## Docs

`.github/workflows/README.md` gets the updated inventory rows plus a
**sizing policy** section — the 10 GB cap, the two-generations rule, the
`gh api` one-liners to check the current footprint, and the rule that
content which is a pure function of a lockfile gets keyed once,
unsuffixed. That's the part that stops this recurring.

Two additions from review:

- **A narrowing-rotation exception to the key-versioning policy.** The
existing policy says to keep old prefixes as transitional restore-keys;
`gobuild-v3` deliberately doesn't, because a v2 archive still contains
`~/go/pkg/mod` and restoring it would re-materialize exactly what the
rotation removes. The doc now prescribes what the code does.
- **The CodeQL caches are listed.** `codeql-dependencies-*` /
`codeql-overlay-base-database-*` (~0.4 GB) are minted by GHAS default
setup, outside this repo's workflows. They were invisible in the
inventory, so a maintainer doing the two-generations check was seeing
~85% of the real budget.

## Verification

- `make ci` green on this tree (full pipeline incl. integration + e2e)
- `make verify` clean — markdownlint over the README + CHANGELOG, and
actionlint over `.github/workflows/**`.
**Note:** `make lint-gha` globs workflows only, so
`.github/actions/setup-env/action.yml` gets no actionlint and no
shellcheck — pointed at it directly, actionlint rejects a composite
action as a malformed workflow. The new guard step's inline `run:` is
therefore hand-verified, not tool-verified: the `if:` predicate is
byte-identical to the two `actions/cache` steps' own conditions, and all
8 call sites were audited (5 suffixed, 3 `go: "false"`).
- Both pre-push reviewers run, no skips
- No change to what any job *does*; only which cache keys hold which
paths

Expect the first run on `main` after merge to be a cold miss on both new
keys (one-time repopulation), then warm. Don't read that run's timing as
a regression.

## Post-merge

**Purge the orphaned entries** — the five dead `gobuild-v2-*` (5.18 GB)
**and** the `setup-go-*` entry (0.97 GB) that `cache: false` orphans.
Nothing restores or refreshes either family after this lands. The repo
is at **9.27 GB / 10 GB across 24 entries** with them still resident.
This branch's own runs add a ~1.05 GB generation on the PR ref
(pre-merge peak ~9.3 GB), and merging adds another ~1.05 GB generation
plus the ~0.5 GB release cache on `main` — so if the PR-scope entries
haven't been reclaimed yet the transient peak is **~10.3 GB, over the
cap this PR exists to defend**. Purge immediately at merge, not later —
this is load-bearing, not housekeeping. The orphans would clear on the
7-day idle sweep, but not necessarily before the next dependency bump.

```bash
gh api repos/Wave-RF/WaveHouse/actions/caches --paginate \
  -q '.actions_caches[]|select(.key|startswith("gobuild-v2-") or startswith("setup-go-"))|.id' \
  | xargs -I{} gh api -X DELETE repos/Wave-RF/WaveHouse/actions/caches/{}
```

Do this **after** merge, not before — `main` still uses the v2 keys
until then, so an early purge just forces a cold repopulate of caches
we're about to abandon.

## Notes

- GitHub's LRU eviction reclaimed the previous generation on its own
mid-investigation (10.53 GB → 7.19 GB), so this isn't currently breaking
builds — it recurs on the next dependency bump. Usage has since climbed
to 9.27 GB as this branch's runs added entries, which is why the
post-merge purge above matters.
- Pre-existing docs drift surfaced by the `docs-reviewer` gate
(unrelated to this branch) is tracked in #444 rather than folded in
here.

Closes #443

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
jfwoods added a commit that referenced this pull request Aug 11, 2026
@jfwoods
docs: address pre-push review round 11 — stale changelog entry, ARGS/…
c2c1021 
…V accuracy

Drops the CHANGELOG dependency-bump entry: after merging origin/main, go.mod
and go.sum are byte-identical to main and no longer appear in this PR's delta,
and the bumps it claimed credit for landed on main via Dependabot (#438). The
matching bullet in the PR description was removed too.

Corrects the test-target flag documentation in development.md, which claimed
all test targets accept ARGS. Per the Makefile: gotestsum drives test-unit and
test-integration only; ARGS reaches test-unit, test-integration, and test-ts;
V=1 reaches test-unit, test-integration, and test-e2e (the orchestrator reads
it directly). Adds the Go SDK unit test and wire-conformance case entries to
"Adding New Tests", which the SDK sync rule requires for every new endpoint.

Narrows the "every operation returns (T, error)" claim in the Go SDK index,
reference, and README: the void operations (Pipes.Set/Delete, Policy.Set,
Schema.Refresh, Sys.Health) return a bare error, as reference.md's own API
tree already showed. Lists the FilterOp constants rather than raw symbols in
the streaming filter docs, matching how every example calls .Where(), and
fixes "the SDK readme" to "readmes" now that docs-prose.sh resolves both.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@EricAndrechek EricAndrechek EricAndrechek approved these changes

Assignees

No one assigned

Labels

area/infra CI, build, deploy, Docker, release area/observability Metrics, logs, traces, health, profiling dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

WaveHouse Task Board
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@EricAndrechek