Repository navigation
chore(deps): bump core to v0.4.9 in drivers, checkpoint, and the config skill - #593
Merged
Merged
Conversation
…ig skill ## Why `core/v0.4.9` is tagged and published, and every in-tree dependent still pins a pre-0.4.9 release. For `driver/openai` that is not only drift: 8f8de39 moved its single telemetry attribute to the attribute vocabulary (#590) while its `go.mod` still required `core v0.4.4` and `otel/log v0.19.0`, so the module does not build on its own — $ cd driver/openai && GOWORK=off go build ./... ./telemetry.go:33:3: cannot use attribute.String("stream.finish.synthesized", synthesized) (value of struct type "go.opentelemetry.io/otel/attribute".KeyValue) as "go.opentelemetry.io/otel/log".KeyValue value in argument to append `driver/openai` is tag-cut by hand on main, and that tag has to land on a commit whose `go.mod` is tidied against the released core, so the bump comes before `driver/openai/v0.3.4`. The same bump carries the two otel advisories out of every dependent for standalone builds: `core v0.4.9` requires the v1.45.0 / v0.21.0 family (`sdk/log`, `otlptrace`) that cleared GO-2026-6615 and GO-2026-6505. ## What changed - `driver/openai`, `driver/anthropic`, `driver/bytedance`, `driver/minimax`, `backends/checkpoint`, `skills/flowcraft-config/scripts/validator`: `core v0.4.9`, tidied with `GOWORK=off` (the mode the release gate uses). The otel family moves as one — v1.44.0 / v0.19.0 to v1.45.0 / v0.21.0 — with the fallout core took in #590 (logr 1.4.4, grpc-gateway 2.29.0, genproto 2026-08-03, proto/otlp v1.11.0). - `driver/openai`: the now-unused direct requirement `otel/log v0.19.0` is replaced by the `otel` module its code actually imports (`attribute`), which tidy records as a direct dependency. - `skills/flowcraft-config/SKILL.md`: the compatibility section names `core v0.4.9`, so one skill version keeps naming one FlowCraft version. The journal settings its cards document landed in #582, so no card in the skill moves with this pin. - `examples/forge` keeps its pins here: it deliberately resolves *published* tags, and `driver/openai v0.3.4` does not exist until the tag below is cut. It follows in a second, small PR. ## Verification - Per bumped module against the published `core v0.4.9`: `GOWORK=off go build ./...`, `go vet ./...`, `go test ./...`, plus `go mod tidy -diff` clean in both workspace mode and `GOWORK=off`. - Workspace-wide: `go test -count=1 -race ./...` per module, `make lint` (0 issues), `gofmt -s -l` empty, `git diff --check` clean. - `GOWORK=off govulncheck@v1.1.4` (the CI invocation): "No vulnerabilities found" in `driver/openai` and `backends/checkpoint`. - `make release-check`: changesets valid, no pending releases. ## Release notes No changeset; driver tags are cut manually. After this merges, `driver/openai/v0.3.4` is cut on the merge commit so downstream hosts can replace the pre-0.4.9 pin.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps every in-tree dependent to the released
core v0.4.9, and repairsdriver/openai, which does not build on its own onmainafter #590:telemetry.gopassesattribute.String(...)into atelemetryhelper that the pinnedcore v0.4.4types aslog.KeyValue.driver/openaiis hand-tagged onmain, so this has to land first: the merge commit is wheredriver/openai/v0.3.4gets cut. The bump also lifts the v1.45.0 / v0.21.0 otel family (from v1.44.0 / v0.19.0) into every dependent, which is where GO-2026-6615 and GO-2026-6505 lived for standalone builds.What changed
driver/{openai,anthropic,bytedance,minimax},backends/checkpoint,skills/flowcraft-config/scripts/validator:core v0.4.9, tidied withGOWORK=off(the release gate's mode), with the tidy fallout core took in chore(core,driver/openai): migrate to the OTel attribute log API #590 (logr 1.4.4, grpc-gateway 2.29.0, genproto 2026-08-03, proto/otlp v1.11.0).driver/openai: drops the now-unused directotel/log v0.19.0requirement in favor ofgo.opentelemetry.io/otel(theattributepackage the code imports).skills/flowcraft-config/SKILL.md: the pin line namescore v0.4.9; the cards already document the journal settings from feat(core): add a sandbox file journal #582, so nothing else in the skill moves.examples/forgeis deliberately left alone: it pins published tags anddriver/openai v0.3.4does not exist yet. It follows in a small PR after the tag.Verification
GOWORK=off go build ./...,go vet ./...,go test ./..., andgo mod tidy -diffclean in workspace mode and withGOWORK=off.go test -count=1 -race ./...per module;make lint0 issues;gofmt -s -lempty;git diff --checkclean.GOWORK=off govulncheck@v1.1.4: no vulnerabilities found indriver/openaiandbackends/checkpoint.make release-check: changesets valid, no pending releases.