Skip to content

Update gomod dependencies #4681

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
renovate merged 1 commit into from
Aug 26, 2026
Merged

Update gomod dependencies #4681

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
164 changes: 81 additions & 83 deletions flow/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ require (
github.com/Azure/azure-sdk-for-go/sdk/messaging/azeventhubs/v2 v2.0.2
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/eventhub/armeventhub v1.3.0
github.com/ClickHouse/ch-go v0.74.0
github.com/ClickHouse/clickhouse-go/v2 v2.47.0
github.com/ClickHouse/clickhouse-go/v2 v2.48.0

@claude claude Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clickhouse-go v2.48.0 is tagged as a breaking change upstream — verified PeerDB is not exposed. No action needed; recording the check so it does not have to be re-derived.

Upstream flags #1928 (arbitrary input/output formats) as "breaking change if you depend on the driver.Conn interface". Nothing in this repo implements clickhouse.Conn/driver.Conn — it is only consumed (connectors/clickhouse/clickhouse.go:32,199, pkg/clickhouse/query_retry.go), and adding methods to an interface only breaks implementers. The passing CodeQL Go build confirms it.

The other semantic changes in 2.48.0 all sit in query parameter binding: floats now bound as typed Float literals (#1894), bools rendered true/false (#1892), Map string-key escaping (#1897), fully timezone-aware time formatting (#1904). Every production ClickHouse call goes through peerdb_clickhouse.Exec/Query/QueryRow with no bind args (queries are string-built), so none of those paths are reachable.

Two things worth keeping an eye on:

  1. #1944 makes Scan return errors when scanning a Tuple into a map, instead of silently succeeding. Production does not scan tuples, but if a ClickHouse e2e assertion does, this bump is what changed its behaviour.
  2. #1902 replaces resources.ClientMeta.IsSupportedClickHouseVersion with a plain proto.CheckMinVersion(resources.MinSupportedVersion, ...). It only affects the "unsupported clickhouse version" warn log, but it also drops the clickhouse-go yaml dependency — that is why go.yaml.in/yaml/v3 disappears from flow/pkg/go.mod in this diff. Expected, not an accidental removal; it stays in flow/go.mod, bumped to 3.0.5 via other deps.

The remaining 2.48.0 changes are HTTP-protocol-only (structured exceptions #1910, the formats work, and removal of a stray HTTP compression debug print), and Connect uses the default native protocol, so they do not apply. ch-go is already at the 0.74.0 that 2.48.0 wants, so no follow-up bump is needed.

@claude claude Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Blocking: flow/go.sum was not regenerated — the flow module does not build

This PR bumps ~30 direct dependencies in flow/go.mod, but flow/go.sum is not in the diff at all. Only flow/pkg/go.sum was updated. flow/go.sum on this branch still carries the old hashes:

$ grep clickhouse-go/v2 flow/go.sum
github.com/ClickHouse/clickhouse-go/v2 v2.47.0 h1:ZDAzrnKSOPTIsm4tdUNfrii2yc8dk4SVRLC77BR7Z5Q=
github.com/ClickHouse/clickhouse-go/v2 v2.47.0/go.mod h1:sPj7C7UYQ2MWHcfX+4eGN6nwnCqwUKfgO6PcwKpd6K8=

$ grep "go.opentelemetry.io/otel v1.4" flow/go.sum
go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=

Every bumped version is missing its h1: and /go.mod hash, so the build fails at module verification before it ever compiles. docker-build already confirms it:

connectors/postgres/cdc.go:23:2: missing go.sum entry for module providing
  package github.com/pgvector/pgvector-go
connectors/mysql/charset.go:18:2: missing go.sum entry for module providing
  package golang.org/x/text/encoding/unicode/utf32
cmd/api.go:22:2: missing go.sum entry for module providing
  package google.golang.org/grpc/health
...
ERROR: process "go build ... -o /root/peer-flow" did not complete successfully: exit code: 1

Root cause — a transient module-proxy failure during the Renovate artifact step, per its own ⚠️ Artifact update problem comment on this PR:

File name: flow/go.sum
go: github.com/tikv/client-go/v2@v2.0.8-... (replaced by
  github.com/PeerDB-io/tikv-client-go/v2@v2.0.7): read
  "https://proxy.golang.org/.../tikv-client-go/v2/@v/v2.0.7.mod":
  stream error: stream ID 473; INTERNAL_ERROR; received from peer

So flow/go.mod was written but flow/go.sum generation aborted midway. That failure is in resolving the replaced tikv-client-go fork — unrelated to any dependency in this bump, which is why a plain retry should clear it.

Fix — retrigger the Renovate artifact update (tick the rebase checkbox in the PR body, or rename the PR title to start with rebase!), or regenerate locally:

cd flow && go mod tidy && go build ./...

Do not merge until flow/go.sum is in the diff and docker-build is green.

@claude claude Bot Aug 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clickhouse-go 2.48.0 carries a documented breaking change. #1928 (arbitrary input/output formats, experimental, HTTP only) extends the driver.Conn interface, and the release notes explicitly call it out as a "breaking change if you depend on driver.Conn".

Checked against our usage: PeerDB only consumes that interface — flow/pkg/clickhouse/query_retry.go, flow/connectors/clickhouse/clickhouse.go, flow/e2e/clickhouse.go — and no type in the repo implements driver.Conn (no mocks or wrappers). So this is source-compatible for us.

Other 2.48.0 behavior changes I checked:

  • Query parameter binding changed for floats (#1894, now bound as typed Float literals), bools (#1892, rendered true/false) and string keys in Map params (#1897, escaping fix). Not applicable — every Exec/Query/QueryRow call under flow/ passes a fully formatted SQL string and no args.
  • fix: return errors when scanning Tuple maps (#1944) turns previously silent scan failures into returned errors. No Tuple scanning in flow/.
  • Remove stray HTTP compression debug output (#1937) removes unsolicited driver output — a small win for the log hygiene rule in .claude/REVIEW.md.
  • preserve per-query JWT in QueryOptions.clone() (#1914) and use atomic.Int64 for connID (#1905) are both fixes in our favor.
  • 2.48.0 requires ch-go v0.74.0, which flow/go.mod already pins directly, so there is no transitive shift there.

No action needed — flagging so the driver.Conn note is not missed if a fake/mock ClickHouse connection is ever added.

@claude claude Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clickhouse-go v2.47.0 → v2.48.0 — upstream declares a breaking change; verified not hit here.

Release notes flag #1928 (arbitrary input/output formats) as a breaking change if you depend on the driver.Conn interface. This repo only ever consumes clickhouse.Conn (flow/connectors/clickhouse/clickhouse.go:199, plus flow/pkg/clickhouse/query_retry.go and validation.go) and never implements it, so the interface widening is source-compatible here.

Other behaviour changes in this range and their applicability:

  • Query-parameter binding changed: floats now bind as typed Float literals (#1894), bools render as true/false (#1892), Map string-key escaping fixed (#1897). PeerDB builds ClickHouse SQL with fmt.Sprintf, and the args ...any pass-through in flow/pkg/clickhouse/query_retry.go has no float/bool/map call sites, so no bound-parameter rendering changes.
  • Scan on Tuple-to-map now returns errors instead of silently succeeding (#1944). All Scan targets in flow/connectors/clickhouse and flow/pkg/clickhouse are scalars/strings, so no previously-swallowed error becomes a new failure.
  • Structured HTTP exceptions (#1910) and the stray HTTP-compression debug print removal (#1937) are HTTP-protocol only; Connect sets no Protocol, so the native protocol is used. Error classification in flow/alerting/classifier.go keys off *clickhouse.Exception.Code rather than message text, so the exception-parser rework is not observable there.

No action needed — noting it so the driver.Conn warning in the changelog is not mistaken for an unaddressed break.

@claude claude Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clickhouse-go v2.48.0 raises the driver's declared minimum ClickHouse server from ~22.11 to 25.8.0.

v2.48.0 deletes resources/meta.yml and Meta.IsSupportedClickHouseVersion and replaces them with a hardcoded resources.MinSupportedVersion = {25, 8, 0}. conn.dial now does proto.CheckMinVersion(resources.MinSupportedVersion, ...), where v2.47.0 checked against a version list whose greatest entry was 22.11.

Impact is log-only — a Warn("unsupported clickhouse version") on the first connection in the pool, no error — and CI is unaffected since .github/workflows/flow.yml:64 pins LTS at 25.8.28.1. But PeerDB deliberately supports older servers: connectors/clickhouse/staging_s3.go:73-85 gates S3 session tokens on >= 24.3.1, and model/qvalue/kind.go:121 gates JSON on >= 25.3. Self-hosted users on 23.x/24.x will now see this warning on every connector startup. Worth deciding whether to suppress it or raise PeerDB's own documented ClickHouse floor.

The rest of the 2.47→2.48 delta I checked and it is clear for this repo:

  • driver.Conn gained QueryFormat/InsertFormat; upstream flags this as a breaking change for implementers. Every use here consumes the interface (clickhouse.go:32,199,270, pkg/clickhouse/*, e2e/clickhouse.go:404) and no type implements it, so no compile break.
  • bind.go / query_parameters.go were substantially rewritten: floats now render as cast(x, 'Float64') for client-side binding, and server-side {name:Type} parameters now send times as epoch, nil as \N, bools as true/false, and maps as {'k':v}. No impact — every ClickHouse statement in this repo is built with fmt.Sprintf and passes zero bind args (the one Query call with a dynamic query, clickhouse.go:479, passes none).
  • lib/column/tuple.go scan now returns the error it previously swallowed (return reflect.Value{}, nil → err). Only reachable when scanning a Tuple into a Go map, which this repo does not do.

github.com/PeerDB-io/glua64 v1.0.1
github.com/PeerDB-io/gluabit32 v1.0.2
github.com/PeerDB-io/gluajson v1.0.2
Expand All @@ -23,24 +23,24 @@ require (
github.com/PeerDB-io/peerdb/flow/pkg v0.0.0
github.com/Shopify/toxiproxy/v2 v2.12.0
github.com/apache/arrow-go/v18 v18.7.0
github.com/aws/aws-sdk-go-v2 v1.43.4
github.com/aws/aws-sdk-go-v2/config v1.32.35
github.com/aws/aws-sdk-go-v2/credentials v1.19.34
github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.33
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.10
github.com/aws/aws-sdk-go-v2/service/kms v1.55.2
github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5
github.com/aws/aws-sdk-go-v2/service/ses v1.37.2
github.com/aws/aws-sdk-go-v2/service/sts v1.45.4
github.com/aws/smithy-go v1.27.6
github.com/aws/aws-sdk-go-v2 v1.43.6
github.com/aws/aws-sdk-go-v2/config v1.32.37
github.com/aws/aws-sdk-go-v2/credentials v1.19.36
github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.37
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.14

@claude claude Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aws-sdk-go-v2 s3 stack — two fixes worth knowing, plus one note on where Renovate stopped.

  • feature/s3/transfermanager v0.3.10 → v0.3.14 fixes a real leak: "Close each file transferred during directory upload/download to avoid leaking file handles" (v0.3.14). Relevant for long-running avro staging uploads.
  • service/s3 v1.106.5 → v1.107.2 carries "Forward the original response body Closer in S3 200-error handling instead of wrapping it in io.NopCloser, to avoid issues with TCP connection reuse (observed on CompleteMultipartUpload)" — directly on the multipart path used for staging.
  • Core aws-sdk-go-v2 v1.43.5 fixes a recorded clock skew persisting on the client even after client and server clocks realign.

Note for whoever merges: upstream service/s3 v1.107.3 extends the "error inside an HTTP 200 response" detection (wave 2/4) and is not in this PR — the renovate/stability-days gate held it back. Not a blocker, it will arrive in the next sweep.

No API-shape changes across these ranges; the s3 bump is a minor only because of an unrelated AWS Backup access-point feature (v1.107.0).

github.com/aws/aws-sdk-go-v2/service/kms v1.55.6
github.com/aws/aws-sdk-go-v2/service/s3 v1.107.2
github.com/aws/aws-sdk-go-v2/service/ses v1.37.6
github.com/aws/aws-sdk-go-v2/service/sts v1.45.6
github.com/aws/smithy-go v1.27.8
github.com/cockroachdb/pebble/v2 v2.1.6
github.com/elastic/go-elasticsearch/v8 v8.19.6
github.com/elastic/go-elasticsearch/v8 v8.19.7
github.com/go-logr/logr v1.4.4
github.com/go-mysql-org/go-mysql v1.15.1-0.20260701093637-35ca5c6ee8c8
github.com/gogo/googleapis v1.4.1
github.com/google/uuid v1.6.0
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0

@claude claude Bot Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Codegen plugin pins are drifting behind the runtime libraries.

The gateway runtime moves to v2.30.0 here, but buf.gen.yaml:32 still pins the generator at buf.build/grpc-ecosystem/gateway:v2.28.0 — and since flow/generated/protos is generated at build time (only stub.go is checked in), every build pairs v2.28.0-generated stubs with a v2.30.0 runtime. The skew was one minor before this PR and becomes two.

Consequence: v2.30.0 generated-code fixes never reach PeerDB. Concretely, #7192 ("Drain request only after ParseForm") and #6948 (nested body path init for oneof fields) both live in emitted code, not the runtime, so bumping the module alone is a no-op for them.

Same pattern further down the file: buf.gen.yaml:9 pins buf.build/protocolbuffers/go:v1.36.11 while google.golang.org/protobuf goes to v1.36.12 on line 97.

This is not a regression introduced by this PR, and it compiles fine (docker-build is green — grpc-gateway keeps generated code forward-compatible with newer runtimes). The root cause is that renovate.json5 has no matcher for buf.gen.yaml, so these pins only ever move by hand. Worth either adding a Renovate rule for the buf plugin versions or bumping them alongside this PR.

github.com/hamba/avro/v2 v2.31.0
github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6
github.com/jackc/pglogrepl v0.0.0-20260401131349-e37c41485510
Expand All @@ -52,55 +52,55 @@ require (
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee
github.com/nickbruun/pgsplit v0.0.0-20240103043353-43e6c2dddfad
github.com/orcaman/concurrent-map/v2 v2.0.1
github.com/pgvector/pgvector-go v0.4.0
github.com/pgvector/pgvector-go/pgx v0.4.0
github.com/pgvector/pgvector-go v0.4.1

@claude claude Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pgvector-go v0.4.0 → v0.4.1 — real robustness win for CDC, worth calling out.

No GitHub release for this tag; the commit log for the range is almost entirely "Fixed panics with Parse methods" (#29), "Fixed panics with DecodeBinary methods", and added length/validation checks for SparseVector and NewSparseVectorFromMap.

That matters here because these decode paths run on input we do not control — vector column values coming off a customer Postgres. Previously a malformed or truncated vector/sparsevec payload could panic inside the decoder rather than surface as an error; now it errors. Good bump to take.

github.com/pgvector/pgvector-go/pgx v0.4.1
github.com/pingcap/errors v0.11.5-0.20260523003111-3697ad564b43
github.com/pingcap/tidb v0.0.0-20250130070702-43f2fb91d740
github.com/pingcap/tidb/pkg/parser v0.0.0-20260504140133-511dba1dbe17
github.com/quasilyte/go-ruleguard/dsl v0.3.23
github.com/shopspring/decimal v1.4.0
github.com/slack-go/slack v0.27.0
github.com/slack-go/slack v0.29.0
github.com/snowflakedb/gosnowflake/v2 v2.1.0
github.com/stretchr/testify v1.11.1
github.com/testcontainers/testcontainers-go v0.43.0
github.com/twmb/franz-go v1.21.5
github.com/stretchr/testify v1.12.1

@claude claude Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

testify v1.12.0 truncates very long objects in assertion failure messages (stretchr/testify#1646).

Worth knowing because the e2e suites assert on whole row sets — failure output that previously dumped the full value will now be cut off, making CI failures harder to diagnose from logs alone. No correctness impact, just diagnosability.

Everything else in the v1.11.1→v1.12.1 range is benign here:

  • *AssertionFunc types became plain aliases — source-compatible.
  • suite now validates Test* method signatures and continues with the valid ones instead of aborting the suite.
  • mock reverted to pre-v1.11.0 argument matching for mutating stringers, and no longer panics on nil expected types.
  • v1.12.1 swaps gopkg.in/yaml.v3 for go.yaml.in/yaml/v3 and vendors go-difflib/go-spew. That is what drops gopkg.in/yaml.v3 and pmezard/go-difflib from the indirect blocks in both flow/go.mod and flow/pkg/go.mod — no first-party file imports either package, so the removals are correct.

github.com/testcontainers/testcontainers-go v0.44.0

@claude claude Bot Aug 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Heads-up (behavioural, test-only): testcontainers-go 0.44 flips the default logger on. PR #3459 changed log/logger.go from

var defaultLogger Logger = &noopLogger{}   // opt *in* via -v / -test.v=true

to

var defaultLogger Logger = log.New(os.Stderr, "", log.LstdFlags)  // opt *out* via -test.v=false

So flow/e2e/mysql.go (our only testcontainers user) will now emit container lifecycle lines to stderr on every e2e run, not just under -v. Expect noisier CI logs; pass -test.v=false or testcontainers.WithLogger(log.NewNoopLogger()) if that becomes a problem.

I checked this against the secrets rule in .claude/REVIEW.md and it is not a leak: the default logger prints lifecycle messages only, and wait/sql.go at v0.44.0 passes w.URL(host, port) straight into sql.Open without logging it — so the root:<password>@host:port DSN built at flow/e2e/mysql.go:108 and the MYSQL_ROOT_PASSWORD / MARIADB_ROOT_PASSWORD env values are not printed.

Also worth knowing from this release: fix: read exec exit code only after draining the output stream (#3766) and fix: properly wait for Ryuk startup when reusing reaper (#3761) — both should reduce e2e flakiness.

@claude claude Bot Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

testcontainers-go v0.44.0 flips the default logger on in tests.

#3459 ("should print max information by default") changes log.defaultLogger from &noopLogger{} to log.New(os.Stderr, "", log.LstdFlags). The gate is inverted too: previously logging was enabled only when -v/-test.v=true was present; now it is on unless -test.v=false is explicitly passed.

Impact here: the MySQL/MariaDB container in flow/e2e/mysql.go:102-116 (and anything else going through testcontainers.GenericContainer) will emit container lifecycle / reaper / wait-strategy output to stderr on every flow_test run, not just verbose ones. Expect noticeably louder CI logs.

No secrets are exposed by this — testcontainers logs image names, container IDs and port mappings, not ContainerRequest.Env — so this is not a REVIEW.md rule-1 issue. Flagging it so nobody is surprised by the CI output volume; log.SetDefault(log.NewNoopLogger()) is the escape hatch if it becomes a problem.

@claude claude Bot Aug 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

testcontainers-go 0.44.0 flips the default logger on, which will make e2e CI output noticeably louder.

#3459 changes log/logger.go from var defaultLogger Logger = &noopLogger{} to log.New(os.Stderr, "", log.LstdFlags). The init() gate inverted too: logging used to be enabled only when -test.v=true / -v was present, and is now enabled unless -test.v=false is passed explicitly. Our MySQL/MariaDB container setup in flow/e2e/mysql.go will therefore start emitting testcontainers lifecycle lines on stderr in every flow_test job.

Since .claude/REVIEW.md treats new stdout/stderr output as high severity when it can carry secrets, I checked what actually lands there:

  • wait/sql.go at v0.44.0 has no logger calls at all, so the DSN built at flow/e2e/mysql.go:107 via url.UserPassword("root", rootPassword) is never printed — that value only reaches sql.Open.
  • The container logger emits image/container/port lifecycle lines and does not dump ContainerRequest.Env, so the root-password env we pass is not logged either.

So this is extra volume, not leakage. Worth knowing when reading CI logs after this merges. If the noise turns out to be unwanted, the two escape hatches the release provides are passing -test.v=false or setting the newly exported log.NewNoopLogger().

Other 0.44.0 changes relevant to our usage (testcontainers.GenericContainer, CleanupContainer, wait.ForSQL) are all fixes: container name escaping in the Docker name filter, reading the exec exit code only after draining output, and properly waiting for Ryuk startup when reusing the reaper. The 22 new modules do not affect us.

@claude claude Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

testcontainers-go v0.43.0 → v0.44.0 — this one does change runtime output in our CI. Highest-impact behaviour change in the PR.

#3459 inverts the default logger:

-var defaultLogger Logger = &noopLogger{}
+var defaultLogger Logger = log.New(os.Stderr, "", log.LstdFlags)

-        if strings.EqualFold(arg, "-test.v=true") || strings.EqualFold(arg, "-v") {
-            defaultLogger = log.New(os.Stderr, "", log.LstdFlags)
+        if strings.EqualFold(arg, "-test.v=false") {
+            defaultLogger = NewNoopLogger()

Before: logging was on only for a literal -test.v=true / -v. After: on unless -test.v=false.

Our CI runs tests through gotestsum (.github/workflows/tilt-flow.yml:576), which invokes go test -json — that passes -test.v=test2json to the test binary, matching neither old trigger. So testcontainers was silent in CI before this bump and will now write container lifecycle lines to stderr for the MySQL/MariaDB containers in flow/e2e/mysql.go.

I checked this against .claude/REVIEW.md rule 1 (no new output that can carry secrets), since that container request carries MYSQL_ROOT_PASSWORD/MARIADB_ROOT_PASSWORD (CI_MYSQL_ROOT_PASSWORD, flow/internal/test_env.go:140) and the wait.ForSQL probe builds a DSN embedding root:<password>. It is clean: every Logger.Printf in docker.go at v0.44.0 formats only image names, container IDs, and registry/auth-absence notices — the Env map is never logged, and wait/sql.go neither logs the URL nor includes it in its Description(). The residual exposure would be a wait-retry error string echoing the DSN, which go-sql-driver/mysql does not do.

Net effect: noisier e2e logs, no credential leak. If the extra noise is unwanted, pass -test.v=false or set an explicit noop logger in the e2e helper.

Also in range and useful for us: exec exit code now read only after draining output (#3766), Ryuk startup properly awaited when reusing the reaper (#3761), and container names escaped in the Docker name filter (#3837) — all three are plausible flake sources in the current e2e setup.

github.com/twmb/franz-go v1.21.6
github.com/twmb/franz-go/pkg/kadm v1.18.0
github.com/twmb/franz-go/plugin/kslog v1.0.0
github.com/twpayne/go-geos v0.21.0
github.com/urfave/cli/v3 v3.10.1
github.com/twpayne/go-geos v0.22.0

@claude claude Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

go-geos v0.21.0 → v0.22.0 — ownership-semantics change with a CGO double-free flavour; verified not reachable.

There is no GitHub release for this tag; the only functional commits in the range are feat: make NewGeometryCollection take ownership of unowned geoms and feat: support ReleaseCollection. Ownership transfer on a CGO-backed geometry type is exactly the kind of change that turns previously-correct caller code into a use-after-free or double-free.

Not reachable here: all call sites use only the NewGeomFrom* constructors — NewGeomFromWKB (flow/shared/datatypes/geo.go:19, flow/connectors/mysql/qvalue_convert.go:164), NewGeomFromWKT (flow/shared/datatypes/geo.go:39, flow/model/qvalue/equals.go:255 and :267), NewGeomFromGeoJSON (flow/connectors/cockroachdb/changefeed.go:876). NewGeometryCollection and ReleaseCollection are unused repo-wide. Worth remembering if geometry-collection construction is ever added.

github.com/urfave/cli/v3 v3.11.0
github.com/xdg-go/scram v1.2.0
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78
github.com/yuin/gopher-lua v1.1.2
go.mongodb.org/mongo-driver/v2 v2.8.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0
go.opentelemetry.io/otel v1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0
go.opentelemetry.io/otel/metric v1.44.0
go.opentelemetry.io/otel/sdk v1.44.0
go.opentelemetry.io/otel/sdk/metric v1.44.0
go.opentelemetry.io/otel/trace v1.44.0
go.temporal.io/api v1.63.4
go.temporal.io/sdk v1.47.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0
go.opentelemetry.io/otel v1.45.0

@claude claude Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

opentelemetry-go v1.44.0 → v1.45.0 — four breaking changes upstream; none reachable, but one is a latent trap.

Upstream breaking changes and their applicability:

  • otel/log loses Kind/Value/KeyValue and their constructors, and log bodies/attrs move to attribute.Value (#8490); sdk/log/logtest RecordFactory loses its attribute-limit fields (#8556). The OTel logs SDK is not used here (metrics + traces only), so no impact.
  • ⚠️ The trap: WithEndpointURL in otlpmetrichttp / otlptracehttp no longer appends the default signal path when the URL has no path — it now uses / (#8538). That would silently POST metrics to the wrong path. We are safe only because flow/otel_metrics/otel_manager.go:795 constructs exporters as otlpmetrichttp.New(ctx, otlpmetrichttp.WithMaxRequestSize(0)) and lets OTEL_EXPORTER_OTLP_*_ENDPOINT drive the endpoint. Anyone adding WithEndpointURL later needs url.JoinPath(endpoint, "/v1/metrics") to keep pre-1.45 behaviour.

WithMaxRequestSize(0) — added in 1.44, and the subject of the comment above that call — is untouched in 1.45.

Two fixes in range that are relevant to us: exporter endpoint configuration is no longer included in internal SDK logs (#8438), reducing the chance of an endpoint-embedded credential reaching logs (rule 1); and Retry-After is finally parsed as seconds rather than nanoseconds (#8383) plus HTTP-date support (#8417) — so OTLP HTTP export retry backoff will behave very differently (correctly) against a collector that returns Retry-After.

go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
go.opentelemetry.io/otel/metric v1.45.0
go.opentelemetry.io/otel/sdk v1.45.0
go.opentelemetry.io/otel/sdk/metric v1.45.0
go.opentelemetry.io/otel/trace v1.45.0
go.temporal.io/api v1.63.5
go.temporal.io/sdk v1.48.0

@claude claude Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

temporal sdk v1.47.0 → v1.48.0 — no breaks; one fix lands directly on a PeerDB failure mode.

Relevant fix: #2513 prevents workflow task failures when an activity with a custom activity ID completes while its cancellation command is still pending. Given how much of the CDC/QRep orchestration cancels and restarts activities, this is a genuine stability improvement rather than a neutral bump.

Compatibility checked: v1.48.0 adds a reworked go.temporal.io/sdk/interceptor/tracing that backs the new contrib/opentelemetry-v2 module and is explicitly not span-compatible with the v1 tracing interceptor. This PR keeps go.temporal.io/sdk/contrib/opentelemetry v0.8.1 (v1) pinned and unchanged, so emitted span shapes and parenting do not change — no dashboard or trace-query breakage. go.temporal.io/api v1.63.5 is additive-only (adds WORKFLOW_TASK_FAILED_CAUSE_REQUEST_TOO_LARGE, no enum renumbering).

go.temporal.io/sdk/contrib/opentelemetry v0.8.1
go.uber.org/automaxprocs v1.6.0
golang.org/x/crypto v0.54.0
golang.org/x/crypto v0.55.0
golang.org/x/exp v0.0.0-20260727155853-b88d891fe743
golang.org/x/sync v0.22.0
golang.org/x/text v0.40.0
golang.org/x/tools v0.48.0
golang.org/x/text v0.41.0

@claude claude Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

golang.org/x/text v0.40.0 → v0.41.0 — security fix, argues for merging.

The single functional commit in this range fixes CVE-2026-56851 (golang/go#80112): the secure/precis Nickname profile wrote an interior space to the destination buffer without first checking there was room for both the space and the next rune, so a short destination could cause out-of-bounds writes or incomplete copies. It now returns transform.ErrShortDst.

Reached only transitively here, but it is a memory-safety fix in a text-transform path, so it argues for merging rather than holding this PR.

golang.org/x/tools v0.49.0
google.golang.org/api v0.287.1
google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7
google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7
google.golang.org/grpc v1.82.1
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d
google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d
google.golang.org/grpc v1.83.1

@claude claude Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

grpc-go v1.83.0 turns on a server-side HTTP/2 control-frame throttle by default.

From the v1.83.0 release notes:

server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.

PeerDB runs gRPC servers (flow/cmd/api.go), so this applies to the flow API. It is a security hardening fix and the default is unlikely to affect normal traffic, but it does change read behaviour under load: a peer that accumulates more than 100 pending non-DATA/non-HEADERS frames (SETTINGS / WINDOW_UPDATE / PING / RST_STREAM bursts from many concurrent streams) will have its connection reads paused. Flagging so the env-var escape hatch is known if anyone reports API stalls after this ships.

v1.83.1 on top is xds/RBAC matcher hardening (xds is not used here) plus a transport fix restricting memory overhead when buffering small DATA frames — both safe.

google.golang.org/protobuf v1.36.12
k8s.io/apimachinery v0.36.3
k8s.io/client-go v0.35.3 // Note: v0.* are newer than v1.*
)

require (
cel.dev/expr v0.25.1 // indirect
cel.dev/expr v0.25.2 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
cloud.google.com/go/iam v1.11.0 // indirect
cloud.google.com/go/longrunning v1.2.0 // indirect
Expand All @@ -117,7 +117,7 @@ require (
github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect
github.com/BurntSushi/toml v1.6.0 // indirect
github.com/DataDog/zstd v1.5.7 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
Expand All @@ -127,19 +127,19 @@ require (
github.com/andybalholm/brotli v1.2.2 // indirect
github.com/apache/arrow/go/v15 v15.0.2 // indirect
github.com/apache/thrift v0.24.0 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.18 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.37 // indirect
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.21.0 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.37 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.37 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.38 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.17 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.30 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.37 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.38 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.5.6 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.33.6 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.6 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
Expand Down Expand Up @@ -174,7 +174,7 @@ require (
github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect
github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/felixge/httpsnoop v1.1.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.1 // indirect
github.com/gabriel-vasile/mimetype v1.4.13 // indirect
github.com/getsentry/sentry-go v0.44.1 // indirect
Expand All @@ -183,20 +183,20 @@ require (
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-ole/go-ole v1.3.0 // indirect
github.com/go-openapi/jsonpointer v0.22.5 // indirect
github.com/go-openapi/jsonreference v0.21.5 // indirect
github.com/go-openapi/swag v0.25.5 // indirect
github.com/go-openapi/swag/cmdutils v0.25.5 // indirect
github.com/go-openapi/swag/conv v0.25.5 // indirect
github.com/go-openapi/swag/fileutils v0.25.5 // indirect
github.com/go-openapi/swag/jsonname v0.25.5 // indirect
github.com/go-openapi/swag/jsonutils v0.25.5 // indirect
github.com/go-openapi/swag/loading v0.25.5 // indirect
github.com/go-openapi/swag/mangling v0.25.5 // indirect
github.com/go-openapi/swag/netutils v0.25.5 // indirect
github.com/go-openapi/swag/stringutils v0.25.5 // indirect
github.com/go-openapi/swag/typeutils v0.25.5 // indirect
github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
github.com/go-openapi/jsonpointer v1.0.0 // indirect
github.com/go-openapi/jsonreference v1.0.0 // indirect
github.com/go-openapi/swag v0.28.0 // indirect
github.com/go-openapi/swag/cmdutils v0.28.0 // indirect
github.com/go-openapi/swag/conv v0.28.0 // indirect
github.com/go-openapi/swag/fileutils v0.28.0 // indirect
github.com/go-openapi/swag/jsonutils v0.28.0 // indirect
github.com/go-openapi/swag/loading v0.28.0 // indirect
github.com/go-openapi/swag/mangling v0.28.0 // indirect
github.com/go-openapi/swag/netutils v0.28.0 // indirect
github.com/go-openapi/swag/pools v0.28.0 // indirect
github.com/go-openapi/swag/stringutils v0.28.0 // indirect
github.com/go-openapi/swag/typeutils v0.28.0 // indirect
github.com/go-openapi/swag/yamlutils v0.28.0 // indirect
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
github.com/goccy/go-json v0.10.6 // indirect
github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
Expand Down Expand Up @@ -234,17 +234,17 @@ require (
github.com/minio/minlz v1.1.0 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/moby/go-archive v0.2.0 // indirect
github.com/moby/moby/client v0.5.0 // indirect
github.com/moby/moby/client v0.5.1 // indirect
github.com/moby/patternmatcher v0.6.1 // indirect
github.com/moby/sys/sequential v0.6.0 // indirect
github.com/moby/sys/sequential v0.7.0 // indirect
github.com/moby/sys/user v0.4.0 // indirect
github.com/moby/sys/userns v0.1.0 // indirect
github.com/moby/term v0.5.2 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/mtibben/percent v0.2.1 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/nexus-rpc/nexus-proto-annotations v0.1.0 // indirect
github.com/nexus-rpc/sdk-go v0.6.0 // indirect
github.com/nexus-rpc/sdk-go v0.7.0 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.1.1 // indirect
github.com/opentracing/basictracer-go v1.1.0 // indirect
Expand All @@ -258,7 +258,6 @@ require (
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
github.com/prometheus/client_golang v1.23.2 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
Expand All @@ -269,10 +268,10 @@ require (
github.com/rogpeppe/go-internal v1.14.1 // indirect
github.com/segmentio/asm v1.2.1 // indirect
github.com/shirou/gopsutil/v3 v3.24.5 // indirect
github.com/shirou/gopsutil/v4 v4.26.5 // indirect
github.com/shirou/gopsutil/v4 v4.26.6 // indirect
github.com/shoenig/go-m1cpu v0.2.1 // indirect
github.com/sirupsen/logrus v1.9.4 // indirect
github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
github.com/spiffe/go-spiffe/v2 v2.7.0 // indirect
github.com/stretchr/objx v0.5.3 // indirect
github.com/tiancaiamao/gp v0.0.0-20230126082955-4f9e4f1ed9b5 // indirect
github.com/tikv/client-go/v2 v2.0.8-0.20250117034919-61e09c6539bd // indirect
Expand All @@ -292,28 +291,27 @@ require (
go.etcd.io/etcd/client/v3 v3.6.9 // indirect
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/detectors/gcp v1.43.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
go.opentelemetry.io/proto/otlp v1.11.0 // indirect
go.uber.org/atomic v1.11.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.28.0 // indirect
go.yaml.in/yaml/v2 v2.4.4 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/mod v0.38.0 // indirect
golang.org/x/net v0.57.0 // indirect
go.yaml.in/yaml/v3 v3.0.5 // indirect
golang.org/x/mod v0.39.0 // indirect
golang.org/x/net v0.58.0 // indirect

@claude claude Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

golang.org/x/net v0.57.0 → v0.58.0 (indirect) — one silent behaviour change in proxy resolution.

http/httpproxy: prioritize lowercase proxy environment variables. If a deployment sets both HTTP_PROXY and http_proxy (or the HTTPS_/NO_ pairs) to different values, the winner changes after this bump. Anything reaching an external endpoint through net/http in a proxied environment — S3/KMS/SES, BigQuery, Snowflake, Elasticsearch, Slack alerts, OTLP HTTP export — resolves its proxy through this package. Not a code change we need to make; just a deploy-config edge case to be aware of if a customer environment sets both casings inconsistently.

Also in range: dns/dnsmessage gained a boundary check in unpackSVCBResource, where a malformed record header length could exceed the buffer and cause an out-of-bounds slice on the second-pass copy — a memory-safety fix. The remaining commits are quic and internal/http3 work (HTTP/3 server deadlines, keep-alive busy-loop, Config.Clone on nil), none of which this repo uses.

golang.org/x/oauth2 v0.36.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 // indirect
golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5 // indirect
golang.org/x/term v0.45.0 // indirect
golang.org/x/time v0.15.0 // indirect
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/api v0.35.3 // indirect
k8s.io/klog/v2 v2.140.0 // indirect
k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 // indirect
Expand Down
Loading
Loading