Repository navigation
Update dependencies and move to Go 1.27 - #10
Merged
3 commits merged intoOct 29, 2026
Merged
3 commits merged into
3 commits merged into
Conversation
Every module moves to its latest compatible release except openfga/openfga and the two modules it pins, openfga/api/proto and openfga/language/pkg/go. Those three are the conformance target: decision 1 bumps the module, the oracle image, the corpus and every Ref: permalink together or not at all, and decision 2 runs the DSL conversion through the language package at the pinned version. Moving them is a retarget, not a dependency update. The updated otel, x/*, grpc and k8s modules declare go 1.26, and Go 1.25 left support when 1.27 shipped. The directive goes straight to 1.27, matching cel4postgres, so the directive, CI (setup-go reads it and resolves the latest 1.27 patch) and the containerised suite all build on the current release. go.work moves with it, since a workspace cannot declare an older go than its modules.
postgres:18-alpine gets the current digest (still PostgreSQL 18.6; the rebuild carries newer Alpine packages). pg_tle moves to v1.5.3. The compose test runner moves to Go 1.27 and gains a digest like every other image here. The runner also loses GOFLAGS=-mod=mod. go.work is committed, so the go command runs in workspace mode, which accepts only readonly or vendor and refused to start: `docker compose run --rm test` had been failing before compiling anything.
harden-runner v2.20.0 to v2.22.3 and upload-artifact v7.0.1 to v7.0.2, still pinned by commit SHA. checkout and setup-go are already at their latest releases.
lemuelroberto
force-pushed
the
deps/bump-dependencies
branch
from
October 29, 2026 23:24
7dd55ee to
12e98d8
Compare
lemuelroberto
changed the title
Merged
lemuelroberto
closed this pull request by merging all changes
into
emfga:main
in
ffacb92
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings every dependency to its latest compatible release, except the
OpenFGA conformance pin, which stays at v1.19.0 (see below).
Supersedes #5 (grpc 1.83.1 to 1.83.2): grpc lands at 1.85.0 here.
What changed
Go
godirective (go.mod, go.work)go get -u ./...+go mod tidy+go work sync(otel 1.47, x/* , k8s 0.37, go-openapi, genproto, modernc, cel.dev/expr, ...)The updated otel, x/*, grpc and k8s modules declare
go 1.26.0, andGo 1.25 is out of support since 1.27 shipped. The directive goes to
1.27, matching cel4postgres;
setup-goreads it and resolves thelatest 1.27 patch. The README now says the host route needs Go 1.27.
Images and tools
@sha256:d3e1620b…@sha256:10a5c69a…(still PostgreSQL 18.6)testrunner@sha256:d200d2dd…GitHub Actions (still SHA-pinned)
Fix: the compose
testservice setGOFLAGS=-mod=mod, which thego command refuses in workspace mode (go.work is committed), so
docker compose run --rm testfailed before compiling anything. Theflag is gone.
Held back
it pins,
openfga/api/protoandopenfga/language/pkg/go, and theoracle image
openfga/openfga:v1.19.0. Decision 1 moves all ofthem, the corpus and the
Ref:permalinks together. A trialretarget to v1.22.1 compiles after a one-line runner signature
change (
listobjects.RunMatrixTestsnow takes a string), but thesuite then fails 242 tests: the v1.22 corpus adds 10 tests
(171/198/1264 vs 161/188/1227) for inline condition expressions
(
$expression, refused by the engine today with code 2056), andTestWriteCausesInventoryfinds a new upstream write cause. Thatis feature work, not a dependency bump.
18, the version floor.
Testing
go build,go vet,gofmt -lclean on Go 1.27.3.go test -count=1 -json ./...againstthe compose stack, four runs: two clean
(14,697 passed, 908 skipped), two with one failure each, a
different test each time, both passing when run alone:
TestRealWorldModels/oncall(the oracle answered 2002 "too manyrewrite rules" under load) and
TestTupleReverseIndexCoversParentEdges(heap fetches afterVACUUM, which concurrent tests can hold back). Both look like
existing timing flakes under a parallel full run rather than
anything these bumps changed; they are fixed in their own PR
stacked on this one.
docker compose run --rm test(golang:1.27-alpine) passes.scripts/build-release.sh+scripts/smoke-artifacts.shpass.CREATE EXTENSION fga4postgresinstalls 0.2.0 through it.