Skip to content

Bump the go_modules group across 1 directory with 2 updates - #1

Closed
dependabot[bot] wants to merge 1 commit into
rootfrom
dependabot/go_modules/go/go_modules-19071ecd8e
Closed

Bump the go_modules group across 1 directory with 2 updates#1
dependabot[bot] wants to merge 1 commit into
rootfrom
dependabot/go_modules/go/go_modules-19071ecd8e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 28, 2026

Copy link
Copy Markdown

Bumps the go_modules group with 2 updates in the /go directory: github.com/go-chi/chi/v5 and golang.org/x/crypto.

Updates github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.2.2

What's Changed

Security fix

  • Fixes GHSA-vrw8-fxc6-2r93 - "Host Header Injection Leads to Open Redirect in RedirectSlashes" commit
    • a lower-severity Open Redirect that can't be exploited in browser or email client, as it requires manipulation of a Host header
    • reported by Anuraag Baishya, @​anuraagbaishya. Thank you!

New Contributors

Full Changelog: go-chi/chi@v5.2.1...v5.2.2

Commits

Updates golang.org/x/crypto from 0.40.0 to 0.45.0

Commits
  • 4e0068c go.mod: update golang.org/x dependencies
  • e79546e ssh: curb GSSAPI DoS risk by limiting number of specified OIDs
  • f91f7a7 ssh/agent: prevent panic on malformed constraint
  • 2df4153 acme/autocert: let automatic renewal work with short lifetime certs
  • bcf6a84 acme: pass context to request
  • b4f2b62 ssh: fix error message on unsupported cipher
  • 79ec3a5 ssh: allow to bind to a hostname in remote forwarding
  • 122a78f go.mod: update golang.org/x dependencies
  • c0531f9 all: eliminate vet diagnostics
  • 0997000 all: fix some comments
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the go_modules group across 1 directory with 2 updates
b01d4d4 
Bumps the go_modules group with 2 updates in the /go directory: [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) and [golang.org/x/crypto](https://github.com/golang/crypto).


Updates `github.com/go-chi/chi/v5` from 5.2.1 to 5.2.2
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.2.1...v5.2.2)

Updates `golang.org/x/crypto` from 0.40.0 to 0.45.0
- [Commits](golang/crypto@v0.40.0...v0.45.0)

---
updated-dependencies:
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.2.2
  dependency-type: direct:production
  dependency-group: go_modules
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Mar 28, 2026
@GottZ

GottZ commented Mar 28, 2026

Copy link
Copy Markdown
Owner

already solved.

@GottZ GottZ closed this Mar 28, 2026
@dependabot @github

dependabot Bot commented on behalf of github Mar 28, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/go_modules/go/go_modules-19071ecd8e branch March 28, 2026 21:07
GottZ added a commit that referenced this pull request Apr 5, 2026
@GottZ @claude
feat(temporal): content_times TIMESTAMPTZ + daily dimension
f79ec67 
Schema-Modernisierung: content_dates DATE[] -> content_times TIMESTAMPTZ[].
User-Entscheidung Session 20: "das macht ja gar keinen sinn, dass die nur
das datum erfassen". Time-Info wurde beim Speichern verworfen. Fix macht
daily-Dimension erst moeglich.

Migration 020:
- content_blocks.content_dates -> content_times (TIMESTAMPTZ[])
- context_temporal.source_date -> source_time (TIMESTAMPTZ)
- Drop M007 dead gravity functions (5 functions, never called from Go)
- Rebuild ctx_rrf WITHOUT 5th channel (Go Post-RRF is the path)
- Add partial B-Tree index idx_temporal_daily
- Backfill daily dimension (existing data at hour=0)

Schema-Cleanup-Bonus: eval.sh P95 Retrieval 156ms -> 57ms durch
5th-Channel-CTE-Removal. Ungenutzte Infrastruktur hatte messbaren Kosten.

Daily Dimension (hour-of-day, 24-cycle, sigma=0.08):
- store.ExpandDimensions: +daily
- rrf.DimensionSigma/DimensionPhase/QueryPhase: +daily
- llm.TemporalDate: +Hour *int field (optional, set by time-of-day matchers)
- llm.matchTimeOfDay: morgens/vormittags/mittags/nachmittags/abends/nachts
  mit Reference-Hours (8/10/12/15/19/23)
- handler.query: Hour in target time.Date eingerechnet

Zeit-Extraktion aus Content:
- isoDateExtract erweitert: capture optional HH:MM
- dotDateExtract erweitert: capture optional HH:MM
- ExtractDates dedup: "2006-01-02T15:04" statt "2006-01-02"
- Formate: 2026-04-05, 2026-04-05 14:30, 2026-04-05T14:30, 2026-04-05T14:30:00Z

Go-Code Renames: content_dates -> content_times (13 files):
- store.UpdateContentTimes, store.FetchContentTimes
- store.TemporalDimension.SourceTime (renamed from SourceDate)
- rrf.Search: remove gravity params (TemporalGravityParams struct deleted)

Live-Verifikation: Block mit "2026-04-05T09:00" -> daily=9 dimension
stored. Query "morgens" (hour=8) -> cyclic_distance(8/24,9/24)=1/24,
GaussianDecay(sigma=0.08) ~0.87 -> Block promoted zu Rank #1.

Tests: 16/16 test.sh, 43/43 eval.sh. Retrieval P95: 57ms (-63% vs baseline).

7 von 7 zyklischen Dimensionen jetzt vollstaendig:
weekday, month, quarter, week, monthday, seasonal, daily.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
GottZ added a commit that referenced this pull request May 27, 2026
@GottZ @claude
feat(temporal): content_times TIMESTAMPTZ + daily dimension
54a857a 
Schema-Modernisierung: content_dates DATE[] -> content_times TIMESTAMPTZ[].
User-Entscheidung Session 20: "das macht ja gar keinen sinn, dass die nur
das datum erfassen". Time-Info wurde beim Speichern verworfen. Fix macht
daily-Dimension erst moeglich.

Migration 020:
- content_blocks.content_dates -> content_times (TIMESTAMPTZ[])
- context_temporal.source_date -> source_time (TIMESTAMPTZ)
- Drop M007 dead gravity functions (5 functions, never called from Go)
- Rebuild ctx_rrf WITHOUT 5th channel (Go Post-RRF is the path)
- Add partial B-Tree index idx_temporal_daily
- Backfill daily dimension (existing data at hour=0)

Schema-Cleanup-Bonus: eval.sh P95 Retrieval 156ms -> 57ms durch
5th-Channel-CTE-Removal. Ungenutzte Infrastruktur hatte messbaren Kosten.

Daily Dimension (hour-of-day, 24-cycle, sigma=0.08):
- store.ExpandDimensions: +daily
- rrf.DimensionSigma/DimensionPhase/QueryPhase: +daily
- llm.TemporalDate: +Hour *int field (optional, set by time-of-day matchers)
- llm.matchTimeOfDay: morgens/vormittags/mittags/nachmittags/abends/nachts
  mit Reference-Hours (8/10/12/15/19/23)
- handler.query: Hour in target time.Date eingerechnet

Zeit-Extraktion aus Content:
- isoDateExtract erweitert: capture optional HH:MM
- dotDateExtract erweitert: capture optional HH:MM
- ExtractDates dedup: "2006-01-02T15:04" statt "2006-01-02"
- Formate: 2026-04-05, 2026-04-05 14:30, 2026-04-05T14:30, 2026-04-05T14:30:00Z

Go-Code Renames: content_dates -> content_times (13 files):
- store.UpdateContentTimes, store.FetchContentTimes
- store.TemporalDimension.SourceTime (renamed from SourceDate)
- rrf.Search: remove gravity params (TemporalGravityParams struct deleted)

Live-Verifikation: Block mit "2026-04-05T09:00" -> daily=9 dimension
stored. Query "morgens" (hour=8) -> cyclic_distance(8/24,9/24)=1/24,
GaussianDecay(sigma=0.08) ~0.87 -> Block promoted zu Rank #1.

Tests: 16/16 test.sh, 43/43 eval.sh. Retrieval P95: 57ms (-63% vs baseline).

7 von 7 zyklischen Dimensionen jetzt vollstaendig:
weekday, month, quarter, week, monthday, seasonal, daily.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
GottZ added a commit that referenced this pull request Jul 10, 2026
@GottZ @claude
feat(auth): ctx_auth principal convergence + ctx_auth_by_id (OAuth F2…
55a2a08 
…, migration 095)

ctx_auth() now RETURNs principal_id (last column, append pattern) and
enforces a third fail-closed gate: the principal must be is_active —
the revoke-all mechanism (deactivating a principal locks every one of
its keys, key-agnostically). The inner scope build is factored into
ctx_auth_by_id(uuid): ctx_auth(plaintext) resolves key_hash→id and
delegates via RETURN QUERY; Achse 03 (token) and 05 (session) will
resolve their AuthResult through the SAME function, so the three gates
(key active, tenant status, principal is_active) + last_used_at live
in one place — no gate-drift twin (K3, masterplan risk #1).

Go: auth.AuthResult.PrincipalID (+ SELECT/Scan); surfaced at
/api/whoami (principal_id, golden shape + TS type updated); threaded
into dispatch.Principal as an identity dimension — carried like
TenantID, NOT the fairness key (fairKey stays HomeScope), so
scheduling is byte-unchanged.

Gates green (dry-run + live): valid key authz byte-identical to raw
row + principal_id populated; principal is_active=false locks all
keys; soft-revoke (key active=false) → no AuthResult; unknown id →
sentinel. Live: ctx stats auth path + whoami.principal_id verified.

Plan: .project/plan-oauth-2026-07-09/ (F2 of 27, INV-A/B binding on 03/05).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GottZ added a commit to TurgutKural/ctx that referenced this pull request Aug 2, 2026
@GottZ @claude
fix(rerank): map Voyage [0,1] scores to logits at the wire boundary
e328f9a 
Score()'s documented contract returns RAW LOGITS — the single consumer
(rrf.RerankCrossEncoder) sigmoids every score before blending. Voyage's
relevance_score is already a calibrated [0,1] relevance (all published
values are quantized probabilities, e.g. 0.94140625 = 241/256), so the
data-path fallback fed probabilities into a second sigmoid: the rerank
signal compressed into [0.5,0.73] (~29% of the llama.cpp span) and at
blend_weight < 1 — the value validate.go itself recommends with graph
expansion — RRF outvoted the reranker, producing measured rank
inversions against an identical relevance verdict expressed as logits.

Map "data" scores through logit(p) = ln(p/(1-p)) at the wire boundary:
the container name is coupled to the score domain (data ⇒ Voyage ⇒
calibrated probability), the downstream sigmoid reconstructs p exactly,
and the raw-logit contract now holds for every backend. Endpoint values
0 and 1 clamp to large finite logits (±Inf would poison the blend
arithmetic); a data score outside [0,1] breaks the documented Voyage
schema and errors → caller fails open, consistent with the strict index
validation.

Existing Voyage tests updated to expect logits; three new tests pin the
sigmoid round-trip, endpoint clamping, and out-of-range rejection. The
decorative section comment now satisfies godot (pre-commit lints the
staged file, so the fix rides in this wave).

Finding: review dimension "kern" GottZ#1 (CONFIRMED via Go probe over the
real RerankCrossEncoder path: rank inversion at blend=0.5, span
compression 0.2952 vs 0.9490 at blend=1.0).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
GottZ added a commit to TurgutKural/ctx that referenced this pull request Aug 2, 2026
@GottZ @claude
test(rerank): discriminating fixtures for usage precedence, auth, con…
5b6a19a 
…tracts

Three coverage gaps the review's mutation probes exposed:

- TestScore_PrefersResultsOverData asserted "prompt_tokens preferred
  over total_tokens" while its fixture carried no total_tokens at all —
  removing the precedence guard or inverting it survived the entire
  suite (both mutations reproduced against rerank AND rrf). The fixture
  now sets both fields with differing values, making the existing
  assertion actually discriminating.
- The documented "absent usage ⇒ 0 ⇒ uncharged, never an estimate"
  contract had no test; TestScore_UsageAbsentChargesNothing pins it.
- Voyage turns the bearer header into a load-bearing path, yet no test
  ever passed an apiKey; TestScore_AuthorizationHeader covers both the
  configured-key and the no-key (local sidecar) case.

Finding: review dimension "tests" GottZ#1 (CONFIRMED — mutations A and B
survive the pre-wave suite, both killed by the both-set fixture),
plus "tests" GottZ#4 and GottZ#5.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
GottZ added a commit that referenced this pull request Aug 2, 2026
@GottZ @claude
fix(rerank): map Voyage [0,1] scores to logits at the wire boundary
05accc1 
Score()'s documented contract returns RAW LOGITS — the single consumer
(rrf.RerankCrossEncoder) sigmoids every score before blending. Voyage's
relevance_score is already a calibrated [0,1] relevance (all published
values are quantized probabilities, e.g. 0.94140625 = 241/256), so the
data-path fallback fed probabilities into a second sigmoid: the rerank
signal compressed into [0.5,0.73] (~29% of the llama.cpp span) and at
blend_weight < 1 — the value validate.go itself recommends with graph
expansion — RRF outvoted the reranker, producing measured rank
inversions against an identical relevance verdict expressed as logits.

Map "data" scores through logit(p) = ln(p/(1-p)) at the wire boundary:
the container name is coupled to the score domain (data ⇒ Voyage ⇒
calibrated probability), the downstream sigmoid reconstructs p exactly,
and the raw-logit contract now holds for every backend. Endpoint values
0 and 1 clamp to large finite logits (±Inf would poison the blend
arithmetic); a data score outside [0,1] breaks the documented Voyage
schema and errors → caller fails open, consistent with the strict index
validation.

Existing Voyage tests updated to expect logits; three new tests pin the
sigmoid round-trip, endpoint clamping, and out-of-range rejection. The
decorative section comment now satisfies godot (pre-commit lints the
staged file, so the fix rides in this wave).

Finding: review dimension "kern" #1 (CONFIRMED via Go probe over the
real RerankCrossEncoder path: rank inversion at blend=0.5, span
compression 0.2952 vs 0.9490 at blend=1.0).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
GottZ added a commit that referenced this pull request Aug 2, 2026
@GottZ @claude
test(rerank): discriminating fixtures for usage precedence, auth, con…
e953e9b 
…tracts

Three coverage gaps the review's mutation probes exposed:

- TestScore_PrefersResultsOverData asserted "prompt_tokens preferred
  over total_tokens" while its fixture carried no total_tokens at all —
  removing the precedence guard or inverting it survived the entire
  suite (both mutations reproduced against rerank AND rrf). The fixture
  now sets both fields with differing values, making the existing
  assertion actually discriminating.
- The documented "absent usage ⇒ 0 ⇒ uncharged, never an estimate"
  contract had no test; TestScore_UsageAbsentChargesNothing pins it.
- Voyage turns the bearer header into a load-bearing path, yet no test
  ever passed an apiKey; TestScore_AuthorizationHeader covers both the
  configured-key and the no-key (local sidecar) case.

Finding: review dimension "tests" #1 (CONFIRMED — mutations A and B
survive the pre-wave suite, both killed by the both-set fixture),
plus "tests" #4 and #5.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
GottZ added a commit to TurgutKural/ctx that referenced this pull request Aug 2, 2026
@GottZ @claude
fix(embed): surface the total_tokens metering switch in log and docs
abe2d21 
The total_tokens fallback silently moves total_tokens-only backends
from charge=0 + uncharged_calls++ to a real token charge in the MW22
fairness window — the embed twin of the semantics jump the rerank
pendant made visible in 4970856. The single production call site
(embedcache.go:258 → lease.ReportUsage) charges the lease, llmlog
embed rows and the D1a status rollup start carrying values where they
were NULL before.

Mirror the 4970856 pattern: one-time INFO when the fallback first
engages (embeds run per query and per backfill batch — per-call INFO
would be noise), extend the MW22 paragraph in docs/operations.md from
"rerank backends" to "rerank and embed backends" (the sentence had
become false with this PR), and note the embed side of the Voyage
dialect in docs/architecture.md.

Findings: review dimensions "downstream" GottZ#1/GottZ#2 + "claims" GottZ#2/GottZ#3 (all
CONFIRMED — probe shows Base ptoks=0/uncharged, HEAD charged for the
identical Voyage-shaped response).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
GottZ added a commit that referenced this pull request Aug 2, 2026
@GottZ @claude
fix(embed): surface the total_tokens metering switch in log and docs
a978ab5 
The total_tokens fallback silently moves total_tokens-only backends
from charge=0 + uncharged_calls++ to a real token charge in the MW22
fairness window — the embed twin of the semantics jump the rerank
pendant made visible in 4970856. The single production call site
(embedcache.go:258 → lease.ReportUsage) charges the lease, llmlog
embed rows and the D1a status rollup start carrying values where they
were NULL before.

Mirror the 4970856 pattern: one-time INFO when the fallback first
engages (embeds run per query and per backfill batch — per-call INFO
would be noise), extend the MW22 paragraph in docs/operations.md from
"rerank backends" to "rerank and embed backends" (the sentence had
become false with this PR), and note the embed side of the Voyage
dialect in docs/architecture.md.

Findings: review dimensions "downstream" #1/#2 + "claims" #2/#3 (all
CONFIRMED — probe shows Base ptoks=0/uncharged, HEAD charged for the
identical Voyage-shaped response).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MP6ZWjHgySC74PfJJKjwBX
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@GottZ