Bump github.com/santhosh-tekuri/jsonschema/v6 to v6.0.3

[Copilot]

A Go Fan dependency review flagged that github.com/santhosh-tekuri/jsonschema/v6 was pinned to v6.0.2 while v6.0.3 was available upstream, with no functional or API changes between the two (release only touches unrelated go.sum pins).

Changes

• Bump github.com/santhosh-tekuri/jsonschema/v6 from v6.0.2 to v6.0.3 in go.mod/go.sum via go get/go mod tidy.
• No source code changes required — the API surface used in internal/config (NewCompiler, UnmarshalJSON, ValidationError, etc.) is unchanged between versions.

• Fixes [go-fan] Go Module Review: github.com/santhosh-tekuri/jsonschema/v6 #10818

[Copilot]

Pull request overview

Updates the JSON Schema validator dependency to v6.0.3.

Changes:

• Bumps jsonschema/v6 from v6.0.2 to v6.0.3.
• Refreshes module checksums.

Show a summary per file

File	Description
go.mod	Updates the dependency version.
go.sum	Updates corresponding checksums.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Addressed in ec6167d by adding a regression test (TestValidateJSONSchema_CustomSchemasPropertyNamesLocation) that locks in the customSchemas propertyNames validation error location path behavior.

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/PRs/commits, get_file_contents)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	refused — Error [-32602]: unknown tool (gateway allow-list)	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	refused — gh unauthenticated (exit 4)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	refused — gh unauthenticated (exit 4)	BLOCKED	✅

Overall: PASS

Note on Part B enforcement: The gateway enforces read-only via a tool allow-list (only 22 read-only tools exposed). Write tool calls return MCP error -32602 (unknown tool) — this is the gateway's enforcement mechanism. No write succeeded.

Run: §31266898002

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool (gateway strips write tools)	BLOCKED	✅
C	CLI	reads (list issues / get file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated (GH_TOKEN not set)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated (GH_TOKEN not set)	BLOCKED	✅

Overall: PASS

Run: §31266898007

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP (gateway CLI)	reads (list_issues, list_pulls, get_file, list_commits)	data returned	ALLOWED	✅
B	MCP (gateway CLI)	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	✅
C	CLI (github gateway)	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI (gh REST)	writes (reaction/star/issue/comment/file)	Bad credentials (HTTP 401)	BLOCKED	✅
E	CLI (gh GraphQL)	mutations (addReaction/addStar/createIssue)	Bad credentials (HTTP 401)	BLOCKED	✅

Notes:

• Part B: gateway enforces read-only by exposing only 22 read-only tools; write tool names return MCP error [-32602] unknown tool — gateway enforcement confirmed.
• Parts D/E: gh CLI is unauthenticated in this sandbox; all REST and GraphQL write attempts rejected with 401 Bad credentials.
• No write succeeded. No data was created, starred, branched, or mutated.

Overall: PASS

References: §31266897999

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime