Release v1.18.2 by github-actions[bot] · Pull Request #848 · overmindtech/cli

github-actions · 2026-05-26T08:48:09Z

Copybara Sync - Release v1.18.2

This PR was automatically created by Copybara, syncing changes from the overmindtech/workspace monorepo.

Original author: renovate[bot] (29139614+renovate[bot]@users.noreply.github.com)

What happens when this PR is merged?

The tag-on-merge workflow will automatically create the v1.18.2 tag on main
This tag will trigger the release workflow, which will:
- Run tests
- Build and publish release binaries via GoReleaser
- Upload packages to Cloudsmith

Review Checklist

Changes look correct and match the expected monorepo sync
Tests pass (see CI checks below)

https://github.com/user-attachments/assets/ec61f4ed-d89d-47d3-a64e-39ea169456c1 ## Summary - `services/brent-backend/service/riveruiauth` — server-side OIDC code+PKCE flow with HMAC-signed session cookies (Secure / HttpOnly / SameSite=Lax) - `/riverui/` mount in `service/server.go` behind auth middleware + `WithAnyScope("brent:write")`, browser-redirect on 401 - Fail-closed `ServerConfig.Validate()` — backend refuses to start when RIVERUI auth config is missing - viper bindings for the four new `BRENT_BACKEND_RIVERUI_AUTH0_*` env vars - `brent-frontend` AppNav "Job Queue" external link to `/riverui/` - `.devcontainer/adminproxy/nginx.conf` proxies `/riverui/`; launch.json and op.local.env wire the secrets through for local dev - ADR 0025 with OAuth2/OIDC primer and debug-only scoping - go-oidc/v3 v3.18.0 promoted to a direct dependency - doc-maintainer touch-ups across `docs/` and frontend READMEs  --- > [!NOTE] > **Medium Risk** > Adds a new authentication flow and cookie-based session handling for `/riverui/`, plus fail-closed startup validation; mistakes could break access to the dashboard or cause boot failures if secrets are missing/misconfigured. > > **Overview** > Adds the embedded River dashboard at `/riverui/` to `brent-backend`, protected by `auth.NewAuthMiddleware` accepting a new `brent_riverui_token` cookie and requiring `brent:write`; browser navigations that hit a 401 are now redirected to a login endpoint. > > Introduces `service/riveruiauth` implementing Auth0 OIDC code+PKCE (`/riverui/brent/login`, `/callback`, `/logout`) with HMAC-signed short-lived state cookies, nonce verification, and a fail-fast scope check before setting the session cookie. > > Wires four new `BRENT_BACKEND_RIVERUI_AUTH0_*` settings through CLI/viper/config, and makes `ServerConfig.Validate()` **fail closed** when auth is enabled but River UI auth config is missing/invalid; adds unit tests for the OIDC flow and the 401→302 wrapper. > > Updates devcontainer proxying/env wiring and docs/ADRs, and adds a brent-frontend nav link to open `/riverui/` in a new tab; adds `github.com/coreos/go-oidc/v3` as a direct dependency. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 06e03789d1f1e99d06331d8f9d64d8e7fd1035fa. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  GitOrigin-RevId: 3ec31cc8485d5e2dadeb6d6a595820eb9bb77c26

…ty] (#5022) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/slack-go/slack](https://redirect.github.com/slack-go/slack) | `v0.23.0` → `v0.23.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fslack-go%2fslack/v0.23.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fslack-go%2fslack/v0.23.0/v0.23.1?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### slack-go `SecretsVerifier` accepts empty signing secret without precondition [GHSA-gxhx-2686-5h9g](https://redirect.github.com/advisories/GHSA-gxhx-2686-5h9g) <details> <summary>More information</summary> #### Details ```go func NewSecretsVerifier(header http.Header, secret string) (SecretsVerifier, error) { hash := hmac.New(sha256.New, []byte(secret)) // raw secret, no precondition } ``` #### Severity - CVSS Score: 4.8 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U` #### References - [https://github.com/slack-go/slack/security/advisories/GHSA-gxhx-2686-5h9g](https://redirect.github.com/slack-go/slack/security/advisories/GHSA-gxhx-2686-5h9g) - [https://github.com/slack-go/slack/releases/tag/v0.23.1](https://redirect.github.com/slack-go/slack/releases/tag/v0.23.1) - [https://github.com/advisories/GHSA-gxhx-2686-5h9g](https://redirect.github.com/advisories/GHSA-gxhx-2686-5h9g) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-gxhx-2686-5h9g) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>slack-go/slack (github.com/slack-go/slack)</summary> ### [`v0.23.1`](https://redirect.github.com/slack-go/slack/releases/tag/v0.23.1) [Compare Source](https://redirect.github.com/slack-go/slack/compare/v0.23.0...v0.23.1) > \[!IMPORTANT] > Even though this is a \[security] patch release, if you were using an empty secret, this is a breaking change due to a change in behaviour. That's on purpose, to ensure you fix your approach so that there are no footguns. ##### Fixed - `NewSecretsVerifier` now rejects empty signing secrets to avoid accepting forged request signatures when applications are misconfigured. **Full Changelog**: <slack-go/slack@v0.23.0...v0.23.1> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 249356a36e09c1f88082398f9ce81b6fd11382c9

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/a-h/templ](https://redirect.github.com/a-h/templ) | `v0.3.1001` → `v0.3.1020` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fa-h%2ftempl/v0.3.1020?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fa-h%2ftempl/v0.3.1001/v0.3.1020?slim=true) | | [github.com/a-h/templ/cmd/templ](https://redirect.github.com/a-h/templ) | `v0.3.1001` → `v0.3.1020` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fa-h%2ftempl%2fcmd%2ftempl/v0.3.1020?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fa-h%2ftempl%2fcmd%2ftempl/v0.3.1001/v0.3.1020?slim=true) | | [github.com/auth0/go-auth0/v2](https://redirect.github.com/auth0/go-auth0) | `v2.10.0` → `v2.11.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fauth0%2fgo-auth0%2fv2/v2.11.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fauth0%2fgo-auth0%2fv2/v2.10.0/v2.11.0?slim=true) | | [github.com/harness/harness-go-sdk](https://redirect.github.com/harness/harness-go-sdk) | `v0.7.26` → `v0.7.27` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fharness%2fharness-go-sdk/v0.7.27?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fharness%2fharness-go-sdk/v0.7.26/v0.7.27?slim=true) | | [github.com/posthog/posthog-go](https://redirect.github.com/posthog/posthog-go) | `v1.12.4` → `v1.12.5` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fposthog%2fposthog-go/v1.12.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fposthog%2fposthog-go/v1.12.4/v1.12.5?slim=true) | | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.53.0` → `v0.54.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.53.0...refs/tags/v0.54.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.54.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.53.0/v0.54.0?slim=true) | | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | [`v0.36.0` → `v0.37.0`](https://cs.opensource.google/go/x/text/+/refs/tags/v0.36.0...refs/tags/v0.37.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2ftext/v0.37.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2ftext/v0.36.0/v0.37.0?slim=true) | | [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) | `v1.81.0` → `v1.81.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fgrpc/v1.81.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fgrpc/v1.81.0/v1.81.1?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>a-h/templ (github.com/a-h/templ)</summary> ### [`v0.3.1020`](https://redirect.github.com/a-h/templ/releases/tag/v0.3.1020) [Compare Source](https://redirect.github.com/a-h/templ/compare/v0.3.1001...v0.3.1020) ##### Changelog - [`09d6b02`](https://redirect.github.com/a-h/templ/commit/09d6b02) chore: bump version - [`a411f13`](https://redirect.github.com/a-h/templ/commit/a411f13) chore: fix linter warning in test code - [`524cd39`](https://redirect.github.com/a-h/templ/commit/524cd39) feat: add -check flag, closes [#1007](https://redirect.github.com/a-h/templ/issues/1007) ([#1373](https://redirect.github.com/a-h/templ/issues/1373)) - [`f3d595c`](https://redirect.github.com/a-h/templ/commit/f3d595c) feat: add Range to ExpressionAttribute nodes ([#1347](https://redirect.github.com/a-h/templ/issues/1347)) - [`82af17c`](https://redirect.github.com/a-h/templ/commit/82af17c) feat: add Range to GoCode nodes ([#1348](https://redirect.github.com/a-h/templ/issues/1348)) - [`cf98cdc`](https://redirect.github.com/a-h/templ/commit/cf98cdc) feat: add Range to StringExpression nodes ([#1349](https://redirect.github.com/a-h/templ/issues/1349)) - [`ff38cee`](https://redirect.github.com/a-h/templ/commit/ff38cee) feat: add ranges for attribute node values ([#1383](https://redirect.github.com/a-h/templ/issues/1383)) - [`552ed02`](https://redirect.github.com/a-h/templ/commit/552ed02) feat: support concurrent rendering of templ components ([#1359](https://redirect.github.com/a-h/templ/issues/1359)) - [`b310a97`](https://redirect.github.com/a-h/templ/commit/b310a97) fix(generatecmd): check `cmd.Start()` error before inserting `cmd` in to `running` map ([#1382](https://redirect.github.com/a-h/templ/issues/1382)) - [`410a80e`](https://redirect.github.com/a-h/templ/commit/410a80e) fix(lsp): delete $GOROOT hack in uri.File - [`95a0854`](https://redirect.github.com/a-h/templ/commit/95a0854) fix: allow JSFuncCall on arbitrary HTML attributes ([#1375](https://redirect.github.com/a-h/templ/issues/1375)) - [`e581c01`](https://redirect.github.com/a-h/templ/commit/e581c01) fix: attributes containing a conditional, are always multiline ([#1380](https://redirect.github.com/a-h/templ/issues/1380)) - [`b2952ed`](https://redirect.github.com/a-h/templ/commit/b2952ed) fix: clear children context in Fragment.Render ([#1360](https://redirect.github.com/a-h/templ/issues/1360)) - [`8fecf2d`](https://redirect.github.com/a-h/templ/commit/8fecf2d) fix: prevent corrupted output in watch mode with gzip, fixes [#1365](https://redirect.github.com/a-h/templ/issues/1365) ([#1366](https://redirect.github.com/a-h/templ/issues/1366)) - [`7adcb62`](https://redirect.github.com/a-h/templ/commit/7adcb62) fix: show correct updates based on written Go files without watch ([#1363](https://redirect.github.com/a-h/templ/issues/1363)) - [`aa493e0`](https://redirect.github.com/a-h/templ/commit/aa493e0) fix: track Range for non-JavaScript ScriptExpression nodes ([#1350](https://redirect.github.com/a-h/templ/issues/1350)) - [`d52d64e`](https://redirect.github.com/a-h/templ/commit/d52d64e) fix: use dedicated shadow host in Suspense example to ensure header is rendered ([#1370](https://redirect.github.com/a-h/templ/issues/1370)) - [`83176f9`](https://redirect.github.com/a-h/templ/commit/83176f9) fix: vulnerabilities in x/net (only affects templ watch mode and tests), fixes [#1354](https://redirect.github.com/a-h/templ/issues/1354) </details> <details> <summary>auth0/go-auth0 (github.com/auth0/go-auth0/v2)</summary> ### [`v2.11.0`](https://redirect.github.com/auth0/go-auth0/blob/HEAD/CHANGELOG.md#v2110-2026-05-14) [Compare Source](https://redirect.github.com/auth0/go-auth0/compare/v2.10.0...v2.11.0) [Full Changelog](https://redirect.github.com/auth0/go-auth0/compare/v2.10.0...v2.11.0) **Added** - feat: add passkey-related fields (`aaguid`, `credential_device_type`, `credential_backed_up`, `identity_user_id`, `user_agent`, `user_handle`, `transports`) to user authentication method types [#770](https://redirect.github.com/auth0/go-auth0/pull/770) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add `CredentialDeviceTypeEnum` with `single_device` and `multi_device` values [#770](https://redirect.github.com/auth0/go-auth0/pull/770) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add `allow_online_access_with_ephemeral_sessions` field to resource server types [#770](https://redirect.github.com/auth0/go-auth0/pull/770) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add `audience` field to `RevokeRefreshTokensRequestContent` for audience-scoped revocation [#770](https://redirect.github.com/auth0/go-auth0/pull/770) ([fern-api\[bot\]](https://redirect.github.com/apps/fern-api)) - feat: add `LoginWithCustomTokenExchange` method for Custom Token Exchange (RFC 8693) [#766](https://redirect.github.com/auth0/go-auth0/pull/766) ([JohnRoesler](https://redirect.github.com/JohnRoesler)) **Fixed** - fix: preserve request body in debug output for POST, PATCH, and PUT methods [#751](https://redirect.github.com/auth0/go-auth0/pull/751) ([bkiran6398](https://redirect.github.com/bkiran6398)) </details> <details> <summary>harness/harness-go-sdk (github.com/harness/harness-go-sdk)</summary> ### [`v0.7.27`](https://redirect.github.com/harness/harness-go-sdk/compare/v0.7.26...v0.7.27) [Compare Source](https://redirect.github.com/harness/harness-go-sdk/compare/v0.7.26...v0.7.27) </details> <details> <summary>posthog/posthog-go (github.com/posthog/posthog-go)</summary> ### [`v1.12.5`](https://redirect.github.com/PostHog/posthog-go/releases/tag/v1.12.5): 1.12.5 [Compare Source](https://redirect.github.com/posthog/posthog-go/compare/v1.12.4...v1.12.5) ##### Unreleased </details> <details> <summary>grpc/grpc-go (google.golang.org/grpc)</summary> ### [`v1.81.1`](https://redirect.github.com/grpc/grpc-go/releases/tag/v1.81.1): Release 1.81.1 [Compare Source](https://redirect.github.com/grpc/grpc-go/compare/v1.81.0...v1.81.1) ### Security - xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per [gRFC A41](https://redirect.github.com/grpc/proposal/blob/master/A41-xds-rbac.md). ([#9111](https://redirect.github.com/grpc/grpc-go/issues/9111)) - Special Thanks: [@al4an444](https://redirect.github.com/al4an444) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace).   --- > [!NOTE] > **Medium Risk** > Primarily dependency upgrades plus regenerated `templ` output; risk is moderate because the new `templ` generator changes how attribute values are resolved/escaped and bumps auth-related libs (`auth0`, `grpc`) which could affect security-sensitive request flows. > > **Overview** > Updates Go dependencies in `go.mod/go.sum`, including `github.com/a-h/templ` (and its install steps), `github.com/auth0/go-auth0/v2`, `google.golang.org/grpc`, `golang.org/x/*`, and others. > > Regenerates `services/api-server/area51/*_templ.go` with the newer `templ` version, switching many attribute render paths from `templ.JoinStringErrs` + `templ.EscapeString` to `templ.ResolveAttributeValue`. > > Extends the `TestPosthogClient` mock to support the newer PostHog client API by adding `EvaluateFlags`/`EvaluateFlagsFunc`. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit ff3c8c5c5173e45900fd5e68b24abec329e3b05a. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: carabasdaniel <daniel.carabas@overmind.tech> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: TP Honey <thomas.honey@overmind.tech> GitOrigin-RevId: 3abbc8ec1953614ec5c66858d0d851537542ac3a

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/aws/aws-sdk-go-v2/service/cloudfront](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.63.0` → `v1.64.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fcloudfront/v1.64.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fcloudfront/v1.63.0/v1.64.0?slim=true) | | [github.com/aws/aws-sdk-go-v2/service/ec2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.301.0` → `v1.302.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fec2/v1.302.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fec2/v1.301.0/v1.302.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2/service/cloudfront)</summary> ### [`v1.64.0`](https://redirect.github.com/aws/aws-sdk-go-v2/blob/HEAD/CHANGELOG.md#Release-2026-04-22) #### General Highlights - **Dependency Update**: Updated to the latest SDK module versions #### Module Highlights - `github.com/aws/aws-sdk-go-v2/service/batch`: [v1.64.0](service/batch/CHANGELOG.md#v1640-2026-04-22) - **Feature**: Support of S3Files volume type, container start and stop timeouts. - `github.com/aws/aws-sdk-go-v2/service/bedrockagentcore`: [v1.22.0](service/bedrockagentcore/CHANGELOG.md#v1220-2026-04-22) - **Feature**: Adds support for Amazon Bedrock AgentCore Harness data plane APIs, enabling customers to invoke managed agent loops and execute commands on live agent sessions with streaming responses. - `github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol`: [v1.31.0](service/bedrockagentcorecontrol/CHANGELOG.md#v1310-2026-04-22) - **Feature**: Adds support for Amazon Bedrock AgentCore Harness control plane APIs, enabling customers to create, manage, and configure managed agent loops with customizable models, tools, memory, and isolated execution environments. - `github.com/aws/aws-sdk-go-v2/service/ec2`: [v1.299.0](service/ec2/CHANGELOG.md#v12990-2026-04-22) - **Feature**: Managed resource visibility settings control whether resources that AWS services provision on your behalf within your AWS account appear in your Amazon console views and API list operations. - `github.com/aws/aws-sdk-go-v2/service/ecs`: [v1.79.0](service/ecs/CHANGELOG.md#v1790-2026-04-22) - **Feature**: GPU health monitoring and auto-repair for ECS Managed Instances - `github.com/aws/aws-sdk-go-v2/service/emrserverless`: [v1.40.0](service/emrserverless/CHANGELOG.md#v1400-2026-04-22) - **Feature**: This release adds support for Spark connect sessions starting with release label emr-7.13.0. - `github.com/aws/aws-sdk-go-v2/service/iotwireless`: [v1.55.0](service/iotwireless/CHANGELOG.md#v1550-2026-04-22) - **Feature**: Enable customers to optionally specify a desired confidence level for Cellular and WiFi position estimates. Customers can use this to trade off confidence level and radius of uncertainty based on their needs. - `github.com/aws/aws-sdk-go-v2/service/ivs`: [v1.49.0](service/ivs/CHANGELOG.md#v1490-2026-04-22) - **Feature**: Adds support for Amazon IVS server-side ad insertion - `github.com/aws/aws-sdk-go-v2/service/lambda`: [v1.90.0](service/lambda/CHANGELOG.md#v1900-2026-04-22) - **Feature**: Add Ruby 4.0 (ruby4.0) support to AWS Lambda. - `github.com/aws/aws-sdk-go-v2/service/opensearch`: [v1.65.0](service/opensearch/CHANGELOG.md#v1650-2026-04-22) - **Feature**: Adds support for RollbackServiceSoftwareUpdate API - `github.com/aws/aws-sdk-go-v2/service/s3`: [v1.100.0](service/s3/CHANGELOG.md#v11000-2026-04-22) - **Feature**: This release adds five additional checksum algorithms for S3 data integrity (MD5, SHA-512, XXHash3, XXHash64, XXHash128) and support for S3 Inventory on directory buckets (S3 Express One Zone). - `github.com/aws/aws-sdk-go-v2/service/s3control`: [v1.70.0](service/s3control/CHANGELOG.md#v1700-2026-04-22) - **Feature**: This release adds support for five additional checksum algorithms for data integrity checking in Amazon S3 - MD5, SHA-512, XXHash3, XXHash64, and XXHash128. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: bb4e008a0601d438fd3700046d1553b982f383d6

> [!NOTE] > **Medium Risk** > Medium risk because it changes Go module resolution via `replace` directives (including a pseudo-version pin) and forces an upstream dependency upgrade, which can subtly affect build/runtime behavior despite being dependency-only. > > **Overview** > **Pins and protects specific Go dependency versions.** `go.mod` now pins `github.com/exaring/otelpgx` to a fork *pseudo-version* that contains a required span-removal patch (with expanded comments warning not to bump to tags), and adds a `replace` to force `github.com/go-git/go-git/v5` to `v5.19.0` for a security fix. > > **Prevents Renovate from undoing the otelpgx pin.** `.github/renovate.json` adds a rule that disables updates for `github.com/overmindtech/otelpgx` to avoid Renovate bumping to fork tags that lack the patch. `go.sum` is updated accordingly. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e87399119e1e07ef5a632e0dd94a39a78f316540. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  GitOrigin-RevId: 5480197cb22c27c199abfeca5567c1e5be85110d

## Summary Closes **ENG-4205** — the stdlib HTTP adapter accepted user-supplied URLs but only blocked the IPv4 link-local range (`169.254.0.0/16`), leaving private, loopback, carrier-grade NAT, and IPv6 private ranges reachable. DNS resolution failures were also silently swallowed, leaving room for DNS rebinding attacks. ## What changed ### New file: `stdlib-source/adapters/http_ssrf.go` Extracts all SSRF validation into a dedicated file containing: - **`ErrIPBlocked`** — sentinel error for policy rejections (supports `errors.Is`) - **`IPPolicy` interface** — `CheckIP(ip net.IP) error` contract for IP validation - **`defaultIPPolicy`** — production policy that blocks: - IPv4 loopback (`127.0.0.0/8`) - IPv4 link-local (`169.254.0.0/16`) - IPv4 private RFC1918 (`10/8`, `172.16/12`, `192.168/16`) - IPv4 carrier-grade NAT RFC6598 (`100.64.0.0/10`) - IPv6 loopback (`::1`) - IPv6 link-local (`fe80::/10`) - IPv6 unique-local ULA (`fc00::/7`) - IPv4-mapped IPv6 (`::ffff:a.b.c.d`) — unwrapped to v4 before checks - **`allowLoopbackPolicy`** — test-only policy that wraps `defaultIPPolicy` but permits loopback, so `httptest.NewServer` on `127.0.0.1` still works in tests - **`validateHost`** — resolves hostnames via an injectable `*net.Resolver` and checks all returned IPs against the policy; DNS failures are now returned as errors instead of silently swallowed - **`newSecureTransport`** — builds an `*http.Transport` with a `DialContext` hook that re-resolves DNS and enforces the IP policy at connection time, preventing DNS rebinding. Skips blocked IPs and tries allowed ones; preserves `lastErr` for diagnostics; respects `context.Canceled`/`DeadlineExceeded`. ### Modified file: `stdlib-source/adapters/http.go` - Removed the old `linkLocalRange`, `isLinkLocalIP`, and `validateHostname` helpers - Added `ipPolicy IPPolicy` and `resolver *net.Resolver` fields to `HTTPAdapter` with a `policy()` helper (nil defaults to `defaultIPPolicy`/`net.DefaultResolver`) - Replaced the inline `http.Transport` with `newSecureTransport(s.policy(), s.resolver)` - Redirect validation now goes through `validateHost` with the full blocklist and injected resolver - Production construction in `main.go` is unchanged (`&HTTPAdapter{cache: sharedCache}`) ### Test files - **`http_ssrf_test.go`** — unit tests for both policies covering all blocked CIDR families, IPv4-mapped IPv6 bypass prevention, nil IP, and public IP allowance - **`http_test.go`** — `newTestAdapter` helper replaces all raw adapter literals; new end-to-end tests for private IPs, CGNAT, IPv6 loopback, IPv6 link-local, IPv6 ULA, IPv4-mapped IPv6, and a `defaultIPPolicy` integration test proving loopback is blocked at dial time - **DNS rebinding regression test** — starts a stub UDP DNS server (`newStubDNSServer`) that resolves `attacker.test` → `10.0.0.1`; injects it via the `resolver` field on `HTTPAdapter`; asserts `Get` is blocked with "private" in the error message ## How to verify ```bash go test -race -v -timeout 5m ./stdlib-source/adapters/... ``` ## Security impact This is a **medium severity** fix under the Compliance Maintenance project. The attack surface (user-supplied URLs fetched by the stdlib HTTP adapter) is now protected at connection time against all private/internal IP ranges enumerated in ENG-4205.  Linear Issue: [ENG-4205](https://linear.app/overmind/issue/ENG-4205/close-ssrf-gaps-in-the-http-adapter) <div><a href="https://cursor.com/agents/bc-e3668fa5-ae2c-4358-9c2c-b9d63196d88c"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-e3668fa5-ae2c-4358-9c2c-b9d63196d88c"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> GitOrigin-RevId: b8087fb61bffc52f28f71180f16f3eefe51f5e77

## Summary The api-server-worker was holding tens of megabytes of protobuf items and edges per change-analysis job that nothing in the api-server ever read. Root cause: `sdpws.WaitForAllQueriesHandler` silently embedded `StoreEverythingHandler`, so every caller inherited per-event item/edge accumulation whether they consumed it or not. This contributed to the OOMKills tracked on ThousandEyes-scale loads (2,026 items / 37,892 edges per change). Two layers of fix: 1. **Flip the naming so the safe variant is the default.** The bare `WaitForAllQueriesHandler` now stores nothing; the old behavior moves to `WaitForAllQueriesStoreEverythingHandler`. Storage is opt-in by name — future callers cannot add this waste back by accident. New `WaitForAllQueriesItemsOnlyHandler` covers the common "I need items but not edges" case. 2. **Migrate every existing caller.** Each call site is on the variant matching what it actually reads — verified by the compiler (the bare type no longer has `Items`/`Edges` fields, so any missed site fails to build). ## Caller classification | Site | Reads | Migrated to | | --- | --- | --- | | `BlastRadiusProgressHandler` (affectedClient) | neither (edge count via atomic) | `WaitForAllQueriesHandler` (no-store) | | `lookupClient` in `recursivelyQueryBlastRadius` | items only (LLM input) | `WaitForAllQueriesItemsOnlyHandler` | | gateway `tools.go` relationship tool | items only | `WaitForAllQueriesItemsOnlyHandler` | | `revlink.go` warmup | items + edges (the actual output) | unchanged (uses `StoreEverythingHandler` directly) | | Tests reading items + edges | both | `WaitForAllQueriesStoreEverythingHandler` | | Tests reading items only | items | `WaitForAllQueriesItemsOnlyHandler` | | Tests reading neither (connection-lifecycle) | neither | bare (now safely no-store) | `numEdges` in `runLLMBlastRadiusCalculation` now reads from the existing `edgeCount atomic.Int32` that was already counting every edge via the `onEdgeReceived` callback — values are equivalent. ## Estimated heap savings Back-of-envelope from the proto struct shapes in `go/sdp-go/items.pb.go` against the ThousandEyes vpc-cni example: - `affectedClient` edges: 37,892 × ≈600 B ≈ **22 MB**. - `affectedClient` items: 2,026 × ≈8 KB ≈ **16 MB**. - `lookupClient` transient edge waste across recursion: **5–10 MB**. - **Per-job total: ~40–50 MB.** At 4–8 concurrent jobs per worker: **~160–400 MB** lower peak heap per `api-server-worker` against a `GOMEMLIMIT` of 6400 MiB. The number that decides whether OOMKills return at non-throttled presets is peak heap — that's what the operational validation step measures. ## Testing - ✅ `go build ./...` — clean. - ✅ `go vet ./go/sdp-go/sdpws/... ./services/api-server/... ./services/gateway/...` — clean. (The pre-existing `cli/cmd/root.go:544` `WithTimeout` vet warning is untouched.) - ✅ `go test ./go/sdp-go/sdpws/... -count=1` — five new unit tests covering all four wait variants pass: bare retains nothing, items-only retains items, store-everything retains both, `DoneCallback` fires exactly once on `Status.Done()==true`. - ✅ `go test ./services/api-server/service/changeanalysis -run 'TestBlastRadiusChunkMapper_ShortCircuitsOverCap|TestBlastRadiusArgsReducer|TestRunWholeChangeHypothesisGenerator' -count=1` — pure-unit coverage of the blast-radius pipeline passes. - ⚠️ Integration tests requiring a live gateway (`TestRecursivelyQueryBlastRadius*`, `TestAffectedClient*`, `TestCalculateMappedResources`) and tests requiring Postgres (`TestGenericRiskCalculationWorker`, `TestChangesByReferenceTool_Call`, etc.) were not run — the cloud agent VM has neither service available. These predate this change; the rename surfaces zero compile errors in any of them after migration. - ⚠️ The v6 benchmark heap evidence (`TestV6Benchmark` with ThousandEyes-shaped fixture) was not captured — same environment limitation. Worth running locally against `services/api-server/service/changeanalysis/v6_benchmark_test.go` with backend services up and `OPENAI_API_KEY` set to confirm the heap delta empirically before merging. The type-system layer of the validation plan is the strongest guarantee here: the rename forces every site that touched `.Items` or `.Edges` to declare what it actually consumes, and the build fails until they all line up. ## Out of scope - Gateway-side `GraphStateTracker`. - Snapshot lifecycle. - `StoreEverythingHandler` itself (kept as-is — its name already warns; `revlink.go` and `services/gateway/service/e2e_test.go` are the two legitimate consumers).  <div><a href="https://cursor.com/agents/bc-4d9ba373-1787-4125-9e82-a05392b67f0b"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-4d9ba373-1787-4125-9e82-a05392b67f0b"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> GitOrigin-RevId: ff074e8a02a3a805321ff3b324e542212f875925

## Summary - Drop the `replace github.com/google/cel-go => github.com/google/cel-go v0.22.1` in `go.mod`. The protovalidate/kubernetes incompatibility it worked around is gone in the current dep graph. - Bump the direct `github.com/google/cel-go` require from `v0.28.0` (replaced down to v0.22.1, so the require line was a lie) to `v0.28.1`, the current latest. - Drop the matching Renovate `allowedVersions` pin so Renovate stops reverting future bumps. ## Linear Ticket Fixes: [ENG-4231](https://linear.app/overmind/issue/ENG-4231/revisit-cel-go-replace-directive-and-upgrade-to-latest) — Revisit `cel-go` replace directive and upgrade to latest - **Purpose**: Clean up a stale `replace` directive in `go.mod` so authors browsing CEL features stop landing on a 6-version-old API surface. `cel-go` is now a direct dependency of `services/brent-backend/workflows` for the `EventListener`'s `match:` evaluator. - **Blocks**: Not on the critical path; ticket recommends shipping before WA8 (Dogfood Point 1) so the EventListener arrives at customers on a current CEL. ## Changes `go mod graph` confirms the original incompatibility is no longer present: ``` github.com/overmindtech/workspace github.com/google/cel-go@v0.28.0 buf.build/go/protovalidate@v1.2.0 github.com/google/cel-go@v0.28.0 k8s.io/apiserver@v0.35.0 github.com/google/cel-go@v0.26.0 k8s.io/apiextensions-apiserver@v0.35.0 github.com/google/cel-go@v0.26.0 sigs.k8s.io/controller-runtime@v0.23.3 github.com/google/cel-go@v0.26.0 ``` The kubernetes side has moved from "incompatible with anything above v0.22.1" to "happily on v0.26", and the underlying registry-isolation bug was fixed by [bufbuild/protovalidate-go#302](bufbuild/protovalidate-go#302) (shipped in protovalidate v1.2.0, which we already use). MVS resolves to v0.28.1 cleanly with the replace removed. Only one production file uses `cel-go`: `services/brent-backend/workflows/cel_cache.go`. The APIs it touches (`cel.NewEnv`, `cel.Variable`, `cel.ObjectType`, `cel.{String,Dyn}Type`, `cel.CustomTypeAdapter`, `cel.CustomTypeProvider`, `types.NewRegistry`, `types.{Provider,Type,FieldType}`, `ref.Val`) are stable surface area across v0.22 → v0.28. Local checks (all clean): - `go mod tidy` - `go build ./...` - `go test ./services/brent-backend/workflows/...` - `golangci-lint run ./services/brent-backend/workflows/...` The v0.28.0 release enables backtick identifier escaping by default ([cel-go#1295](google/cel-go#1295)). This is additive (unescaped identifiers still work); no shipped CEL expression uses the new syntax. ## Approved Plan - **Plan approver**: Elliot Waddington - **Approval ticket**: https://linear.app/overmind/issue/ENG-4368/approve-revisit-cel-go-replace-directive-and-upgrade-to-latest > Deviation analysis and reviewer assignment are handled automatically by the > pre-approved PR review automation (see docs/PREAPPROVED_CHANGES.md). Made with [Cursor](https://cursor.com)  --- > [!NOTE] > **Low Risk** > Low risk dependency-only change: removes a `go.mod` `replace` override for `github.com/google/cel-go` and bumps the module patch version; main risk is subtle behavior differences in CEL parsing/type-checking at runtime. > > **Overview** > Drops the `go.mod` `replace` that forced `github.com/google/cel-go` down to `v0.22.1`, and removes the matching Renovate `allowedVersions` pin so dependency automation can upgrade it going forward. > > Updates the direct `cel-go` requirement from `v0.28.0` to `v0.28.1` and refreshes `go.sum` accordingly (including pruning now-unused transitive entries like `github.com/stoewer/go-strcase`). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 717669ce49a234cd44baf46ce60d02a65e26bc06. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 004bbc0301f0233ba866312fd2f15c376de8074c

…#5068) ## Summary - `auth.ExtractAccount` previously returned `("", nil)` when the JWT custom claim `https://api.overmind.tech/account-name` was present but blank — an empty string is a valid SQL value and would silently file tenant data into a "no-tenant" bucket. - Adds a new sentinel `ErrEmptyAccountName` returned for that case; `ErrNoClaims` continues to mean "no claims at all". - Every existing caller either discards the error and applies its own `== ""` guard, or already tests `err != nil || accountName == ""`. No behaviour change for current callers; future callers inherit the protection. ## Drive-by `services/brent-backend/workflows/on_yaml.go` — two `//nolint:exhaustive` directives were flagged as dead by `nolintlint` on CI (but valid locally; cache state difference on the same golangci-lint v2.12.2). Made both switches genuinely exhaustive on `yaml.Kind` so both linters agree on every machine. Unblocks this PR's CI. ## Linear Ticket Fixes: [ENG-4371](https://linear.app/overmind/issue/ENG-4371) — Reject empty account_name custom claim in auth.ExtractAccount - **Purpose**: Close a silent-fall-through path in the shared auth helper where an empty `account_name` claim slipped past `err != nil` checks and reached tenant-scoped SQL as a valid empty string. - **Surfaced by**: Review of [ENG-4313](https://linear.app/overmind/issue/ENG-4313) — Phase 1.2 plan (`GetUserStatus` / `ProvisionCurrentUser`) — where both new RPCs called `ExtractAccount` and only checked the error. Landing this on `main` first removes the trap before Phase 1.2 ships. ## Changes - `go/auth/middleware.go` — new sentinel `ErrEmptyAccountName`; `ExtractAccount` returns it when the claim is present but blank. Doc comment explains the rationale. - `go/auth/middleware_test.go` — new `TestExtractAccount` covering missing-claim, blank-claim, and populated-claim paths. - `services/brent-backend/workflows/on_yaml.go` — drive-by; see above. Caller-impact survey (every `ExtractAccount` use in the tree) confirmed safe: handlers that discard the error and apply their own `== ""` guard see no change; revlink span-attribute callers correctly now skip the attribute on a malformed JWT.  --- > [!NOTE] > **Medium Risk** > Touches shared auth/tenant-identification logic; while the change is small, it can turn previously-accepted empty account names into request failures and may impact callers that assumed empty was valid. > > **Overview** > Prevents silent “no-tenant” behavior by making `ExtractAccount` return a new sentinel error (`ErrEmptyAccountName`) when the `account_name` custom claim exists but is blank (while preserving `ErrNoClaims` for missing claims). > > Adds `TestExtractAccount` to cover the no-claims, blank-claim, and populated-claim paths, ensuring callers can distinguish missing vs malformed tenant identity. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 8bda33cf3de63327b579a3518a74de8ac3468485. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 04411c29ab2476e347c151ec832e0d6f49aacb31

## Summary - Adds `tools/depot-usage/` — Cobra CLI wrapping Depot's `UsageService`, `BuildService`, and `RegistryService`. Seven subcommands (`get-usage`, `compare`, `compare-builds`, `sample-steps`, `platform-overhead`, `images`, `list-projects`) that produce the views Depot's dashboard hides. - Adds `docs/research/depot-build-analytics-research.md` with the analytics-options inventory, the April → May findings, and reproduce commands. Headline: the Cloudsmith-key cache-bust is real but < 2 % of the bill; the dominant mover is Depot platform overhead (`exporting to image` mean 8.1 → 34.9 s/build, ~14 % of the May bill). ## Linear Ticket Fixes: [ENG-4386](https://linear.app/overmind/issue/ENG-4386/review-depot-container-build-spend) — review depot container build spend - **Purpose**: track the follow-ups the investigation surfaced (Depot support ticket, Cloudsmith secret-mount fix, GHCR image-size dive, GitHub Actions launch-side review, Honeycomb daily-usage trigger, key rotation). ## Changes - `tools/depot-usage/` — new Go package under the workspace `go.mod`. 13 source files, unit tests for percentile/normalisation helpers. - `docs/research/depot-build-analytics-research.md` — research note. Live Cloudsmith API key values that surfaced in un-truncated `sample-steps` output are redacted to prefix-suffix form before commit. - `go.mod` / `go.sum` — adds cobra, viper, the depot Connect-RPC bindings, and bumps `connectrpc.com/connect` to v1.19.2 (existing pin guard documents that v1.19.0 was faulty; v1.19.2 is past it). Reviewer focus areas: `cmd/sample_steps.go` (build sampling and step-name normalisation) and `cmd/platform_overhead.go` (percentile computation that drives the ticket-ready table). Everything else is mechanical Connect-RPC paging. Made with [Cursor](https://cursor.com)  --- > [!NOTE] > **Medium Risk** > Introduces a new Go CLI plus new third-party API bindings and updates the CI container build export mode on non-`main` refs, which could affect PR build verification behavior and caching if misconfigured. > > **Overview** > Adds a new `tools/depot-usage` Go CLI (with tests) for pulling Depot Usage/Build/Registry data and generating summaries/diffs across time windows (including per-build and per-step sampling plus platform-overhead reports). > > Updates `.github/workflows/ci.yml` to set BuildKit output to `type=cacheonly` on non-`main` refs, skipping image export/assembly during PR builds while keeping cache warm; `main` builds keep the default image output for push/SBOM. > > Adds a detailed research writeup in `docs/research/depot-build-analytics-research.md` and updates Go dependencies (bumps `connectrpc.com/connect` to `v1.19.2` and adds Depot buf-generated client modules). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit ecf6ecc3fa760ade1aded2a2119e017192e53343. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: David Schmitt <DavidS-ovm@users.noreply.github.com> GitOrigin-RevId: 6fd5c5bd3f4150f56a62764813b8e4a6a9de3298

plan: a749596c-d871-45d1-a113-7f2e552f172b  --- > [!NOTE] > **Medium Risk** > Adds new identity FKs and uniqueness/index constraints to `plans`/`reviews` and updates events/protos/workflow prompts to use principal UUIDs; mistakes could break review assignment, notifications, or cross-tenant identity resolution. Changes are largely additive with legacy subject fallbacks, reducing immediate rollout risk. > > **Overview** > **Begins migrating Brent from Auth0-subject identity to stable principal UUIDs.** Adds `author_principal_id` on plans and `requested_reviewer_id`/`actual_reviewer_id` (plus reserved delegation/auth-strength columns) on reviews via a new migration, with concurrent indexes and a new partial-unique constraint keyed on `(plan_id, actual_reviewer_id)`. > > Updates workflow markdown prompts (Slack + Linear mirroring + PR review) and `.cursor/team-members.md` to resolve/display people by **Brent Principal ID** (with explicit fallbacks to legacy `*_subject` for historical rows), and introduces a reproducible `seed_team_principals.sh` to pin/seed principals, identities, and verified bindings. > > Extends the Brent protobuf surface (`brent.proto` + generated Go/TS) and event payloads to carry principal IDs alongside legacy subjects, and adds `auth.ResolvePrincipalID` (with tests) to standardize subject→principal resolution; integration tests are adjusted to seed principals before creating plans. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 29f89eb6d0c2a377550d3477b442ce3b16ae4bdd. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  --------- Co-authored-by: jameslaneovermind <122231433+jameslaneovermind@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 66a81693d176384c129d4bb447d536154fc84df8

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/aws/aws-sdk-go-v2/service/apigateway](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.39.3` → `v1.39.4` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fapigateway/v1.39.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fapigateway/v1.39.3/v1.39.4?slim=true) | | [github.com/aws/aws-sdk-go-v2/service/ec2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.302.0` → `v1.303.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fec2/v1.303.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fec2/v1.302.0/v1.303.0?slim=true) | | [github.com/aws/aws-sdk-go-v2/service/ecs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.79.1` → `v1.80.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fecs/v1.80.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fecs/v1.79.1/v1.80.0?slim=true) | | [github.com/aws/aws-sdk-go-v2/service/kms](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.51.1` → `v1.52.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fkms/v1.52.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fkms/v1.51.1/v1.52.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2/service/apigateway)</summary> ### [`v1.39.4`](https://redirect.github.com/aws/aws-sdk-go-v2/compare/v1.39.3...v1.39.4) [Compare Source](https://redirect.github.com/aws/aws-sdk-go-v2/compare/v1.39.3...v1.39.4) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 671fff792802adcc8fc9c00a65a9bf2e6f0644fe

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/nats-io/nats-server/v2](https://redirect.github.com/nats-io/nats-server) | `v2.14.0` → `v2.14.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fnats-io%2fnats-server%2fv2/v2.14.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fnats-io%2fnats-server%2fv2/v2.14.0/v2.14.1?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>nats-io/nats-server (github.com/nats-io/nats-server/v2)</summary> ### [`v2.14.1`](https://redirect.github.com/nats-io/nats-server/releases/tag/v2.14.1) [Compare Source](https://redirect.github.com/nats-io/nats-server/compare/v2.14.0...v2.14.1) #### Changelog Refer to the [2.14 Upgrade Guide](https://docs.nats.io/release-notes/whats_new/whats_new_214) for backwards compatibility notes with 2.12.x. Please note that the 2.13.x version was skipped. ##### Go Version - 1.26.3 ([#8107](https://redirect.github.com/nats-io/nats-server/issues/8107)) ##### Dependencies - github.com/klauspost/compress v1.18.6 ([#8124](https://redirect.github.com/nats-io/nats-server/issues/8124)) - golang.org/x/crypto v0.51.0 ([#8124](https://redirect.github.com/nats-io/nats-server/issues/8124)) - golang.org/x/sys v0.44.0 ([#8124](https://redirect.github.com/nats-io/nats-server/issues/8124)) ##### Added General - New metrics `in_client_msgs`, `in_client_bytes`, `out_client_msgs` and `out_client_bytes` are now available via the `/varz` monitoring endpoint for tracking data to/from normal clients only ([#7851](https://redirect.github.com/nats-io/nats-server/issues/7851)) ##### Improved General - Client TLS certificates without subject DNs but with DNS subject alternate names are now permitted ([#8100](https://redirect.github.com/nats-io/nats-server/issues/8100)) - The log level of TLS handshake timeout or non-TLS record errors have been demoted to debug level to reduce noise ([#8096](https://redirect.github.com/nats-io/nats-server/issues/8096)) JetStream - Num pending is now only calculated on consumer leaders, avoiding unnecessary CPU usage on followers ([#8172](https://redirect.github.com/nats-io/nats-server/issues/8172)) - Snapshot and catchup loops no longer leak timers ([#8186](https://redirect.github.com/nats-io/nats-server/issues/8186), thanks to [@SebTardif](https://redirect.github.com/SebTardif)) - Stream and consumer assignment errors are now surfaced ([#8208](https://redirect.github.com/nats-io/nats-server/issues/8208)) - Intersection of sublists and subject trees can now be cancelled early, avoiding high CPU usage in some pathological cases ([#8209](https://redirect.github.com/nats-io/nats-server/issues/8209)) ##### Fixed General - Cluster route compression now obeys the cluster `max_pings_out` option if configured ([#8093](https://redirect.github.com/nats-io/nats-server/issues/8093)) - The internal send loop no longer mutates caller headers, which could corrupt buffers ([#8097](https://redirect.github.com/nats-io/nats-server/issues/8097)) - Removing headers no longer fails to remove later headers if the matching prefix also appeared in an earlier header value ([#8103](https://redirect.github.com/nats-io/nats-server/issues/8103)) - The sublist now correctly maintains negative results in the cache when calculating number of interested subjects ([#8119](https://redirect.github.com/nats-io/nats-server/issues/8119)) - Server shutdown requests are now idempotent, preventing concurrency issues when shutting down in embedded contexts ([#8163](https://redirect.github.com/nats-io/nats-server/issues/8163)) - TLS listeners now work correctly with the PROXY protocol where enabled ([#8130](https://redirect.github.com/nats-io/nats-server/issues/8130)) - Reduced lock contention that could be created between leafnodes and clients ([#8139](https://redirect.github.com/nats-io/nats-server/issues/8139), [#8159](https://redirect.github.com/nats-io/nats-server/issues/8159)) - Fixed a panic that could happen when an error occurs when walking JWT directory resolver folders ([#8173](https://redirect.github.com/nats-io/nats-server/issues/8173), thanks to [@SebTardif](https://redirect.github.com/SebTardif)) - In-process connections will no longer unexpectedly revert to TLS required with async `INFO` ([#8205](https://redirect.github.com/nats-io/nats-server/issues/8205)) Leafnodes - Leafnode connections will no longer negotiate compression if they are configured over already-compressed WebSockets ([#7969](https://redirect.github.com/nats-io/nats-server/issues/7969)) JetStream - Fast batch now correctly parses the batch sequence as a uint64 ([#8094](https://redirect.github.com/nats-io/nats-server/issues/8094)) - Atomic batch no longer double-pools committed entries on cleanup ([#8098](https://redirect.github.com/nats-io/nats-server/issues/8098)) - Raft nodes will now ignore temporary snapshots on recovery after a crash ([#8101](https://redirect.github.com/nats-io/nats-server/issues/8101)) - A number of paths that could leave consumer redelivered in a drifted state have been fixed, e.g. with workqueue or interest-based streams with `max_deliver`, on single message removal or after purges/compactions ([#8102](https://redirect.github.com/nats-io/nats-server/issues/8102)) - Caches are now cleared correctly when converting filestore encryption mode, avoiding block-level corruption ([#8105](https://redirect.github.com/nats-io/nats-server/issues/8105), [#8166](https://redirect.github.com/nats-io/nats-server/issues/8166)) - Fixed a race condition when updating the deduplication map on leader change ([#8106](https://redirect.github.com/nats-io/nats-server/issues/8106)) - Source consumer creation will no longer schedule a recreation if a setup is already in progress, avoiding potential setup storms ([#8111](https://redirect.github.com/nats-io/nats-server/issues/8111)) - Fixed data races when reading from the stream configuration when checking reservations, answering some API requests amongst others ([#8115](https://redirect.github.com/nats-io/nats-server/issues/8115)) - Stream republish subjects are now validated correctly ([#8127](https://redirect.github.com/nats-io/nats-server/issues/8127)) - The delivery policy for consumers on clustered workqueue streams is now enforced correctly ([#8126](https://redirect.github.com/nats-io/nats-server/issues/8126)) - The `Nats-Schedule-Next: purge` action now correctly checks if the target is a schedule ([#8135](https://redirect.github.com/nats-io/nats-server/issues/8135)) - Raft node append entry caches are now invalidated correctly on WAL truncation and snapshot installs ([#8149](https://redirect.github.com/nats-io/nats-server/issues/8149)) - Skip message errors are now surfaced correctly, propagating failures ([#8152](https://redirect.github.com/nats-io/nats-server/issues/8152)) - Mirror consumers are now retried immediately on a last sequence mismatch, avoiding stalling for longer than necessary ([#8152](https://redirect.github.com/nats-io/nats-server/issues/8152)) - Raft nodes will no longer allow proposals to remove unknown peers ([#8154](https://redirect.github.com/nats-io/nats-server/issues/8154)) - Pending state no longer leaks when reaching max deliveries ([#8156](https://redirect.github.com/nats-io/nats-server/issues/8156)) - A panic when reusing a wait group when resetting a stream's clustered state has been fixed ([#8158](https://redirect.github.com/nats-io/nats-server/issues/8158)) - Correctly reset local meta log when extending the meta group to a parent domain ([#8142](https://redirect.github.com/nats-io/nats-server/issues/8142)) - Consumer file stores will now correctly flush when deleting a single redelivery, avoiding unexpected further redeliveries ([#8168](https://redirect.github.com/nats-io/nats-server/issues/8168)) - Storage reservations for un-tiered streams have been made consistent between creates/updates and clustered/non-clustered modes ([#8170](https://redirect.github.com/nats-io/nats-server/issues/8170)) - Raft will now correctly cancel an in-flight checkpoint operation when resetting ([#8180](https://redirect.github.com/nats-io/nats-server/issues/8180), [#8202](https://redirect.github.com/nats-io/nats-server/issues/8202)) - The `JetStreamMaxMemory` and `JetStreamMaxStore` options are now handled correctly in embedded mode ([#8184](https://redirect.github.com/nats-io/nats-server/issues/8184)) - A number of fields that were aliasing underlying filestore block caches have been fixed ([#8187](https://redirect.github.com/nats-io/nats-server/issues/8187)) - Consumers with `inactive_threshold` should no longer have their local state deleted unexpectedly when the proposal to the metalayer to clean up the consumer fails ([#8198](https://redirect.github.com/nats-io/nats-server/issues/8198)) - Metalayer state is now preserved in a number of cases where it was incorrectly being removed on shutdown ([#8199](https://redirect.github.com/nats-io/nats-server/issues/8199)) MQTT - Invalid characters in subjects are now rejected correctly, avoiding protocol issues when forwarded to other connection types ([#8104](https://redirect.github.com/nats-io/nats-server/issues/8104), [#8112](https://redirect.github.com/nats-io/nats-server/issues/8112)) ##### Complete Changes </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: cebf20b4ca0624c3d653463eeecc1cd54089238c

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/aws/aws-sdk-go-v2/service/apigateway](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.39.4` → `v1.40.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fapigateway/v1.40.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fapigateway/v1.39.4/v1.40.0?slim=true) | | [github.com/aws/aws-sdk-go-v2/service/eks](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.83.0` → `v1.84.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2feks/v1.84.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2feks/v1.83.0/v1.84.0?slim=true) | | [github.com/aws/aws-sdk-go-v2/service/networkmanager](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.41.10` → `v1.42.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fnetworkmanager/v1.42.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fnetworkmanager/v1.41.10/v1.42.0?slim=true) | | [github.com/aws/aws-sdk-go-v2/service/sesv2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.60.4` → `v1.60.5` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fsesv2/v1.60.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2faws%2faws-sdk-go-v2%2fservice%2fsesv2/v1.60.4/v1.60.5?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2/service/apigateway)</summary> ### [`v1.40.0`](https://redirect.github.com/aws/aws-sdk-go-v2/blob/HEAD/CHANGELOG.md#Release-2025-11-192) [Compare Source](https://redirect.github.com/aws/aws-sdk-go-v2/compare/v1.39.4...v1.40.0) #### General Highlights - **Dependency Update**: Updated to the latest SDK module versions #### Module Highlights - `github.com/aws/aws-sdk-go-v2`: v1.40.0 - **Feature**: Add support for AWS Login credentials (package credentials/logincreds) to the default credential chain. - `github.com/aws/aws-sdk-go-v2/config`: [v1.32.0](config/CHANGELOG.md#v1320-2025-11-192) - **Feature**: Add support for AWS Login credentials (package credentials/logincreds) to the default credential chain. - `github.com/aws/aws-sdk-go-v2/credentials`: [v1.19.0](credentials/CHANGELOG.md#v1190-2025-11-192) - **Feature**: Add support for AWS Login credentials (package credentials/logincreds) to the default credential chain. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 0b3dae651fab44e475bd1e427d5a7a27382fd322

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/onsi/ginkgo/v2](https://redirect.github.com/onsi/ginkgo) | `v2.28.3` → `v2.29.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fonsi%2fginkgo%2fv2/v2.29.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fonsi%2fginkgo%2fv2/v2.28.3/v2.29.0?slim=true) | | [github.com/onsi/gomega](https://redirect.github.com/onsi/gomega) | `v1.40.0` → `v1.41.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fonsi%2fgomega/v1.41.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fonsi%2fgomega/v1.40.0/v1.41.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>onsi/ginkgo (github.com/onsi/ginkgo/v2)</summary> ### [`v2.29.0`](https://redirect.github.com/onsi/ginkgo/releases/tag/v2.29.0) [Compare Source](https://redirect.github.com/onsi/ginkgo/compare/v2.28.3...v2.29.0) #### 2.29.0 `GinkgoHelperGo` makes it easier to write test helpers that need to run in goroutines. Specifically, it makes managing the failure state and capturing failure panics correctly straightforward. `ginkgo outline` now includes entries defined in `DescribeTableSubtree` </details> <details> <summary>onsi/gomega (github.com/onsi/gomega)</summary> ### [`v1.41.0`](https://redirect.github.com/onsi/gomega/compare/v1.40.0...v1.41.0) [Compare Source](https://redirect.github.com/onsi/gomega/compare/v1.40.0...v1.41.0) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: c8d65252b195a9dac1668fa36286f9acc0d9597d

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/harness/harness-go-sdk](https://redirect.github.com/harness/harness-go-sdk) | `v0.7.27` → `v0.7.28` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fharness%2fharness-go-sdk/v0.7.28?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fharness%2fharness-go-sdk/v0.7.27/v0.7.28?slim=true) | | [github.com/resend/resend-go/v3](https://redirect.github.com/resend/resend-go) | `v3.6.0` → `v3.7.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fresend%2fresend-go%2fv3/v3.7.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fresend%2fresend-go%2fv3/v3.6.0/v3.7.0?slim=true) | | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.54.0` → `v0.55.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.54.0...refs/tags/v0.55.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.55.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.54.0/v0.55.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. --- ### Release Notes <details> <summary>harness/harness-go-sdk (github.com/harness/harness-go-sdk)</summary> ### [`v0.7.28`](https://redirect.github.com/harness/harness-go-sdk/compare/v0.7.27...v0.7.28) [Compare Source](https://redirect.github.com/harness/harness-go-sdk/compare/v0.7.27...v0.7.28) </details> <details> <summary>resend/resend-go (github.com/resend/resend-go/v3)</summary> ### [`v3.7.0`](https://redirect.github.com/resend/resend-go/releases/tag/v3.7.0) [Compare Source](https://redirect.github.com/resend/resend-go/compare/v3.6.0...v3.7.0) #### What's Changed - chore: gh actions hardening by [@felipefreitag](https://redirect.github.com/felipefreitag) in [#114](https://redirect.github.com/resend/resend-go/pull/114) - feat(domains): add Capabilities to CreateDomainRequest by [@ryanhill4L](https://redirect.github.com/ryanhill4L) in [#115](https://redirect.github.com/resend/resend-go/pull/115) - feat(domains): add capabilities to Domain and CreateDomainResponse structs by [@drish](https://redirect.github.com/drish) in [#117](https://redirect.github.com/resend/resend-go/pull/117) #### New Contributors - [@felipefreitag](https://redirect.github.com/felipefreitag) made their first contribution in [#114](https://redirect.github.com/resend/resend-go/pull/114) - [@ryanhill4L](https://redirect.github.com/ryanhill4L) made their first contribution in [#115](https://redirect.github.com/resend/resend-go/pull/115) **Full Changelog**: <resend/resend-go@v3.6.0...v3.7.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> GitOrigin-RevId: a3929c481f6a2dfd94dc6230c3d3911f9cd4c1bc

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/riverqueue/river](https://redirect.github.com/riverqueue/river) | `v0.35.1` → `v0.37.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2friverqueue%2friver/v0.37.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2friverqueue%2friver/v0.35.1/v0.37.1?slim=true) | | [github.com/riverqueue/river/riverdriver/riverpgxv5](https://redirect.github.com/riverqueue/river) | `v0.35.1` → `v0.37.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2friverqueue%2friver%2friverdriver%2friverpgxv5/v0.37.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2friverqueue%2friver%2friverdriver%2friverpgxv5/v0.35.1/v0.37.1?slim=true) | | [github.com/riverqueue/river/rivertype](https://redirect.github.com/riverqueue/river) | `v0.35.1` → `v0.37.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2friverqueue%2friver%2frivertype/v0.37.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2friverqueue%2friver%2frivertype/v0.35.1/v0.37.1?slim=true) | | [github.com/riverqueue/rivercontrib/otelriver](https://redirect.github.com/riverqueue/rivercontrib) | `v0.7.0` → `v0.8.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2friverqueue%2frivercontrib%2fotelriver/v0.8.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2friverqueue%2frivercontrib%2fotelriver/v0.7.0/v0.8.0?slim=true) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/370) for more information. ## ⚠️ Warning These modules contain database migrations that need to be added manually to our atlas migrations. Check the contents of https://github.com/riverqueue/river/tree/master/rivermigrate/migration before merging this update. --- ### Release Notes <details> <summary>riverqueue/river (github.com/riverqueue/river)</summary> ### [`v0.37.1`](https://redirect.github.com/riverqueue/river/releases/tag/v0.37.1) [Compare Source](https://redirect.github.com/riverqueue/river/compare/v0.37.0...v0.37.1) ##### Fixed - Wrap `PeriodicJobEnqueuer.insertBatch` database calls in a 30-second timeout. Previously, a stalled pgx `Begin`/`Insert`/`Commit` could hang the periodic enqueuer indefinitely, halting all periodic job insertion until the process was restarted or leader re-elected. [PR #1251](https://redirect.github.com/riverqueue/river/pull/1251) ### [`v0.37.0`](https://redirect.github.com/riverqueue/river/releases/tag/v0.37.0) [Compare Source](https://redirect.github.com/riverqueue/river/compare/v0.36.0...v0.37.0) ##### Added - Added "resumable jobs" that can be broken down into multiple steps and with a step persisted after it finishes that lets them skip work that's already been done. This is particularly useful for long running jobs that may experience a cancellation (like in the event of a deploy) during the span of their run. [PR #1226](https://redirect.github.com/riverqueue/river/pull/1226). ### [`v0.36.0`](https://redirect.github.com/riverqueue/river/releases/tag/v0.36.0) [Compare Source](https://redirect.github.com/riverqueue/river/compare/v0.35.1...v0.36.0) ##### Added - Add `QeueueBundle.Remove` to remove an already added queue/producer. [PR #1235](https://redirect.github.com/riverqueue/river/pull/1235) and [PR #1240](https://redirect.github.com/riverqueue/river/pull/1240). ##### Fixed - Fix unsafe concurrent producer map access in client. [PR #1236](https://redirect.github.com/riverqueue/river/pull/1236). - Mark schema replacements as `Stable` in sqlc templates, preventing query SQL from having to be reallocated over and over again.. [PR #1242](https://redirect.github.com/riverqueue/river/pull/1242). - Fix bug in `sqltemplate` cached path in order in which named args are passed to a query (previously, the order was unstable). [PR #1243](https://redirect.github.com/riverqueue/river/pull/1243). </details> <details> <summary>riverqueue/rivercontrib (github.com/riverqueue/rivercontrib/otelriver)</summary> ### [`v0.8.0`](https://redirect.github.com/riverqueue/rivercontrib/releases/tag/v0.8.0) [Compare Source](https://redirect.github.com/riverqueue/rivercontrib/compare/v0.7.0...v0.8.0) ##### Added - Augment `otelriver` middleware to cleanly handle errors returned in batch results from River Pro's batch jobs feature. [PR #54](https://redirect.github.com/riverqueue/rivercontrib/pull/54). </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/overmindtech/workspace).  GitOrigin-RevId: 2085d02fb65ce68529e09bbaf50d3589c0703b62

…5178) ## Summary - Delete `.cursor/team-members.md` and the one-off `seed_team_principals.sh` script now that `principal_bindings` is canonical in Brent. - Migrate Cursor commands and subagents to resolve approvers via Brent MCP (`list_principals_by_kind`, `get_bindings`, `reviewer_principal_id`). - Drop the retired path from `get_policy_file`, remove the transitional CI guard, and update docs to past tense. ## Linear Ticket Fixes: [ENG-4317](https://linear.app/overmind/issue/ENG-4317/phase-15b-retire-cursorteam-membersmd-and-migrate-downstream-consumers) — Phase 1.5b — retire `.cursor/team-members.md` and migrate downstream consumers - **Purpose**: Close the Friends milestone identity workstream by retiring the hand-maintained team directory and moving IDE-side consumers to Brent MCP, after ENG-4316 proved runtime cutover in production. ## Changes Review focus: `.cursor/agents/` and `.cursor/commands/` migration to Brent MCP; `github_policy_file_tool.go` allowlist shrink; deletion of seed/guard scripts; doc rewrites in `docs/plans/` and friends-using-brent playbook. ## Brent Plan - **Plan**: [Retire team-members.md and migrate downstream consumers](https://brent-dev.overmind-demo.com/open/plans/510973d1-4b09-476a-a209-c9d8ac246e08?prompt=Use+the+Brent+MCP+server+to+call+get_plan+with+id+%22510973d1-4b09-476a-a209-c9d8ac246e08%22%2C+then+help+me+review+or+continue+from+that+plan.&target=cursor) - **Approved by**: James Lane > Deviation analysis and reviewer assignment are handled automatically by the > pre-approved PR review automation (see docs/PREAPPROVED_CHANGES.md). Made with [Cursor](https://cursor.com)  --- > [!NOTE] > **Medium Risk** > Medium risk because it removes the legacy `.cursor/team-members.md` directory and updates multiple Cursor command/subagent workflows to resolve reviewers via Brent principal/binding MCP calls, which could break approval/reviewer assignment if bindings are missing or name matching is ambiguous. > > **Overview** > Retires the hand-maintained Cursor team roster by deleting `.cursor/team-members.md`, removing the `seed_team_principals.sh` seeding script, and dropping the transitional CI guard that prevented workflows from referencing the file. > > Updates Cursor agents/commands used for plan submission, PR creation/update, `/next`, and approval flows to resolve humans via Brent MCP (`list_principals_by_kind`) and map to GitHub/Linear via `get_bindings`, switching review requests to use `reviewer_principal_id` and adding explicit *not found/ambiguous* error handling. > > Documentation is updated to reflect the new principal/binding-based directory as the source of truth, including playbooks and automation docs that previously referenced the retired roster. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 333f178f7fdc0558eea0b66744b593ea514b11be. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>  --------- Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: d0d2add90992df1051bb11ccf841a978233a9fc0

tphoney and others added 22 commits May 26, 2026 08:42

Run go mod tidy

91c7935

tphoney merged commit c924a04 into main May 26, 2026

tphoney deleted the copybara/v1.18.2 branch May 26, 2026 08:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release v1.18.2#848

Release v1.18.2#848
tphoney merged 22 commits into
mainfrom
copybara/v1.18.2

github-actions Bot commented May 26, 2026 •

edited by tphoney

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

github-actions Bot commented May 26, 2026 • edited by tphoney Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Copybara Sync - Release v1.18.2

What happens when this PR is merged?

Review Checklist

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented May 26, 2026 •

edited by tphoney

Loading