Repository navigation
Release v1.19.5 - #860
Merged
Merged
Release v1.19.5#860
Conversation
## Summary These are mechanical bumps and do not change functionality. ### Go modules - `buf.build/gen/go/depot/api/connectrpc/go` `v1.20.0-20260805103418-70b5c163d960.1` → `v1.21.0-20260921104210-c942b34ee9b4.1` - `buf.build/gen/go/depot/api/protocolbuffers/go` `v1.36.12-20260805103418-70b5c163d960.2` → `v1.36.12-20260921104210-c942b34ee9b4.2` - `cloud.google.com/go/aiplatform` `v1.126.0` → `v1.127.0` - `cloud.google.com/go/bigquery` `v1.83.0` → `v1.85.0` - `cloud.google.com/go/bigtable` `v1.52.0` → `v1.58.0` - `cloud.google.com/go/certificatemanager` `v1.15.0` → `v1.16.0` - `cloud.google.com/go/compute` `v1.67.0` → `v1.70.0` - `cloud.google.com/go/container` `v1.54.0` → `v1.55.0` - `cloud.google.com/go/dataplex` `v1.36.0` → `v1.37.0` - `cloud.google.com/go/dataproc/v2` `v2.25.0` → `v2.26.0` - `cloud.google.com/go/eventarc` `v1.25.0` → `v1.26.0` - `cloud.google.com/go/filestore` `v1.16.0` → `v1.17.0` - `cloud.google.com/go/functions` `v1.25.0` → `v1.26.0` - `cloud.google.com/go/iam` `v1.13.0` → `v1.14.0` - `cloud.google.com/go/kms` `v1.33.0` → `v1.35.0` - `cloud.google.com/go/logging` `v1.19.1` → `v1.20.0` - `cloud.google.com/go/monitoring` `v1.30.0` → `v1.31.0` - `cloud.google.com/go/orgpolicy` `v1.20.0` → `v1.21.0` - `cloud.google.com/go/redis` `v1.25.0` → `v1.26.0` - `cloud.google.com/go/resourcemanager` `v1.16.0` → `v1.17.0` - `cloud.google.com/go/run` `v1.22.0` → `v1.23.0` - `cloud.google.com/go/secretmanager` `v1.21.0` → `v1.22.0` - `cloud.google.com/go/securitycentermanagement` `v1.6.0` → `v1.7.0` - `cloud.google.com/go/spanner` `v1.95.0` → `v1.95.1` - `cloud.google.com/go/storagetransfer` `v1.19.0` → `v1.20.0` - `connectrpc.com/connect` `v1.20.0` → `v1.21.0` - `github.com/aws/smithy-go` `v1.28.1` → `v1.28.2` - `github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v8` `v8.3.0` → `v8.4.0` - `github.com/brianvoe/gofakeit/v7` `v7.17.0` → `v7.17.1` - `github.com/googleapis/gax-go/v2` `v2.24.1` → `v2.26.2` - `github.com/hashicorp/hcl/v2` `v2.24.0` → `v2.25.0` - `github.com/modelcontextprotocol/go-sdk` `v1.7.0` → `v1.8.0` - `github.com/nats-io/nats-server/v2` `v2.14.6` → `v2.15.0` - `github.com/nats-io/nats.go` `v1.53.1` → `v1.54.0` - `github.com/neo4j/neo4j-go-driver/v6` `v6.2.0` → `v6.3.0` - `github.com/onsi/ginkgo/v2` `v2.32.2` → `v2.33.0` - `github.com/onsi/gomega` `v1.43.0` → `v1.44.0` - `github.com/pb33f/ordered-map/v2` `v2.3.1` → `v2.3.2` - `github.com/stripe/stripe-go/v86` `v86.4.1` → `v86.4.2` - `google.golang.org/grpc` `v1.83.2` → `v1.84.0` - `golang.org/x/sync` `v0.22.0` → `v0.23.0` (required by the modules above) - `golang.org/x/text` `v0.41.0` → `v0.42.0` (required by the modules above) - `golang.org/x/time` `v0.15.0` → `v0.16.0` (required by the modules above) ### Image packages - `libssl3t64` and `openssl-provider-legacy` `3.5.5-1ubuntu3.5` → `3.5.5-1ubuntu3.6` in `plugins/private-evals/container/Dockerfile`. The `ubuntu:26.04` base image tag stays. ## Test plan - [ ] CI passes on the dependency bump Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 00ae10cf0d420beceb5b0bad23f3b5cb35a4c598
## Summary These are mechanical bumps and do not change functionality. ### Go modules - `buf.build/gen/go/depot/api/connectrpc/go` `v1.21.0-20260921104210-c942b34ee9b4.1` -> `v1.21.0-20261001173247-90a8f4590f00.1` - `buf.build/gen/go/depot/api/protocolbuffers/go` `v1.36.12-20260921104210-c942b34ee9b4.2` -> `v1.36.12-20261001173247-90a8f4590f00.2` - `cloud.google.com/go/auth` `v0.23.2` -> `v0.24.0` - `cloud.google.com/go/auth/oauth2adapt` `v0.2.8` -> `v0.3.0` - `cloud.google.com/go/compute/metadata` `v0.9.0` -> `v0.10.0` - `cloud.google.com/go/networksecurity` `v0.19.0` -> `v0.20.0` - `cloud.google.com/go/storage` `v1.67.1` -> `v1.69.0` - `github.com/Azure/azure-sdk-for-go/sdk/azcore` `v1.23.1` -> `v1.23.2` - `github.com/apache/thrift` `v0.24.0` -> `v0.25.0` (existing `replace`) - `github.com/auth0/go-auth0/v3` `v3.4.0` -> `v3.7.0` - `github.com/aws/aws-sdk-go-v2/service/eks` `v1.101.0` -> `v1.102.0` - `github.com/aws/aws-sdk-go-v2/service/ssm` `v1.78.1` -> `v1.79.0` - `github.com/cenkalti/backoff/v7` `v7.0.0` -> `v7.0.1` - `github.com/getsentry/sentry-go` `v0.48.0` -> `v0.49.0` - `github.com/harness/harness-go-sdk` `v0.8.27` -> `v0.8.31` - `github.com/openai/openai-go/v3` `v3.56.0` -> `v3.70.0` - `github.com/resend/resend-go/v4` `v4.3.0` -> `v4.8.0` - `gitlab.com/gitlab-org/api/client-go/v3` `v3.13.0` -> `v3.15.0` - `golang.org/x/image` `v0.45.0` -> `v0.46.0` (existing `replace`) - `golang.org/x/net` `v0.58.0` -> `v0.59.0` - `golang.org/x/oauth2` `v0.36.0` -> `v0.37.0` - `google.golang.org/api` `v0.293.0` -> `v0.300.0` - `google.golang.org/genproto/googleapis/rpc` `v0.0.0-20260819154853-08b0e4226688` -> `v0.0.0-20260928230214-8a89bd6388cc` - `riverqueue.com/riverui` `v0.19.0` -> `v0.20.0` - `sigs.k8s.io/kind` `v0.32.0` -> `v0.33.0` - `github.com/riverqueue/river` `v0.45.0` -> `v0.48.0` (required by `riverui` `v0.20.0`) - `github.com/riverqueue/river/riverdriver/riverpgxv5` `v0.45.0` -> `v0.48.0` (required by `riverui` `v0.20.0`) - `github.com/riverqueue/river/rivertype` `v0.45.0` -> `v0.48.0` (required by `riverui` `v0.20.0`) `github.com/exaring/otelpgx` stays on the fork. `libssl3t64` and `openssl-provider-legacy` are already pinned to `3.5.5-1ubuntu3.6` on `main`. ## Test plan - [ ] CI passes on the dependency bump Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 3a6a6c6973d1309d6708318cc11ad5c086d1ba1e
## Summary - Store one OpenAI key per Overmind account, encrypted at rest, so Explore and change analysis use that account's key. - A missing key is an error. Nothing falls back to Overmind's key. - The gateway drops its own key and asks api-server for the account key once per Explore session. ## Linear Ticket Fixes: [ENG-6643](https://linear.app/overmind/issue/ENG-6643/store-account-openai-keys-for-the-gateway-to-read) — Store account OpenAI keys for the gateway to read - **Purpose**: Store one OpenAI key per account, encrypted at rest, so Explore and change analysis use that account's key. The approved plan includes the gateway call. ## Changes - New `account_openai_keys` table, field-encryption wiring, and `AccountOpenAIKeyService` / `InternalOpenAIKeyService`. Status returns last four characters only. A rejected OpenAI probe writes nothing, and the error text does not include the secret. - Conversations resolve a stored account key through Bind. Change analysis puts the change's account on the worker context and no longer attaches a platform choice. Tests and the area51 CLI that already hold a key use `UseCallerKey`. - The gateway removes `--openai-api-key`, the boot check, and the `OPENAI_API_KEY` ExternalSecret entry. A new Explore conversation calls `IssueOpenAIKey` once. Only `service:gateway` may call that RPC. - api-server still starts when `API_SERVER_FIELDCRYPTO_KEY_PRIMARY` is unset; Set then stores nothing. Terraform items and ExternalSecret entries for the api-server field-encryption keys are included. Applying Terraform and syncing the secret are deploy steps, not part of this PR. Reviewers should focus on the secret never appearing in errors, logs, or status responses, and on the missing-row path returning an error rather than Overmind's key. ## Until Plan Plan ID: UNTIL-1117 - **Plan**: Store account OpenAI keys for the gateway to read - **Approved by**: Thomas Honey > Deviation analysis and reviewer assignment are handled automatically by the > pre-approved PR review automation (see docs/PREAPPROVED_CHANGES.md). Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 7b109e8b421b5d0b3f07e626799695c4a9f90a67
## Summary - Reverts #6782, #6783, and #6785 together. An account with no saved key was stopping change analysis and Explore. Those accounts use Overmind's key again. - GitHub could not revert the pull requests one at a time. Each one edits the same files as the next. ## Linear Ticket Fixes: [ENG-6617](https://linear.app/overmind/issue/ENG-6617/openai-key-support-for-overmind) — OpenAI key support for overmind - **Purpose**: Put change analysis and Explore back on Overmind's key for every account that has not saved a key. ## Changes This is one revert of the three squash commits, newest first. The account key vault, the gateway key lookup, and the change-analysis cancel path are gone. The `account_openai_keys` migration stays. #6785 has already deployed, so that migration may already be applied. Deleting an applied Atlas migration stops the api-server on startup. The table is unused. Nothing reads or writes it. Made with [Cursor](https://cursor.com) Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 6326c06bed2f20c529e99f7befdd816323562303
## Summary - An account with no saved OpenAI key keeps running change analysis and Explore on Overmind's key. - A saved key that OpenAI rejects, that has no quota, or that does not decrypt stops the call. It does not switch back to Overmind's key. - The vault does not hold Overmind's key. The api-server and the gateway each make the platform choice from their own OPENAI_API_KEY, and only when the account has no row. ## Linear Ticket Fixes: [ENG-6617](https://linear.app/overmind/issue/ENG-6617/openai-key-support-for-overmind) — OpenAI key support for overmind - **Purpose**: Let an account optionally store an OpenAI key, while accounts with no saved key keep running on Overmind's key. ## Changes ChoiceForAccount turns a missing account_openai_keys row into a platform choice when the process key is set. Bind calls it before NewConversation, so SignalAggregator and the pull-request summary follow the same rule. IsKeyFailure treats ErrNotConfigured as a key failure only when the platform secret is empty, so an account with no saved key is not cancelled. A decrypt failure, a missing account, and a saved key that OpenAI rejects or that has no quota still cancel the job. IssueOpenAIKey maps a missing row to FailedPrecondition and a missing account to InvalidArgument. Explore turns only FailedPrecondition into a platform choice from the gateway key. Any other issue error stops the chat. Field-encryption Terraform and the api-server external secret are restored so existing ciphertext can still be decrypted. Do not replace random_bytes if the 1Password items still exist. If those items were already destroyed, delete account_openai_keys rows in dogfood and prod before apply creates a new key. That delete is not in this pull request. ## Until Plan Plan ID: UNTIL-1119 - **Plan**: Keep Overmind's key when an account has no saved key - **Approved by**: Thomas Honey > Deviation analysis and reviewer assignment are handled automatically by the > pre-approved PR review automation (see docs/PREAPPROVED_CHANGES.md). Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 3ae30cd344a9dcaa598971e8074b3c674ecfb7dc
## Summary
- When OpenAI rejects an account's saved key, or the key has no quota,
the api-server now records it on the `account_openai_keys` row
(`last_failure_reason`, `last_failure_at`). The next call on that key
that succeeds clears it, and so does saving a key. A follow-up plan
shows this on the settings page.
- Change analysis now says the key failed in its neutral GitHub check
("OpenAI rejected the key" / "The OpenAI key has no quota") instead of
"Analysis did not complete. Re-run your plan to retry", which a re-run
with the same key cannot fix. The job stops instead of retrying on the
bad key.
## Linear Ticket
Fixes:
[ENG-6617](https://linear.app/overmind/issue/ENG-6617/openai-key-support-for-overmind)
— OpenAI key support for overmind
- **Purpose**: Let accounts use their own OpenAI key for change analysis
and Explore
## Changes
- **Schema and store** (`services/api-server/models`,
`service/openaikey/vault.go`): three nullable columns plus a migration.
`Vault.Report` writes only when the row is still the save the call used
(`secret_version` and `updated_at`) and the result is newer than the
stored one (`last_result_at`), so a late or stale report cannot
overwrite a newer result or stamp a new key with an old failure.
`Decide` now also returns that generation.
- **Reporter** (`go/sdp-go/llm/key_reporter.go`): `KeyReporter` rides on
an account `Choice` (`WithReporter`; platform choices never carry one).
The responses conversation and the embeddings tool list call `Observe`
after each OpenAI call, including a stream that opens with HTTP 200 and
then sends an error event. One reporter covers one unit of work (a job,
a `Bind` conversation, or one Explore message) and sends at most two
reports: the first success, and the first key failure. A mutex covers
each decision and its send, so a parallel call that succeeds after a
failure cannot clear it. Worth a careful look.
- **Gateway** (`services/gateway/service/assistant.go`,
`sdp/openai_key.proto`): `IssueOpenAIKey` now returns the generation,
and the new `ReportOpenAIKeyResult` RPC (`service:gateway` scope only)
carries it back. The gateway resets the reporter per message. If the API
server is older and returns no generation, the gateway reports nothing,
so the rollout is safe in either order.
- **Check text** (`service/changeanalysis/change_analysis.go`,
`area51/llm.go`): `classifyWorkFailure` and the blast-radius worker
treat a recorded key failure as terminal even when the returned error is
no longer an OpenAI error. The conclusion stays `neutral` so it does not
block the pull request.
- **Tests**: vault and RPC integration tests (embedded Postgres),
reporter unit tests (ordering, parallel calls, `Reset`, the
401/403/quota/rate-limit/platform cases on both clients), gateway
message flows, and change-analysis and Area51 jobs that check the stored
row. Docs: the `llm` package doc and
`docs/runbooks/openai-spending-cap.md`.
## Until Plan
Plan ID: UNTIL-1120
- **Plan**: Record when a stored OpenAI key fails
- **Approved by**: Thomas Honey
> Deviation analysis and reviewer assignment are handled automatically
by the
> pre-approved PR review automation (see docs/PREAPPROVED_CHANGES.md).
Made with [Cursor](https://cursor.com)
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
GitOrigin-RevId: dd2d7089e0f502a11f2062f8a1c1bddc9cf4df0f
## Summary - A key is now stored only when OpenAI confirms it. Before, a probe that timed out or got a 5xx or 429 still saved the key with a warning, so a mistyped key could sit on the account until the gateway first tried to use it. - Saves are limited per account (one in flight, a burst of 5, then one every 6 minutes), because every save makes the api-server call OpenAI. - Both OpenAI key services are now mounted through one `openaikey.Register`, and the API key exchange auth bypass is anchored so it cannot match a path under another service. ## Linear Ticket Fixes: [ENG-6617](https://linear.app/overmind/issue/ENG-6617/openai-key-support-for-overmind) — OpenAI key support for overmind - **Purpose**: Let an account store its own OpenAI key for Overmind to use. ## Changes - `openaikey/vault.go`: `Set` checks the format first (20 to 512 printable ASCII characters, no spaces), then probes OpenAI and stores nothing unless the key is confirmed. An unconfirmed probe returns `ErrUnconfirmed`; a cancelled or expired caller context is passed through. `Set` now returns `(Status, error)`. The probe outcome goes on the span, and a warning is logged when a key is not stored. - `openaikey/save_limiter.go` (new): the per-account limiter, an LRU of 1024 accounts held in process, so the limits apply per replica. A save refused because another is in flight does not spend a token. - `openaikey/service.go`: maps the new errors to Connect codes (InvalidArgument, ResourceExhausted, Unavailable, Canceled, DeadlineExceeded) and adds `Register`. - `service/main.go`: uses `Register`. `apiKeyExchangeBypass` is now `^...$`. - `sdp/openai_key.proto`: `validation_warning` is deprecated and never set. Go and TypeScript are regenerated; the diff is only the deprecation. - Migration: updates the `last_validated_at` column comment only. Keys already stored without confirmation keep a NULL `last_validated_at`, which the settings page already shows as not validated. There is no backfill. - Tests: unconfirmed probes (timeout, 500, 503, 429, dropped connection) store nothing; caller cancellation; format checks; the limiter with a fake clock; HTTP auth across all five procedures with signed tokens; and the anchored bypass. Where to look: `connectSetError` in `service.go`, and the release path around the probe in `Set`. The openaikey tests and the bypass tests pass locally with `-race`. The rest of the `service` package tests need NATS, so they were not run locally. ## Until Plan Plan ID: UNTIL-1122 - **Plan**: Harden account OpenAI key saves - **Approved by**: Thomas Honey > Deviation analysis and reviewer assignment are handled automatically by the > pre-approved PR review automation (see docs/PREAPPROVED_CHANGES.md). Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: f0a4cf11326ea2d6443122b60d8e4f664df11f41
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/aws/aws-sdk-go-v2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.47.1` → `v1.47.2` |  |  | | [github.com/aws/aws-sdk-go-v2/config](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.33.6` → `v1.33.8` |  |  | | [github.com/aws/aws-sdk-go-v2/credentials](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.20.6` → `v1.20.8` |  |  | | [github.com/aws/aws-sdk-go-v2/feature/ec2/imds](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.20.1` → `v1.20.2` |  |  | | [github.com/aws/aws-sdk-go-v2/service/apigateway](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.50.0` → `v1.52.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/autoscaling](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.78.1` → `v1.78.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/cloudfront](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.73.1` → `v1.74.2` |  |  | | [github.com/aws/aws-sdk-go-v2/service/cloudwatch](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.73.0` → `v1.73.2` |  |  | | [github.com/aws/aws-sdk-go-v2/service/directconnect](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.53.0` → `v1.55.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/dynamodb](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.69.1` → `v1.70.2` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ec2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.336.1` → `v1.338.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ecs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.99.1` → `v1.100.2` |  |  | | [github.com/aws/aws-sdk-go-v2/service/efs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.49.1` → `v1.49.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/eks](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.102.0` → `v1.104.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.41.1` → `v1.41.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.63.1` → `v1.63.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/iam](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.64.1` → `v1.64.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/kms](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.61.1` → `v1.61.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/lambda](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.110.0` → `v1.112.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/networkfirewall](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.74.0` → `v1.76.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/networkmanager](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.50.1` → `v1.50.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/rds](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.129.1` → `v1.130.2` |  |  | | [github.com/aws/aws-sdk-go-v2/service/route53](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.70.1` → `v1.70.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/s3](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.113.4` → `v1.114.2` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sesv2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.76.0` → `v1.79.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sns](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.47.2` → `v1.47.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sqs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.52.1` → `v1.52.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ssm](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.79.0` → `v1.79.2` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sts](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.51.1` → `v1.51.3` |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/6708) for more information. --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNDguNCIsInVwZGF0ZWRJblZlciI6IjQ0LjE0OC40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJnb2xhbmciXX0=--> Co-authored-by: overmind-renovate[bot] <329497464+overmind-renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 2f17143745d307b946b53d30bdf9ab10acd98c4e
## Summary These are mechanical bumps and do not change functionality. ### Go modules - `github.com/tidwall/gjson` `v1.19.0` -> `v1.20.0` - `go.opentelemetry.io/contrib/detectors/aws/ec2/v2` `v2.5.3` -> `v2.6.0` - `go.opentelemetry.io/otel` `v1.46.0` -> `v1.47.0` - `go.opentelemetry.io/otel/exporters/otlp/otlptrace` `v1.46.0` -> `v1.47.0` - `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` `v1.46.0` -> `v1.47.0` - `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` `v1.46.0` -> `v1.47.0` - `go.opentelemetry.io/otel/metric` `v1.46.0` -> `v1.47.0` - `go.opentelemetry.io/otel/sdk` `v1.46.0` -> `v1.47.0` - `go.opentelemetry.io/otel/sdk/metric` `v1.46.0` -> `v1.47.0` - `go.opentelemetry.io/otel/trace` `v1.46.0` -> `v1.47.0` - `github.com/uptrace/opentelemetry-go-extra/otellogrus` `v0.3.2` -> `v0.4.0` (otel `v1.47.0` requires `otel/log` `v1.47.0`, which `v0.3.2` does not build against) - `github.com/uptrace/opentelemetry-go-extra/otelutil` `v0.3.2` -> `v0.4.0` (required by `otellogrus` `v0.4.0`) - `go.opentelemetry.io/otel/log` `v0.11.0` -> `v1.47.0` (required by otel `v1.47.0`) - `google.golang.org/genproto/googleapis/api` `v0.0.0-20260819154853-08b0e4226688` -> `v0.0.0-20260928230214-8a89bd6388cc` (pulled in by `go mod tidy`) ### Published vulnerability pins - `zlib` `1.3.2-r0` -> `1.3.2-r1` (CVE-2026-85091) in the Alpine runtime stage of: - `aws-source/build/package/Dockerfile` - `cli/Dockerfile` - `harness-source/build/package/Dockerfile` - `k8s-source/build/package/Dockerfile` - `services/api-server/build/package/Dockerfile` - `services/frontend/Dockerfile` - `services/gateway/build/package/Dockerfile` - `services/revlink/build/package/Dockerfile` - `services/srcman/build/package/Dockerfile` - `services/until-backend/build/package/Dockerfile` - `sources/azure/build/package/Dockerfile` - `sources/gcp/build/package/Dockerfile` - `sources/snapshot/build/package/Dockerfile` - `stdlib-source/build/package/Dockerfile` - `tools/area51-cli/build/package/Dockerfile` The zlib pin is a floor (`zlib>=1.3.2-r1`) because Alpine only keeps the newest package revision. `github.com/posthog/posthog-go` stays on `v1.25.1`. `v1.26.0` adds `Flush` to `posthog.Client`, and that bump is handled separately. `libssl3t64` and `openssl-provider-legacy` are already pinned to `3.5.5-1ubuntu3.6` on `main`. ## Test plan - [ ] CI passes on the dependency bump <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Mechanical dependency and base-image package pins; OTel touches broad tracing paths but is a minor version bump with no intentional behavior changes. > > **Overview** > Bumps **Go dependencies** (`go.mod` / `go.sum`) and pins **patched Alpine zlib** in container runtime images. No application logic changes. > > **Go modules:** OpenTelemetry moves **v1.46.0 → v1.47.0** (core `otel`, SDK, metrics, trace, OTLP/stdout exporters, and `otel/log` **v0.11.0 → v1.47.0**). Related bumps: AWS EC2 resource detector **v2.5.3 → v2.6.0**, **uptrace/otellogrus** and **otelutil** **v0.3.2 → v0.4.0** (aligned with otel v1.47), **tidwall/gjson** **v1.19.0 → v1.20.0**, and a refreshed **google.golang.org/genproto/googleapis/api** pseudo-version from `go mod tidy`. > > **Containers:** Alpine `apk` steps now require **`zlib>=1.3.2-r1`** (CVE-2026-85091) in runtime stages for sources, core services (api-server, gateway, frontend runner, revlink, srcman, until-backend), CLI, and area51-cli—either as a standalone install or alongside existing packages (e.g. `postgresql16-client`, `overmind-cli`). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c956fe6ef831d5467a9fe3b113b2a32f90879101. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: a2a1c797e4cbd86628a542e4cb6d5a44548787ed
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/aws/aws-sdk-go-v2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.47.2` → `v1.47.3` |  |  | | [github.com/aws/aws-sdk-go-v2/config](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.33.8` → `v1.33.9` |  |  | | [github.com/aws/aws-sdk-go-v2/credentials](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.20.8` → `v1.20.9` |  |  | | [github.com/aws/aws-sdk-go-v2/feature/ec2/imds](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.20.2` → `v1.20.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/apigateway](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.52.0` → `v1.52.1` |  |  | | [github.com/aws/aws-sdk-go-v2/service/autoscaling](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.78.3` → `v1.78.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/cloudfront](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.74.2` → `v1.75.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/cloudwatch](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.73.2` → `v1.73.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/directconnect](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.55.0` → `v1.55.1` |  |  | | [github.com/aws/aws-sdk-go-v2/service/dynamodb](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.70.2` → `v1.70.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ec2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.338.3` → `v1.339.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ecs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.100.2` → `v1.100.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/efs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.49.3` → `v1.49.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/eks](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.104.0` → `v1.104.1` |  |  | | [github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.41.3` → `v1.41.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.63.3` → `v1.63.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/iam](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.64.3` → `v1.64.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/kms](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.61.3` → `v1.61.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/lambda](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.112.0` → `v1.113.0` |  |  | | [github.com/aws/aws-sdk-go-v2/service/networkfirewall](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.76.0` → `v1.76.1` |  |  | | [github.com/aws/aws-sdk-go-v2/service/networkmanager](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.50.3` → `v1.50.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/rds](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.130.2` → `v1.130.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/route53](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.70.3` → `v1.70.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/s3](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.114.2` → `v1.114.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sesv2](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.79.0` → `v1.79.1` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sns](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.47.4` → `v1.47.5` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sqs](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.52.3` → `v1.52.4` |  |  | | [github.com/aws/aws-sdk-go-v2/service/ssm](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.79.2` → `v1.79.3` |  |  | | [github.com/aws/aws-sdk-go-v2/service/sts](https://redirect.github.com/aws/aws-sdk-go-v2) | `v1.51.3` → `v1.51.4` |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/6708) for more information. --- ### Release Notes <details> <summary>aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)</summary> ### [`v1.47.3`](https://redirect.github.com/aws/aws-sdk-go-v2/blob/HEAD/CHANGELOG.md#Release-2024-10-10) #### Module Highlights - `github.com/aws/aws-sdk-go-v2/service/acmpca`: [v1.37.3](service/acmpca/CHANGELOG.md#v1373-2024-10-10) - **Documentation**: Documentation updates for AWS Private CA. - `github.com/aws/aws-sdk-go-v2/service/databasemigrationservice`: [v1.43.0](service/databasemigrationservice/CHANGELOG.md#v1430-2024-10-10) - **Feature**: Introduces DescribeDataMigrations, CreateDataMigration, ModifyDataMigration, DeleteDataMigration, StartDataMigration, StopDataMigration operations to SDK. Provides FailedDependencyFault error message. - `github.com/aws/aws-sdk-go-v2/service/ec2`: [v1.182.0](service/ec2/CHANGELOG.md#v11820-2024-10-10) - **Feature**: This release adds support for assigning the billing of shared Amazon EC2 On-Demand Capacity Reservations. - `github.com/aws/aws-sdk-go-v2/service/ecs`: [v1.47.3](service/ecs/CHANGELOG.md#v1473-2024-10-10) - **Documentation**: This is a documentation only release that updates to documentation to let customers know that Amazon Elastic Inference is no longer available. - `github.com/aws/aws-sdk-go-v2/service/elasticinference`: [v1.23.3](service/elasticinference/CHANGELOG.md#v1233-2024-10-10) - **Documentation**: Elastic Inference - Documentation update to add service shutdown notice. - `github.com/aws/aws-sdk-go-v2/service/iotfleetwise`: [v1.20.0](service/iotfleetwise/CHANGELOG.md#v1200-2024-10-10) - **Feature**: Refine campaign related API validations - `github.com/aws/aws-sdk-go-v2/service/neptunegraph`: [v1.14.0](service/neptunegraph/CHANGELOG.md#v1140-2024-10-10) - **Feature**: Support for 16 m-NCU graphs available through account allowlisting - `github.com/aws/aws-sdk-go-v2/service/outposts`: [v1.45.0](service/outposts/CHANGELOG.md#v1450-2024-10-10) - **Feature**: Adding new "DELIVERED" enum value for Outposts Order status - `github.com/aws/aws-sdk-go-v2/service/route53resolver`: [v1.33.0](service/route53resolver/CHANGELOG.md#v1330-2024-10-10) - **Feature**: Route 53 Resolver Forwarding Rules can now include a server name indication (SNI) in the target address for rules that use the DNS-over-HTTPS (DoH) protocol. When a DoH-enabled Outbound Resolver Endpoint forwards a request to a DoH server, it will provide the SNI in the TLS handshake. - `github.com/aws/aws-sdk-go-v2/service/socialmessaging`: [v1.0.0](service/socialmessaging/CHANGELOG.md#v100-2024-10-10) - **Release**: New AWS service client module - **Feature**: This release for AWS End User Messaging includes a public SDK, providing a suite of APIs that enable sending WhatsApp messages to end users. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuNyIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJnb2xhbmciXX0=--> Co-authored-by: overmind-renovate[bot] <329497464+overmind-renovate[bot]@users.noreply.github.com> GitOrigin-RevId: 71c4e5e3b561f9e88d5ffc460585f4cb67c37ac2
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/Azure/azure-sdk-for-go/sdk/azcore](https://redirect.github.com/Azure/azure-sdk-for-go) | `v1.23.2` → `v1.23.3` |  |  | | [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://redirect.github.com/Azure/azure-sdk-for-go) | `v1.14.1` → `v1.15.0` |  |  | | [github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault/v2](https://redirect.github.com/Azure/azure-sdk-for-go) | `v2.0.2` → `v2.1.0` |  |  | | [github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v12](https://redirect.github.com/Azure/azure-sdk-for-go) | `v12.0.0` → `v12.1.0` |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/6708) for more information. --- ### Release Notes <details> <summary>Azure/azure-sdk-for-go (github.com/Azure/azure-sdk-for-go/sdk/azcore)</summary> ### [`v1.23.3`](https://redirect.github.com/Azure/azure-sdk-for-go/releases/tag/sdk/azcore/v1.23.3) #### 1.23.3 (2026-10-06) ##### Bugs Fixed - Fixed `arm.ResourceID.Location` being empty when the `locations` segment uses different casing. ##### Other Changes - Added `azure-deprecating` to the default set of allowed (non-redacted) response headers for logging. - Replaced internal default HTTP client with the one from `sdk/internal`. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "after 6pm on thursday,before 10am on friday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuNyIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJnb2xhbmciXX0=--> Co-authored-by: overmind-renovate[bot] <329497464+overmind-renovate[bot]@users.noreply.github.com> GitOrigin-RevId: f499479b096aefb74cb99f93acccd497b9b925d1
These are mechanical dependency bumps and do not change functionality. ## Packages updated Go modules: - `cloud.google.com/go/spanner` v1.95.1 -> v1.96.1 - `github.com/brianvoe/gofakeit/v7` v7.17.1 -> v7.18.0 - `github.com/nats-io/nats-server/v2` v2.15.0 -> v2.15.1 - `github.com/onsi/ginkgo/v2` v2.33.0 -> v2.33.1 - `github.com/resend/resend-go/v4` v4.8.0 -> v4.8.2 - `github.com/klauspost/compress` v1.20.0 -> v1.20.1 (indirect, pulled in by the bumps above) Dockerfile pin: - `nsc` v2.12.2 -> v2.15.0 in `services/api-server/build/package/Dockerfile`. This addresses the Go stdlib findings in `/usr/local/bin/nsc`. No `nsc` release is built with Go 1.26.6 or later yet, so v2.15.0 is the newest available. The `nsc` v2.12.2 pins in `.github/workflows/ci.yml` are unchanged in this PR. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Mechanical version pins only; the nsc image change affects build tooling in api-server containers, not runtime app logic. > > **Overview** > Routine **dependency maintenance** in `go.mod` / `go.sum`: patch/minor bumps for **Spanner**, **gofakeit**, **nats-server**, **Ginkgo**, **Resend**, and indirect **klauspost/compress**. No application code changes. > > The **api-server** image build in `services/api-server/build/package/Dockerfile` now installs **nsc v2.15.0** (was v2.12.2), aligning the bundled NATS operator CLI with newer releases and addressing **Go stdlib scanner findings** on `/usr/local/bin/nsc`. **CI workflow** `nsc` downloads remain on **v2.12.2** in this PR. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f54b183b8cc21802e92e0e92af47f2ef306a9543. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 02b2b916c4c22fb66284caa856d20ceeb693af02
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Copybara Sync - Release v1.19.5
This PR was automatically created by Copybara, syncing changes from the overmindtech/workspace monorepo.
Original author: carabasdaniel (daniel.carabas@overmind.tech)
What happens when this PR is merged?
tag-on-mergeworkflow will automatically create thev1.19.5tag on mainReview Checklist