fix(deps): update golang.org/x/net to v0.60.0 and golang.org/x/tools to v0.51.0 #203

2026-10-10T15:20:39Z

argoyle commented

2026-10-10 15:20:39 +00:00

Fixes two CI gates that broke on 2026-10-09, when Go 1.27.2 was released (CI tracks go-version: stable).

vulnerabilities: golang.org/x/net v0.58.0 has five new advisories, all fixed in v0.60.0: GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617. x/net is an indirect dependency, so Renovate never opened a PR for it.
check (codegen gate): with golang.org/x/tools v0.49.0 under Go 1.27.2, gqlgen no longer sees methods on bound model types. go generate replaces them with panic("not implemented") resolver stubs. The same commit was green on 10-08 and red on 10-09, and generating with GOTOOLCHAIN=go1.27.1 gives no diff. x/tools v0.51.0 generates the committed code again.

Verified locally under Go 1.27.2: go generate ./... gives no diff, govulncheck ./... finds no vulnerabilities, go test -race ./... passes, and prek run --all-files passes. This is a dependency-only change, so there was no expert review.

🤖 Generated with Claude Code

https://claude.ai/code/session_012GZcP1B9UALgvE785GL8Jb

Fixes two CI gates that broke on 2026-10-09, when Go 1.27.2 was released (CI tracks `go-version: stable`). - **vulnerabilities:** `golang.org/x/net` v0.58.0 has five new advisories, all fixed in v0.60.0: GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617. x/net is an indirect dependency, so Renovate never opened a PR for it. - **check (codegen gate):** with `golang.org/x/tools` v0.49.0 under Go 1.27.2, gqlgen no longer sees methods on bound model types. `go generate` replaces them with `panic("not implemented")` resolver stubs. The same commit was green on 10-08 and red on 10-09, and generating with `GOTOOLCHAIN=go1.27.1` gives no diff. x/tools v0.51.0 generates the committed code again. Verified locally under Go 1.27.2: `go generate ./...` gives no diff, `govulncheck ./...` finds no vulnerabilities, `go test -race ./...` passes, and `prek run --all-files` passes. This is a dependency-only change, so there was no expert review. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012GZcP1B9UALgvE785GL8Jb

argoyle added 1 commit 2026-10-10 15:20:40 +00:00

fix(deps): update golang.org/x/net to v0.60.0 and golang.org/x/tools to v0.51.0

otelsetup / vulnerabilities (pull_request) Successful in 14m50s

Details

otelsetup / test (pull_request) Successful in 19m2s

Details

pre-commit / pre-commit (pull_request) Failing after 20m43s

Details

b606291e9f

golang.org/x/net v0.58.0 has five advisories fixed in v0.60.0 (GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617), so the vulnerabilities job fails on every PR. x/net is indirect, so Renovate never proposed it.

golang.org/x/tools v0.49.0 under Go 1.27.2 makes gqlgen miss methods on bound model types: go generate replaces them with panicking resolver stubs, which fails the check job's codegen gate. x/tools v0.51.0 generates the committed code again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012GZcP1B9UALgvE785GL8Jb

argoyle scheduled this pull request to auto merge when all checks succeed 2026-10-10 15:20:41 +00:00

gitea-actions Bot commented

2026-10-10 18:49:21 +00:00

Coverage Report

Total coverage: 30%

## Coverage Report Total coverage: **30%**

argoyle added 1 commit 2026-10-10 21:29:30 +00:00

fix(otel): use otel.SetLoggerProvider instead of deprecated log/global

otelsetup / test (pull_request) Successful in 9m13s

Details

otelsetup / vulnerabilities (pull_request) Successful in 9m58s

Details

pre-commit / pre-commit (pull_request) Successful in 18m57s

Details

9b7fe11d3b

OpenTelemetry v1.47 deprecates go.opentelemetry.io/otel/log/global, so
golangci-lint's staticcheck (SA1019) fails pre-commit on every PR.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012GZcP1B9UALgvE785GL8Jb

gitea-actions Bot commented

2026-10-11 06:39:44 +00:00

Coverage Report

Total coverage: 30%

## Coverage Report Total coverage: **30%**

argoyle merged commit 63a04e8044 into main

2026-10-11 06:56:55 +00:00

argoyle deleted branch fix/x-net-x-tools

2026-10-11 06:56:56 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: shiny/otelsetup#203