fix: bump SDK deps for EasyJSON removal (v4 cascade)

[aaron-zeisler]

Summary

Bumps go-sdk-common from /v3 to /v4 (and go-server-sdk/v7 to a v4-cascade dev pseudo) so that consumers of go-server-sdk-consul/v3 building against the new SDK majors can compile.

This module itself stays on /v3 — only its dependencies bump. .go imports are rewritten go-sdk-common/v3 → /v4.

Why now

The SDK-2113 EasyJSON removal project is shipping go-jsonstream, go-sdk-common, and go-server-sdk-evaluation as /v4 majors. ld-relay imports both consul/v3 and go-sdk-common/v4, which produces a type mismatch unless this module's source is bumped to /v4.

Dependency Chain (v4 cascade)

go-jsonstream/v4 (#39)        <- feat!:
└─ go-sdk-common/v4 (#50)     <- feat!:
   ├─ go-server-sdk-evaluation/v4 (#51) <- feat!:
   ├─ go-sdk-events/v3 (#43)  <- chore:
   └─ go-server-sdk/v7 (#380) <- chore: (also bumps ldotel sub-module)
      ├─ ld-relay (#666)      <- chore:
      ├─ go-server-sdk-redis-redigo/v3 (#42) <- chore:
      ├─ go-server-sdk-consul/v3 (this PR) <- chore:
      ├─ go-server-sdk-dynamodb/v4 <- chore: (separate PR)
      └─ launchdarkly/opentelemetry (#10) <- chore:
         └─ foundation (#8924) <- chore:
            └─ internal services (6 PRs) <- chore:

Test plan

• go build ./... clean
• Unit tests pass (go test -short)
• No /v3 imports of bumped libs remaining

Context

Part of SDK-2113 (epic). Tracks SDK-2119 (cascade). Surfaced during ld-relay's v4 transition.

Stage 5 cleanup

Once go-sdk-common@v4.0.0 and a real go-server-sdk@v7.x.y tag exist, this PR's pseudo-versions should be flipped to those real versions before merge — or merge as-is and follow up.

via LD Research 🤖

Made with Cursor

---

Note

Low Risk
Import and dependency-only changes with no Consul persistence logic edits; main follow-up is replacing dev pseudo-versions with released tags before merge.

Overview
Aligns this Consul persistent data store module with the go-sdk-common v4 cascade so apps that already use go-sdk-common/v4 (e.g. ld-relay) do not hit type mismatches when wiring this package. Source imports move from go-sdk-common/v3 to /v4 for ldvalue, ldlog, and ldlogtest in the builder, implementation, and tests; module identity stays go-server-sdk-consul/v3.

go.mod raises the toolchain to Go 1.24.0, bumps go-server-sdk/v7 to a v4-cascade dev pseudo-version, refreshes testify and transitive LaunchDarkly libs (go-jsonstream/v4, evaluation v4, events, etc.), and updates go.sum. No Consul store behavior changes—only dependency and import alignment.

^{Reviewed by Cursor Bugbot for commit c05fd21. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c05fd21. Configure here.}

[cursor]

go.mod has v3 direct and v4 indirect, reversed

Medium Severity

go-sdk-common/v3 is listed as a direct dependency in go.mod but no source file imports from it anymore. Conversely, go-sdk-common/v4 is marked // indirect despite being directly imported by consul_builder.go, consul_impl.go, and consul_test.go. This indicates go mod tidy was not run after the import rewrites. The direct/indirect markers are inverted, which misrepresents the module's actual dependency graph and may confuse tooling or downstream consumers.

Additional Locations (1)

• go.mod#L28-L29

 

^{Reviewed by Cursor Bugbot for commit c05fd21. Configure here.}