From c4493ba8a1bf62ea4b5a15909622274a36366ba0 Mon Sep 17 00:00:00 2001 From: Hai Huang Date: Tue, 1 Sep 2026 09:55:32 -0400 Subject: [PATCH] chore: bump bifrost/core to v1.7.15 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Supersedes #830, which proposed v1.8.4. bifrost v1.8.0 raised its go directive to 1.27.0, and Go propagates that into every module in the workspace, so Dependabot's PR rewrote `go 1.26.5` to `go 1.27.0` in all seven go.mod files while authbridge/go.work stayed at 1.26.5. CI failed with: go: module . listed in go.work file requires go >= 1.27.0, but go.work lists go 1.26.5 v1.7.15 is the last release still on go 1.26.5, so this takes two patch releases with no toolchain change. Verified: every module's go directive and go.work are untouched, all modules build and vet, and the full authlib suite passes (48 packages). Adopting v1.8.x is a Go 1.27 migration rather than a dependency bump. It needs authbridge/go.work bumped AND the four digest-pinned `golang:1.26-alpine` builders in cmd/*/Dockerfile moved to 1.27 — those set GOWORK=off but not GOTOOLCHAIN, so they would not fail, they would silently download the 1.27 toolchain mid-build and ship images where a pinned 1.26 base bootstraps an unpinned 1.27. It also commits every developer to Go 1.27.0, roughly a month old at time of writing. None of that buys anything today: authlib touches exactly three bifrost symbols — bschemas.ModelProvider, bschemas.Anthropic and bschemas.OpenAI — in one six-line function in plugins/contextguru/plugin.go. Nothing in bifrost 1.8 is reachable from our code, and #830 is not a security update. The code side of v1.8.x is already clear, for whenever the toolchain move happens deliberately: v1.8.4 was built and tested locally with go.work at 1.27.0 and the full authlib suite passed, so there is no API break waiting. Assisted-By: Claude (Anthropic AI) Signed-off-by: Hai Huang --- authbridge/authlib/go.mod | 2 +- authbridge/authlib/go.sum | 4 ++-- authbridge/cmd/authbridge-envoy/go.mod | 2 +- authbridge/cmd/authbridge-envoy/go.sum | 4 ++-- authbridge/cmd/authbridge-proxy/go.mod | 2 +- authbridge/cmd/authbridge-proxy/go.sum | 4 ++-- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/authbridge/authlib/go.mod b/authbridge/authlib/go.mod index 8ad4ae47..d17b267c 100644 --- a/authbridge/authlib/go.mod +++ b/authbridge/authlib/go.mod @@ -8,7 +8,7 @@ require ( github.com/fsnotify/fsnotify v1.10.1 github.com/gobwas/glob v0.2.3 github.com/lestrrat-go/jwx/v2 v2.1.7 - github.com/maximhq/bifrost/core v1.7.13 + github.com/maximhq/bifrost/core v1.7.15 github.com/open-policy-agent/opa v1.20.1 github.com/rossoctl/context-guru v0.1.0 github.com/spiffe/go-spiffe/v2 v2.8.1 diff --git a/authbridge/authlib/go.sum b/authbridge/authlib/go.sum index 8c658d41..64a53270 100644 --- a/authbridge/authlib/go.sum +++ b/authbridge/authlib/go.sum @@ -160,8 +160,8 @@ github.com/mark3labs/mcp-go v0.43.2 h1:21PUSlWWiSbUPQwXIJ5WKlETixpFpq+WBpbMGDSVy github.com/mark3labs/mcp-go v0.43.2/go.mod h1:YnJfOL382MIWDx1kMY+2zsRHU/q78dBg9aFb8W6Thdw= github.com/mattn/go-pointer v0.0.1 h1:n+XhsuGeVO6MEAp7xyEukFINEa+Quek5psIR/ylA6o0= github.com/mattn/go-pointer v0.0.1/go.mod h1:2zXcozF6qYGgmsG+SeTZz3oAbFLdD3OWqnUbNvJZAlc= -github.com/maximhq/bifrost/core v1.7.13 h1:BQoIWq3/ee5IrNiNDJMQ2HmxwbIUu++VwLBRsi6j3kU= -github.com/maximhq/bifrost/core v1.7.13/go.mod h1:XQGQ99V6iW2yRbq4zg5+LfDcJMR06x/Ie4HuC8FWEDI= +github.com/maximhq/bifrost/core v1.7.15 h1:LOq+gnxqpex6Kok0l3GxyMoi04IBOT9uhzvkgV+uUv4= +github.com/maximhq/bifrost/core v1.7.15/go.mod h1:XQGQ99V6iW2yRbq4zg5+LfDcJMR06x/Ie4HuC8FWEDI= github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM= github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= diff --git a/authbridge/cmd/authbridge-envoy/go.mod b/authbridge/cmd/authbridge-envoy/go.mod index 0f48aaab..494878bf 100644 --- a/authbridge/cmd/authbridge-envoy/go.mod +++ b/authbridge/cmd/authbridge-envoy/go.mod @@ -73,7 +73,7 @@ require ( github.com/mailru/easyjson v0.9.1 // indirect github.com/mark3labs/mcp-go v0.43.2 // indirect github.com/mattn/go-pointer v0.0.1 // indirect - github.com/maximhq/bifrost/core v1.7.13 // indirect + github.com/maximhq/bifrost/core v1.7.15 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/open-policy-agent/opa v1.20.1 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect diff --git a/authbridge/cmd/authbridge-envoy/go.sum b/authbridge/cmd/authbridge-envoy/go.sum index 89754d54..2b46d117 100644 --- a/authbridge/cmd/authbridge-envoy/go.sum +++ b/authbridge/cmd/authbridge-envoy/go.sum @@ -164,8 +164,8 @@ github.com/mark3labs/mcp-go v0.43.2 h1:21PUSlWWiSbUPQwXIJ5WKlETixpFpq+WBpbMGDSVy github.com/mark3labs/mcp-go v0.43.2/go.mod h1:YnJfOL382MIWDx1kMY+2zsRHU/q78dBg9aFb8W6Thdw= github.com/mattn/go-pointer v0.0.1 h1:n+XhsuGeVO6MEAp7xyEukFINEa+Quek5psIR/ylA6o0= github.com/mattn/go-pointer v0.0.1/go.mod h1:2zXcozF6qYGgmsG+SeTZz3oAbFLdD3OWqnUbNvJZAlc= -github.com/maximhq/bifrost/core v1.7.13 h1:BQoIWq3/ee5IrNiNDJMQ2HmxwbIUu++VwLBRsi6j3kU= -github.com/maximhq/bifrost/core v1.7.13/go.mod h1:XQGQ99V6iW2yRbq4zg5+LfDcJMR06x/Ie4HuC8FWEDI= +github.com/maximhq/bifrost/core v1.7.15 h1:LOq+gnxqpex6Kok0l3GxyMoi04IBOT9uhzvkgV+uUv4= +github.com/maximhq/bifrost/core v1.7.15/go.mod h1:XQGQ99V6iW2yRbq4zg5+LfDcJMR06x/Ie4HuC8FWEDI= github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM= github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= diff --git a/authbridge/cmd/authbridge-proxy/go.mod b/authbridge/cmd/authbridge-proxy/go.mod index 1ace7ec6..2de1aedf 100644 --- a/authbridge/cmd/authbridge-proxy/go.mod +++ b/authbridge/cmd/authbridge-proxy/go.mod @@ -64,7 +64,7 @@ require ( github.com/mailru/easyjson v0.9.1 // indirect github.com/mark3labs/mcp-go v0.43.2 // indirect github.com/mattn/go-pointer v0.0.1 // indirect - github.com/maximhq/bifrost/core v1.7.13 // indirect + github.com/maximhq/bifrost/core v1.7.15 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/open-policy-agent/opa v1.20.1 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect diff --git a/authbridge/cmd/authbridge-proxy/go.sum b/authbridge/cmd/authbridge-proxy/go.sum index e38a89c6..e668cbf9 100644 --- a/authbridge/cmd/authbridge-proxy/go.sum +++ b/authbridge/cmd/authbridge-proxy/go.sum @@ -158,8 +158,8 @@ github.com/mark3labs/mcp-go v0.43.2 h1:21PUSlWWiSbUPQwXIJ5WKlETixpFpq+WBpbMGDSVy github.com/mark3labs/mcp-go v0.43.2/go.mod h1:YnJfOL382MIWDx1kMY+2zsRHU/q78dBg9aFb8W6Thdw= github.com/mattn/go-pointer v0.0.1 h1:n+XhsuGeVO6MEAp7xyEukFINEa+Quek5psIR/ylA6o0= github.com/mattn/go-pointer v0.0.1/go.mod h1:2zXcozF6qYGgmsG+SeTZz3oAbFLdD3OWqnUbNvJZAlc= -github.com/maximhq/bifrost/core v1.7.13 h1:BQoIWq3/ee5IrNiNDJMQ2HmxwbIUu++VwLBRsi6j3kU= -github.com/maximhq/bifrost/core v1.7.13/go.mod h1:XQGQ99V6iW2yRbq4zg5+LfDcJMR06x/Ie4HuC8FWEDI= +github.com/maximhq/bifrost/core v1.7.15 h1:LOq+gnxqpex6Kok0l3GxyMoi04IBOT9uhzvkgV+uUv4= +github.com/maximhq/bifrost/core v1.7.15/go.mod h1:XQGQ99V6iW2yRbq4zg5+LfDcJMR06x/Ie4HuC8FWEDI= github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM= github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=