From 3a2c5bd3c2a5eaeb6656097a8078690b0629473e Mon Sep 17 00:00:00 2001 From: Hai Huang Date: Tue, 1 Sep 2026 09:45:43 -0400 Subject: [PATCH] chore: gate bifrost v1.8+ behind the Go 1.27 move MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit bifrost/core v1.8.0 raised its own go directive to 1.27.0, which Go propagates into every module in the workspace. #830 (v1.8.4) therefore rewrote 'go 1.26.5' to 'go 1.27.0' in all seven go.mod files and failed CI against go.work, which still says 1.26.5. Adopting v1.8.x is a Go 1.27 migration rather than a dependency bump: it needs authbridge/go.work bumped and the four digest-pinned golang:1.26-alpine builders in cmd/*/Dockerfile moved to 1.27. Those set GOWORK=off but not GOTOOLCHAIN, so they would not fail — they would silently download the 1.27 toolchain mid-build and ship images where a pinned 1.26 base bootstraps an unpinned 1.27. Expressed as a version range rather than update-types so v1.7.x patches keep flowing; #840 takes v1.7.15, the newest release still on go 1.26.5. There is no API break waiting — v1.8.4 was built and tested against authlib with go.work at 1.27.0 and the full suite passed — so this gates only the toolchain decision. Applied to the three directories that require bifrost and have a Dependabot entry: authlib directly, authbridge-proxy and authbridge-envoy indirectly via authlib. Assisted-By: Claude (Anthropic AI) Signed-off-by: Hai Huang --- .github/dependabot.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0612cdec..81b0993e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -31,6 +31,22 @@ updates: # ignore once OPA is on the glob v1 API. - dependency-name: "github.com/gobwas/glob" update-types: ["version-update:semver-major"] + # bifrost/core v1.8.0 raised its own go directive to 1.27.0, which Go + # propagates into every module in the workspace. Adopting it is a Go + # 1.27 migration, not a dependency bump: it needs authbridge/go.work + # bumped and the four digest-pinned golang:1.26-alpine builders in + # cmd/*/Dockerfile moved to 1.27 (they set GOWORK=off but not + # GOTOOLCHAIN, so they would silently download the 1.27 toolchain + # mid-build rather than fail). authlib uses three symbols from + # core/schemas, so v1.8 buys nothing today. + # + # Range rather than update-types, so v1.7.x patches keep flowing — + # v1.7.15 is the newest release still on go 1.26.5 (see #840). There is + # no API break waiting: v1.8.4 was built and tested against authlib + # with go.work at 1.27.0 and the suite passed. Drop this range when the + # Go 1.27 move is made deliberately. + - dependency-name: "github.com/maximhq/bifrost/core" + versions: [">=1.8.0"] # Go - mode-specific binaries - package-ecosystem: gomod @@ -41,6 +57,10 @@ updates: # See the authlib entry above for why glob v1 is blocked. - dependency-name: "github.com/gobwas/glob" update-types: ["version-update:semver-major"] + # Indirect via authlib. See the authlib entry above for why bifrost + # v1.8+ is gated on the Go 1.27 move. + - dependency-name: "github.com/maximhq/bifrost/core" + versions: [">=1.8.0"] - package-ecosystem: gomod directory: /authbridge/cmd/authbridge-envoy schedule: @@ -49,6 +69,10 @@ updates: # See the authlib entry above for why glob v1 is blocked. - dependency-name: "github.com/gobwas/glob" update-types: ["version-update:semver-major"] + # Indirect via authlib. See the authlib entry above for why bifrost + # v1.8+ is gated on the Go 1.27 move. + - dependency-name: "github.com/maximhq/bifrost/core" + versions: [">=1.8.0"] # Go - abctl TUI - package-ecosystem: gomod directory: /authbridge/cmd/abctl