chore(deps): bump the dependencies group across 1 directory with 7 updates by dependabot[bot] · Pull Request #2953 · openfga/openfga

dependabot · Mar 2, 2026

Bumps the dependencies group with 3 updates in the / directory: github.com/pressly/goose/v3, go.opentelemetry.io/otel and go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc.

Updates github.com/pressly/goose/v3 from 3.26.0 to 3.27.0

Release notes

Sourced from github.com/pressly/goose/v3's releases.

v3.27.0

What's Changed

Added

Preliminary Spanner dialect support (#966)

Changed

Minimum Go version is now 1.25

SQL migration templates no longer include StatementBegin and StatementEnd annotations. These are only needed for complex statements containing semicolons (e.g., stored procedures). See docs for details.

Various dependency upgrades

Other

Added formatting for YDB table names to include folder (#1007)

Fix tests for StarRocks 3.5 (#1024)

CI improvements (#1000, #1005, #1008)

Full Changelog: pressly/goose@v3.26.0...v3.27.0

Changelog

Sourced from github.com/pressly/goose/v3's changelog.

[v3.27.0] - 2026-02-22

Added

Preliminary Spanner dialect support (#966)

Changed

Minimum Go version is now 1.25

SQL migration templates no longer include StatementBegin and StatementEnd annotations. These are only needed for complex statements containing semicolons (e.g., stored procedures). See docs for details.

Various dependency upgrades

Commits

7fb1461 release: v3.27.0
0b651ba fix: downgrade go directive to 1.25.0 in internal/testing
aa8e825 build(deps): bump dependencies in internal/testing
83743b6 chore: apply go fix modernizations and bump dependencies (#1034)
5de4fb4 feat: add dockermanage package (#1029)
ac97ee0 build(deps): bump github.com/ydb-platform/ydb-go-sdk/v3 from 3.125.1 to 3.126...
8a37350 build(deps): bump the gomod group across 1 directory with 2 updates (#1026)
bab893c Fix tests for StarRocks 3.5 (#1024)
26e537d build(deps): bump the gomod group across 1 directory with 5 updates (#1020)
7a98c89 docs: update ordering of CLI param help text
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel from 1.40.0 to 1.41.0

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

Support testing of [Go 1.26]. (#7902)

Fixed

Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)

Commits

4575a97 Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)
66fc10d fix: add error handling for insecure HTTP endpoints with TLS client configura...
76e6eec chore(deps): update github/codeql-action action to v4.32.5 (#7980)
0d50f90 Revert "Generate semconv/v1.40.0" (#7978)
c38a4a5 Generate semconv/v1.40.0 (#7929)
0f1a224 chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)
c79ebf4 chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)
f758157 chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)
92a1164 fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...
3cd7c27 chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.40.0 to 1.41.0

Changelog

Sourced from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc's changelog.

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

Support testing of [Go 1.26]. (#7902)

Fixed

Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)

Commits

4575a97 Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)
66fc10d fix: add error handling for insecure HTTP endpoints with TLS client configura...
76e6eec chore(deps): update github/codeql-action action to v4.32.5 (#7980)
0d50f90 Revert "Generate semconv/v1.40.0" (#7978)
c38a4a5 Generate semconv/v1.40.0 (#7929)
0f1a224 chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)
c79ebf4 chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)
f758157 chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)
92a1164 fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...
3cd7c27 chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/sdk from 1.40.0 to 1.41.0

Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

Support testing of [Go 1.26]. (#7902)

Fixed

Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)

Commits

4575a97 Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)
66fc10d fix: add error handling for insecure HTTP endpoints with TLS client configura...
76e6eec chore(deps): update github/codeql-action action to v4.32.5 (#7980)
0d50f90 Revert "Generate semconv/v1.40.0" (#7978)
c38a4a5 Generate semconv/v1.40.0 (#7929)
0f1a224 chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)
c79ebf4 chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)
f758157 chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)
92a1164 fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...
3cd7c27 chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)
Additional commits viewable in compare view

Updates go.opentelemetry.io/otel/trace from 1.40.0 to 1.41.0

Changelog

Sourced from go.opentelemetry.io/otel/trace's changelog.

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

Support testing of [Go 1.26]. (#7902)

Fixed

Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)

Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)

Commits

4575a97 Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)
66fc10d fix: add error handling for insecure HTTP endpoints with TLS client configura...
76e6eec chore(deps): update github/codeql-action action to v4.32.5 (#7980)
0d50f90 Revert "Generate semconv/v1.40.0" (#7978)
c38a4a5 Generate semconv/v1.40.0 (#7929)
0f1a224 chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)
c79ebf4 chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)
f758157 chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)
92a1164 fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...
3cd7c27 chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)
Additional commits viewable in compare view

Updates golang.org/x/exp from 0.0.0-20251023183803-a4bb9ffd2546 to 0.0.0-20260218203240-3dfff04db8fa

Commits

See full diff in compare view

Updates modernc.org/sqlite from 1.46.0 to 1.46.1

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

2026-02-17 v1.46.1:

Ensure connection state is reset if Tx.Commit fails. Previously, errors like SQLITE_BUSY during COMMIT could leave the underlying connection inside a transaction, causing errors when the connection was reused by the database/sql pool. The driver now detects this state and forces a rollback internally.

Fixes [GitHub issue #2](modernc-org/sqlite#2), thanks Edoardo Spadolini!

2026-02-17 v1.46.0:

Enable ColumnTypeScanType to report time.Time instead of string for TEXT columns declared as DATE, DATETIME, TIME, or TIMESTAMP via a new _texttotime URI parameter.

See [GitHub pull request #1](modernc-org/sqlite#1), thanks devhaozi!

2026-02-09 v1.45.0:

Introduce vtab subpackage (modernc.org/sqlite/vtab) exposing Module, Table, Cursor, and IndexInfo API for Go virtual tables.

Wire vtab registration into the driver: vtab.RegisterModule installs modules globally and each new connection calls sqlite3_create_module_v2.

Implement vtab trampolines for xCreate/xConnect/xBestIndex/xDisconnect/xDestroy/xOpen/xClose/xFilter/xNext/xEof/xColumn/xRowid.

Map SQLite’s sqlite3_index_info into vtab.IndexInfo, including constraints, ORDER BY terms, and constraint usage (ArgIndex → xFilter argv[]).

Add an in‑repo dummy vtab module and test (module_test.go) that validates registration, basic scanning, and constraint visibility.

See [GitLab merge request #90](https://gitlab.com/cznic/sqlite/-/merge_requests/90), thanks Adrian Witas!

2026-01-19 v1.44.3: Resolves [GitLab issue #243](https://gitlab.com/cznic/sqlite/-/issues/243).

2026-01-18 v1.44.2: Upgrade to SQLite 3.51.2.

2026-01-13 v1.44.0: Upgrade to SQLite 3.51.1.

2025-10-10 v1.39.1: Upgrade to SQLite 3.50.4.

2025-06-09 v1.38.0: Upgrade to SQLite 3.50.1.

2025-02-26 v1.36.0: Upgrade to SQLite 3.49.0.

2024-11-16 v1.34.0: Implement ResetSession and IsValid methods in connection

2024-07-22 v1.31.0: Support windows/386.

2024-06-04 v1.30.0: Upgrade to SQLite 3.46.0, release notes at https://sqlite.org/releaselog/3_46_0.html.

2024-02-13 v1.29.0: Upgrade to SQLite 3.45.1, release notes at https://sqlite.org/releaselog/3_45_1.html.

2023-12-14: v1.28.0: Add (*Driver).RegisterConnectionHook, ConnectionHookFn, ExecQuerierContext, RegisterConnectionHook.

2023-08-03 v1.25.0: enable SQLITE_ENABLE_DBSTAT_VTAB.

2023-07-11 v1.24.0: Add (*conn).{Serialize,Deserialize,NewBackup,NewRestore} methods, add Backup type.

2023-06-01 v1.23.0: Allow registering aggregate functions.

... (truncated)

Commits

c777b90 add GOVERNANCE.md
806ed2d fix inconsistent transaction state on failed Commit
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates Bumps the dependencies group with 3 updates in the / directory: [github.com/pressly/goose/v3](https://github.com/pressly/goose), [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) and [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go). Updates `github.com/pressly/goose/v3` from 3.26.0 to 3.27.0 - [Release notes](https://github.com/pressly/goose/releases) - [Changelog](https://github.com/pressly/goose/blob/main/CHANGELOG.md) - [Commits](pressly/goose@v3.26.0...v3.27.0) Updates `go.opentelemetry.io/otel` from 1.40.0 to 1.41.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.41.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.40.0 to 1.41.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.41.0) Updates `go.opentelemetry.io/otel/sdk` from 1.40.0 to 1.41.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.41.0) Updates `go.opentelemetry.io/otel/trace` from 1.40.0 to 1.41.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.41.0) Updates `golang.org/x/exp` from 0.0.0-20251023183803-a4bb9ffd2546 to 0.0.0-20260218203240-3dfff04db8fa - [Commits](https://github.com/golang/exp/commits) Updates `modernc.org/sqlite` from 1.46.0 to 1.46.1 - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.46.0...v1.46.1) --- updated-dependencies: - dependency-name: github.com/pressly/goose/v3 dependency-version: 3.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: go.opentelemetry.io/otel dependency-version: 1.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc dependency-version: 1.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: go.opentelemetry.io/otel/trace dependency-version: 1.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: golang.org/x/exp dependency-version: 0.0.0-20260218203240-3dfff04db8fa dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: modernc.org/sqlite dependency-version: 1.46.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · Mar 2, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	modernc.org/sqlite@v1.46.0 ⏵ v1.46.1	⁺¹
	go.opentelemetry.io/otel@v1.40.0 ⏵ v1.41.0	⁺¹
	golang.org/x/exp@v0.0.0-20251023183803-a4bb9ffd2546 ⏵ v0.0.0-20260218203240-3dfff04db8fa
	github.com/pressly/goose/v3@v3.26.0 ⏵ v3.27.0
	go.opentelemetry.io/otel/sdk@v1.40.0 ⏵ v1.41.0
	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.40.0 ⏵ v1.41.0	⁺¹
	go.opentelemetry.io/otel/trace@v1.40.0 ⏵ v1.41.0	⁺¹

View full report

socket-security · Mar 2, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: golang `modernc.org/libc` under LGPL-2.1-or-later License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (grp/grp_linux_386.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (utime/utime_linux_riscv64.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (utime/utime_linux_arm.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (wctype/wctype_linux_386.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (wctype/wctype_linux_riscv64.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (grp/grp_linux_arm.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (sys/vfs/vfs_linux_386.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (utime/utime_linux_386.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (wctype/wctype_linux_arm64.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (utime/utime_linux_arm64.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (wctype/wctype_linux_arm.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (utime/utime_linux_s390x.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (wctype/wctype_linux_s390x.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (sys/vfs/vfs_linux_arm.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (langinfo/langinfo_linux_386.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (poll/poll_linux_arm.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (langinfo/langinfo_linux_arm.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (langinfo/langinfo_linux_riscv64.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (poll/poll_linux_386.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (pwd/pwd_linux_386.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (langinfo/langinfo_linux_arm64.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (langinfo/langinfo_linux_s390x.go) License: GPL-2.0+ - the applicable license policy does not allow this license (4) (testdata/nsz.repo.hu/libc-test/src/math/crlibm/COPYING) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (pwd/pwd_linux_arm.go) License: GPL-2.0-or-later - the applicable license policy does not allow this license (4) (sys/vfs/vfs_linux_riscv64.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (poll/poll_linux_s390x.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (sys/vfs/vfs_linux_s390x.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (poll/poll_linux_riscv64.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (langinfo/langinfo_linux_amd64.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (langinfo/langinfo_linux_mips64le.go) License: LGPL-2.1-or-later - the applicable license policy does not allow this license (4) (poll/poll_linux_arm64.go) From: `?` → `golang/modernc.org/sqlite@v1.46.1` → `golang/modernc.org/libc@v1.68.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore golang/modernc.org/libc@v1.68.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dosubot · Mar 2, 2026

Related Documentation

Checked 8 published document(s) in 1 knowledge base(s). No updates required.

^{How did I do? Any feedback?}

codecov · Mar 2, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.35%. Comparing base (b039f69) to head (380a2bb).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2953      +/-   ##
==========================================
- Coverage   90.40%   90.35%   -0.04%     
==========================================
  Files         186      186              
  Lines       19808    19808              
==========================================
- Hits        17905    17896       -9     
- Misses       1254     1259       +5     
- Partials      649      653       +4

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…/dependencies-d4e1365b0a

Copilot

Pull request overview

Updates Go module dependencies to newer versions (Dependabot group bump), including Goose and OpenTelemetry, along with related transitive sums.

Changes:

Bump github.com/pressly/goose/v3 to v3.27.0.
Bump OpenTelemetry modules to v1.41.0.
Refresh transitive dependency versions and go.sum entries (e.g., golang.org/x/*, modernc.org/*).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Description
go.mod	Updates direct and indirect dependency requirements to the newer versions included in the group bump.
go.sum	Updates module checksums to match the resolved dependency graph after the version bumps.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…to v1.41.0

Add support for exporting logs via OTLP, allowing integration with any OpenTelemetry-compatible backend (Grafana Loki, Datadog, GCP Cloud Logging, etc.). When log.otlp.enabled is set, logs are exported via OTLP in addition to stdout. The otelzap bridge attaches span context (trace ID, span ID) to each log record, enabling log-trace correlation in backends that support it. Configuration mirrors the trace configuration shape: the standard OTel env vars (OTEL_EXPORTER_OTLP_LOGS_ENDPOINT, OTEL_EXPORTER_OTLP_ENDPOINT) only answer where logs are sent, while the explicit OpenFGA flag (log.otlp.enabled / --log-otlp-enabled / OPENFGA_LOG_OTLP_ENABLED) answers whether to export at all — so a cluster that injects the generic endpoint variable for tracing does not silently start exporting logs on upgrade. zap's production sampling is applied outside the tee, so the keep/drop decision is made once, before fan-out: stdout and OTLP receive the same deterministically sampled stream and collector egress stays bounded during log storms. Changes: - Add otelzap bridge core backed by an OTLP log provider (internal/telemetry/logging.go) - Add WithOTELCore logger option that tees log entries to the bridge. The bridge core is capped to the configured log level, the stdout core strips the bridge-only context field via contextFilterCore, and the sampler wraps the tee (pkg/logger/logger.go) - Attach the context field in the *WithContext logging methods only when an OTEL core is configured, and use those methods in the gRPC logging interceptor so the bridge can extract span context (pkg/middleware/logging/logging.go) - Add config: log.otlp.enabled, log.otlp.endpoint, log.otlp.tls.enabled with OPENFGA_LOG_OTLP_* env vars and OTEL_EXPORTER_OTLP_* endpoint fallbacks (pkg/server/config/config.go, cmd/run/, .config-schema.json) feat: add potential v2 breaking change logs for Expand and ListUsers (openfga#3182) release: update changelog for release 1.18.1 (openfga#3188) release: Update changelog to prep for 1.18.1 release (openfga#3186) test: fix flaky TestV2CheckWithIteratorCache_HigherConsistencyBypassesCache (openfga#3061) Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Merge commit from fork * test reproducing ListUsers report * implement fix * additional test with 3 operands fix: match IPv4-mapped IPv6 addresses in the in_cidr condition (openfga#3181) Signed-off-by: kanywst <niwatakuma@icloud.com> fix: use deterministic proto marshaling for stored authorization models (openfga#3171) chore: create draft release and publish after provenance succeeds for immutable tags/releases (openfga#3178) docs: fix changelog entry (openfga#3177) Signed-off-by: Saad Hussain <saad.hussain@okta.com> feat: add v2Check logs for resolution breaking change (openfga#3149) feat: BatchCheck uses v2Check when ExperimentalWeightedGraphCheck is enabled (openfga#3154) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: update changelog to add CVE identifiers for recent fixes (openfga#3176) chore: update todo comment string in migration guide (openfga#3175) release: update changelog for release `v1.18.0` (openfga#3174) Co-authored-by: adriantam <adrian.tam@okta.com> Merge commit from fork * fix(authn): require issuer and audience when OIDC authn is enabled Enforce configuration authn.oidc.audience and authn.oidc.issuer when `authn.method` is set to `oidc`. * fixed based on code review feedback * fix: adding comments + test case on empty space for audience * update based on code review feedback * Update CHANGELOG.md Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> * update changelog * Update CHANGELOG.md --------- Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Merge commit from fork * fix(mysql): collate identifier columns as utf8mb4_bin * fix: add operator note to changelog * fix: move tests to shared storage * fix: separate migrations for each table * fix: add runbook for migrations * fix: set lock_wait_timeout * fix: add docker instructions * fix: add docker instructions * fix: combine the migrations back into one, fix documentation for this * fix: include details about table copy and * Update CHANGELOG.md Co-authored-by: Adrian Tam <adrian.tam@okta.com> --------- Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: use constant-time comparison for preshared key authentication (openfga#3168) chore(deps): bump the dependencies group with 2 updates (openfga#3166) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore(deps): bump the dependencies group with 2 updates (openfga#3167) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> release: update changelog for release `v1.17.1` (openfga#3165) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: bump grpc-health-probe to v0.4.52 (openfga#3164) Co-authored-by: Saad Hussain <saad.hussain@okta.com> docs: update caching docs (openfga#3163) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: continuation token deserializer - handle `|` in type names (openfga#3152) chore(deps): bump the dependencies group across 1 directory with 13 updates (openfga#3162) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore(deps): bump the dependencies group across 1 directory with 10 updates (openfga#3156) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> fix: use query start time as iterator cache entry LastModified to prevent stale-read survival (openfga#3155) chore(deps): bump grpc-ecosystem/grpc-health-probe from v0.4.50 to v0.4.51 in the dependencies group (openfga#3157) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> chore: Bump go toolchain to 1.26.4 (openfga#3159) fix: prevent v2Check from falling back for throttling and validation (openfga#3150) ci: make pr benchmark comparisons less fragile (openfga#3153) Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> release: update changelog for release `v1.17.0` (openfga#3151) Co-authored-by: Vic-Dev <vmichellej@gmail.com> refactor: redesign cache key generation, making it more secure and consistent (openfga#3148) feat: add configurable trace sampler with ParentBased support (openfga#3072) release: update changelog for release `v1.16.1` (openfga#3147) chore: update grpc-health-probe to latest to addres std lib CVEs (openfga#3146) fix: skip v2Check weight2 pruning if iterator is unordered (openfga#3145) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore: add concurrency-group to PR-related CI steps (openfga#3140) docs: move OIDC JWKS refresh entry from v1.15.1 to v1.16.0 (openfga#3142) fix: when v2Check is primary algorithm, fix fallback condition and emit metrics (openfga#3141) release: update changelog for release `v1.16.0` (openfga#3139) Merge commit from fork * fix: Standardize cache key generation everywhere * Revert "fix: Standardize cache key generation everywhere" This reverts commit ce60c6f9ae48a310a4dea2b824b5993520c8ba1c. * length-encoded approach * Revert "length-encoded approach" This reverts commit b94637c187c57a2d3f3904247267bbc8ad21a41a. * implement Hexer() and use in some cache keys * appendConditionsHash -> generateConditionsHash * mv Hexer -> BuildKey * BuildKey -> BuildCacheKey refactor to BuildCacheKey on each individual prefix component to remove collision risk * make v2 cacheKey functions the standard * make cache key prefixes consistent * generateConditionsHash -> generateConditionsString * delimit condition name string * remove extra empty check * relocate and reuse existing userTypeRestrictions function * replace hashing of conditions for brevity * fix tests * cleanup, add test file * remove unused slice capacity * make prefix treatments consistent * add nil-byte separator in object ids * hash user type restrictions for brevity * update comment string, use nil-byte separator for future-proofing * remove call to xxhash.new * adjustments for performance, consistency, and interface ergonomics. * make condition hash generation more efficient. * add clarifying comments for size caluculations * fix builder growth calculations to match original intentions * update outdated comment * don't hash potentially zero values * Revert "don't hash potentially zero values" This reverts commit 2ad6c5b796bc20a82c1414c5146c3c708330eefa. * add condition key separator unconditionally * patch test expectations for new key structure * export V2IteratorCachePrefix, use in tests --------- Co-authored-by: justin <justin.cohen@okta.com> Co-authored-by: Joshua Jones <joshua.jones@okta.com> fix: unintentional zeroing of slice values by setting slice to nil (openfga#3135) increase the check v2 trace information fidelity (openfga#3134) feat: add datastore ping and ping retry configurations (openfga#3113) fix: prevent v2Check strategies returning spurious false on context cancellation (openfga#3128) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix(authn/oidc): refresh JWKS on unknown kid to handle key rotation (openfga#3101) fix: v2Check falls back to v1 on errors (openfga#3126) fix: don't cache false results from cancelled-context goroutines in v2Check (openfga#3125) Signed-off-by: Saad Hussain <saad.hussain@okta.com> make union cache key unique by including the node input's label (openfga#3117) Signed-off-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> fix: shadow v2check and check use the same trace (openfga#3118) fix: bump go toolchain version to 1.26.3 (openfga#3115) chore: add more spans/attributes to v1 and v2 Check (openfga#3116) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: add matches attribute to shadowv2Check and Check spans (openfga#3114) fix: use the same `request_id` for shadow traces in v2Check (openfga#3110) release: update changelog for release `v1.15.1` (openfga#3112) feat: reuse MySQL container across tests (openfga#3042) fix: close all channels opened thus far, before return on error (openfga#3111) chore: Add more spans/attributes to v2Check (openfga#3102) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: ensure acquired limiter token is released on throttle context cancelation (openfga#3106) fix: cancel context before waiting on worker pool in ResolveUnionEdges (openfga#3105) fix: replace golang.org/x/exp/maps with stdlib maps to resolve govet inline errors (openfga#3104) fix: v2Check EdgeCacheKey collisions (openfga#3097) Signed-off-by: Saad Hussain <saad.hussain@okta.com> fix: expose context errors when they can be the potential cause of an underlying datastore error (openfga#3096) chore(deps): bump the dependencies group across 1 directory with 2 updates (openfga#3093) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: move subproblem cache lookup from ResolveUnionEdges into ResolveUnion (openfga#3095) chore(deps): bump the dependencies group with 4 updates (openfga#3092) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: error handler panic (openfga#3091) release: update changelog for release `v1.15.0` (openfga#3090) chore(deps): bump the dependencies group across 1 directory with 4 updates (openfga#3087) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: v2Check correctly uses query cache even when cache controller is disabled (openfga#3086) Signed-off-by: Saad Hussain <saad.hussain@okta.com> chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#3081) Signed-off-by: dependabot[bot] <support@github.com> chore(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 (openfga#3085) Signed-off-by: dependabot[bot] <support@github.com> chore(deps): bump grpc-ecosystem/grpc-health-probe from v0.4.47 to v0.4.48 in the dependencies group across 1 directory (openfga#3065) Signed-off-by: dependabot[bot] <support@github.com> feat: try to use UDS internally between HTTP server and gRPC server (openfga#2937) feat: add jitter to internal cache TTLs to prevent thundering herd effects (openfga#3033) Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> list objects pipeline edge pruning (openfga#3075) update toolchain go to 1.26.2 to address stdlib CVEs (openfga#3084) chore: add store ID and datastore query/item count to shadowV2Check log (openfga#3073) Signed-off-by: Saad Hussain <saad.hussain@okta.com> CI speed up (openfga#3062) Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Co-authored-by: Joshua Jones <joshua.jones@okta.com> Add tracing to v2 Check planner strategy selection (openfga#3077) fix: v2Check honours `check-query-cache-enabled` flag (openfga#3070) Signed-off-by: Saad Hussain <saad.hussain@okta.com> feat: reuse PostgreSQL container across tests (openfga#3018) chore: fix reporter links in changelog (openfga#3069) release: update changelog for release `v1.14.2` (openfga#3068) fix: add null byte delimiter in contextual tuple cache keys and validation in v2Check (openfga#3064) release: update changelog for release `v1.14.1` (openfga#3060) chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#3056) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: use a baseURL for AuthZEN configuration endpoint (openfga#3057) chore: replace docker with moby (openfga#3047) Iterator Cache V2: Storage Wrapper Pattern with Lock-Free Design (openfga#3016) Signed-off-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> test: fix flaky condition test (openfga#3058) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 6 updates (openfga#3045) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.41.0 to 1.43.0 (openfga#3054) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> feat: add graceful shutdown timeout configuration (openfga#2976) chore: update changelog to reflect playground off-by-default behavior (openfga#3053) chore: decouple Error() and Unwrap() (openfga#3051) perf: remove `fmt` from cache key generation (openfga#3006) perf: enhancements for list objects (openfga#3043) chore: remove stale notice file (openfga#3050) docs: update 1.14.0 for CVE fix (openfga#3046) feat: Add datastore throttling & concurrency limiting to v2Check (openfga#3035) Signed-off-by: Saad Hussain <saad.hussain@okta.com> release: update changelog for release `v1.14.0` (openfga#3040) batch check cache (openfga#3025) Merge commit from fork Also prevent enabling playground when the server requires authentication feat: add stats on tuple iterator query (openfga#3030) fix: remove unnecessary non-deterministic test (openfga#3038) remove unnecessary import (openfga#3032) perf: improve the intersection algorithm, reducing latency and memory use (openfga#3031) fix: ListObjects pipeline algorithm enhancements and fix for potential deadlock (openfga#3028) chore: Also update openfga/helm-charts in release script (openfga#3010) chore: update CICD to enforce GRPC healthprobe changes (openfga#2990) fix: SQL `TupleOperation` serialization and `pgx.ErrNoRows` error handling (openfga#3014) docs: update changelog for CVE-2026-33729 (openfga#3017) chore: output the diff after running keep-a-changelog (openfga#3015) chore(deps): bump the dependencies group across 1 directory with 11 updates (openfga#2998) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 10 updates (openfga#2999) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> release: update changelog for release `v1.13.1` (openfga#3002) Merge commit from fork * strip unicode control characters, encode context key length in cache key * add cache_key tests to ensure we escape control characters and encode context key length * run linter * docs: update changelog * Apply suggestion from @adriantam Co-authored-by: Adrian Tam <adrian.tam@okta.com> * Apply suggestion from @adriantam Co-authored-by: Adrian Tam <adrian.tam@okta.com> --------- Co-authored-by: Saad Hussain <saad.hussain@okta.com> Co-authored-by: Saad Hussain <saad.h@outlook.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> release: update changelog for release `v1.13.0` (openfga#2997) refactor: Separate caches for v1 and v2 Check (openfga#2968) Co-authored-by: Justin Cohen <justincoh@gmail.com> docs: fix typos in comments (openfga#2972) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> observability: aggregate message statistics for each list-objects sender into a single span (openfga#2993) Co-authored-by: Justin Cohen <justincoh@gmail.com> fix: capture panics in pipeline's base resolver, and return as errors. (openfga#2994) docs: fix typos in RELEASES.md and Makefile (openfga#2980) Co-authored-by: Adrian Tam <adrian.tam@okta.com> AuthZen v1.0 Implementation (openfga#2875) Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Rokibul Hasan <mdrokibulhasan@appscode.com> Signed-off-by: Vihang Mehta <vihang@gimletlabs.ai> Co-authored-by: Karl Persson <kalle.persson92@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Maria Ines Parnisari <maria.inesparnisari@okta.com> Co-authored-by: Rokibul Hasan <mdrokibulhasan18@gmail.com> Co-authored-by: José Padilla <jose.padilla@okta.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> Co-authored-by: Vihang Mehta <vihang@gimletlabs.ai> Co-authored-by: Joshua Jones <joshua.jones.software@gmail.com> Co-authored-by: Justin Cohen <justincoh@gmail.com> release: update changelog for release `v1.12.1` (openfga#2992) chore(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 (openfga#2988) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> chore: enforce minor version upgrade rule (openfga#2978) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> perf: tuple validation performance tweaks (openfga#2984) fix: support URI schemes in OTLP endpoint configuration (openfga#2981) refactor: remove custom pipes and replace with channels (openfga#2977) chore(docs): added caching docs (openfga#2664) Co-authored-by: Saad Hussain <saad.hussain@okta.com> release: update changelog for release `v1.12.0` (openfga#2974) chore: update toolchain go to 1.26.1 (openfga#2975) fix: update toolchain go to 1.25.8 to address stdlib CVEs (openfga#2971) fix: correct swapped format args in DecodeParameterType error message (openfga#2961) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> perf: small tweaks to tuple validation functions (openfga#2963) Co-authored-by: Vic-Dev <vmichellej@gmail.com> test: add tests for condition parameter type any with complex context structures (openfga#2959) Signed-off-by: Artem Muterko <artem@sopho.tech> test: add functional test for ReadAssertions API endpoint (openfga#2960) Signed-off-by: Artem Muterko <artem@sopho.tech> Co-authored-by: Adrian Tam <adrian.tam@okta.com> make configurable the maximum received grpc message size (openfga#2952) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> fix: set ExperimentalPipelineListObjects in experimentals by default (openfga#2957) fix: `cache_item_count` metric overcounting (openfga#2950) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump the dependencies group across 1 directory with 7 updates (openfga#2953) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> refactor: Make shadowV2Check final log clearer (openfga#2946) Move telemetry package to internal/telemetry (openfga#2938) Signed-off-by: Oleksandr Shestopal <ar.shestopal-oshegithub@gmail.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> chore(deps): bump the dependencies group across 1 directory with 3 updates (openfga#2956) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: Resolve race condition in check reducers (openfga#2947) Co-authored-by: Adrian Tam <adrian.tam@okta.com> fix: gateway grpc client tls cert rotation (openfga#2951) Signed-off-by: Shashank Goel <goelshashank13@gmail.com> fix: disable LO pipeline if ff has it set for a store (openfga#2945) chore(deps): bump the dependencies group across 1 directory with 4 updates (openfga#2949) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> fix: various random fixes (openfga#2942) refactor: check using weighted graph (openfga#2816) Co-authored-by: Yissell Garma <yissell.garma@okta.com> release: update changelog for release `v1.11.6` (openfga#2939) feat: enable pipeline algorithm by default (openfga#2921) add tests to exercise reported bug (openfga#2934) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Adrian Tam <adrian.tam@okta.com> refine AGENTS.md to make it more concise with higher value. (openfga#2936) Co-authored-by: Justin Cohen <justincoh@gmail.com> migrate grpc dial context to NewClient (openfga#2714) Co-authored-by: Adrian Tam <adrian.tam@okta.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (openfga#2935) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Mar 2, 2026

Copilot AI review requested due to automatic review settings March 2, 2026 20:14

dependabot Bot requested a review from a team as a code owner March 2, 2026 20:14

dependabot Bot removed the request for review from Copilot March 2, 2026 20:14

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Mar 2, 2026

adriantam added 2 commits March 3, 2026 11:45

Merge remote-tracking branch 'origin/main' into dependabot/go_modules…

aea7338

…/dependencies-d4e1365b0a

manually bump golang.org/x/exp to v0.51.0 to fix govulnerability

a506cd7

Copilot AI review requested due to automatic review settings March 3, 2026 16:46

Copilot AI reviewed Mar 3, 2026

View reviewed changes

Comment thread go.mod

Comment thread go.mod Outdated

Copilot started reviewing on behalf of adriantam March 3, 2026 16:51 View session

bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp …

bdfa0d3

…to v1.41.0

adriantam approved these changes Mar 3, 2026

View reviewed changes

Merge branch 'main' into dependabot/go_modules/dependencies-d4e1365b0a

b68ecd1

Vic-Dev approved these changes Mar 3, 2026

View reviewed changes

Merge branch 'main' into dependabot/go_modules/dependencies-d4e1365b0a

380a2bb

adriantam enabled auto-merge (squash) March 4, 2026 15:09

adriantam merged commit 3123b03 into main Mar 4, 2026
19 checks passed

adriantam deleted the dependabot/go_modules/dependencies-d4e1365b0a branch March 4, 2026 15:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the dependencies group across 1 directory with 7 updates#2953

chore(deps): bump the dependencies group across 1 directory with 7 updates#2953
adriantam merged 6 commits into
mainopenfga/openfga:mainfrom
dependabot/go_modules/dependencies-d4e1365b0aopenfga/openfga:dependabot/go_modules/dependencies-d4e1365b0aCopy head branch name to clipboard

dependabot Bot commented on behalf of github Mar 2, 2026

Uh oh!

socket-security Bot commented Mar 2, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Mar 2, 2026 •

edited

Loading

Uh oh!

dosubot Bot commented Mar 2, 2026

Uh oh!

codecov Bot commented Mar 2, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Search code, repositories, users, issues, pull requests...

Uh oh!

Conversation

dependabot Bot commented on behalf of github Mar 2, 2026

v3.27.0

What's Changed

Added

Changed

Other

[v3.27.0] - 2026-02-22

Added

Changed

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

Added

Fixed

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

Added

Fixed

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

Added

Fixed

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

Added

Fixed

Changelog

Uh oh!

socket-security Bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dosubot Bot commented Mar 2, 2026

Uh oh!

codecov Bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

socket-security Bot commented Mar 2, 2026 •

edited

Loading

socket-security Bot commented Mar 2, 2026 •

edited

Loading

codecov Bot commented Mar 2, 2026 •

edited

Loading