go 1.26.3 upgrade - #3782
Merged
Merged
Conversation
|
|
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (44)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis PR updates Go toolchain references to 1.26.3 across repository ChangesGo 1.26.3 Toolchain Upgrade
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies" Comment |
akshaydeo
marked this pull request as ready for review
May 26, 2026 22:43
Contributor
Confidence Score: 5/5Pure version bump with no logic changes; all modules, workflows, and Docker images are consistently updated. Every changed file is a mechanical substitution of a version string or image tag. All go.mod files, CI workflow steps, Dockerfiles, and Makefiles are mutually consistent at Go 1.26.3 and Alpine 3.23.4. Image digests are pinned and updated. No application code or dependency graphs were modified. No files require special attention. Important Files Changed
Reviews (3): Last reviewed commit: "go 1.26.3 upgrade" | Re-trigger Greptile |
akshaydeo
force-pushed
the
05-27-go_1.26.3_upgrade
branch
from
May 27, 2026 10:08
9bb5cfa to
0357d21
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cli/go.mod`:
- Line 1: The workflows install Go 1.26.2 while go.mod files (e.g., cli/go.mod)
require go 1.26.3; update the GitHub workflow jobs (e.g.,
.github/workflows/snyk.yml, pr-tests.yml, release-cli.yml, release-pipeline.yml,
helm-release.yml, e2e-tests.yml) to either set go-version to "1.26.3" or add
GOTOOLCHAIN: auto to the job environment so the setup script picks the correct
toolchain; ensure consistency between go.mod (go 1.26.3) and the workflow job
settings so CI uses Go 1.26.3.
In `@transports/go.mod`:
- Line 3: Update the GitHub Actions workflow Go toolchain pins to match
transports/go.mod (go 1.26.3): find all occurrences of the workflow input/key
"go-version" in the listed workflows (.github/workflows/snyk.yml,
release-pipeline.yml, release-cli.yml, helm-release.yml, e2e-tests.yml,
pr-tests.yml) and change their values from "1.26.2" to "1.26.3" (or remove the
pin if you prefer an unpinned toolchain); ensure any uses of actions/setup-go or
matrix entries referencing go-version are updated consistently so the CI
toolchain matches the go directive in transports/go.mod.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 8ea44b3a-11f8-40be-968a-6db14d86d67d
📒 Files selected for processing (38)
.github/workflows/scripts/schemasync/go.modMakefilecli/go.modcore/go.modexamples/mcps/auth-demo-server/go.modexamples/mcps/edge-case-server/go.modexamples/mcps/error-test-server/go.modexamples/mcps/go-test-server/go.modexamples/mcps/http-no-ping-server/go.modexamples/mcps/oauth-demo-server/go.modexamples/mcps/parallel-test-server/go.modexamples/plugins/hello-world-wasm-go/go.modexamples/plugins/hello-world/Makefileexamples/plugins/hello-world/go.modexamples/plugins/http-transport-only/go.modexamples/plugins/llm-only/go.modexamples/plugins/mcp-only/go.modexamples/plugins/multi-interface/go.modframework/go.modplugins/compat/go.modplugins/governance/go.modplugins/jsonparser/go.modplugins/logging/go.modplugins/maxim/go.modplugins/mocker/go.modplugins/otel/go.modplugins/prompts/go.modplugins/semanticcache/go.modplugins/telemetry/go.modtests/async/go.modtests/governance/go.modtests/scripts/1millogs/go.modtests/scripts/migration-checker/go.modtests/semanticcache/go.modtransports/Dockerfiletransports/Dockerfile.localtransports/Dockerfile.redhattransports/go.mod
akshaydeo
force-pushed
the
05-27-go_1.26.3_upgrade
branch
from
May 27, 2026 12:53
0357d21 to
27738c7
Compare
Contributor
Author
Merge activity
|
akshaydeo
added a commit
that referenced
this pull request
May 29, 2026
## Summary Bumps the Go toolchain version from `1.26.2` to `1.26.3` across all modules and Docker build images, and upgrades the Alpine runtime base image from `3.21.7` to `3.23.4` in the transport Dockerfiles. ## Changes - Updated all `go.mod` files across core, CLI, transports, plugins, examples, framework, and test modules to require Go `1.26.3` - Updated Docker build stages in `Dockerfile`, `Dockerfile.local`, and `Dockerfile.redhat` to use `golang:1.26.3-alpine3.23` with the corresponding new digest - Updated the runtime stage in `Dockerfile` and `Dockerfile.local` from `alpine:3.21.7` to `alpine:3.23.4` with the corresponding new digest - Updated `Makefile` targets (root and `examples/plugins/hello-world`) to use `golang:1.26.3-alpine3.23` for Docker-based cross-compilation ## Type of change - [ ] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [x] Chore/CI ## Affected areas - [x] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs ## How to test ```sh go version go test ./... ``` Verify Docker builds succeed: ```sh docker build -f transports/Dockerfile . docker build -f transports/Dockerfile.local . ``` ## Breaking changes - [ ] Yes - [x] No ## Related issues N/A ## Security considerations The Alpine runtime base image upgrade from `3.21.7` to `3.23.4` incorporates upstream security patches available in the newer Alpine release. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
akshaydeo
added a commit
that referenced
this pull request
May 29, 2026
## Summary This PR releases **core v1.5.14**, **framework v1.3.14**, **transports v1.5.6**, and bumps all dependent plugins to their respective `.14` patch versions. It delivers a broad set of new capabilities across MCP authentication, key rotation, OTel metrics, Bedrock/Anthropic compatibility, and UI improvements, alongside a number of targeted bug fixes and refactors. ## Changes - **Direct API Key Header** — Providers can now receive an API key passed directly via a request header (#3817) - **MCP Per-User Auth** — Introduced `MCPCredentialStore` abstraction, per-user MCP credential reconciliation, and a new per-user header auth type with lazy-auth submission flow (#3656, #3702, #3703, #3704, #3705) - **MCP TLS Configuration** — Added configurable TLS (`insecureSkipVerify`, `caCertPem`) for HTTP/SSE MCP client connections (#3779, #3783) - **MCP Sessions Management** — Filter, search, and pagination on the MCP sessions list API and table, plus a `can_reauth` identity gate (#3823, #3824, #3825) - **Key Rotation** — Keys now rotate on 401/402/403 responses; returns `502 upstream_credentials_exhausted` when all keys are permanently exhausted. Added `triggered_rotation` to `KeyAttemptRecord` and tightened `bifrost_key_rotation_events_total` semantics (#3430, #3491) - **OTel Metrics** — Added OTel spec-compatible metrics (backward compatible) with provider cache and semantic cache attributes in metrics export (#3865, #3816) - **Opus 4.8 Support** — System message handling and general compatibility for Opus 4.8 (#3868, #3878) - **Dimension Rankings** — New `GetDimensionRankings` API and dashboard tabs for team, customer, BU, and user rankings (#3766) - **Model Pricing Attributes** — `additional_attributes` field on model pricing rows with management API and UI editor (#3829) - **Prompt Cache Retention** — Added prompt cache retention parameter on responses requests (#3810) - **Tool Call Execution UI** — Inline tool-call execution, stop streaming, bulk execute/submit, and a redesigned tool-call UI (#3837, #3843) - **Sheet Navigation** — Prev/next keyboard navigation and URL state across virtual key, MCP client, and routing rule sheets (#3739, #3740, #3744, #3745) - **Bedrock Tool Name Truncation** — Truncate Bedrock function/tool names to the provider length limit - **Bedrock Guardrails** — Set guardrail config in Bedrock requests built from responses (#3862) - **Anthropic Tool Use** — Default `tool_use` input to `{}` when arguments are absent (#3880) - **Responses Streaming** — Fixed responses stream events (#3838) - **Compat Flow** — Fixed missing parameter parsing on the compat flow (#3881) - **Passthrough API Version** — Set a default API version in passthrough requests as a fallback (#3853) - **Virtual Key Updates** — Avoid overriding optional fields during virtual key update (#3855) - **User-Mode Flows** — Gate user-mode flows on caller `user_id`, skip temp token mint, and unify flow/credential kind filtering for pending flows (#3841, #3859) - **Partial Tool Calls** — Handle partial tool call execution failures and return successful results (#3849) - **URL Query Escaping** — Support escaped characters in URL query parameters (#3826) - **MCP Auth Errors** — Inline banner and retry support for MCP auth-required errors (#3856) - **Renamed Resolvers** — `staticHeadersResolver`/`serverOAuthResolver` renamed to `sharedHeadersResolver`/`sharedOAuthResolver` (#3840) - **Starlark Nested Tool Calls** — Exposed `RunWithPluginPipeline` on `ClientManager` and routed Starlark nested tool calls through the canonical plugin gate (#3794) - **Deferred-Fill OAuth Removed** — Removed deferred-fill user-mode OAuth flow support (#3839) - **Go 1.26.3** — Upgraded toolchain to Go 1.26.3 (#3782) ## Type of change - [x] Bug fix - [x] Feature - [x] Refactor - [ ] Documentation - [x] Chore/CI ## Affected areas - [x] Core (Go) - [x] Transports (HTTP) - [x] Providers/Integrations - [x] Plugins - [x] UI (React) - [ ] Docs ## How to test ```sh # Core/Transports go version # should report go1.26.3 go test ./... # UI cd ui pnpm i || npm i pnpm test || npm test pnpm build || npm run build ``` - Validate MCP per-user auth by configuring a per-user header auth type and confirming credentials are stored and reconciled on virtual key and MCP client changes. - Validate key rotation by triggering a 401/402/403 from an upstream provider and confirming rotation occurs; exhaust all keys and confirm a `502 upstream_credentials_exhausted` is returned. - Validate OTel metrics output includes `provider_cache` and `semantic_cache` attributes. - Validate Bedrock requests with tool names exceeding the provider limit are truncated correctly. - Validate Opus 4.8 system message handling by sending a request with a system message to an Opus 4.8 endpoint. ## Breaking changes - [x] Yes - [ ] No The deferred-fill user-mode OAuth flow has been removed (#3839). Any integrations relying on that flow must migrate to the new per-user credential store approach. The `staticHeadersResolver` and `serverOAuthResolver` identifiers have been renamed to `sharedHeadersResolver` and `sharedOAuthResolver` respectively (#3840); any direct references must be updated. ## Related issues #3817, #3656, #3702, #3703, #3704, #3705, #3779, #3783, #3823, #3824, #3825, #3430, #3491, #3865, #3816, #3868, #3878, #3766, #3829, #3810, #3837, #3843, #3739, #3740, #3744, #3745, #3862, #3880, #3838, #3881, #3853, #3855, #3841, #3859, #3849, #3826, #3856, #3840, #3794, #3839, #3782, #3724, #3814, #3836, #3869, #3886 ## Security considerations - MCP per-user credentials are stored via the new `MCPCredentialStore` abstraction; ensure the backing store is appropriately access-controlled and that credential values are encrypted at rest. - The direct API key header feature passes provider secrets via HTTP headers; ensure TLS is enforced on all ingress paths and that headers are not logged in plaintext. - User-mode flows are now gated on `caller user_id` and temp token minting is skipped where appropriate, reducing the surface for privilege escalation. - TLS configuration for MCP HTTP/SSE connections supports `insecureSkipVerify`; this should only be enabled in controlled environments. ## Checklist - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [x] I verified the CI pipeline passes locally if applicable
Merged
akshaydeo
added a commit
that referenced
this pull request
May 29, 2026
## ✨ Features - **Direct API Key Header** - Pass a provider API key directly via request header (#3817) - **MCP Per-User Authentication** - New per-user header auth type with credential storage and lazy-auth submission flow (#3703, #3704, #3705) - **MCP TLS Configuration** - Configurable TLS (insecureSkipVerify, caCertPem) for HTTP/SSE MCP client connections (#3779, #3783) - **MCP Sessions Management** - Filter, search, and pagination on the MCP sessions list API and table, plus a can_reauth identity gate (#3823, #3824, #3825) - **Tool Call Execution UI** - Inline tool-call execution, stop streaming, bulk execute/submit, and a redesigned tool-call UI (#3837, #3843) - **Dimension Rankings Dashboard** - New dashboard tabs for team, customer, BU, and user rankings, backed by a GetDimensionRankings API (#3766) - **Model Pricing Attributes** - additional_attributes on model pricing rows with management API and UI editor (#3829) - **Prompt Cache Retention** - Prompt cache retention parameter on responses requests (#3810) - **Opus 4.8 Support** - System message handling and compatibility for Opus 4.8 (#3878, #3868) - **Key Rotation** - Rotate keys on 401/402/403 and return 502 upstream_credentials_exhausted when all keys are permanently dead (#3491) - **OTel Metrics** - OTel spec compatible metrics plus provider and semantic cache attributes in metrics export (#3865, #3816) - **Sheet Navigation** - Prev/next keyboard navigation and URL state across virtual key, MCP client, and routing rule sheets (#3739, #3740, #3744, #3745) - **Go 1.26.3** - Upgraded toolchain to Go 1.26.3 (#3782) ## 🐞 Fixed - **Bedrock Tool Names** - Truncate Bedrock function/tool names to the provider length limit - **Bedrock Guardrails** - Set guardrail config in Bedrock request built from responses (#3862) - **Anthropic Tool Use** - Default Anthropic tool_use input to {} when arguments are absent (#3880) - **Responses Streaming** - Fixed responses stream events (#3838) - **Compat Flow** - Fixed missing parameter parsing on the compat flow (#3881) - **Passthrough API Version** - Set a default API version in passthrough requests as a fallback (#3853) - **Virtual Key Updates** - Avoid overriding optional fields during virtual key update (#3855) - **User-Mode Flows** - Gate user-mode flows on caller user_id, skip temp token mint, and unify flow/credential kind filtering for pending flows (#3841, #3859) - **Partial Tool Calls** - Handle partial tool call execution failures and return successful results (#3849) - **URL Query Escaping** - Support escaped characters in URL query parameters (#3826) - **MCP Auth Errors** - Inline banner and retry support for MCP auth-required errors (#3856) - **JSON Editor Height** - Cap JSON editor max height at 400px in message views (#3842)
This was referenced Jun 5, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the Go toolchain version from
1.26.2to1.26.3across all modules and Docker build images, and upgrades the Alpine runtime base image from3.21.7to3.23.4in the transport Dockerfiles.Changes
go.modfiles across core, CLI, transports, plugins, examples, framework, and test modules to require Go1.26.3Dockerfile,Dockerfile.local, andDockerfile.redhatto usegolang:1.26.3-alpine3.23with the corresponding new digestDockerfileandDockerfile.localfromalpine:3.21.7toalpine:3.23.4with the corresponding new digestMakefiletargets (root andexamples/plugins/hello-world) to usegolang:1.26.3-alpine3.23for Docker-based cross-compilationType of change
Affected areas
How to test
go version go test ./...Verify Docker builds succeed:
Breaking changes
Related issues
N/A
Security considerations
The Alpine runtime base image upgrade from
3.21.7to3.23.4incorporates upstream security patches available in the newer Alpine release.Checklist
docs/contributing/README.mdand followed the guidelines