fix: bump go tools to solve arena panic issue in loader

[jensneuse]

Summary by CodeRabbit

• Chores
  • Updated internal module dependencies across the project to maintain compatibility and stability.

[coderabbitai]

Walkthrough

This PR updates Go module dependencies across three go.mod files. It bumps router and router-tests versions in demo/go.mod, updates demo, router, and graphql-go-tools versions in router-tests/go.mod, and updates graphql-go-tools version in router/go.mod.

Changes

Cohort / File(s)	Summary
Go Module Version Updates demo/go.mod, router-tests/go.mod, router/go.mod	Bumped module dependency versions: router/router-tests to v0.0.0-20260213130455-6e3277e7b850, graphql-go-tools/v2 from rc.248 to rc.249, and cosmo/demo version in router-tests/go.mod.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• chore: update demo router dependency #2504: Directly modifies the same go.mod dependency lines for router and graphql-go-tools versions.
• chore(demo): update demo module router dependencies #2364: Updates demo and router-tests module dependency references for router-related versions.
• fix: astparser/lexer fixes #2020: Modifies the same module dependency entries in router/go.mod and router-tests/go.mod files.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: bumping go tools (graphql-go-tools) to fix an arena panic issue in the loader, which aligns with the dependency version updates across all three modified go.mod files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Merge Conflict Detection	✅ Passed	✅ No merge conflicts detected when merging into main

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

❌ Internal Query Planner CI checks failed

The Internal Query Planner CI checks failed in the celestial repository, and this is going to stop the merge of this PR.
If you are part of the WunderGraph organization, you can see the PR with more details.

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In `@router-tests/go.mod`:
- Around line 25-29: Run `go mod tidy` in the router-tests module and regenerate
go.sum so it includes valid checksum entries for the coordinated bumps of the
cosmo modules: github.com/wundergraph/cosmo/demo,
github.com/wundergraph/cosmo/demo/pkg/subgraphs/projects,
github.com/wundergraph/cosmo/router and
github.com/wundergraph/cosmo/router-plugin; then verify go.sum contains entries
for each of those module versions (not just
github.com/wundergraph/graphql-go-tools/v2) and that the hashes are valid before
merging.

In `@router/go.mod`:
- Line 34: Update the NewVariablesNormalizer call to match the new signature by
passing the enableFieldArgumentMapping boolean; replace
astnormalization.NewVariablesNormalizer() with
astnormalization.NewVariablesNormalizer(false) (or true if your code relies on
field-argument mapping) in the call site inside the operation processing logic
(the NewVariablesNormalizer invocation in operation_processor.go).

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# Check go.sum entries for the mentioned module versions
cd router-tests
echo "=== Checking go.sum entries ===" 
rg -n 'github.com/wundergraph/cosmo/demo ' go.sum | head -20
echo "---"
rg -n 'github.com/wundergraph/cosmo/router ' go.sum | head -20
echo "---"
rg -n 'github.com/wundergraph/graphql-go-tools/v2 ' go.sum | head -20

# Check for mcp-go dependency (from learnings - v0.38.0 has regressions)
echo "=== Checking mcp-go versions ===" 
rg -n 'github.com/mark3labs/mcp-go' go.mod go.sum

Repository: wundergraph/cosmo

Length of output: 602

---

🏁 Script executed:

# Also check the actual go.mod to see lines 25-29 context
cd router-tests
echo "=== Contents of go.mod lines 20-35 ===" 
sed -n '20,35p' go.mod

Repository: wundergraph/cosmo

Length of output: 872

---

🏁 Script executed:

# Check if there are any require statements for mcp-go in the go.mod
cd router-tests
echo "=== Search for mcp-go in entire go.mod ===" 
grep -n 'mcp-go\|mark3labs' go.mod

Repository: wundergraph/cosmo

Length of output: 143

---

Verify go.sum entries are generated for demo, router, and router-plugin modules.
go.sum is missing entries for github.com/wundergraph/cosmo/demo, github.com/wundergraph/cosmo/demo/pkg/subgraphs/projects, and github.com/wundergraph/cosmo/router despite these being present in go.mod. Only graphql-go-tools/v2 has corresponding go.sum entries. Run go mod tidy in router-tests and confirm all four coordinated module bumps produce valid go.sum hashes before merging.

🤖 Prompt for AI Agents

In `@router-tests/go.mod` around lines 25 - 29, Run `go mod tidy` in the
router-tests module and regenerate go.sum so it includes valid checksum entries
for the coordinated bumps of the cosmo modules:
github.com/wundergraph/cosmo/demo,
github.com/wundergraph/cosmo/demo/pkg/subgraphs/projects,
github.com/wundergraph/cosmo/router and
github.com/wundergraph/cosmo/router-plugin; then verify go.sum contains entries
for each of those module versions (not just
github.com/wundergraph/graphql-go-tools/v2) and that the hashes are valid before
merging.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

rg -n 'NewVariablesNormalizer\s*\(' --type=go -A 2

Repository: wundergraph/cosmo

Length of output: 354

---

🏁 Script executed:

rg -n 'astnormalization|NewVariablesNormalizer' --type=go | head -20

Repository: wundergraph/cosmo

Length of output: 1907

---

🏁 Script executed:

sed -n '1430,1440p' router/core/operation_processor.go

Repository: wundergraph/cosmo

Length of output: 648

---

🏁 Script executed:

rg -n 'enableFieldArgumentMapping|VariablesNormalizer' --type=go -B 2 -A 2

Repository: wundergraph/cosmo

Length of output: 931

---

🏁 Script executed:

cat router/go.mod | grep graphql-go-tools

Repository: wundergraph/cosmo

Length of output: 201

---

🏁 Script executed:

rg 'graphql-go-tools/v2' router/go.sum | head -5

Repository: wundergraph/cosmo

Length of output: 277

---

🏁 Script executed:

git log --oneline --all -n 20 | head -20

Repository: wundergraph/cosmo

Length of output: 179

---

🏁 Script executed:

rg -n 'TODO|FIXME|TODO:|FIXME:' router/core/operation_processor.go | grep -i normal

Repository: wundergraph/cosmo

Length of output: 43

---

🏁 Script executed:

find router -name "*.go" -type f | xargs grep -l 'NewVariablesNormalizer' | head -5

Repository: wundergraph/cosmo

Length of output: 95

---

🏁 Script executed:

git log -p --all -S 'NewVariablesNormalizer()' -- router/core/operation_processor.go | head -50

Repository: wundergraph/cosmo

Length of output: 43

---

🏁 Script executed:

# Check if there's a build or test that would validate compilation
ls -la router/ | grep -E 'test|build'

Repository: wundergraph/cosmo

Length of output: 43

---

🏁 Script executed:

git rev-parse HEAD

Repository: wundergraph/cosmo

Length of output: 101

---

🏁 Script executed:

fd -e "go.work" . --type f

Repository: wundergraph/cosmo

Length of output: 43

---

🏁 Script executed:

git log --oneline --all -n 50 | grep -i "go-tools\|graphql-go-tools\|variable" | head -10

Repository: wundergraph/cosmo

Length of output: 43

---

Update NewVariablesNormalizer() call to pass the required enableFieldArgumentMapping parameter.

The call at router/core/operation_processor.go:1433 must be updated to match the signature change in rc.249. Replace astnormalization.NewVariablesNormalizer() with astnormalization.NewVariablesNormalizer(enableFieldArgumentMapping bool), passing the appropriate boolean value for your use case.

🤖 Prompt for AI Agents

In `@router/go.mod` at line 34, Update the NewVariablesNormalizer call to match
the new signature by passing the enableFieldArgumentMapping boolean; replace
astnormalization.NewVariablesNormalizer() with
astnormalization.NewVariablesNormalizer(false) (or true if your code relies on
field-argument mapping) in the call site inside the operation processing logic
(the NewVariablesNormalizer invocation in operation_processor.go).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.44%. Comparing base (9743345) to head (cbd8a95).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2506      +/-   ##
==========================================
+ Coverage   61.78%   62.44%   +0.65%     
==========================================
  Files         231      231              
  Lines       24126    24126              
==========================================
+ Hits        14907    15066     +159     
+ Misses       7974     7813     -161     
- Partials     1245     1247       +2     

see 17 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.