fix(demo): bump router pin to fix full-demo docker build

[gausie]

What was wrong

The full-demo docker build (make dc-federation-demo / scripts/setup-fulldemo.sh) has been broken: building the demo subgraph images failed in the RUN go build ./cmd/<subgraph> step with:

/go/pkg/mod/github.com/wundergraph/cosmo/router@v0.0.0-20260330183556-dc4388d100a4/pkg/pubsub/datasource/mocks.go:1106:63: undefined: resolve.SubscriptionCloseKind

demo/go.mod pinned github.com/wundergraph/cosmo/router at a pseudo-version from 2026-03-30 whose pubsub mocks reference resolve.SubscriptionCloseKind, while module version selection resolved github.com/wundergraph/graphql-go-tools/v2 to v2.4.5-0.20260610040534-eecda72eb837, whose resolve package doesn't define that type. The two pins were incompatible, breaking every consumer of the full demo (e.g. the terraform-provider-cosmo e2e workflow, which builds the demo from cosmo@main).

The fix

Bump cosmo/router and cosmo/router-tests in demo/go.mod to the current main pseudo-version (v0.0.0-20260710155145-803a4bc06d92), which resolves graphql-go-tools/v2 to v2.10.0 — the same version the router module itself pins. Everything else in the diff is go mod tidy fallout. No source changes.

Verification

• go build ./... in demo/ passes.
• All nine Go demo subgraph images build via the real failing path: docker compose -f docker-compose.full.yml --profile default --profile subgraphs build employees family hobbies products test1 availability mood countries products_fg — all OK. They share the single demo/go.mod, so this covers every target.

Summary by CodeRabbit

• Chores
  • Updated the demo and test modules to newer dependency versions.
  • Refreshed selected libraries related to routing, JWT/auth, messaging, compression/encoding, and time/oauth handling.
  • Added a handful of new indirect dependencies to keep schema, integration, and related tooling current.
  • Overall improves compatibility and reliability while keeping the demo’s public functionality unchanged.

[claude]

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: dc20e302-8f67-486e-b2c4-0e57c60aa58c

📥 Commits

Reviewing files that changed from the base of the PR and between 67f2948 and 4146da1.

📒 Files selected for processing (1)

• router-tests/go.mod

---

Walkthrough

Updated direct and indirect dependency versions in demo/go.mod and aligned the router dependency version in router-tests/go.mod.

Changes

Go dependency refresh

Layer / File(s)	Summary
Refresh demo module requirements demo/go.mod	Updated direct and indirect router, NATS, GraphQL tooling, encoding, JSON schema, MCP SDK, and Go extension module requirements.
Align router-tests router version router-tests/go.mod	Bumped the declared github.com/wundergraph/cosmo/router pseudo-version.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• wundergraph/cosmo#2959: Updates overlapping go-arena and graphql-go-tools/v2 dependencies.
• wundergraph/cosmo#3057: Updates overlapping router-related Go module dependencies.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: bumping the router pin to fix the full demo Docker build.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Router-nonroot image scan passed

✅ No security vulnerabilities found in image:

ghcr.io/wundergraph/cosmo/router:sha-f7bf84e32f8eec0034d18ccb4b5540e5d4f82e39-nonroot

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.85%. Comparing base (803a4bc) to head (4146da1).

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #3071       +/-   ##
===========================================
+ Coverage   48.73%   61.85%   +13.12%     
===========================================
  Files        1128      261      -867     
  Lines      156654    30649   -126005     
  Branches    10805        0    -10805     
===========================================
- Hits        76340    18958    -57382     
+ Misses      78442    10179    -68263     
+ Partials     1872     1512      -360     

see 877 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.