diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e03cf17..fb2a4a4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,7 +1,12 @@ version: 2 updates: + # One entry for both Go modules. examples/ replaces the kit with ../, so + # a bump in the root module must land in examples/go.mod in the same PR + # or the examples tidy check fails. - package-ecosystem: gomod - directory: / + directories: + - / + - /examples schedule: interval: weekly day: monday @@ -19,25 +24,6 @@ updates: patterns: - "*" - - package-ecosystem: gomod - directory: /examples - schedule: - interval: weekly - day: monday - open-pull-requests-limit: 5 - groups: - go-deps-examples: - applies-to: version-updates - patterns: - - "*" - update-types: - - minor - - patch - go-deps-examples-security: - applies-to: security-updates - patterns: - - "*" - - package-ecosystem: github-actions directory: / schedule: diff --git a/CHANGELOG.md b/CHANGELOG.md index 0e4c329..0861c09 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,41 @@ All notable changes to **go-github-kit** are documented in this file. The format is based on [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.9.1] - 2026-09-20 + +Maintenance release. Bumps `golang.org/x/oauth2` and `golang.org/x/time` +in the root module and brings `examples/` in step. No library source or +public API changes since 1.9.0. + +Neither bump changes behaviour for consumers. `oauth2` v0.37.0 carries one +code change, an endpoint rename in its `google` subpackage, which the kit +does not import; the kit uses only the core `oauth2` package for +`WithToken` and `WithTokenSource`. `x/time` v0.16.0 has no code change. +Both modules now declare `go 1.26.0`, below the kit's own `go 1.27` floor +set in 1.9.0, so the consumer floor is unchanged. + +### Dependencies + +- `golang.org/x/oauth2` v0.36.0 to v0.37.0. +- `golang.org/x/time` v0.15.0 to v0.16.0. + +### Examples + +- `examples/go.mod` follows the root module: `golang.org/x/oauth2` v0.37.0 + (direct) and `golang.org/x/time` v0.16.0 (indirect). The examples module + replaces the kit with `../`, so a root bump that is not mirrored here + fails the examples tidy check in CI; that is what blocked the Dependabot + PR for this bump, and why the two modules move together in this release. + +### CI + +- `.github/dependabot.yml`: the two `gomod` entries for `/` and + `/examples` are merged into one entry listing both `directories`, so + a version bump lands in both go.mod files in a single grouped PR. + Group names are unchanged. Dependabot does not bump indirect + requirements on its own, so a root-only dependency that examples sees + transitively may still need a manual `go mod tidy` in `examples/`. + ## [1.9.0] - 2026-09-01 Maintenance release. Moves the module to Go 1.27, applies `go fix ./...`, @@ -907,6 +942,7 @@ and rotating PATs alike. - `golang.org/x/oauth2` v0.36.0 - `golang.org/x/time` v0.15.0 +[1.9.1]: https://github.com/pcanilho/go-github-kit/releases/tag/v1.9.1 [1.9.0]: https://github.com/pcanilho/go-github-kit/releases/tag/v1.9.0 [1.8.0]: https://github.com/pcanilho/go-github-kit/releases/tag/v1.8.0 [1.7.0]: https://github.com/pcanilho/go-github-kit/releases/tag/v1.7.0 diff --git a/examples/go.mod b/examples/go.mod index efee1ea..3cce782 100644 --- a/examples/go.mod +++ b/examples/go.mod @@ -19,7 +19,7 @@ require ( github.com/google/go-querystring v1.2.0 // indirect github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect github.com/shurcooL/graphql v0.0.0-20240915155400-7ee5256398cf // indirect - golang.org/x/time v0.15.0 // indirect + golang.org/x/time v0.16.0 // indirect ) replace github.com/pcanilho/go-github-kit => ../ diff --git a/examples/go.sum b/examples/go.sum index bc71c00..6a0e3be 100644 --- a/examples/go.sum +++ b/examples/go.sum @@ -21,5 +21,5 @@ github.com/shurcooL/graphql v0.0.0-20240915155400-7ee5256398cf h1:o1uxfymjZ7jZ4M github.com/shurcooL/graphql v0.0.0-20240915155400-7ee5256398cf/go.mod h1:9dIRpgIY7hVhoqfe0/FcYp0bpInZaT7dc3BYOprrIUE= golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= -golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= -golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= +golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE= +golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s= diff --git a/go.mod b/go.mod index a3cbb84..77a10af 100644 --- a/go.mod +++ b/go.mod @@ -7,6 +7,6 @@ toolchain go1.27.0 require ( github.com/gofri/go-github-ratelimit/v2 v2.0.2 github.com/hashicorp/golang-lru/v2 v2.0.7 - golang.org/x/oauth2 v0.36.0 - golang.org/x/time v0.15.0 + golang.org/x/oauth2 v0.37.0 + golang.org/x/time v0.16.0 ) diff --git a/go.sum b/go.sum index 7ed049a..e92c045 100644 --- a/go.sum +++ b/go.sum @@ -2,7 +2,7 @@ github.com/gofri/go-github-ratelimit/v2 v2.0.2 h1:gS8wAS1jTmlWGdTjAM7KIpsLjwY1S0 github.com/gofri/go-github-ratelimit/v2 v2.0.2/go.mod h1:YBQt4gTbdcbMjJFT05YFEaECwH78P5b0IwrnbLiHGdE= github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k= github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM= -golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= -golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= -golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= +golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= +golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= +golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE= +golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=