From 612ff96d39d2447f2883f82776c413c03ccbf81b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 21:44:28 +0000 Subject: [PATCH 1/2] chore(deps): bump the go-deps group with 2 updates Bumps the go-deps group with 2 updates: [golang.org/x/oauth2](https://github.com/golang/oauth2) and [golang.org/x/time](https://github.com/golang/time). Updates `golang.org/x/oauth2` from 0.36.0 to 0.37.0 - [Commits](https://github.com/golang/oauth2/compare/v0.36.0...v0.37.0) Updates `golang.org/x/time` from 0.15.0 to 0.16.0 - [Commits](https://github.com/golang/time/compare/v0.15.0...v0.16.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps - dependency-name: golang.org/x/time dependency-version: 0.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go-deps ... Signed-off-by: dependabot[bot] --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index a3cbb84..77a10af 100644 --- a/go.mod +++ b/go.mod @@ -7,6 +7,6 @@ toolchain go1.27.0 require ( github.com/gofri/go-github-ratelimit/v2 v2.0.2 github.com/hashicorp/golang-lru/v2 v2.0.7 - golang.org/x/oauth2 v0.36.0 - golang.org/x/time v0.15.0 + golang.org/x/oauth2 v0.37.0 + golang.org/x/time v0.16.0 ) diff --git a/go.sum b/go.sum index 7ed049a..e92c045 100644 --- a/go.sum +++ b/go.sum @@ -2,7 +2,7 @@ github.com/gofri/go-github-ratelimit/v2 v2.0.2 h1:gS8wAS1jTmlWGdTjAM7KIpsLjwY1S0 github.com/gofri/go-github-ratelimit/v2 v2.0.2/go.mod h1:YBQt4gTbdcbMjJFT05YFEaECwH78P5b0IwrnbLiHGdE= github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k= github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM= -golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= -golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= -golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= +golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= +golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= +golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE= +golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s= From 99063c346c7c413a4d9ae037a7e7e46cc8298b05 Mon Sep 17 00:00:00 2001 From: Paulo Canilho Date: Sun, 20 Sep 2026 16:54:05 +0200 Subject: [PATCH 2/2] chore(deps): mirror bump into examples, merge dependabot gomod entries; release 1.9.1 --- .github/dependabot.yml | 26 ++++++-------------------- CHANGELOG.md | 36 ++++++++++++++++++++++++++++++++++++ examples/go.mod | 4 ++-- examples/go.sum | 8 ++++---- 4 files changed, 48 insertions(+), 26 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e03cf17..fb2a4a4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,7 +1,12 @@ version: 2 updates: + # One entry for both Go modules. examples/ replaces the kit with ../, so + # a bump in the root module must land in examples/go.mod in the same PR + # or the examples tidy check fails. - package-ecosystem: gomod - directory: / + directories: + - / + - /examples schedule: interval: weekly day: monday @@ -19,25 +24,6 @@ updates: patterns: - "*" - - package-ecosystem: gomod - directory: /examples - schedule: - interval: weekly - day: monday - open-pull-requests-limit: 5 - groups: - go-deps-examples: - applies-to: version-updates - patterns: - - "*" - update-types: - - minor - - patch - go-deps-examples-security: - applies-to: security-updates - patterns: - - "*" - - package-ecosystem: github-actions directory: / schedule: diff --git a/CHANGELOG.md b/CHANGELOG.md index 0e4c329..0861c09 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,41 @@ All notable changes to **go-github-kit** are documented in this file. The format is based on [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.9.1] - 2026-09-20 + +Maintenance release. Bumps `golang.org/x/oauth2` and `golang.org/x/time` +in the root module and brings `examples/` in step. No library source or +public API changes since 1.9.0. + +Neither bump changes behaviour for consumers. `oauth2` v0.37.0 carries one +code change, an endpoint rename in its `google` subpackage, which the kit +does not import; the kit uses only the core `oauth2` package for +`WithToken` and `WithTokenSource`. `x/time` v0.16.0 has no code change. +Both modules now declare `go 1.26.0`, below the kit's own `go 1.27` floor +set in 1.9.0, so the consumer floor is unchanged. + +### Dependencies + +- `golang.org/x/oauth2` v0.36.0 to v0.37.0. +- `golang.org/x/time` v0.15.0 to v0.16.0. + +### Examples + +- `examples/go.mod` follows the root module: `golang.org/x/oauth2` v0.37.0 + (direct) and `golang.org/x/time` v0.16.0 (indirect). The examples module + replaces the kit with `../`, so a root bump that is not mirrored here + fails the examples tidy check in CI; that is what blocked the Dependabot + PR for this bump, and why the two modules move together in this release. + +### CI + +- `.github/dependabot.yml`: the two `gomod` entries for `/` and + `/examples` are merged into one entry listing both `directories`, so + a version bump lands in both go.mod files in a single grouped PR. + Group names are unchanged. Dependabot does not bump indirect + requirements on its own, so a root-only dependency that examples sees + transitively may still need a manual `go mod tidy` in `examples/`. + ## [1.9.0] - 2026-09-01 Maintenance release. Moves the module to Go 1.27, applies `go fix ./...`, @@ -907,6 +942,7 @@ and rotating PATs alike. - `golang.org/x/oauth2` v0.36.0 - `golang.org/x/time` v0.15.0 +[1.9.1]: https://github.com/pcanilho/go-github-kit/releases/tag/v1.9.1 [1.9.0]: https://github.com/pcanilho/go-github-kit/releases/tag/v1.9.0 [1.8.0]: https://github.com/pcanilho/go-github-kit/releases/tag/v1.8.0 [1.7.0]: https://github.com/pcanilho/go-github-kit/releases/tag/v1.7.0 diff --git a/examples/go.mod b/examples/go.mod index aad687b..3cce782 100644 --- a/examples/go.mod +++ b/examples/go.mod @@ -9,7 +9,7 @@ require ( github.com/google/go-github/v90 v90.0.0 github.com/pcanilho/go-github-kit v1.0.0 github.com/shurcooL/githubv4 v0.0.0-20260209031235-2402fdf4a9ed - golang.org/x/oauth2 v0.36.0 + golang.org/x/oauth2 v0.37.0 ) require ( @@ -19,7 +19,7 @@ require ( github.com/google/go-querystring v1.2.0 // indirect github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect github.com/shurcooL/graphql v0.0.0-20240915155400-7ee5256398cf // indirect - golang.org/x/time v0.15.0 // indirect + golang.org/x/time v0.16.0 // indirect ) replace github.com/pcanilho/go-github-kit => ../ diff --git a/examples/go.sum b/examples/go.sum index 65c693f..6a0e3be 100644 --- a/examples/go.sum +++ b/examples/go.sum @@ -19,7 +19,7 @@ github.com/shurcooL/githubv4 v0.0.0-20260209031235-2402fdf4a9ed h1:KT7hI8vYXgU0s github.com/shurcooL/githubv4 v0.0.0-20260209031235-2402fdf4a9ed/go.mod h1:zqMwyHmnN/eDOZOdiTohqIUKUrTFX62PNlu7IJdu0q8= github.com/shurcooL/graphql v0.0.0-20240915155400-7ee5256398cf h1:o1uxfymjZ7jZ4MsgCErcwWGtVKSiNAXtS59Lhs6uI/g= github.com/shurcooL/graphql v0.0.0-20240915155400-7ee5256398cf/go.mod h1:9dIRpgIY7hVhoqfe0/FcYp0bpInZaT7dc3BYOprrIUE= -golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= -golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= -golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= +golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= +golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= +golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE= +golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=