Skip to content

chore(deps): update Go dependencies and GitHub Actions - #308

Merged
sammcj merged 1 commit into
mainfrom
chore/combined-dependency-updates
Aug 11, 2026
Merged

chore(deps): update Go dependencies and GitHub Actions#308
sammcj merged 1 commit into
mainfrom
chore/combined-dependency-updates

Conversation

@sammcj

@sammcj sammcj commented Aug 11, 2026

Copy link
Copy Markdown
Owner

Combines the open Renovate PRs into a single update.

Closes #270
Closes #275
Closes #277
Closes #279
Closes #280

GitHub Actions

  • actions/checkout v6.1.0 -> v7.0.1
  • actions/setup-go v6.5.0 -> v7.0.0
  • actions/cache v5.1.0 -> v6.1.0
  • softprops/action-gh-release v2.6.2 -> v3.0.2 (Node 20 -> Node 24 runtime)

All pins remain commit SHAs with a version comment.

Go modules

  • github.com/google/go-github v76 -> v90
  • github.com/pdfcpu/pdfcpu v0.14.0 -> v0.15.0
  • golang.org/x/text v0.40.0 -> v0.41.0

go-github v90 migration

github.NewClient no longer takes an *http.Client directly. It now takes variadic ClientOptionsFunc options and returns (*Client, error). The three call sites in internal/tools/github/auth.go use github.WithHTTPClient(...) and propagate the error. None of the other v77-v90 breaking changes touch APIs this repo calls.

Verification

make lint, make test and make build all pass.

Combines Renovate PRs #270, #275, #277, #279, #280.

- actions/checkout v6.1.0 -> v7.0.1
- actions/setup-go v6.5.0 -> v7.0.0
- actions/cache v5.1.0 -> v6.1.0
- softprops/action-gh-release v2.6.2 -> v3.0.2
- github.com/google/go-github v76 -> v90
- github.com/pdfcpu/pdfcpu v0.14.0 -> v0.15.0
- golang.org/x/text v0.40.0 -> v0.41.0

go-github v90 replaced the NewClient(*http.Client) signature with
variadic ClientOptionsFunc options returning an error.
Copilot AI balanced review requested due to automatic review settings August 11, 2026 23:06
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedgolang/​github.com/​pdfcpu/​pdfcpu@​v0.14.0 ⏵ v0.15.08210010010070
Addedgolang/​github.com/​google/​go-github/​v90@​v90.0.075100100100100
Updatedgolang/​golang.org/​x/​text@​v0.40.0 ⏵ v0.41.077 +1100100100100

View full report

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates pinned GitHub Actions and Go dependencies, including the go-github v90 client migration.

Changes:

  • Upgrades four GitHub Actions with SHA pins.
  • Updates go-github, pdfcpu, and x/text.
  • Adapts GitHub client construction to go-github v90.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.

Show a summary per file
File Description
.github/workflows/build-and-release.yml Updates build and release actions.
.github/workflows/claude-code-review.yml Updates checkout.
.github/workflows/claude.yml Updates checkout and Go setup.
.github/workflows/dependency-submission.yml Updates checkout, Go setup, and caching.
go.mod Updates direct dependency versions.
go.sum Refreshes dependency checksums.
internal/tools/github/auth.go Migrates client construction to v90.
internal/tools/github/client.go Updates the go-github import path.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@sammcj
sammcj merged commit 1845e0d into main Aug 11, 2026
11 checks passed
@sammcj
sammcj deleted the chore/combined-dependency-updates branch August 11, 2026 23:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants