Consolidates the Dependabot minor/patch Go-dep bumps that move together
through the workspace dependency graph. The same deps repeat across many
module go.mod files, and apps/provisioning + apps/secret already pin
grafana-app-sdk@0.56.0 on main, so the whole workspace must move as one
coherent set rather than 23 trivial PRs.
Direct dependency bumps (exact Dependabot targets, all within current major):
- github.com/grafana/grafana-app-sdk 0.53.2 -> 0.56.0
(root + apps/advisor, alerting/notifications, alerting/rules,
correlations, dashboard, iam, playlist, plugins, shorturl)
- github.com/grafana/grafana-aws-sdk 1.4.3 -> 1.4.5 (root)
- github.com/beevik/etree 1.4.1 -> 1.6.0 (root)
- github.com/russellhaering/goxmldsig 1.4.0 -> 1.6.0 (root)
- github.com/opentracing-contrib/go-grpc 0.1.2 -> 0.1.3 (root)
- gocloud.dev 0.44.0 -> 0.46.0 (root)
- cloud.google.com/go/kms 1.25.0 -> 1.31.0 (root)
- buf.build/gen/go/parca-dev/parca/connectrpc/go and protocolbuffers/go
-> 1.20.0-/1.36.11-20260523035409-ca8a9e862107.1 (root)
- golang.org/x/net was already at 0.55.0 on main (no change needed).
grafana-plugin-sdk-go is carried to 0.291.1 transitively (required by
grafana-aws-sdk@1.4.5); it still exports QueryTypeDefinitionSpec.Examples
so the query schema code compiles. The explicit bump to 0.292.1 is NOT
taken here (see below).
Transitive consequences of grafana-app-sdk@0.56.0 (faithful to what
Dependabot itself produces via MVS): k8s.io/* 0.35.3 -> 0.36.x,
grafana/authlib + authlib/types advanced, go directive 1.26.1 -> 1.26.2
(app-sdk@0.56.0 declares go 1.26.2; go.work synced to match — the
member modules already required 1.26.2 on main).
Source changes required to compile against the bumped SDKs (mirrors
upstream grafana/grafana exactly, no unrelated drift):
- authlib types.AuthInfo gained GetAccessToken(); implement it on the
three identity.Requester types — StaticRequester, SignedInUser and
authn.Identity — each adding an AccessToken field + getter alongside
the existing GetIDToken.
- grafana-app-sdk resource.ClientGenerator now requires DiscoveryClient()
(and already required GetCustomRouteClient); implement both on
lazyClientGenerator and on the plugins install test fake.
Verification (Go workspace == CI build model; GOWORK on):
go build ./... PASSES for root and all nine bumped app modules and
pkg/apimachinery; go test -short PASSES for every app module,
pkg/apimachinery/identity, and the touched root packages
(services/user, services/authn, services/apiserver). Heavy root-wide
test suites were not run.
Deferred (left to their open Dependabot PRs): grafana-plugin-sdk-go
0.292.1. That release removes QueryTypeDefinitionSpec.Examples and the
QueryExample type, which requires a non-trivial upstream feature refactor
of pkg/registry/apis/query/queryschema (examples move to
data.QueryExamples) that is beyond a dependency bump.
Co-authored-by: Antje Worring <worringantje@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
