[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/iodesystems/gwag/v2	v2.1.0 → v2.9.0

---

Release Notes

iodesystems/gwag (github.com/iodesystems/gwag/v2)

v2.9.0

Compare Source

Relay deploys and sub status: Relay.Shutdown closes sockets cleanly, and the generated runtime reports each subscription's real state and retries failures.

Added

• Relay.Shutdown(ctx) sends close 1001 ("server restarting") to every socket, closes them, and answers new ones with 503, so a deploy is not a 1006 for every client. http.Server.Shutdown does not touch hijacked connections: call it from srv.RegisterOnShutdown.
• Relay generated runtime: per-sub status. useSub returns {status, error}, and subscribeRaw takes an onState callback: pending, subscribed (the relay acked), or failed (the mint threw or the relay refused the cap). setMintRetry tunes the retry.

Fixed

• Relay generated runtime: a failed mint dropped the sub until the next reconnect, and a relay err frame was ignored. Both now retry with jittered backoff, 2 s to 60 s, while the sub is mounted and the socket is open.

v2.8.0

Compare Source

Relay liveness and cheap compression: a ping op, a heartbeat and live state in the generated runtime, and WithCompression, which compresses a fan-out once rather than once per socket.

Added

• relay.WithCompression() negotiates permessage-deflate (no context takeover) on the multiplex relay's sockets. Off by default. A data frame is compressed once per event and sub id and shared among sockets, so a fan-out does not compress per socket.
• Relay ping op. A client frame {"op":"ping","id":…} gets {"op":"pong","id":…}, so a browser (which cannot send WebSocket ping control frames) can keep a socket alive through a proxy idle timeout and detect a dead one. Before this, the relay answered ping with {"op":"err","err":"unknown op"}.
• Relay generated runtime: heartbeat and live state. The runtime pings every 20 s, replaces a socket that stops answering, and exports useLiveSocket, subscribeLive, liveSnapshot and setHeartbeat. React 18 or later is required for useLiveSocket.
• Relay generated runtime: wire sub ids are <channel>#<n>, so sockets on a channel can share compressed frames. No relay change is needed; a mismatch of runtime and relay versions works.

v2.7.0

Compare Source

OpenAPI 3.2 ingest, a 3.0 / 3.1 export option with down-conversion, base64 validation, and one pub/sub transport under gat and gwag.

Migration

• OpenAPI format: byte outside multipart/form-data is now a GraphQL String, not Upload, and contentEncoding: base64 ingests the same way. Clients pass base64 text. It used to reach the upstream as a multipart body or query value holding a Go struct. format: byte in multipart/form-data is still Upload.
• Proto bytes fields are base64 both ways (proto3 JSON). GraphQL args used to take the raw string, and output was base64 on gwag's default path but the raw string on gat and gwag's map path. Clients that send raw text to a bytes arg must base64-encode it; gat clients reading bytes output must decode it. Input accepts standard or URL-safe base64, padded or not. Upload-marked bytes fields are unchanged.
• Standalone gwag gateways have pub/sub. ps/v1 appears in the schema, admin service lists and MCP tools without WithCluster. Tests that count services or slots see one more.
• WithChannelAuth patterns with a > before the last token, or an empty token, make New panic. Write a.> (rest of the channel) or a.*.b (one token).

Added

• OpenAPI base64 validation (experimental). Args declared format: byte or contentEncoding: base64 are checked before dispatch. WithValidation("strict"|"warn"|"off") (gwag), Validation(...) (gat); strict is the default, so bad base64 fails the call without reaching the upstream.
• OpenAPI version of the schema route (experimental). WithOpenAPIVersion("3.0"|"3.1") (gwag), OpenAPIVersion("3.0"|"3.1") (gat) or ?openapi=3.0|3.1 write every spec in that version. 3.1 writes "openapi": "3.1.0" with JSON Schema 2020-12 forms: nullable becomes a "null" type entry, boolean exclusive bounds become numbers, a schema example becomes examples; a 3.2 source is converted down. 3.0 converts 3.1 and 3.2 sources (huma writes 3.1.0) down to "openapi": "3.0.3", for client generators that read only 3.0; what 3.0 cannot express is kept in x-gwag-oas31, x-gwag-oas32, x-webhooks, x-additional-operations and x-item-schema. Without the option or parameter the output is unchanged: synthesized specs 3.0.0, OpenAPI sources as declared. New ir.RenderOpenAPIWith, ir.RenderOpenAPIOptions{Version}, ir.ParseOpenAPIVersion, ir.OpenAPI30Version. See docs/gat.md "OpenAPI version" for every converted construct and which are lossy.
• OpenAPI ingest reads x-additional-operations (QUERY and custom methods) and x-item-schema (streamed responses), so a 3.0 spec written by gwag registers with the same operations as its source, on GraphQL, gRPC and REST ingress.
• OpenAPI 3.2 query and additionalOperations. A QUERY operation becomes a GraphQL Query field with a body arg; a custom method becomes a Mutation. gwag, gat and REST ingress send the declared method and body upstream. HEAD / OPTIONS / TRACE / CONNECT operations are still skipped, now with a warning at registration (new ir.UnsupportedOpenAPIOperations). Cross-kind OpenAPI 3.0 export puts these methods under the x-additional-operations Path Item extension.
• OpenAPI 3.2 streamed responses as GraphQL subscriptions. An upstream OpenAPI operation whose success response has itemSchema on text/event-stream, application/jsonl, application/x-ndjson or application/json-seq ingests as a subscription (one upstream request per subscriber), in gwag and in gat BYO-IR registrations. gwag also relays it on IngressHandler in the declared media type and serves it as a server-streaming gRPC method; streams count against MaxStreams / MaxStreamsTotal. An operation that also offers application/json stays unary. New ir.OpenAPIStreamOf, ir.OpenAPIStream, ir.NewOpenAPIStreamReader (experimental). See docs/gat.md "Streamed responses from an upstream spec".
• gat.Bus (experimental): one pub/sub transport interface under gat's PubSub and gwag's ps.pub / ps.sub. Implementations gat.NewLocalBus, gat.NewPeerMeshBus (what EnablePeerMesh installs), and Gateway.UseBus to plug one in. gat.MatchChannel is the shared NATS-style matcher; gw/gat/bustest is a conformance suite for new buses.
• gw/gat/gatnats (experimental): gatnats.New(nc) is a gat.Bus over a NATS connection, in its own package so gat does not import nats.go.
• Single-node pub/sub. A gwag gateway without WithCluster installs the ps slot and serves ps.pub / ps.sub in-process.
• Pub/sub degrade mode. In cluster mode, when the NATS connection is down, ps.pub / ps.sub deliver on this node only and switch back to NATS on reconnect. New gauge go_api_gateway_pubsub_bus_degraded; HealthHandler body gains pubsub (nats / local / local_degraded) and degraded: true while degraded (status code unchanged). See docs/pubsub.md "Transport".

Changed

• OpenAPI ingest: a nullable $ref (allOf: [$ref] or a one-branch oneOf with nullable: true, or the 3.1 oneOf: [$ref, {type: null}]) now becomes a nullable field of the referenced type. It used to fall back to a scalar, so the GraphQL type of such fields changes.
• Subscription errors keep their extensions. An error a subscription dispatcher returns before the stream starts (e.g. a proto stream over MaxStreams) now carries extensions.code on the GraphQL error frame (was message only).
• Standalone gwag gateways now have the ps/v1 slot: the schema includes ps.pub (Query) and ps_sub / ps_stable_sub (Subscription), and ps/v1 appears in admin service listings, service stats, and the MCP schema tools, as it already did in cluster mode. WithChannelBinding without a cluster no longer panics in New.
• Channel patterns with a > that is not the last token (e.g. in WithChannelAuth / WithChannelBinding) now match nothing, as in NATS and gat. gwag used to treat such a > as "match the rest". New now panics on such a WithChannelAuth pattern (or one with an empty token): the rule would match nothing, and its channels would fall back to the default HMAC tier, which can be weaker than the tier the rule declared.

Fixed

• Repeated and map fields of a proto request message rendered as a scalar GraphQL arg (xs: Int), so a list could not be sent. They are now [T] args, and map fields take the JSON scalar.
• Unset proto fields with presence (proto2 optional, proto3 optional, oneof members) read as zero values on gwag's default GraphQL path, and a proto2 enum without a 0 value read as 0. They now read null, as on the map path and in protojson.
• Proto map<K,V> fields in gRPC args and responses (gwag and gat) panicked in the codec. They now convert as a JSON object: string keys, values in proto3 JSON form (enum names, base64 bytes, 64-bit integers as strings).
• uint64 / fixed64 args above 2^63-1 were refused, and negative values wrapped. They now parse over the full unsigned range, and a negative value is an error. uint32 args refuse negative values too.
• ClusterOptions.ClientListen with port 0 now picks a free port. natsd read 0 as its default 4222.
• docs/pubsub.md showed ps.pub as a Mutation returning Boolean! and ps.sub nested under Subscription.ps. The real fields are Query.ps.pub(...) returning Gwag_Ps_V1_PubResponse and Subscription.ps_sub(...), with ts as a string and payloadType in camelCase.
• docs/gat-pubsub.md described gwag pub/sub as durable; it is NATS core, without persistence or replay.

v2.6.0

Compare Source

gwag's GraphQL and gRPC ingress now run on gat's: one request path, so gwag gains batching, Connect and gRPC-Web.

Migration

• gwag GraphQL clients that send malformed requests now get 400 instead of 200 with errors. This covers invalid JSON, an empty query, and variables that is not an object.
• gat MaxOperations refuses the whole request. This applies to a document or to a batch counted as a whole. Before, the first n operations ran and the rest failed. Raise MaxOperations if a client sends more.
• Status codes are more specific.
  • gRPC clients of OpenAPI and GraphQL upstreams see AlreadyExists, Unavailable and similar codes where they saw InvalidArgument or Internal.
  • REST clients see the upstream's own HTTP status where they saw 400 or 500.
  • gat handlers that return a *connect.Error or a gRPC status keep that code where they got Internal.
• Pub/sub auth failures carry PERMISSION_DENIED in extensions.code (none before).

Added

• Batched GraphQL requests. A POST body that is a JSON array runs each document in order and answers with an array of results; WithMaxOperations(n) also caps the batch: at most n documents, and at most n operations summed over them (over the cap, the whole batch is refused with 400 and nothing runs). (The GraphQL handler now runs on gat's request path.)
• gat ingress hooks (experimental). PreRequest, WSUpgrade, GraphiQL, ParseContentType, AcceptStringVariables, UsePlanCache, EchoComplete let a host wrap gat's GraphQL handler; see docs/gat.md "Ingress hooks". New gat.Request, gat.RequestHook, gat.RequestParser.
• Connect and gRPC-Web ingress. ConnectHandler() (experimental) serves the routes GRPCUnknownHandler serves over Connect, gRPC-Web and gRPC on an http.Handler. Both now run on gat's gRPC ingress; see docs/operations.md "gRPC, Connect and gRPC-Web".
• gat gRPC routes from the host (experimental). SetGRPCRoutes serves host-supplied methods (gat.GRPCRoute) over Connect, gRPC and gRPC-Web (GRPCHandler) and on a grpc-go server (GRPCStreamHandler); the table swaps atomically. PreCall hooks every gRPC call; gat.ErrorCode is the one error-to-code mapping both use. See docs/gat.md "gRPC routes you supply".
• WithConnectErrorCodes() (experimental). GraphQL dispatch errors carry gat's extensions shape, {status, code: "not_found"} (lower-case gRPC code, as the gRPC and REST ingresses classify the error), instead of {code: "NOT_FOUND"}. Default stays upper case until v3. New ir.RuntimeOptions.WrapError.
• gat.HTTPStatus(code) (experimental). A gRPC / Connect code as an HTTP status, by the Connect protocol's table.

Changed

• GraphQL endpoint: 400 on bad input. A body that is not valid JSON, an empty or missing query, or variables that are not an object (a JSON string holding one is still accepted; invalid variables on GET included) now answer 400 instead of 200 with a GraphQL error or silently dropped variables.
• GraphQL endpoint: other input changes. A multipart body over WithUploadLimit answers 413 (was 400). On POST, query / variables in the URL no longer override the body. A WebSocket upgrade without the graphql-transport-ws subprotocol is accepted and closed with 1008 (was served as an HTTP request).
• gat MaxOperations refuses the whole document. A document selecting more operations than the cap now fails validation and nothing runs (was: the first n ran and the rest got field errors). In a batch the cap counts the operations of all its documents together: a batch over it is refused whole with 400.
• gRPC ingress: more specific status codes. An OpenAPI or downstream-GraphQL upstream's HTTP error status now picks the gRPC code (gat.ErrorCode): 409 AlreadyExists (was InvalidArgument), 412 FailedPrecondition, 413 ResourceExhausted, 501 Unimplemented, 502/503/504 Unavailable (were Internal). GraphQL extensions.code is unchanged.
• REST ingress: upstream statuses relayed. IngressHandler answers a failed dispatch with the upstream's own HTTP status (was: 4xx other than 400/401/403/404/429 became 400, every 5xx became 500). An error with no HTTP status uses gat.HTTPStatus(gat.ErrorCode(err)): a gRPC upstream's status picks the REST status (was 500 for all); a cancelled or timed-out call is 499 / 504 (was 500).
• gat gRPC error codes. A handler error that is a *connect.Error or carries a gRPC status keeps its code (was Internal unless it had an HTTP status); context.Canceled / DeadlineExceeded answer Canceled / DeadlineExceeded (was Internal). Wrapped errors are unwrapped.
• Pub/sub auth failures carry a code. A ps.pub / ps.sub refused by channel auth (HMAC or delegate) now fails with PermissionDenied: GraphQL extensions.code PERMISSION_DENIED (was none), gRPC PermissionDenied, REST 403. Messages are unchanged.
• gat 413 carries extensions.code (BAD_REQUEST), as gwag's does.

Fixed

• gRPC upstream timeouts recognised. A gRPC upstream whose copy of the deadline reset the stream just before the gateway's own timer fired was reported as the upstream's DeadlineExceeded, not as the upstream timeout: no upstream timeout after message, and no count toward replica ejection.

v2.5.0

Compare Source

Migration

• gwag GraphQL endpoint limits. A request selecting more than 64 operations is now refused, and a body over 1 MiB gets 413. If a client sends larger requests, set WithMaxOperations(n) / WithMaxRequestBytes(n), or pass 0 to turn a limit off. gat had these defaults already.
• gat with no schema. A gat handler whose schema is not assembled yet answers 503 NOT_READY instead of 200 with an error.
• Dependencies. huma v2.40.0, grpc v1.85.0, mcp-go v1.4.0 and golang.org/x/net v0.62.0 are the new minimums.

Added

• WithMetricPrefix(prefix). Opt in to gwag_* Prometheus metric names; default stays go_api_gateway_* until v3.
• Request limits. WithMaxOperations(n), WithMaxRequestBytes(n), WithMaxDepth(n), WithoutIntrospection() on the GraphQL endpoint; see docs/operations.md "Request limits". Shared with gat (gw/internal/gqlguard).
• Trusted documents. WithTrustedDocuments(docs, enforce) and ParseTrustedDocuments: persisted-document ids, Apollo APQ and GET by id, as in gat.
• Upstream call timeouts. Timeout(d) (per service),
  WithUpstreamTimeout(d) (gateway default) and
  ServiceBinding.timeout_ms (control plane) bound unary dispatch to
  gRPC, OpenAPI and downstream-GraphQL upstreams. Off by default.
• Retry on a different replica when a unary call provably never
  reached an upstream (connect refused, no connection). Delivered
  requests, 5xx and timeouts are never retried.
• Replica ejection. WithReplicaEjection(failures, cooldown): a
  replica with 5 consecutive failures (default) gets no traffic for
  10 s (default). Fails open when every replica is ejected.
• Integer scalars (experimental). gat.IntegerScalar(name, desc) for a Go type's huma.SchemaProvider, or x-gwag-scalar: <Name> on an OpenAPI integer schema, renders that field as its own GraphQL scalar: a JSON number exact within ±(2^53-1), input as number or decimal string. REST stays integer/int64, proto int64. New ir.TypeRef.ScalarName, ir.ScalarExtension.
• gat VersionedOnly(true) (experimental). Render each GraphQL operation once, at ns.v1.op, without the unversioned ns.op copy. Default off. New ir.RuntimeOptions.VersionedOnly.
• gat SetSchema (experimental). Serve a host-assembled schema and replace it at run time; in-flight requests keep the schema they started with. A gat handler with no schema yet answers 503 NOT_READY (was 200 with a "Must provide schema" error).

Security

• Default request limits. The GraphQL endpoint now refuses documents selecting more than 64 operations and bodies over 1 MiB (413). Raise or turn them off with WithMaxOperations(0) / WithMaxRequestBytes(0).
• GraphiQL no longer runs linked queries. A browser GET with ?query= executed the query server-side, outside the plan cache, so it skipped the request limits and the no-mutations-over-GET rule: a link could fire a mutation with the visitor's cookies. The page now only prefills the query.

Fixed

• Cluster puts retried. Deprecate and MCP-config writes retry a put lost to a replica change instead of failing the admin call; the deprecated bucket now follows the cluster replica count.
• uint64 proto fields. A set uint64 / fixed64 field no longer panics on the map conversion path (gRPC ingress, subscriptions, pub/sub, runtime transforms); it renders as a decimal string.

v2.4.0

Compare Source

Added

• gat @export within one document. A field reading a variable that
  another field of the same query exports runs after it: gat splits the
  document into stages at plan time and merges their data into one
  response in query field order. One request, one result type.
• gat batched requests with @export. A POST body that is an array
  of operations runs them in order; @export(as: "x") on a field passes
  its values (deduplicated; a list under a list) to the operations after
  it as $x. The answer to "fetch these, then the things they reference"
  in one round trip, without links or nested resolvers.
• ir.RuntimeOptions.Directives declares extra directives on the
  rendered schema; ir.PrintSchemaSDL prints them.
• gat request attributes. gat.Attrs is a bag scoped to the
  inbound request (GraphQL HTTP request, gRPC call, graphql-ws
  connection) that every fused operation shares;
  gat.LockIfAbsentAndFill computes a value once while concurrent
  callers wait, so a session lookup runs once per request, not once per
  operation. gat.AttrsMiddleware scopes REST requests.
• gat parallel queries. ParallelQueries(n) runs up to n query
  operations of one GraphQL request concurrently; mutations stay
  serial. Off by default.
• gat request limits. MaxOperations(n) caps operations per GraphQL
  request (aliases included; excess ones fail with 400, not dispatched).
  MaxRequestBytes(n) caps the GraphQL body.
• gat trusted documents. TrustedDocuments(docs, enforce) serves
  requests naming a document by documentId, the APQ sha256Hash
  extension, or ?documentId= over GET; enforce refuses query text.
  ParseTrustedDocuments reads graphql-codegen's persisted-documents
  manifest.
• gat combines fused operations' cache headers. Cache-Control,
  ETag, Last-Modified and Vary from each operation's huma output
  merge into the GraphQL response: identical values pass through,
  otherwise the most restrictive combination; ETags combine into one
  weak ETag. GET with a matching If-None-Match gets 304.
• gat MaxDepth and DisableIntrospection. Validation rules run by
  the plan cache, so each distinct query is checked once.
  DisableIntrospection also stops serving {prefix}/schema/*.
• gat HookDispatch. A per-operation hook that receives the
  request context and returns the one the handler sees, plus a done
  callback with the error — for trace spans. No tracing dependency.

Security

• gwag refuses mutations over GET. GET /graphql?query=mutation…
  ran the mutation upstream, cookies forwarded by ForwardHeaders
  included. It now gets 405 before execution, as GraphQL over HTTP
  requires.
• gat refuses mutations over GET. GET {prefix}/graphql?query=mutation…
  ran the mutation, so any page could trigger one with a visitor's
  cookies (a link or an <img src>; SameSite=Lax still sends cookies
  on top-level GETs). A GET whose operation is a mutation now gets 405
  before anything runs; GraphQL over HTTP forbids them there.

Fixed

• OpenAPI array query parameters and array responses keep their list
  type. Ingest dropped it: ?ids=a&ids=b became a String argument
  and a JSON-array response a single object (fields read as null), in
  gat and gwag, over GraphQL and gRPC. Outbound OpenAPI calls now send a
  list argument as repeated keys instead of ids=[a b], and gat's gRPC
  ingress answers list operations under the response message's value.
• gat GET requests read variables and extensions. They were
  ignored, so a GET query with variables failed.
• gat ObserveDispatch now fires for gRPC calls. gRPC ingress
  invoked handlers directly and was never observed; observation now
  wraps the handler invocation both surfaces share.

Changed

• GraphQL and proto types change for OpenAPI array parameters and
  array responses (the fix above): ids: String → ids: [String!],
  listThings: Thing → listThings: [Thing!]. Regenerate clients.
• gat core API is stable: Gateway, New, ServiceRegistration,
  Handler, Register, RegisterHuma, RegisterSSE, RegisterGRPC,
  HandleMux, and the /graphql, /schema/* and gRPC routes. The
  rest of gw/gat stays experimental (docs/stability.md).
• gat runs at most 64 operations per GraphQL request by default
  (MaxOperations); excess aliases fail with 400 instead of
  dispatching. MaxOperations(0) removes the cap.
• gat refuses GraphQL bodies over 1 MiB with 413 (MaxRequestBytes
  default), matching huma's REST limit for the same operation. Set
  MaxRequestBytes(0) for no limit.
• graphql-go fork v2.1.0: PlanCacheOptions.Rules, Plan.IsMutation.
• gat allocates less per request. Mounted endpoints use the
  adapter's own request on humago/humachi/humamux/humaflow, and binary
  proto requests decode straight into the input struct (gatbench:
  GraphQL Get 88 → 74 allocs/op, Connect proto Get 69 → 59).

v2.3.1

Compare Source

Security

• gat runs huma's input checks on GraphQL and gRPC calls. Parameter
  and body schema validation (maxLength, pattern, minimum, enum,
  formats, ...) and input Resolve methods ran over REST only; GraphQL
  and gRPC-ingress calls (unary, RegisterSSE, Subscribe) reached the
  handler with input REST rejects. A failure is now a 422, or the status
  a Resolver error carries, as GraphQL extensions.status or the mapped
  gRPC code.

v2.3.0

Compare Source

Added

• gat: RegisterSSE, the paired drop-in for huma's sse.Register.
  One handler serves REST (Server-Sent Events), a GraphQL subscription
  over graphql-transport-ws, and a gRPC server-streaming method on
  RegisterGRPC, behind the op's huma middlewares. Several event types
  render as a GraphQL union and a proto message with one oneof.

Deprecated

• gat: Subscribe. Use RegisterSSE, which defines the stream in
  huma and also serves it over REST.

Fixed

• Proto rendering of unions. A service with a union type (OpenAPI
  oneOf) produced a descriptor set that failed to build
  ("….AB" not found), so gat's RegisterGRPC failed for it. A
  union now renders as a message holding one oneof value.
• gat: Subscribe streams over gRPC. v2.2.0 listed them as
  server-streaming methods in /schema/proto but RegisterGRPC did
  not mount them; they are now served.

v2.2.0

Compare Source

Added

• gat: Subscribe registers GraphQL subscriptions. gat.Subscribe[I, O]
  takes a huma operation and a source func(ctx, *I) (<-chan *O, error);
  the field is served over graphql-transport-ws on {prefix}/graphql
  (WebSocket upgrade on GET), with the op's huma middlewares applied.
  gat.ConnectionInitPayload(ctx) exposes the connection_init payload.

v2.1.3

Compare Source

Security

• gat: huma middlewares now run on GraphQL and gRPC dispatch. An op
  registered with gat.Register called its handler directly over
  /graphql and gRPC ingress, skipping both api.UseMiddleware and
  huma.Operation.Middlewares. An op guarded only by a huma middleware
  (auth, role check) was open on those surfaces. The chain now runs in
  huma's order; a middleware that writes an error instead of calling
  next becomes a GraphQL error (with extensions.status) or the
  mapped Connect code. Middlewares see the transport request's headers,
  Method() is the op's method, Param() returns "", and
  BodyReader() is empty.

v2.1.2

Compare Source

Fixed

• SDL descriptions ending in " now parse. A one-line description
  like e.g. "match 0.97" rendered as """…"match 0.97"""", which
  closes the block string early; graphql-js and codegen rejected the
  whole schema. Such descriptions now use the multi-line form. An
  embedded """ is now escaped as \""" (was \"\"\", which put
  the backslashes into the parsed description).
• RetractStable and cluster Register survive a KV replica
  change. The gateway raises the KV buckets' replica count as peers
  join; a put sent during that change could get no ack and fail after
  5s. For a retract, the local retract stayed applied but was not
  persisted; for a registration, the call failed. Both puts now retry
  with a 2s per-attempt timeout inside a 10s budget. Heartbeat TTL
  refreshes retry inside their existing 5s budget.

Changed

• Go dependencies updated to current minor/patch versions: nats-server
  v2.15.1, nats.go v1.54.0, grpc v1.84.0, otel v1.47.0, mcp-go v1.2.1,
  prometheus client_golang v1.25.0, protoreflect v1.19.0 (v2 module
  v2.0.0 stable), golang.org/x/net v0.61.0. No source changes.
• UI: graphql 17; graphql-request replaced by a fetch client. GraphQL
  errors now read as the error text joined with "; ".

v2.1.1

Compare Source

Fixed

• Subscriptions no longer leak a goroutine per cancelled subscriber.
  graphql-go v2.0.0 → v2.0.1. runSubscription stops reading once its
  context is cancelled; graphql-go's producer then blocked forever on
  its next result send, and its result channel never closed.
• Cluster tracking retries after a failed start, and Close no longer
  hangs. If the initial self-registration Put failed (for example,
  timing out while JetStream settles at boot), the half-started tracker
  stayed installed. The boot retry loop saw it and stopped, so the
  gateway ran without peer refresh, the reconciler or KV watches, and
  Close blocked forever waiting on loops that never started. Close
  also no longer hangs when it runs while that start is still in flight,
  as it can against the background start ControlPlane launches.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 19 additional dependencies were updated

Details:

Package	Change
github.com/danielgtaylor/huma/v2	v2.39.1 -> v2.40.0
github.com/go-chi/chi/v5	v5.3.2 -> v5.5.0
github.com/mark3labs/mcp-go	v1.0.0 -> v1.5.0
golang.org/x/text	v0.41.0 -> v0.43.0
connectrpc.com/connect	v1.20.0 -> v1.21.1
github.com/IodeSystems/graphql-go/v2	v2.0.0 -> v2.1.0
github.com/getkin/kin-openapi	v0.149.0 -> v0.152.0
github.com/go-openapi/jsonpointer	v0.23.1 -> v1.0.2
github.com/google/jsonschema-go	v0.4.2 -> v0.4.3
github.com/mattn/go-runewidth	v0.0.27 -> v0.0.31
github.com/oasdiff/yaml	v0.1.1 -> v0.1.3
github.com/oasdiff/yaml3	v0.0.14 -> v0.0.16
github.com/spf13/cast	v1.7.1 -> v1.10.0
golang.org/x/crypto	v0.55.0 -> v0.58.0
golang.org/x/net	v0.58.0 -> v0.62.0
golang.org/x/sync	v0.22.0 -> v0.24.0
golang.org/x/sys	v0.47.0 -> v0.49.0
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260526163538-3dc84a4a5aaa -> v0.0.0-20261026165753-2ffab32bce7e
google.golang.org/grpc	v1.83.2 -> v1.85.0