Skip to content

chore(deps): bump github.com/jferrl/go-githubauth from 1.5.1 to 1.6.0#5786

Merged
kodiakhq[bot] merged 1 commit into
v2from
dependabot/go_modules/github.com/jferrl/go-githubauth-1.6.0
Apr 27, 2026
Merged

chore(deps): bump github.com/jferrl/go-githubauth from 1.5.1 to 1.6.0#5786
kodiakhq[bot] merged 1 commit into
v2from
dependabot/go_modules/github.com/jferrl/go-githubauth-1.6.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 27, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/jferrl/go-githubauth from 1.5.1 to 1.6.0.

Release notes

Sourced from github.com/jferrl/go-githubauth's releases.

v1.6.0

✨ Features

External key store support for GitHub App JWTs

Added NewApplicationTokenSourceFromSigner which accepts any crypto.Signer with an RSA public key. Enables signing via AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault Transit, PKCS#11 HSMs, or ssh-agent — the private key never touches process memory. Validates at construction that the signer's public key is *rsa.PublicKey (GitHub requires RS256).

signer, _ := kms.NewSigner(ctx, keyID) // any crypto.Signer backed by RSA
ts, err := githubauth.NewApplicationTokenSourceFromSigner(appID, signer)

Proactive token refresh with configurable skew

New ReuseTokenSourceWithSkew refreshes cached tokens when time.Until(exp) <= skew instead of waiting for expiry to pass. Closes the in-flight 401 window where a request starts shortly before expiry and reaches GitHub already expired.

NewApplicationTokenSource and NewInstallationTokenSource now wrap with DefaultExpirySkew (30s); tune via WithExpirySkew / WithInstallationExpirySkew. Zero/negative skew delegates to oauth2.ReuseTokenSource verbatim for backwards compatibility.

Automatic retry on installation token throttling

createInstallationToken now performs a single automatic retry when GitHub returns 429, or 403 with Retry-After / X-RateLimit-Reset headers. Sleep honors context cancellation and is capped at 60s. Terminal throttle errors wrap ErrRateLimited for errors.Is branching. Opt out via WithRetryOnThrottle(false).

New webhook subpackage

Added a webhook package for verifying GitHub webhook deliveries using constant-time HMAC-SHA256:

  • Verify(secret, body, signature) with sentinel errors (ErrMissingSignature, ErrInvalidSignatureFormat, ErrSignatureMismatch) wrapped for errors.Is / errors.As.
  • Middleware(secret, opts...) net/http middleware with body restoration, 25 MiB default cap, and 401/413 short-circuits.
  • Functional options WithMaxPayloadSize and WithErrorHandler.
  • Suitable for direct use in queue, Lambda, or Cloud Run consumers.
http.Handle("/webhook", webhook.Middleware(secret)(handler))

📦 Dependencies

  • Bump golang.org/x/oauth2 from 0.34.0 → 0.36.0
  • Bump codecov/codecov-action 5 → 6
  • Bump styfle/cancel-workflow-action 0.13.0 → 0.13.1

⚠️ Breaking / Behavior Changes

  • Minimum Go version is now 1.25 (transitively required by golang.org/x/oauth2 v0.36.0). README previously claimed 1.21; the actual floor is now enforced.
  • Token sources refresh 30s before expiry by default. Set skew to 0 via WithExpirySkew(0) / WithInstallationExpirySkew(0) to restore prior behavior.

Full Changelog: jferrl/go-githubauth@v1.5.1...v1.6.0

Changelog

Sourced from github.com/jferrl/go-githubauth's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Commits
  • dc730e4 ✨ feat(auth): retry installation token fetches on rate limit
  • 599f97f ✨ feat(auth): proactive token refresh with configurable skew
  • a6a8b1b ✨ feat(auth): add crypto.Signer-backed JWT token source
  • e6ea894 ✨ feat(webhook): add GitHub webhook signature verification
  • ec35ab1 Merge pull request #45 from jferrl/dependabot/github_actions/codecov/codecov-...
  • 6b16b50 chore(deps): bump codecov/codecov-action from 5 to 6
  • 401bfce Merge pull request #44 from jferrl/dependabot/github_actions/styfle/cancel-wo...
  • 8bb1690 chore(deps): bump styfle/cancel-workflow-action from 0.13.0 to 0.13.1
  • 134b27b Merge pull request #43 from jferrl/dependabot/go_modules/golang.org/x/oauth2-...
  • 724c86a chore(deps): bump golang.org/x/oauth2 from 0.35.0 to 0.36.0
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/jferrl/go-githubauth](https://github.com/jferrl/go-githubauth) from 1.5.1 to 1.6.0.
- [Release notes](https://github.com/jferrl/go-githubauth/releases)
- [Changelog](https://github.com/jferrl/go-githubauth/blob/main/CHANGELOG.md)
- [Commits](jferrl/go-githubauth@v1.5.1...v1.6.0)

---
updated-dependencies:
- dependency-name: github.com/jferrl/go-githubauth
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added automerge Used by Kodiak bot to automerge PRs dependencies Pull requests that update a dependency file go labels Apr 27, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner April 27, 2026 02:21
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go automerge Used by Kodiak bot to automerge PRs labels Apr 27, 2026
@dosubot dosubot Bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Apr 27, 2026
@codecov

codecov Bot commented Apr 27, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.19%. Comparing base (d883b1a) to head (d20d548).
⚠️ Report is 4 commits behind head on v2.

Additional details and impacted files
@@           Coverage Diff           @@
##               v2    #5786   +/-   ##
=======================================
  Coverage   61.19%   61.19%           
=======================================
  Files         141      141           
  Lines       14195    14195           
=======================================
  Hits         8686     8686           
  Misses       4777     4777           
  Partials      732      732           
Flag Coverage Δ
integrationtests 34.49% <ø> (ø)
unittests 52.29% <ø> (-0.02%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@kodiakhq
kodiakhq Bot merged commit 88c1197 into v2 Apr 27, 2026
36 of 37 checks passed
@kodiakhq
kodiakhq Bot deleted the dependabot/go_modules/github.com/jferrl/go-githubauth-1.6.0 branch April 27, 2026 02:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

automerge Used by Kodiak bot to automerge PRs dependencies Pull requests that update a dependency file go size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants