chore(deps): refresh Go, npm, actions, and development tools

.devcontainer/Dockerfile

@@ -8,9 +8,9 @@
 # Stage 1 (ci): everything the test suites and CI need.
 # Stage 2 (dev): editor tooling + the non-root `vscode` user.
 
-# Base pinned by digest — the SAME image gitops-api builds on, so this repo's Go behaves
+# Base pinned by digest — the SAME image gitops-reverser builds on, so this repo's Go behaves
 # identically to the one that consumes it.
-FROM golang:1.26.5-bookworm@sha256:18aedc16aa19b3fd7ded7245fc14b109e054d65d22ed53c355c899582bbb2113 AS ci
+FROM golang:1.27.1-bookworm@sha256:648f440f42a0958804efb24df176f806f9d353b41f1c0627f666428e40310f6b AS ci
 
 ENV DEBIAN_FRONTEND=noninteractive
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
@@ -41,21 +41,21 @@ RUN apt-get update \
 # YQ_VERSION            -> https://github.com/mikefarah/yq/releases  (builds conformance/gen/*.json)
 # KUBECTL_VERSION / K3D_VERSION — kept in lockstep with gitops-api, so a cluster stood up
 #   here behaves identically to the one the gateway will really run against.
-# NODE_MAJOR            -> the current Node LTS line. 22 runs `.ts` under `node --test`
+# NODE_MAJOR            -> the current Node LTS line. 24 runs `.ts` under `node --test`
 #   natively (type stripping), which is why this repo's client suite needs ZERO test deps.
 # ACTIONLINT_VERSION    -> https://github.com/rhysd/actionlint/releases
 # HADOLINT_VERSION      -> https://github.com/hadolint/hadolint/releases
 #   A workflow YAML and a Dockerfile were the only files here with no linter, which is how CI came to
 #   pack a bundle it had never built.
 ENV PATH="/go/bin:/usr/local/go/bin:${PATH}" \
-    GOLANGCI_LINT_VERSION=v2.12.2 \
-    TASK_VERSION=v3.51.1 \
-    YQ_VERSION=v4.48.1 \
-    KUBECTL_VERSION=v1.36.2 \
+    GOLANGCI_LINT_VERSION=v2.13.2 \
+    TASK_VERSION=v3.53.1 \
+    YQ_VERSION=v4.53.6 \
+    KUBECTL_VERSION=v1.37.0 \
     K3D_VERSION=v5.9.0 \
-    NODE_MAJOR=22 \
-    ACTIONLINT_VERSION=1.7.7 \
-    HADOLINT_VERSION=2.14.0
+    NODE_MAJOR=24 \
+    ACTIONLINT_VERSION=1.7.12 \
+    HADOLINT_VERSION=2.15.1
 
 RUN test "$(dpkg --print-architecture)" = "amd64" \
     || (echo "This devcontainer currently supports amd64 only." && exit 1)
@@ -104,7 +104,7 @@ RUN groupadd --gid 2000 godev \
     && chgrp -R godev /go && chmod -R 2775 /go \
     && setfacl -d -m g:godev:rwx /go && setfacl -d -m u::rwx /go && setfacl -d -m o::rx /go
 
-RUN go install golang.org/x/tools/cmd/goimports@v0.43.0
+RUN go install golang.org/x/tools/cmd/goimports@v0.50.0
 
 # hadolint ignore=SC2016
 RUN printf '%s\n' 'export PATH="/go/bin:/usr/local/go/bin:${PATH}"' \
@@ -120,10 +120,10 @@ USER root
 ENV DEBIAN_FRONTEND=noninteractive
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
-ENV DLV_VERSION=v1.27.0 \
+ENV DLV_VERSION=v1.27.2 \
     GOPLS_VERSION=v0.23.0 \
-    STATICCHECK_VERSION=v0.7.0 \
-    CODEX_VERSION=0.144.3
+    STATICCHECK_VERSION=v0.8.1 \
+    CODEX_VERSION=0.154.0
 
 RUN apt-get update \
     && apt-get -y install --no-install-recommends bash-completion \

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
     name: workflows and Dockerfile
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -62,7 +62,7 @@ jobs:
     name: fixtures are the contract
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: install yq
@@ -77,12 +77,12 @@ jobs:
     runs-on: ubuntu-latest
     needs: fixtures
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26"
+          go-version: "1.27.1"
           # There is no gateway/go.sum, and there never will be: the core module has ZERO
           # dependencies, and the `consumable` job below fails the build if it ever grows one. So
           # there is nothing to restore and nothing to save — asking for a cache here only produced
@@ -96,7 +96,7 @@ jobs:
         working-directory: gateway
       - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: v2.12.2
+          version: v2.13.2
           working-directory: gateway
 
   # The Kubernetes adapter is a SEPARATE MODULE — which is the point (`go get .../gateway` stays
@@ -111,12 +111,12 @@ jobs:
     name: kube adapter (go)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26"
+          go-version: "1.27.1"
           # This module DOES have dependencies (it is the only one that imports client-go), so this
           # is the one Go job where a cache is real.
           cache-dependency-path: gateway/kube/go.sum
@@ -126,7 +126,7 @@ jobs:
         working-directory: gateway/kube
       - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: v2.12.2
+          version: v2.13.2
           working-directory: gateway/kube
           args: --build-tags e2e
 
@@ -148,12 +148,12 @@ jobs:
     name: a stranger can `go get` this
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26"
+          go-version: "1.27.1"
           # No cache, and not because a file is missing: this job's entire job is to resolve the
           # modules FROM THE NETWORK, the way an adopter does. A warm module cache here would be a
           # way for the bug to hide. (It also has no go.mod of its own to key a cache on — the repo
@@ -242,12 +242,12 @@ jobs:
     runs-on: ubuntu-latest
     needs: fixtures
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version: "24"
           cache: npm
           cache-dependency-path: packages/krm-stream/package-lock.json
       # task, so the build+pack step below is the SAME task a developer runs. The two used to be
@@ -290,12 +290,12 @@ jobs:
     name: Vue adapter example
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version: "24"
           cache: npm
           cache-dependency-path: examples/vue/package-lock.json
       - run: npm ci --no-audit --no-fund
@@ -313,16 +313,16 @@ jobs:
     runs-on: ubuntu-latest
     needs: fixtures
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26"
+          go-version: "1.27.1"
           cache: false # the core module has no dependencies; see the `gateway` job
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version: "24"
       - uses: arduino/setup-task@c0bc642852239c2689f73f4ea6459c29405f3c52 # v3.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -337,16 +337,16 @@ jobs:
     runs-on: ubuntu-latest
     needs: fixtures
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26"
+          go-version: "1.27.1"
           cache: false # the core module has no dependencies; see the `gateway` job
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version: "24"
       - uses: arduino/setup-task@c0bc642852239c2689f73f4ea6459c29405f3c52 # v3.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/codeql.yml

@@ -37,20 +37,20 @@ jobs:
             build-mode: none # interpreted; CodeQL reads the source directly
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       # go.work ties gateway/ and gateway/kube/ together and autobuild honours it, so both modules are
       # analysed. kube being a separate module must not make it the one nobody scans.
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         if: matrix.language == 'go'
         with:
           go-version-file: gateway/go.mod
           cache: false
 
       - name: initialize codeql
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -59,6 +59,6 @@ jobs:
           queries: security-extended
 
       - name: analyze
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           category: /language:${{ matrix.language }}

.github/workflows/release.yml

@@ -84,7 +84,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version: "24"
           # Writes the .npmrc that points publish at the public registry. With trusted publishing
           # there is no token to put in it.
           registry-url: https://registry.npmjs.org
@@ -123,9 +123,9 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26"
+          go-version: "1.27.1"
           cache: false # it must resolve from the network. That is the entire point.
 
       # No checkout anywhere in this job, on purpose.

.github/workflows/scorecard.yml

@@ -34,18 +34,18 @@ jobs:
       id-token: write # publish results to the public Scorecard API
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: run scorecard analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
 
       - name: upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: results.sarif

CONTRIBUTING.md

@@ -2,7 +2,7 @@
 
 ## Prerequisites
 
-The devcontainer provides Go 1.26, Node 22, Task, `kubectl`, and `k3d`.
+The devcontainer provides Go 1.27.1, Node 24, Task, `kubectl`, and `k3d`.
 
 ```bash
 task fixtures-check  # regenerate and verify shared fixture output

README.md

@@ -3,7 +3,7 @@
 [![CodeQL](https://github.com/ConfigButler/krm-stream/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/ConfigButler/krm-stream/actions/workflows/codeql.yml)
 [![npm](https://img.shields.io/npm/v/%40configbutler%2Fkrm-stream?logo=npm&color=cb3837)](https://www.npmjs.com/package/@configbutler/krm-stream)
 [![Runtime dependencies](https://img.shields.io/badge/runtime%20deps-0-2ea44f)](packages/krm-stream/package.json)
-[![Go](https://img.shields.io/badge/go-1.26-blue?logo=go)](gateway/go.mod)
+[![Go](https://img.shields.io/badge/go-1.27.1-blue?logo=go)](gateway/go.mod)
 [![TypeScript](https://img.shields.io/badge/typescript-ESM-3178c6?logo=typescript&logoColor=white)](packages/krm-stream)
 [![License](https://img.shields.io/github/license/ConfigButler/krm-stream)](https://www.apache.org/licenses/LICENSE-2.0)
 [![Open Issues](https://img.shields.io/github/issues/ConfigButler/krm-stream)](https://github.com/ConfigButler/krm-stream/issues)
@@ -200,8 +200,8 @@ browser. Use [`gateway.ValidateMergePatch`](gateway/patch.go) in the host save h
 
 The project is pre-1.0. Protocol and API changes may still be made before 1.0.
 
-- Go 1.26 for the gateway.
-- Node 22 for client development and tests.
+- Go 1.27.1 for the gateway.
+- Node 24 for client development and tests.
 - Kubernetes 1.35+ for strict resource-version ordering. `OrderingLenient` supports known
   non-conformant or aggregated APIs at the cost of per-object monotonic ordering.
 

Taskfile.yml

@@ -31,7 +31,7 @@ vars:
   # Kubernetes 1.35+ is a REQUIREMENT of this library, not a preference: from 1.35, resourceVersion
   # orderability is a Certified Kubernetes conformance requirement, and the gateway relies on it to
   # promise consumers per-object monotonicity. So the cluster we verify against must be one.
-  K3S_IMAGE: rancher/k3s:v1.36.2-k3s1
+  K3S_IMAGE: rancher/k3s:v1.36.4-k3s1
   KUBECONFIG_PATH: '{{.HOME}}/.kube/config' 
 
 tasks: