fix: switch REST client auth to x-api-key header

[jscaltreto]

Summary

QuickNode's REST API no longer accepts Authorization: Bearer tokens — it now requires the API key via the x-api-key header. This caused terraform plan to fail with a 401 Unauthorized during provider configuration even when supplying a valid API key. This PR aligns the main REST client with the streams client, which was already using x-api-key correctly.

Also bumps several dependencies to address CVEs surfaced by the Trivy scan, and updates the generated API clients to match.

Detail

Auth fix:

• internal/provider/provider.go: Replaced securityprovider.NewSecurityProviderBearerToken with an inline RequestEditorFn that sets x-api-key: <apiKey> on each request, matching the pattern already used for the streams client. Removed the now-unused securityprovider import.
• internal/utils/error.go: Changed ErrorResponse.Error from *string to json.RawMessage. QuickNode returns error as a JSON object (not a string) in non-200 responses, causing a silent unmarshal failure that swallowed the real API error message and replaced it with a misleading internal warning.

Dependency upgrades:

• golang.org/x/net v0.55.0 → v0.56.0 (CVE-2026-46600)
• golang.org/x/text v0.37.0 → v0.40.0 (CVE-2026-56852)
• golang.org/x/crypto v0.52.0 → v0.54.0 (latest)
• google.golang.org/grpc v1.79.3 → v1.82.1 (GHSA-hrxh-6v49-42gf)
• github.com/oapi-codegen/oapi-codegen/v2 v2.4.1 → v2.7.1 (GHSA-rjwr-m7qx-3fjr)
• github.com/oapi-codegen/runtime v1.1.1 → v1.6.0 (required by regenerated code from v2.7.1 codegen)
• Added .trivyignore for GO-2026-5932 (golang.org/x/crypto/openpgp is unmaintained by design, has no fixed version, and is not imported by any package in our dependency tree — Trivy flags it at the module level).
• Added .licenseignore entry for go.yaml.in/yaml/v3 (Apache-2.0 AND MIT dual-license; both are acceptable).

Regenerated API clients (api/quicknode/quicknode.gen.go, api/streams/streams.gen.go): changes are additive only — typed context keys for auth scopes and Valid() methods on all enum types.

Testing

Verified locally using dev_overrides with a valid QuickNode API key. Prior to this change, terraform plan failed with 401 Unauthorized and a JSON unmarshal warning. After this change, the provider configures successfully and plans complete.

Trivy scan passes locally with 0 findings after the dependency upgrades. All unit tests pass.

Documentation

No documentation changes required.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 17 package(s) with unknown licenses.

See the Details below.

License Issues

go.mod

Package	Version	License	Issue Type
github.com/davecgh/go-spew	1.1.2-0.20180830191138-d8f796af33cc	Null	Unknown License
github.com/getkin/kin-openapi	0.135.0	Null	Unknown License
github.com/go-openapi/jsonpointer	0.22.4	Null	Unknown License
github.com/mailru/easyjson	0.9.1	Null	Unknown License
github.com/oapi-codegen/oapi-codegen/v2	2.7.1	Null	Unknown License
github.com/oasdiff/yaml	0.0.9	Null	Unknown License
github.com/onsi/gomega	1.27.6	Null	Unknown License
github.com/pmezard/go-difflib	1.0.1-0.20181226105442-5d4384ee4fb2	Null	Unknown License
github.com/stretchr/testify	1.11.1	Null	Unknown License
golang.org/x/crypto	0.54.0	Null	Unknown License
golang.org/x/mod	0.37.0	Null	Unknown License
golang.org/x/net	0.56.0	Null	Unknown License
golang.org/x/sync	0.22.0	Null	Unknown License
golang.org/x/sys	0.47.0	Null	Unknown License
golang.org/x/text	0.40.0	Null	Unknown License
golang.org/x/tools	0.47.0	Null	Unknown License
github.com/oasdiff/yaml3	0.0.9	Null	Unknown License

Allowed Licenses: BSD-1-Clause, BSD-2-Clause, BSD-3-Clause, MIT, MIT-0, Apache-1.1, Apache-2.0, Artistic-1.0, Artistic-2.0, PHP-3.0, PHP-3.01, PSF-2.0, Zlib, zlib-acknowledgement, BSL-1.0, OpenSSL, WTFPL, CC0-1.0, CC-PDDC, CC-BY-1.0, CC-BY-2.0, CC-BY-2.5, CC-BY-3.0, CC-BY-4.0, Unlicense, ISC, BlueOak-1.0.0, BSD-2-Clause-Patent, ADSL, Apache-2.0, APAFML, BSD-1-Clause, BSD-2-Clause, BSD-2-Clause-FreeBSD, BSD-2-Clause-NetBSD, BSD-2-Clause-Views, BSL-1.0, DSDP, ECL-1.0, ECL-2.0, ImageMagick, ISC, Linux-OpenIB, MIT, MIT-Modern-Variant, MS-PL, MulanPSL-1.0, Mup, PostgreSQL, Spencer-99, UPL-1.0, Xerox, 0BSD, AFL-1.1, AFL-1.2, AFL-2.0, AFL-2.1, AFL-3.0, AMDPLPA, AML, AMPAS, ANTLR-PD, ANTLR-PD-fallback, Apache-1.0, Apache-1.1, Artistic-2.0, Bahyph, Barr, BSD-3-Clause, BSD-3-Clause-Attribution, BSD-3-Clause-Clear, BSD-3-Clause-LBNL, BSD-3-Clause-Modification, BSD-3-Clause-No-Nuclear-License-2014, BSD-3-Clause-No-Nuclear-Warranty, BSD-3-Clause-Open-MPI, BSD-4-Clause, BSD-4-Clause-Shortened, BSD-4-Clause-UC, BSD-Source-Code, bzip2-1.0.5, bzip2-1.0.6, CC0-1.0, CNRI-Jython, CNRI-Python, CNRI-Python-GPL-Compatible, Cube, curl, eGenix, Entessa, FTL, HTMLTIDY, IBM-pibs, ICU, Info-ZIP, Intel, JasPer-2.0, Libpng, libpng-2.0, libtiff, LPPL-1.3c, MIT-0, MIT-advertising, MIT-open-group, MIT-CMU, MIT-enna, MIT-feh, MITNFA, MTLL, MulanPSL-2.0, Multics, Naumen, NCSA, Net-SNMP, NetCDF, NTP, OLDAP-2.0, OLDAP-2.0.1, OLDAP-2.1, OLDAP-2.2, OLDAP-2.2.1, OLDAP-2.2.2, OLDAP-2.3, OLDAP-2.4, OLDAP-2.5, OLDAP-2.6, OLDAP-2.7, OLDAP-2.8, OML, OpenSSL, PHP-3.0, PHP-3.01, Plexus, PSF-2.0, Python-2.0, Ruby, Saxpath, SGI-B-2.0, SMLNJ, SWL, TCL, TCP-wrappers, Unicode-DFS-2015, Unicode-DFS-2016, Unlicense, VSL-1.0, W3C, X11, XFree86-1.1, Xnet, xpp, Zlib, zlib-acknowledgement, ZPL-2.0, ZPL-2.1, AAL, Adobe-2006, Afmparse, Artistic-1.0, Artistic-1.0-cl8, Artistic-1.0-Perl, Beerware, blessing, Borceux, CECILL-B, ClArtistic, Condor-1.1, Crossword, CrystalStacker, diffmark, DOC, EFL-1.0, EFL-2.0, Fair, FSFUL, FSFULLR, Giftware, HPND, IJG, Leptonica, LPL-1.0, LPL-1.02, MirOS, mpich2, NASA-1.3, NBPL-1.0, Newsletr, NLPL, NRL, OGTSL, OLDAP-1.1, OLDAP-1.2, OLDAP-1.3, OLDAP-1.4, psutils, Qhull, Rdisc, RSA-MD, Spencer-86, Spencer-94, TU-Berlin-1.0, TU-Berlin-2.0, Vim, W3C-19980720, W3C-20150513, Wsuipa, WTFPL, xinetd, Zed, Zend-2.0, ZPL-1.1

Excluded from license check: pkg:golang/github.com/hashicorp/terraform-plugin-framework@v1.15.0, pkg:golang/github.com/hashicorp/terraform-plugin-go@v0.27.0, pkg:golang/github.com/hashicorp/terraform-registry-address@v0.2.5, pkg:golang/google.golang.org/protobuf, pkg:golang/golang.org/x/crypto, pkg:golang/golang.org/x/mod, pkg:golang/golang.org/x/net, pkg:golang/golang.org/x/sync, pkg:golang/golang.org/x/sys, pkg:golang/golang.org/x/text, pkg:golang/golang.org/x/time, pkg:golang/golang.org/x/tools, pkg:golang/honnef.co/go/tools, pkg:golang/go.yaml.in/yaml/v3

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
gomod/github.com/davecgh/go-spew	1.1.2-0.20180830191138-d8f796af33cc	Unknown	Unknown
gomod/github.com/getkin/kin-openapi	0.135.0	Unknown	Unknown
gomod/github.com/go-openapi/jsonpointer	0.22.4	Unknown	Unknown
gomod/github.com/go-openapi/swag/jsonname	0.25.4	🟢 8.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/12 approved changesets -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 10 all dependencies are pinned Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8
gomod/github.com/mailru/easyjson	0.9.1	Unknown	Unknown
gomod/github.com/oapi-codegen/oapi-codegen/v2	2.7.1	Unknown	Unknown
gomod/github.com/oapi-codegen/runtime	1.6.0	🟢 7.3	Details Check Score Reason Code-Review 🟢 3 Found 4/13 approved changesets -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 21 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST 🟢 7 SAST tool is not run on all commits -- score normalized to 7 Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches
gomod/github.com/oasdiff/yaml	0.0.9	Unknown	Unknown
gomod/github.com/oasdiff/yaml3	0.0.9	Unknown	Unknown
gomod/github.com/onsi/gomega	1.27.6	Unknown	Unknown
gomod/github.com/pmezard/go-difflib	1.0.1-0.20181226105442-5d4384ee4fb2	Unknown	Unknown
gomod/github.com/speakeasy-api/jsonpath	0.6.3	Unknown	Unknown
gomod/github.com/speakeasy-api/openapi	1.19.2	Unknown	Unknown
gomod/github.com/stretchr/testify	1.11.1	Unknown	Unknown
gomod/github.com/woodsbury/decimal128	1.4.0	Unknown	Unknown
gomod/go.yaml.in/yaml/v3	3.0.4	Unknown	Unknown
gomod/golang.org/x/crypto	0.54.0	Unknown	Unknown
gomod/golang.org/x/mod	0.37.0	Unknown	Unknown
gomod/golang.org/x/net	0.56.0	Unknown	Unknown
gomod/golang.org/x/sync	0.22.0	Unknown	Unknown
gomod/golang.org/x/sys	0.47.0	Unknown	Unknown
gomod/golang.org/x/text	0.40.0	Unknown	Unknown
gomod/golang.org/x/tools	0.47.0	Unknown	Unknown
gomod/google.golang.org/genproto/googleapis/rpc	0.0.0-20260414002931-afd174a4e478	🟢 7.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 SAST 🟢 3 SAST tool is not run on all commits -- score normalized to 3
gomod/google.golang.org/grpc	1.82.1	🟢 7.6	Details Check Score Reason Code-Review 🟢 9 Found 29/30 approved changesets -- score normalized to 9 Security-Policy 🟢 9 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 SAST 🟢 7 SAST tool detected but not run on all commits
gomod/google.golang.org/protobuf	1.36.11	Unknown	Unknown

Scanned Files

• go.mod