feat: bump deps and fix errors.Cause()

.gitignore

@@ -23,12 +23,6 @@ tmp/
 ## Lefthook
 !.lefthook.yaml
 
-## VSCode
-!.vscode/
-.vscode/*
-!.vscode/extensions.json
-!.vscode/settings.default.json
-
 ## Editorconfig
 !.editorconfig
 

.golangci.yaml

@@ -13,55 +13,58 @@ linters:
     - tparallel
     - paralleltest
     - containedctx
-    # Tool specific linters
-    - arangolint # Opinionated best practices for arangodb client.
-    - clickhouselint # Detects common mistakes with the ClickHouse native Go driver API.
-    - ginkgolinter # enforces standards of using ginkgo and gomega [fast: false, auto-fix: false]
-    - rowserrcheck # Checks whether Rows.Err of rows is checked successfully.
-    - sloglint # ensure consistent code style when using log/slog [fast: false, auto-fix: false]
-    #- spancheck # Checks for mistakes with OpenTelemetry/Census spans.
-    - sqlclosecheck # Checks that sql.Rows, sql.Stmt, sqlx.NamedStmt, pgx.Query are closed.
-    - zerologlint # Detects the wrong usage of `zerolog` that a user forgets to dispatch with `Send` or `Msg` [fast: false, auto-fix: false]
     # Discouraged linters
-    - noinlineerr # Disallows inline error handling (`if err := ...; err != nil {`).
-    - embeddedstructfieldcheck #  Embedded types should be at the top of the field list of a struct, and there must be an empty line separating embedded fields from regular fields. [fast]
-    - cyclop # checks function and package cyclomatic complexity [fast: false, auto-fix: false]
-    - depguard # Go linter that checks if package imports are in a list of acceptable packages [fast: true, auto-fix: false]
-    - dogsled # Checks assignments with too many blank identifiers (e.g. x, _, _, _, := f()) [fast: true, auto-fix: false]
-    - dupl # Tool for code clone detection [fast: true, auto-fix: false]
-    - dupword # checks for duplicate words in the source code [fast: true, auto-fix: false]
-    - dogsled # Checks assignments with too many blank identifiers (e.g. x, _, _, _, := f()) [fast: true, auto-fix: false]
-    - err113 # Go linter to check the errors handling expressions [fast: false, auto-fix: false]
-    - exhaustruct # Checks if all structure fields are initialized [fast: false, auto-fix: false]
-    - funlen # Tool for detection of long functions [fast: true, auto-fix: false]
-    - gochecknoglobals # Check that no global variables exist. [fast: false, auto-fix: false]
-    - gochecknoinits # Checks that no init functions are present in Go code [fast: true, auto-fix: false]
-    - gocognit # Computes and checks the cognitive complexity of functions [fast: true, auto-fix: false]
-    - gocyclo # Computes and checks the cyclomatic complexity of functions [fast: true, auto-fix: false]
-    - godot # Check if comments end in a period [fast: true, auto-fix: true]
-    - godox # Tool for detection of comment keywords [fast: true, auto-fix: false]
-    - interfacebloat # A linter that checks the number of methods inside an interface. [fast: true, auto-fix: false]
-    - intrange # (go >= 1.22) intrange is a linter to find places where for loops could make use of an integer range. [fast: true, auto-fix: false]
-    - ireturn # Accept Interfaces, Return Concrete Types [fast: false, auto-fix: false]
-    - lll # Reports long lines [fast: true, auto-fix: false]
-    - maintidx # maintidx measures the maintainability index of each function. [fast: true, auto-fix: false]
-    - nestif # Reports deeply nested if statements [fast: true, auto-fix: false]
-    - nlreturn # nlreturn checks for a new line before return and branch statements to increase code clarity [fast: true, auto-fix: false]
-    - mnd # An analyzer to detect magic numbers. [fast: true, auto-fix: false]
-    - perfsprint # Checks that fmt.Sprintf can be replaced with a faster alternative. [fast: false, auto-fix: false]
-    - prealloc # Finds slice declarations that could potentially be pre-allocated [fast: true, auto-fix: false]
-    - protogetter # Reports direct reads from proto message fields when getters should be used [fast: false, auto-fix: true]
-    - tagalign # check that struct tags are well aligned [fast: true, auto-fix: true]
-    - tagliatelle # Checks the struct tags. [fast: true, auto-fix: false]
-    - unparam # Reports unused function parameters [fast: false, auto-fix: false]
-    - varnamelen # checks that the length of a variable's name matches its scope [fast: false, auto-fix: false]
-    - wrapcheck # Checks that errors returned from external packages are wrapped [fast: false, auto-fix: false]
-    # Deprected linters
-    - gomodguard
-    - wsl
+    - cyclop # cyclomatic complexity; gocognit/gocyclo cover this when wanted
+    - depguard # requires a curated allowlist to be useful; opt in per project
+    - dogsled # blank-identifier count is a style preference
+    - dupl # clone detection is noisy on table-driven tests
+    - dupword # high false-positive rate in prose comments
+    - embeddedstructfieldcheck # embedded-field placement is a style preference
+    - err113 # forbids dynamic errors; conflicts with fmt.Errorf wrapping
+    - exhaustruct_v5 # requires every struct field set; impractical outside config
+    - funlen # length caps fight table-driven tests
+    - ginkgolinter # Ginkgo not used
+    - gochecknoglobals # package-level vars are legitimate for sentinels
+    - gochecknoinits # init is legitimate for registration patterns
+    - gocognit # complexity caps land arbitrarily; review catches this
+    - gocyclo # as above
+    - godot # comment punctuation is not worth a build failure
+    - godox # TODO/FIXME are tracked in the issue tracker, not the linter
+    - interfacebloat # interface size is a design call
+    - intrange # range-over-int is a rewrite, not a defect
+    - ireturn # returning interfaces is sometimes the right design
+    - lll # line length belongs to the formatter
+    - maintidx # composite metric; same objection as cyclop
+    - mnd # magic-number detection fires on ports, sizes, exit codes
+    - nestif # nesting depth is a review concern
+    - nlreturn # blank-line-before-return is covered by wsl_v5
+    - noinlineerr # forbids `if err := ...; err != nil`, the idiomatic form
+    - perfsprint # micro-optimisation; apply where profiling says so
+    - prealloc # speculative preallocation hurts readability
+    - protogetter # protobuf not used
+    - sloglint # opt in per project once a logging convention is fixed
+    - tagalign # struct-tag alignment is formatter territory
+    - tagliatelle # tag naming varies per wire format
+    - unparam # fires on interface implementations and callbacks
+    - varnamelen # name length by scope is a style preference
+    - wrapcheck # noisy; wrap deliberately at package boundaries instead
+    - zerologlint # zerolog not used
+    # Deprecated linters — successors stay enabled
+    - exhaustruct # replaced by exhaustruct_v5 (deprecated v2.6.0)
+    - gomodguard # replaced by gomodguard_v2 (deprecated v2.12.0)
+    - wsl # replaced by wsl_v5 (deprecated v2.2.0)
 
   # https://golangci-lint.run/docs/linters/
   settings:
+    # https://golangci-lint.run/docs/linters/configuration/#forbidigo
+    forbidigo:
+      forbid:
+        # default
+        - pattern: ^(fmt\.Print(|f|ln)|print|println)$
+        - pattern: ^errors\.Cause$
+          pkg: ^github.com/pkg/errors$
+          msg: "Use github.com/foomo/go/errors.Cause() or standard library errors.As() or errors.Unwrap() instead."
+      analyze-types: true
     # https://golangci-lint.run/docs/linters/configuration/#goconst
     goconst:
       ignore-tests: true
@@ -94,6 +97,7 @@ linters:
           disabled: true
   exclusions:
     generated: lax
+    warn-unused: true
     presets:
       - comments
       - common-false-positives

.mise.toml

@@ -7,12 +7,12 @@ minimum_release_age = "3d"
 # https://mise-tools.jdx.dev/tools/actionlint
 actionlint = "1.7.12"
 # https://mise-tools.jdx.dev/tools/golangci-lint
-golangci-lint = "2.12.2"
+golangci-lint = "2.14.0"
 # https://mise-tools.jdx.dev/tools/lefthook
-lefthook = "2.1.10"
+lefthook = "2.1.14"
 # https://mise-tools.jdx.dev/tools/goreleaser
-goreleaser = "2.17.1"
+goreleaser = "2.18.2"
 # https://github.com/oligot/go-mod-upgrade/releases
 "github:oligot/go-mod-upgrade" = "0.12.0"
 # https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck?tab=versions
-"go:golang.org/x/vuln/cmd/govulncheck" = "1.6.0"
+"go:golang.org/x/vuln/cmd/govulncheck" = "1.8.0"

examples/go.mod

@@ -1,6 +1,6 @@
 module github.com/foomo/keel/examples
 
-go 1.26.0
+go 1.27.0
 
 replace (
 	github.com/foomo/keel => ../
@@ -11,19 +11,19 @@ replace (
 
 require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
-	github.com/foomo/keel v0.30.1
-	github.com/foomo/keel/net/stream v0.30.1
-	github.com/foomo/keel/persistence/mongo v0.30.1
-	github.com/foomo/keel/persistence/postgres v0.30.1
+	github.com/foomo/keel v0.31.0
+	github.com/foomo/keel/net/stream v0.31.0
+	github.com/foomo/keel/persistence/mongo v0.31.0
+	github.com/foomo/keel/persistence/postgres v0.31.0
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
-	github.com/nats-io/nats.go v1.52.0
+	github.com/nats-io/nats.go v1.54.0
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.24.1
-	go.mongodb.org/mongo-driver/v2 v2.8.0
-	go.opentelemetry.io/otel v1.45.0
-	go.opentelemetry.io/otel/metric v1.45.0
-	go.opentelemetry.io/otel/trace v1.45.0
+	go.mongodb.org/mongo-driver/v2 v2.9.1
+	go.opentelemetry.io/otel v1.47.0-rc.1.0.20260924072922-c131dcfc3885
+	go.opentelemetry.io/otel/metric v1.47.0-rc.1.0.20260924072922-c131dcfc3885
+	go.opentelemetry.io/otel/trace v1.47.0-rc.1.0.20260924072922-c131dcfc3885
 	go.uber.org/zap v1.28.0
 )
 
@@ -45,8 +45,8 @@ require (
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/fbiville/markdown-table-formatter v0.3.0 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
-	github.com/foomo/go v0.16.0 // indirect
-	github.com/foomo/goflux v0.6.0 // indirect
+	github.com/foomo/go v0.17.1 // indirect
+	github.com/foomo/goflux v0.10.0 // indirect
 	github.com/foomo/gofuncy v0.4.0 // indirect
 	github.com/foomo/gostandards v0.3.0 // indirect
 	github.com/foomo/mongo-lock v0.2.0 // indirect
@@ -63,9 +63,9 @@ require (
 	github.com/googleapis/enterprise-certificate-proxy v0.3.16 // indirect
 	github.com/googleapis/gax-go/v2 v2.22.0 // indirect
 	github.com/grafana/otel-profiling-go v0.6.0 // indirect
-	github.com/grafana/pyroscope-go v1.4.1 // indirect
+	github.com/grafana/pyroscope-go v1.4.2 // indirect
 	github.com/grafana/pyroscope-go/godeltaprof v0.1.11 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
 	github.com/hashicorp/consul/api v1.34.3 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
@@ -77,7 +77,7 @@ require (
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/hashicorp/serf v0.10.2 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.19.2 // indirect
+	github.com/klauspost/compress v1.20.1 // indirect
 	github.com/lib/pq v1.12.3 // indirect
 	github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect
@@ -91,7 +91,7 @@ require (
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
-	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.70.1 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
@@ -106,7 +106,7 @@ require (
 	github.com/spf13/viper v1.21.0 // indirect
 	github.com/spf13/viper/remote v1.21.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/tinylib/msgp v1.6.4 // indirect
+	github.com/tinylib/msgp v1.6.5 // indirect
 	github.com/tklauser/go-sysconf v0.4.0 // indirect
 	github.com/tklauser/numcpus v0.12.0 // indirect
 	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
@@ -119,44 +119,43 @@ require (
 	go.etcd.io/etcd/client/v2 v2.305.30 // indirect
 	go.etcd.io/etcd/client/v3 v3.6.11 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/bridges/otelzap v0.20.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo v0.0.0-20260806001559-16e258788156 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/host v0.70.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/runtime v0.70.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.21.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.45.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.45.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0 // indirect
-	go.opentelemetry.io/otel/exporters/prometheus v0.67.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.21.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.45.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0 // indirect
-	go.opentelemetry.io/otel/log v0.21.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.45.0 // indirect
-	go.opentelemetry.io/otel/sdk/log v0.21.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.45.0 // indirect
+	go.opentelemetry.io/contrib/bridges/otelzap v0.20.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo v0.0.0-20260930123116-8d041e719a38 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/host v0.71.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/runtime v0.71.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.22.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.22.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.46.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0 // indirect
+	go.opentelemetry.io/otel/exporters/prometheus v0.68.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.22.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.46.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.46.0 // indirect
+	go.opentelemetry.io/otel/log v1.47.0-rc.1 // indirect
+	go.opentelemetry.io/otel/sdk v1.47.0-rc.1.0.20260924072922-c131dcfc3885 // indirect
+	go.opentelemetry.io/otel/sdk/log v0.22.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.47.0-rc.1.0.20260924072922-c131dcfc3885 // indirect
 	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.54.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
 	golang.org/x/exp v0.0.0-20260529124908-c761662dc8c9 // indirect
-	golang.org/x/mod v0.38.0 // indirect
-	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/time v0.16.0 // indirect
 	google.golang.org/api v0.282.0 // indirect
 	google.golang.org/genproto v0.0.0-20260526163538-3dc84a4a5aaa // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
-	google.golang.org/grpc v1.83.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/grpc v1.83.2 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )