Repository navigation
chore(deps): bump github.com/launchdarkly/go-server-sdk/v7 from 7.13.4 to 7.18.0 - #873
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github.com/launchdarkly/go-server-sdk/v7](https://github.com/launchdarkly/go-server-sdk) from 7.13.4 to 7.18.0. - [Release notes](https://github.com/launchdarkly/go-server-sdk/releases) - [Changelog](https://github.com/launchdarkly/go-server-sdk/blob/v7/CHANGELOG.md) - [Commits](launchdarkly/go-server-sdk@v7.13.4...v7.18.0) --- updated-dependencies: - dependency-name: github.com/launchdarkly/go-server-sdk/v7 dependency-version: 7.18.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Dependency verification: NEEDS A HUMAN DECISIONRisk tier high (dev-server, go-directive, ld-sdk) · ecosystems: gomod · head Decisions for a humanVerification is complete for these items. Each one needs a choice, not more checks.
Updates
5 transitive update(s)
Go directive: What the verifier checked
Already failing on
|
| Check | Kind | Base | PR | Outcome |
|---|---|---|---|---|
| A dev-server import with a rejected SDK key fails with the SDK initialization timeout after the full --sdk-init-timeout | discriminating | fail | pass | proven (fails on base, passes on PR) |
| The binary imports and syncs a project through the Go SDK and serves the same evaluated flags on /dev and the SDK routes | guard | pass | pass | holds on both |
| The SDK adapter evaluates real flag configurations (rules, segments, multi-kind targets, rollouts, prerequisites) to the golden flag state | guard | pass | pass | holds on both |
| The Go SDK FDv2 data system initializes from the dev server and receives an override and a sync | guard | pass | pass | holds on both |
Impact review
go-server-sdk 7.13.4 → 7.18.0 (with go-sdk-common 3.6.0, go-server-sdk-evaluation 3.1.0, go-sdk-events 3.7.0, go-jsonstream 3.1.2, eventsource 1.14.0, x/sys 0.45.0, and a forced go 1.25.0 line). The dev server uses the SDK in one place in shipped code: internal/dev_server/adapters/sdk.go creates a client with MakeCustomClient and reads AllFlagsState on every project import and sync. It also builds its FDv2 responses (sdk/fdv2.go) with SDK subsystems types, and uses go-sdk-common values and contexts everywhere. One upstream behavior change reaches ldcli: since 7.16.0, a rejected SDK key (401/403) no longer stops the data source. An import or sync then fails only after the full --sdk-init-timeout, with a timeout error instead of an immediate 'initialization failed', and the failed client keeps retrying in the background. The FDv2 wire types that ldcli serializes are unchanged, except for fields that ldcli does not use. Four generated checks run the import, sync, evaluation, FDv2, and rejected-key paths through the real SDK and binary.
- github.com/launchdarkly/go-server-sdk/v7 v7.13.4..v7.18.0: 7.14.0 transport options. 7.14.1 minimum Go 1.24. 7.14.2 to 7.14.7 FDv2 data-system fixes (initializer spec, synchronizer left open after Close, x-ld-fd-fallback). 7.15.0 X-LaunchDarkly-Instance-Id header, FDv2 Goodbye loses Silent/Catastrophe. 7.15.1 to 7.15.4 core-library and EasyJSON churn, reverted to v3 libraries. 7.15.6 go-jsonstream 3.1.2. 7.16.0 behavior change: invalid SDK keys and TLS failures no longer stop data sources, MakeCustomClient returns ErrInitializationTimeout instead of ErrInitializationFailed for 401/403, and streaming uses an extended 5 min to 1 h backoff. 7.17.0 DuplicateKeysKeepFirst and FDv2 payload filter deprecations, initialization without a selector, Valid status before readiness. 7.17.1 log-once fixes. 7.18.0 file-based flag overrides (ldoverrides, opt-in), file data source reload. The subsystems FDv2 types lost their 'not stable, do not use' warnings. (breaking) (source)
- github.com/launchdarkly/go-sdk-common/v3 v3.4.0..v3.6.0: Additive. ldcontext.NewSingleContextKind. ldreason gains an overrideAffected property, written to JSON only when true. Minimum Go 1.24, go-jsonstream 3.1.2. (source)
- github.com/launchdarkly/go-server-sdk-evaluation/v3 v3.0.1..v3.1.0: Transitive. Adds an override marker to ldmodel FeatureFlag and Segment. go-jsonstream 3.1.2. No evaluation rule changes in the notes. (source)
- github.com/launchdarkly/go-jsonstream/v3 v3.1.0..v3.1.2: Transitive. Rewrite of the default jreader tokenizer and jwriter buffer for speed. An RFC 8259 strictness change (chore(main): release 0.0.1 #46) was reverted (feat: add methods to send real (local) API requests for demo #54) before 3.1.2. (source)
- github.com/launchdarkly/eventsource v1.10.0..v1.14.0: Transitive SSE client of the SDK. Retry curves (used by the 7.16.0 backoff), Close deadlock fix (1.11.1), request.Context cancellation, server-side features that ldcli does not use. (source)
- github.com/launchdarkly/go-sdk-events/v3 v3.5.0..v3.7.0: Transitive. EventMetrics, override-affected summary counters. The dev server configures ldcomponents.NoEvents(), so no event code runs. (source)
- golang.org/x/sys v0.41.0..v0.45.0: Transitive. Declares go 1.25.0. govulncheck: fixes GO-2026-5024 at the required-module level (not reachable on base). (source)
- Used in:
internal/dev_server/adapters/sdk.go,internal/dev_server/model/project.go,internal/dev_server/model/flags_state.go,internal/dev_server/sdk/fdv2.go,internal/dev_server/sdk/client_flag_eval.go,cmd/dev_server/start_server.go,internal/setup/installer.go - Upstream behavior changes that reach ldcli: yes
- Note: Import, sync, and evaluation do not change. With 17 real flag configurations (targets, context targets, clause operators, segments, semver, prerequisites, rollouts by key and by attribute, an experiment, JSON edge values, a deleted flag), the SDK adapter gives the same flag state on both versions. The binary serves the same values on /dev/projects, /sdk/latest-all, /sdk/poll (FDv2), and /sdk/evalx after an import and a sync. (generated/sdk-import-evaluates-flag-configs.sh, generated/devserver-import-sync-through-sdk.sh, generated/golden-v1.json.txt, generated/golden-v2.json.txt)
- Note: FDv2 types that ldcli serializes in sdk/fdv2.go and sdk/client_flag_eval.go (ServerIntent, Payload, PutObject, PollingPayload, RawEvent, Selector, NewSelector, ObjectKind, IntentCode) have the same fields and JSON tags. Only Goodbye lost Silent and Catastrophe, and ldcli does not use Goodbye. The 'not stable, do not use' warnings are gone from these types. The Go SDK FDv2 data system initializes from the dev server and receives an override and a sync on both versions. Only 7.18.0 also sends a flag change event for an FDv2 full transfer on an open stream. That affects SDK client code only. No shipped ldcli code uses flag trackers. (git diff v7.13.4 v7.18.0 -- subsystems/, generated/fdv2-go-sdk-against-dev-server.sh)
- Note: Other changes that reach the dev-server client do not change results. Every stream request from an import or sync now carries a random X-LaunchDarkly-Instance-Id header (7.15.0). The fake stream saw it on the PR only. AllFlagsState gained an override-only path that applies only when an override source is configured. ldcli configures none, and it calls AllFlagsState only after a successful initialization. (generated/devserver-import-sync-through-sdk.sh (detail: instance-id header), ldclient.go AllFlagsState diff)
- Note: Not reachable: ldfiledata DuplicateKeys deprecation, FDv2 payload filter deprecation, ldoverrides and ldmiddleware (new, not imported), events changes (the dev server uses NoEvents), big segments, hooks, and persistent stores. The minimum Go is 1.24 and ldcli uses 1.25. internal/setup/installer.go only names the module path as a string. (rg -n 'launchdarkly/go-server-sdk' --glob '*.go')
- Note: go 1.25 → go 1.25.0 is forced: go-server-sdk 7.18.0 and golang.org/x/sys 0.45.0 both declare go 1.25.0, and no toolchain line was added. golangci-lint and the release snapshot (8 targets in goreleaser-cross) pass, as the go-directive gate requires. (logs/pr/release-snapshot.log, logs/pr/golangci-lint.log)
- Note: Already on main, not caused by this PR: the go-jsonstream reader turns an escaped surrogate pair in flag JSON (for example \ud83d\ude00) into two U+FFFD characters on both versions. The guard golden keeps this behavior. (generated/golden-v1.json.txt (json-values.unicode))
Check details
pr-state
- Branch is 6 commit(s) behind
main. The checks ran on the PR merged into the currentmain.
pr-disclosure
- Not named, but forced: github.com/launchdarkly/go-sdk-common/v3 v3.4.0 → v3.6.0, required by github.com/launchdarkly/go-server-sdk/v7 v7.18.0
ci-status
Workflows that PR CI must run on 669fa3d, and their runs on that commit:
| Workflow | Event | Run | Result |
|---|---|---|---|
.github/workflows/dependency-scan.yml |
pull_request | 38593083700 2026-10-14 | pass: success |
.github/workflows/dev-server-ui.yml |
pull_request | 38593083603 2026-10-14 | pass: success |
.github/workflows/go.yml |
pull_request | 38593083589 2026-10-14 | pass: success |
.github/workflows/lint-pr-title.yml |
pull_request_target | 38593134078 2026-10-14 | pass: success |
- Check
Cursor Bugbot: success - Check
Do Not Merge checker: success - Check
Require additional human oversight on bot PRs: success - Check
semgrep-cloud-platform/scan: success
upstream-changes
github.com/launchdarkly/go-sdk-common/v3v3.4.0 → v3.6.0: launchdarkly/go-sdk-common, 18 commits, 21 files, notes: release notes, full rangegithub.com/launchdarkly/go-server-sdk/v7v7.13.4 → v7.18.0: launchdarkly/go-server-sdk, 120 commits, 181 files, notes: release notes, full range, mentions: breaking (1), deprecation (2), requirements (1)
transitive-changes
- gomod (modules compiled into ldcli): 7 changed, 0 added, 0 removed
github.com/launchdarkly/eventsourcev1.10.0 → v1.14.0 (minor)github.com/launchdarkly/go-jsonstream/v3v3.1.0 → v3.1.2 (patch)github.com/launchdarkly/go-sdk-common/v3v3.4.0 → v3.6.0 (minor)github.com/launchdarkly/go-sdk-events/v3v3.5.0 → v3.7.0 (minor)github.com/launchdarkly/go-server-sdk-evaluation/v3v3.0.1 → v3.1.0 (minor)github.com/launchdarkly/go-server-sdk/v7v7.13.4 → v7.18.0 (minor)golang.org/x/sysv0.41.0 → v0.45.0 (major)
license-changes
github.com/launchdarkly/eventsource@v1.14.0: Apache-2.0github.com/launchdarkly/go-jsonstream/v3@v3.1.2: Apache-2.0github.com/launchdarkly/go-sdk-common/v3@v3.6.0: Apache-2.0github.com/launchdarkly/go-sdk-events/v3@v3.7.0: Apache-2.0github.com/launchdarkly/go-server-sdk-evaluation/v3@v3.1.0: Apache-2.0github.com/launchdarkly/go-server-sdk/v7@v7.18.0: Apache-2.0golang.org/x/sys@v0.45.0: BSD-3-Clause
go-directive
- go directive:
1.25→1.25.0; toolchain:none→none - Go used for this PR:
go1.25.14
go-generate-drift
Files rewritten by go generate ./... (patch saved as drift.patch next to this check's status):
internal/dev_server/api/server.gen.go | 430 +++++++++++++++-----
1 file changed, 323 insertions(+), 107 deletions(-)
The regenerated code does not compile:
# github.com/launchdarkly/ldcli/internal/dev_server/api
internal/dev_server/api/data_mapping.go:11:5: unknown field Id in struct literal of type Variation
internal/dev_server/api/get_project.go:20:3: unknown field LastSyncedFromSource in struct literal of type ProjectJSONResponse
internal/dev_server/api/patch_project.go:24:3: unknown field LastSyncedFromSource in struct literal of type ProjectJSONResponse
internal/dev_server/api/post_add_project.go:38:3: unknown field LastSyncedFromSource in struct literal of type ProjectJSONResponse
internal/dev_server/api/post_import_project.go:45:21: v.Id undefined (type Variation has no field or method Id)
internal/dev_server/api/post_import_project.go:75:3: unknown field LastSyncedFromSource in struct literal of type ProjectJSONResponse
internal/dev_server/api/server.gen.go:382:16: undefined: runtime.BindQueryParameterWithOptions
internal/dev_server/api/server.gen.go:382:114: undefined: runtime.BindQueryParameterOptions
internal/dev_server/api/server.gen.go:384:30: undefined: runtime.RequiredParameterError
internal/dev_server/api/server.gen.go:395:16: undefined: runtime.BindQueryParameterWithOptions
internal/dev_server/api/server.gen.go:395:16: too many errors
govulncheck
- Fixed by this PR (required module): GO-2026-5024
- Still reachable on the PR: GO-2026-5320 (github.com/yuin/goldmark, fixed in v1.7.17), GO-2026-5970 (golang.org/x/text, fixed in v0.39.0), GO-2026-6603 (stdlib, fixed in v1.26.9), GO-2026-6605 (stdlib, fixed in v1.26.9), GO-2026-6607 (stdlib, fixed in v1.26.9), GO-2026-6608 (stdlib, fixed in v1.26.9), GO-2026-6609 (stdlib, fixed in v1.26.9), GO-2026-6610 (stdlib, fixed in v1.26.9), GO-2026-6611 (stdlib, fixed in v1.26.9), GO-2026-6612 (stdlib, fixed in v1.26.9), GO-2026-6613 (stdlib, fixed in v1.26.9), GO-2026-6617 (stdlib, fixed in v1.26.9)
release-snapshot
- Release image not pullable (unauthorized). Fallback: public
goreleaser/goreleaser-cross:v1.24.2(goreleaser/goreleaser-cross@sha256:c4bfde12925cd9e23faae3e35…) with sha256-pinned musl.cc toolchains at/musl. - dist/ldcli_darwin_amd64_v1/ldcli: Mach-O 64-bit x86_64 executable, flags:
<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> - dist/ldcli_darwin_arm64_v8.0/ldcli: Mach-O 64-bit arm64 executable, flags:
<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE> - dist/ldcli_linux_386_sse2/ldcli: ELF 32-bit LSB executable, Intel 80386
- dist/ldcli_linux_amd64_v1/ldcli: ELF 64-bit LSB executable, x86-64
- dist/ldcli_linux_arm64_v8.0/ldcli: ELF 64-bit LSB executable, ARM aarch64
- dist/ldcli_windows_386_sse2/ldcli.exe: PE32 executable (console) Intel 80386, for MS Windows
- dist/ldcli_windows_amd64_v1/ldcli.exe: PE32+ executable (console) x86-64, for MS Windows
- dist/ldcli_windows_arm64_v8.0/ldcli.exe: PE32+ executable (console) Aarch64, for MS Windows
- Fidelity gap: the public image plus musl.cc replace the LaunchDarkly image, which can have extras that this build does not have.
- Fidelity gap: the binaries are built, but not executed.
- Fidelity gap:
goreleaser builddoes not run thedockers,docker_manifests, orbrewssteps.
binary-smoke
ldcli --version: ldcli version dev- dev-server served /ui/ (1160 KB) and /dev/projects (
[])
generated: devserver-rejected-sdk-key
- Import with a rejected SDK key (--sdk-init-timeout 3s): HTTP 500 after 3009 ms, 1 stream request(s)
- Response:
{"code":"internal_server_error","message":"unable to get source flags from LD SDK: timeout encountered waiting for LaunchDarkly client initialization"} - SDK stream after the 401: retrying in 221.0702 secs;
Closing LaunchDarkly clientlines: 0 (adapters/sdk.go returns before its deferred Close when MakeCustomClient fails)
generated: devserver-import-sync-through-sdk
- Import through the SDK: 16 flags; flagsState matches the golden evaluation
/sdk/latest-all: values match/sdk/poll(FDv2): events ["payload-transferred","put-object","server-intent"]; values match/sdk/evalx/{envId}/contexts/{context}: values match- Sync through the SDK: HTTP 200; flagsState matches the golden evaluation
- Fake stream requests: 2; instance-id header: instance-id=set
generated: sdk-import-evaluates-flag-configs
- 16 flags evaluated for a multi-kind context; user-agent: GoClient/7.18.0
- AllFlagsState JSON sha256:
341c6aac242974fc(compare across sides in the logs)
generated: fdv2-go-sdk-against-dev-server
- verify: FDv2 client initialized from /sdk/poll; override event over /sdk/stream: yes; synced values applied: yes; flag change event for the sync: yes
Generated by scripts/dependency-pr/verify.sh (profile full) at 2026-10-17T00:24:37Z. The verifier does not approve or merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github.com/launchdarkly/go-server-sdk/v7 from 7.13.4 to 7.18.0.
Release notes
Sourced from github.com/launchdarkly/go-server-sdk/v7's releases.
... (truncated)
Changelog
Sourced from github.com/launchdarkly/go-server-sdk/v7's changelog.
... (truncated)
Commits
2ccb971chore(v7): release 7.18.0 (#453)8b5131afeat: Add file-based flag overrides (#458)3f3cf2aci: add released-dependency check for release branches (#456)c14f870fix: Do not log the cached-data warning after initialization succeeds (#449)b392b02ci: add nightly contract tests with long-running tests enabled (#454)b28b76cchore(deps): bump go.opentelemetry.io/otel/sdk from 1.43.0 to 1.45.0 in /ldot...778569efeat(internal): add reload orchestration with debouncing and failure retry to...5bf0434fix: Make the file data source's initialized flag safe to read concurrently (...d56d62dci: use the shared sdk-go-version-matrix workflow (#450)51436bachore(v7): release 7.17.1 (#446)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Overview
Bumps LaunchDarkly Go server SDK from
7.13.4to7.18.0and refreshes related modules ingo.mod/go.sumonly—no application source changes.Also updates
go-sdk-common/v3(3.4.0→3.6.0) and several transitive LaunchDarkly packages (eventsource,go-jsonstream,go-sdk-events,go-server-sdk-evaluation), plusgolang.org/x/sys(0.41.0→0.45.0). The modulegodirective is normalized to1.25.0, andgopkg.in/ghodss/yaml.v1appears as a new indirect dependency from the upgraded tree.The newer SDK brings file-based flag overrides, file data-source reload behavior, and assorted initialization/logging fixes from 7.14–7.18; the CLI will pick those up wherever it embeds the server SDK (e.g. dev server adapters).
Reviewed by Cursor Bugbot for commit 669fa3d. Bugbot is set up for automated code reviews on this repo. Configure here.