chore(release)!: trigger v6 major cut by rodrigodh · Pull Request #554 · LerianStudio/lib-commons

rodrigodh · 2026-07-21T18:46:58Z

	Lib Commons

Description

Triggers the v6 major release on the develop beta channel.

The previous trigger (#553) only changed the README, and the release workflow's paths-ignore skips **.md, so no release ran. This PR adds a one-line v6 note to the commons package godoc (commons/doc.go) — a non-ignored .go path — so the release pipeline runs. The Fiber v3 / /v6 breaking change is already on develop; semantic-release will pick it up and cut v6.0.0-beta.1.

Type of Change

BREAKING CHANGE: Consumers must update their integration
docs: godoc note (in a .go file)

Breaking Changes

Module path is now /v6 — imports become github.com/LerianStudio/lib-commons/v6/...; run go mod tidy.
Fiber v3 — HTTP/server helpers target gofiber/fiber/v3; consumers on Fiber v2 must migrate.

(Code for both already exists on develop; this PR only makes the pipeline register the major.)

Testing

go build ./commons/... passes
Release job computes v6.0.0-beta.1 on merge (verify on develop)

Architectural Checklist

Breaking change flagged above
No behavior change (godoc only)

Related Issues

Unblocks the v6.0.0 stable release (#549)

Add a v6 note to the commons package godoc. This touches a non-doc-ignored path so the release pipeline runs and semantic-release registers the major (the Fiber v3 / /v6 breaking change already landed on develop). BREAKING CHANGE: module path is now github.com/LerianStudio/lib-commons/v6 and HTTP/server helpers target gofiber/fiber/v3; consumers must update all imports and migrate off Fiber v2. X-Lerian-Ref: 0x1

coderabbitai · 2026-07-21T18:47:17Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: fcc02711-046f-4035-bae5-7181a9e128c8

📥 Commits

Reviewing files that changed from the base of the PR and between 81cdd5f and 1cf8d79.

📒 Files selected for processing (1)

commons/doc.go

📝 Walkthrough

Walkthrough

Changes

Package Documentation Update

Layer / File(s)	Summary
Package documentation `commons/doc.go`	The package comment documents the `github.com/LerianStudio/lib-commons/v6` module path and Fiber v3 HTTP/server helper targeting.

Possibly related PRs

LerianStudio/lib-commons#553: Updates v6 README installation and breaking-change documentation for the same module and Fiber migration.

✨ Finishing Touches

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch chore/trigger-v6-major-2

_{Comment @coderabbitai help to get the list of available commands.}

lerian-studio · 2026-07-21T18:48:49Z

🔒 Security Scan Results — `lib-commons`

✅ PR Mergeable — no blocking findings

Stage	Status	Blocking?
Filesystem Scan	✅ Clean	—
Docker Image Scan	➖ Skipped	—
Docker Hub Health Score	➖ Skipped	—
Pre-release Version Check	✅ Clean	—

Trivy

Filesystem Scan

✅ No vulnerabilities or secrets found.

Pre-release Version Check

✅ No unstable version pins found.

_{🔍 View full scan logs}

lerian-studio · 2026-07-21T18:55:05Z

🔍 PR Validation Summary

🚫 PR Blocked — 1 blocking failure

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	❌ failure	yes
PR Description	✅ success	yes
PR Size	⏭️ skipped	no
Auto Labels	⏭️ skipped	no
PR Metadata	⏭️ skipped	no

Fix the blocking checks above before merge.

_{🔍 View workflow run}

lerian-studio · 2026-07-21T19:02:05Z

📊 Unit Test Coverage Report: `app`

Metric	Value
Overall Coverage	`87.3%` ✅ PASS
Threshold	`80%`

Coverage by Package

Package	Coverage
`github.com/LerianStudio/lib-commons/v6/commons/backoff`	91.1%
`github.com/LerianStudio/lib-commons/v6/commons/certificate`	88.8%
`github.com/LerianStudio/lib-commons/v6/commons/circuitbreaker`	86.8%
`github.com/LerianStudio/lib-commons/v6/commons/cron`	94.2%
`github.com/LerianStudio/lib-commons/v6/commons/crypto`	95.6%
`github.com/LerianStudio/lib-commons/v6/commons/dlq`	81.0%
`github.com/LerianStudio/lib-commons/v6/commons/errgroup`	86.1%
`github.com/LerianStudio/lib-commons/v6/commons/events`	100.0%
`github.com/LerianStudio/lib-commons/v6/commons/internal/nilcheck`	100.0%
`github.com/LerianStudio/lib-commons/v6/commons/jwt`	89.4%
`github.com/LerianStudio/lib-commons/v6/commons/license`	96.9%
`github.com/LerianStudio/lib-commons/v6/commons/mongo`	89.0%
`github.com/LerianStudio/lib-commons/v6/commons/net/http/idempotency`	87.9%
`github.com/LerianStudio/lib-commons/v6/commons/net/http/openapi`	98.4%
`github.com/LerianStudio/lib-commons/v6/commons/net/http/problem`	100.0%
`github.com/LerianStudio/lib-commons/v6/commons/net/http/ratelimit`	92.3%
`github.com/LerianStudio/lib-commons/v6/commons/net/http`	96.2%
`github.com/LerianStudio/lib-commons/v6/commons/outbox`	92.1%
`github.com/LerianStudio/lib-commons/v6/commons/pointers`	100.0%
`github.com/LerianStudio/lib-commons/v6/commons/postgres`	87.7%
`github.com/LerianStudio/lib-commons/v6/commons/rabbitmq`	89.2%
`github.com/LerianStudio/lib-commons/v6/commons/redis`	89.5%
`github.com/LerianStudio/lib-commons/v6/commons/safe`	99.6%
`github.com/LerianStudio/lib-commons/v6/commons/secretsmanager`	99.4%
`github.com/LerianStudio/lib-commons/v6/commons/security/ssrf`	95.9%
`github.com/LerianStudio/lib-commons/v6/commons/security`	100.0%
`github.com/LerianStudio/lib-commons/v6/commons/server`	87.3%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/cache`	97.9%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/client`	93.0%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/consumer`	87.9%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/core`	98.5%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/event`	96.5%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/internal/eviction`	100.0%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/log`	100.0%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/middleware`	93.8%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/mongo`	76.3%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/postgres`	84.9%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/rabbitmq`	83.3%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/redis`	95.8%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/s3`	89.3%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/tenantcache`	98.6%
`github.com/LerianStudio/lib-commons/v6/commons/tenant-manager/valkey`	100.0%
`github.com/LerianStudio/lib-commons/v6/commons/transaction`	95.1%
`github.com/LerianStudio/lib-commons/v6/commons/webhook`	93.2%
`github.com/LerianStudio/lib-commons/v6/commons`	95.2%

Generated by Go PR Analysis workflow

* feat(webhook): add v1-only verification X-Lerian-Ref: 0x1 * fix(webhook): harden freshness verification X-Lerian-Ref: 0x1 * feat(secretsmanager): add scoped secret refs Add version-addressed external credential references bound to a trusted tenant namespace before AWS retrieval. X-Lerian-Ref: 0x1 * feat(core)!: migrate to Fiber v3, cut /v6 major Bump gofiber/fiber v2->v3.4.0 and cut the /v6 module major. Consume lib-observability/v2 (v2.0.0-beta.1). fiber.Ctx is now an interface by value: all *fiber.Ctx signatures across commons/net/http and tenant-manager drop the pointer; UserContext()/SetUserContext() -> Context()/SetContext(). Reconcile the huma/openapi wrapper to the v3 humafiber binding (NewV2WithGroup -> NewWithGroup, no huma bump). Other v3 deltas: c.BodyParser -> c.Bind().Body, CORS config fields now []string, App.Test(req,int) -> fiber.TestConfig{}, App.Add now takes []string. BREAKING CHANGE: module path is now github.com/LerianStudio/lib-commons/v6 and exported commons/net/http helpers take fiber.Ctx by value; consumers must be on Fiber v3. X-Lerian-Ref: 0x1 * chore(ci): accept CVE-2026-45045 (transitive fiber/v2 via humafiber) Fiber v3 migration leaves fiber/v2 in the module graph only as an indirect dep of huma's humafiber adapter (v2 binding compiled, never invoked). The v2 trusted-proxy CVE path is unreachable and has no fixed version; suppress to unblock the security gate. See the .trivyignore entry for the removal trigger. X-Lerian-Ref: 0x1 * fix(net): detect CORS wildcard in parsed origins, not raw string The wildcard guards compared the raw ACCESS_CONTROL_ALLOW_ORIGIN string to "*", so a mixed value like "*,https://trusted.example" bypassed the deny-wildcard policy and, with AllowCredentials=true, panicked Fiber v3 (which rejects any "*" entry in AllowOrigins alongside credentials). Detect a "*" entry anywhere in the parsed list via hasWildcardOrigin, and add a regression test for the mixed-wildcard input. (CodeRabbit #541) X-Lerian-Ref: 0x1 * fix(deps): bump golang.org/x/text to v0.39.0 (CVE-2026-56852) Trivy newly flagged golang.org/x/text v0.38.0 for CVE-2026-56852 (infinite loop on invalid input); fixed in v0.39.0. Unlike the transitive fiber/v2 advisory, this one has a fix version, so bump rather than suppress. X-Lerian-Ref: 0x1 * chore(deps): bump lib-observability/v2 to v2.0.0 (#548) Pin to the stable v2.0.0 release of lib-observability (was v2.0.0-beta.1). No API changes; build and vet pass. X-Lerian-Ref: 0x1 * fix: breaking changes should trigger major bump in .releaserc.yml (#547) * fix: bump major on breaking changes in .releaserc.yml * test: update release policy test to expect major bump on breaking changes * feat(webhook): inject W3C trace context into outbound deliveries Outbound webhook requests carried no traceparent/tracestate, so receivers could not correlate a delivery with the originating trace. Inject W3C trace context in doHTTP after the webhook headers are set. Use an explicit propagation.TraceContext propagator rather than the global propagator, which commonly bundles Baggage — arbitrary baggage (tenant IDs, internal attributes) must not be leaked to external receivers. Closes #488 Claude-Session: https://claude.ai/code/session_01RcQLK4qK1kbpvXWjuAR3Xh * feat(mongo): add client-level CSOT timeout with a 30s default connectLocked set only ServerSelectionTimeout and HeartbeatInterval, never a client-level Timeout (CSOT). Under mongo-driver/v2 CSOT is the single per-operation bound, so callers passing a deadline-less context could hang indefinitely. Add Config.Timeout, apply it via clientOptions.SetTimeout, and default it to 30s (matching the existing inline-default pattern for the sibling timeouts). Because CSOT applies as a fallback deadline to every op without its own context deadline, a 30s default would break bootstrap index builds on large collections. EnsureIndexes now imposes a longer explicit deadline (ensureIndexesTimeout) when the caller supplied none, while respecting any caller-provided deadline. Closes #503 Claude-Session: https://claude.ai/code/session_01RcQLK4qK1kbpvXWjuAR3Xh * feat(net): add opt-in WithFailClosed to the idempotency middleware On transient Redis errors the idempotency middleware fails open in four branches (GetClient, SetNX, and the two duplicate/replay reads): each logs and calls c.Next(), running the mutation with no dedup coverage — and on the duplicate/replay path silently re-running an already-seen request. Add a failClosed flag and WithFailClosed(bool) option (plus an optional WithUnavailableHandler, mirroring the existing WithRejectedHandler). All four branches now route through a shared onRedisError helper: when failClosed is set they abort with 503 (or the configured handler) instead of proceeding. Default stays false, so existing fail-open behavior is preserved exactly; replay-cache consumers that depend on it are unaffected. The Lua/atomic gate is intentionally out of scope. Closes #508 Claude-Session: https://claude.ai/code/session_01RcQLK4qK1kbpvXWjuAR3Xh * test(webhook): fix trace-context test data race and strengthen span assertion Transfer captured request headers through a buffered channel (cap 1) instead of a shared variable: the send/receive establishes a happens-before edge so the test is race-free under -race. HTTP round-trip completion alone does not synchronize the shared read. Also assert the injected traceparent's span id equals the active span's span id, not just the trace id, so the test proves injection used the ACTIVE span rather than any span in the same trace. Claude-Session: https://claude.ai/code/session_01RcQLK4qK1kbpvXWjuAR3Xh * chore(release)!: cut lib-commons v6 major (#553) Update install instructions to the /v6 module path and trigger the major release. The v6 line migrates to Fiber v3 and cuts the /v6 module path (github.com/LerianStudio/lib-commons/v6). BREAKING CHANGE: module path is now github.com/LerianStudio/lib-commons/v6 and HTTP/server helpers target gofiber/fiber/v3; consumers must update all imports and migrate off Fiber v2. X-Lerian-Ref: 0x1 * chore(release)!: trigger v6 major cut (#554) Add a v6 note to the commons package godoc. This touches a non-doc-ignored path so the release pipeline runs and semantic-release registers the major (the Fiber v3 / /v6 breaking change already landed on develop). BREAKING CHANGE: module path is now github.com/LerianStudio/lib-commons/v6 and HTTP/server helpers target gofiber/fiber/v3; consumers must update all imports and migrate off Fiber v2. X-Lerian-Ref: 0x1 --------- Co-authored-by: lerian-studio <srv.iam@lerian.studio> Co-authored-by: Fred Amaral <fred@fredamaral.com.br> Co-authored-by: Gandalf, the White <gandalf@lerian.studio>

rodrigodh merged commit a62d3d3 into develop Jul 21, 2026
3 of 5 checks passed

github-actions Bot deleted the chore/trigger-v6-major-2 branch July 21, 2026 18:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(release)!: trigger v6 major cut#554

chore(release)!: trigger v6 major cut#554
rodrigodh merged 1 commit into
developfrom
chore/trigger-v6-major-2

rodrigodh commented Jul 21, 2026

Lib Commons

Uh oh!

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Uh oh!

Uh oh!

lerian-studio commented Jul 21, 2026

Uh oh!

lerian-studio commented Jul 21, 2026

Uh oh!

lerian-studio commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

rodrigodh commented Jul 21, 2026

Lib Commons

Description

Type of Change

Breaking Changes

Testing

Architectural Checklist

Related Issues

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Uh oh!

Uh oh!

lerian-studio commented Jul 21, 2026

🔒 Security Scan Results — lib-commons

✅ PR Mergeable — no blocking findings

Trivy

Filesystem Scan

Pre-release Version Check

Uh oh!

lerian-studio commented Jul 21, 2026

🔍 PR Validation Summary

🚫 PR Blocked — 1 blocking failure

Uh oh!

lerian-studio commented Jul 21, 2026

📊 Unit Test Coverage Report: app

Coverage by Package

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

🔒 Security Scan Results — `lib-commons`

📊 Unit Test Coverage Report: `app`