Bump github.com/basecamp/cli for the keyring probe race fix - #661
Conversation
Pulls in basecamp/cli#69: concurrent CLI processes could lose the keychain probe-write race and misread the lost write as an unavailable keyring, failing auth with credentials-not-found. go mod tidy raises the go directive to 1.26.7 to match the dependency.
There was a problem hiding this comment.
Pull request overview
Bumps github.com/basecamp/cli to include the concurrent keyring probe race fix.
Changes:
- Updates the dependency and checksums.
- Raises the minimum Go version to 1.26.7.
- Nix’s locked Go 1.26.5 must also be updated.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
go.mod |
Updates the CLI dependency and Go requirement. |
go.sum |
Updates dependency checksums. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0b59bbf008
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The cli bump raises go.mod's directive to 1.26.7, but flake.lock still pinned a nixpkgs whose go_1_26 was 1.26.5, so the Nix flake could not build. Advance nixpkgs to a revision carrying 1.26.7 and recompute vendorHash for the changed go.sum; verified via make update-nix-hash.
The pinned github.com/basecamp/cli module requires Go 1.26.7, so lowering go.mod's go line can no longer make an older patch release build.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f1f7cfeb8c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| go 1.26.5 | ||
|
|
||
| toolchain go1.26.7 | ||
| go 1.26.7 |
There was a problem hiding this comment.
For contributors or agents relying on the repository instructions, the root AGENTS.md still advertises Go 1.26+ even though this directive now rejects Go 1.26.0–1.26.6 when automatic toolchain switching is unavailable. The final tree updates CONTRIBUTING.md and install.md, but that newly documented 1.26.7 floor remains inconsistent here; update the root requirement as well.
AGENTS.md reference: AGENTS.md:L108-L108
Useful? React with 👍 / 👎.
Bumps the
github.com/basecamp/clipin to844e9f9, picking up basecamp/cli#69.Root cause: two concurrent CLI processes racing the keychain availability probe — the loser saw its probe write missing and misread the lost race as an unavailable keyring, so auth failed intermittently with "credentials not found" (reproduced 199/200 under two concurrent
basecamp me -jloops).go mod tidyraises thegodirective to 1.26.7 to match the dependency and collapses the now-redundanttoolchainline.Summary by cubic
Bumps
github.com/basecamp/clito pick up a fix for a keyring probe race that caused intermittent auth failures with "credentials not found" under concurrent CLI processes.go mod tidyraises thegodirective to 1.26.7 and collapses the redundanttoolchainline.flake.lockso Nix builds get Go 1.26.7 and recomputesvendorHash.go.modline no longer builds with older patch releases.Written for commit f1f7cfe. Summary will update on new commits.