chore: update Go from v1.23.7 to v1.25.5 by cstockton · Pull Request #2303 · supabase/auth

cstockton · 2025-12-20T16:35:26Z

Note: this PR depends on #2304

Update to Go v1.25.5

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings:

Updating all apierrors constructors to use const fmt strings with args
Removing fmt.Sprintf usages that violate go vet fmt checks
Refactoring internal error/message helpers to accept fmt + params

In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Why update?

Aside from security related reasons and general best practices here are some highlights im looking forward to!

The flight recorder could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future.
The synctest package means no more DI for now func() time.Time :D
Addition of t.Context() and t.Cleanup(func()) will make lower friction as we sever ties with our testing framework. There are other neat API's like T.Attr and T.Output.
The new json/v2 package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this.
The new jsontext may come in handy for implementing JWT templates depending on how we want to design it.
And much more!

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Right now exhaustive is incompatible with Go v1.25.5, after reviewing the repo I think it would be best to remove it: - It seems to be unmaintained, no changes in over a year - Much of exhaustive's value has been absorbed into staticcheck - Supporting it would add complexity to our build pipeline With these things in mind it doesn't seem it worth keeping.

coveralls · 2025-12-22T20:09:53Z

Pull Request Test Coverage Report for Build 20463314291

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

For more information on this, see Tracking coverage changes with pull request builds.
To avoid this issue with future PRs, see these Recommended CI Configurations.
For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

43 of 86(50.0%) changed or added relevant lines in 19 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-0.002%) to 68.782%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/admin.go	0	1	0.0%
internal/api/logout.go	0	1	0.0%
internal/api/oauthserver/handlers.go	1	2	50.0%
internal/api/oauthserver/service.go	0	1	0.0%
internal/api/phone.go	0	1	0.0%
internal/api/provider/provider.go	0	1	0.0%
internal/api/signup.go	0	1	0.0%
internal/api/token.go	1	2	50.0%
internal/api/web3.go	1	2	50.0%
internal/api/mfa.go	2	4	50.0%

Totals
Change from base Build 20463305468:	-0.002%
Covered Lines:	14742
Relevant Lines:	21433

💛 - Coveralls

fadymak

🙌

This reverts commit 058836f.

Note: this PR depends on #2304 ## Update to Go v1.25.5 As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test. ## Why update? Aside from security related reasons and general best practices here are some highlights im looking forward to! * The [flight recorder](https://go.dev/blog/flight-recorder) could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future. * The [synctest](https://pkg.go.dev/testing/synctest) package means no more DI for `now func() time.Time` :D * Addition of [t.Context()](https://pkg.go.dev/testing#T.Context) and [t.Cleanup(func())](https://pkg.go.dev/testing#T.Cleanup) will make lower friction as we sever ties with our testing framework. There are other neat API's like `T.Attr` and `T.Output`. * The new [json/v2](https://pkg.go.dev/encoding/json/v2@go1.25.5) package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this. * The new [jsontext](https://pkg.go.dev/encoding/json/jsontext@go1.25.5#example-package-StringReplace) may come in handy for implementing JWT templates depending on how we want to design it. * And much more! --------- Co-authored-by: Chris Stockton <chris.stockton@supabase.io>

cstockton · 2025-12-20T16:35:26Z

Note: this PR depends on #2304

Update to Go v1.25.5

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings:

Updating all apierrors constructors to use const fmt strings with args
Removing fmt.Sprintf usages that violate go vet fmt checks
Refactoring internal error/message helpers to accept fmt + params

In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Why update?

Aside from security related reasons and general best practices here are some highlights im looking forward to!

The flight recorder could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future.
The synctest package means no more DI for now func() time.Time :D
Addition of t.Context() and t.Cleanup(func()) will make lower friction as we sever ties with our testing framework. There are other neat API's like T.Attr and T.Output.
The new json/v2 package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this.
The new jsontext may come in handy for implementing JWT templates depending on how we want to design it.
And much more!

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Right now exhaustive is incompatible with Go v1.25.5, after reviewing the repo I think it would be best to remove it: - It seems to be unmaintained, no changes in over a year - Much of exhaustive's value has been absorbed into staticcheck - Supporting it would add complexity to our build pipeline With these things in mind it doesn't seem it worth keeping.

coveralls · 2025-12-22T20:09:53Z

Pull Request Test Coverage Report for Build 20463314291

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

For more information on this, see Tracking coverage changes with pull request builds.
To avoid this issue with future PRs, see these Recommended CI Configurations.
For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

43 of 86(50.0%) changed or added relevant lines in 19 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-0.002%) to 68.782%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/admin.go	0	1	0.0%
internal/api/logout.go	0	1	0.0%
internal/api/oauthserver/handlers.go	1	2	50.0%
internal/api/oauthserver/service.go	0	1	0.0%
internal/api/phone.go	0	1	0.0%
internal/api/provider/provider.go	0	1	0.0%
internal/api/signup.go	0	1	0.0%
internal/api/token.go	1	2	50.0%
internal/api/web3.go	1	2	50.0%
internal/api/mfa.go	2	4	50.0%

Totals
Change from base Build 20463305468:	-0.002%
Covered Lines:	14742
Relevant Lines:	21433

💛 - Coveralls

fadymak

🙌

This reverts commit 058836f.

Note: this PR depends on #2304 ## Update to Go v1.25.5 As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test. ## Why update? Aside from security related reasons and general best practices here are some highlights im looking forward to! * The [flight recorder](https://go.dev/blog/flight-recorder) could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future. * The [synctest](https://pkg.go.dev/testing/synctest) package means no more DI for `now func() time.Time` :D * Addition of [t.Context()](https://pkg.go.dev/testing#T.Context) and [t.Cleanup(func())](https://pkg.go.dev/testing#T.Cleanup) will make lower friction as we sever ties with our testing framework. There are other neat API's like `T.Attr` and `T.Output`. * The new [json/v2](https://pkg.go.dev/encoding/json/v2@go1.25.5) package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this. * The new [jsontext](https://pkg.go.dev/encoding/json/jsontext@go1.25.5#example-package-StringReplace) may come in handy for implementing JWT templates depending on how we want to design it. * And much more! --------- Co-authored-by: Chris Stockton <chris.stockton@supabase.io>

cstockton · 2025-12-20T16:35:26Z

Note: this PR depends on #2304

Update to Go v1.25.5

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings:

Updating all apierrors constructors to use const fmt strings with args
Removing fmt.Sprintf usages that violate go vet fmt checks
Refactoring internal error/message helpers to accept fmt + params

In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Why update?

Aside from security related reasons and general best practices here are some highlights im looking forward to!

The flight recorder could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future.
The synctest package means no more DI for now func() time.Time :D
Addition of t.Context() and t.Cleanup(func()) will make lower friction as we sever ties with our testing framework. There are other neat API's like T.Attr and T.Output.
The new json/v2 package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this.
The new jsontext may come in handy for implementing JWT templates depending on how we want to design it.
And much more!

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Right now exhaustive is incompatible with Go v1.25.5, after reviewing the repo I think it would be best to remove it: - It seems to be unmaintained, no changes in over a year - Much of exhaustive's value has been absorbed into staticcheck - Supporting it would add complexity to our build pipeline With these things in mind it doesn't seem it worth keeping.

coveralls · 2025-12-22T20:09:53Z

Pull Request Test Coverage Report for Build 20463314291

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

For more information on this, see Tracking coverage changes with pull request builds.
To avoid this issue with future PRs, see these Recommended CI Configurations.
For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

43 of 86(50.0%) changed or added relevant lines in 19 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-0.002%) to 68.782%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/admin.go	0	1	0.0%
internal/api/logout.go	0	1	0.0%
internal/api/oauthserver/handlers.go	1	2	50.0%
internal/api/oauthserver/service.go	0	1	0.0%
internal/api/phone.go	0	1	0.0%
internal/api/provider/provider.go	0	1	0.0%
internal/api/signup.go	0	1	0.0%
internal/api/token.go	1	2	50.0%
internal/api/web3.go	1	2	50.0%
internal/api/mfa.go	2	4	50.0%

Totals
Change from base Build 20463305468:	-0.002%
Covered Lines:	14742
Relevant Lines:	21433

💛 - Coveralls

fadymak

🙌

This reverts commit 058836f.

Note: this PR depends on #2304 ## Update to Go v1.25.5 As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test. ## Why update? Aside from security related reasons and general best practices here are some highlights im looking forward to! * The [flight recorder](https://go.dev/blog/flight-recorder) could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future. * The [synctest](https://pkg.go.dev/testing/synctest) package means no more DI for `now func() time.Time` :D * Addition of [t.Context()](https://pkg.go.dev/testing#T.Context) and [t.Cleanup(func())](https://pkg.go.dev/testing#T.Cleanup) will make lower friction as we sever ties with our testing framework. There are other neat API's like `T.Attr` and `T.Output`. * The new [json/v2](https://pkg.go.dev/encoding/json/v2@go1.25.5) package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this. * The new [jsontext](https://pkg.go.dev/encoding/json/jsontext@go1.25.5#example-package-StringReplace) may come in handy for implementing JWT templates depending on how we want to design it. * And much more! --------- Co-authored-by: Chris Stockton <chris.stockton@supabase.io>

cstockton · 2025-12-20T16:35:26Z

Note: this PR depends on #2304

Update to Go v1.25.5

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings:

Updating all apierrors constructors to use const fmt strings with args
Removing fmt.Sprintf usages that violate go vet fmt checks
Refactoring internal error/message helpers to accept fmt + params

In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Why update?

Aside from security related reasons and general best practices here are some highlights im looking forward to!

The flight recorder could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future.
The synctest package means no more DI for now func() time.Time :D
Addition of t.Context() and t.Cleanup(func()) will make lower friction as we sever ties with our testing framework. There are other neat API's like T.Attr and T.Output.
The new json/v2 package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this.
The new jsontext may come in handy for implementing JWT templates depending on how we want to design it.
And much more!

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Right now exhaustive is incompatible with Go v1.25.5, after reviewing the repo I think it would be best to remove it: - It seems to be unmaintained, no changes in over a year - Much of exhaustive's value has been absorbed into staticcheck - Supporting it would add complexity to our build pipeline With these things in mind it doesn't seem it worth keeping.

coveralls · 2025-12-22T20:09:53Z

Pull Request Test Coverage Report for Build 20463314291

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

For more information on this, see Tracking coverage changes with pull request builds.
To avoid this issue with future PRs, see these Recommended CI Configurations.
For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

43 of 86(50.0%) changed or added relevant lines in 19 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-0.002%) to 68.782%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/admin.go	0	1	0.0%
internal/api/logout.go	0	1	0.0%
internal/api/oauthserver/handlers.go	1	2	50.0%
internal/api/oauthserver/service.go	0	1	0.0%
internal/api/phone.go	0	1	0.0%
internal/api/provider/provider.go	0	1	0.0%
internal/api/signup.go	0	1	0.0%
internal/api/token.go	1	2	50.0%
internal/api/web3.go	1	2	50.0%
internal/api/mfa.go	2	4	50.0%

Totals
Change from base Build 20463305468:	-0.002%
Covered Lines:	14742
Relevant Lines:	21433

💛 - Coveralls

fadymak

🙌

This reverts commit 058836f.

Note: this PR depends on #2304 ## Update to Go v1.25.5 As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test. ## Why update? Aside from security related reasons and general best practices here are some highlights im looking forward to! * The [flight recorder](https://go.dev/blog/flight-recorder) could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future. * The [synctest](https://pkg.go.dev/testing/synctest) package means no more DI for `now func() time.Time` :D * Addition of [t.Context()](https://pkg.go.dev/testing#T.Context) and [t.Cleanup(func())](https://pkg.go.dev/testing#T.Cleanup) will make lower friction as we sever ties with our testing framework. There are other neat API's like `T.Attr` and `T.Output`. * The new [json/v2](https://pkg.go.dev/encoding/json/v2@go1.25.5) package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this. * The new [jsontext](https://pkg.go.dev/encoding/json/jsontext@go1.25.5#example-package-StringReplace) may come in handy for implementing JWT templates depending on how we want to design it. * And much more! --------- Co-authored-by: Chris Stockton <chris.stockton@supabase.io>

cstockton · 2025-12-20T16:35:26Z

Note: this PR depends on #2304

Update to Go v1.25.5

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings:

Updating all apierrors constructors to use const fmt strings with args
Removing fmt.Sprintf usages that violate go vet fmt checks
Refactoring internal error/message helpers to accept fmt + params

In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Why update?

Aside from security related reasons and general best practices here are some highlights im looking forward to!

The flight recorder could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future.
The synctest package means no more DI for now func() time.Time :D
Addition of t.Context() and t.Cleanup(func()) will make lower friction as we sever ties with our testing framework. There are other neat API's like T.Attr and T.Output.
The new json/v2 package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this.
The new jsontext may come in handy for implementing JWT templates depending on how we want to design it.
And much more!

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Right now exhaustive is incompatible with Go v1.25.5, after reviewing the repo I think it would be best to remove it: - It seems to be unmaintained, no changes in over a year - Much of exhaustive's value has been absorbed into staticcheck - Supporting it would add complexity to our build pipeline With these things in mind it doesn't seem it worth keeping.

coveralls · 2025-12-22T20:09:53Z

Pull Request Test Coverage Report for Build 20463314291

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

For more information on this, see Tracking coverage changes with pull request builds.
To avoid this issue with future PRs, see these Recommended CI Configurations.
For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

43 of 86(50.0%) changed or added relevant lines in 19 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-0.002%) to 68.782%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/admin.go	0	1	0.0%
internal/api/logout.go	0	1	0.0%
internal/api/oauthserver/handlers.go	1	2	50.0%
internal/api/oauthserver/service.go	0	1	0.0%
internal/api/phone.go	0	1	0.0%
internal/api/provider/provider.go	0	1	0.0%
internal/api/signup.go	0	1	0.0%
internal/api/token.go	1	2	50.0%
internal/api/web3.go	1	2	50.0%
internal/api/mfa.go	2	4	50.0%

Totals
Change from base Build 20463305468:	-0.002%
Covered Lines:	14742
Relevant Lines:	21433

💛 - Coveralls

fadymak

🙌

This reverts commit 058836f.

Note: this PR depends on #2304 ## Update to Go v1.25.5 As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test. ## Why update? Aside from security related reasons and general best practices here are some highlights im looking forward to! * The [flight recorder](https://go.dev/blog/flight-recorder) could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future. * The [synctest](https://pkg.go.dev/testing/synctest) package means no more DI for `now func() time.Time` :D * Addition of [t.Context()](https://pkg.go.dev/testing#T.Context) and [t.Cleanup(func())](https://pkg.go.dev/testing#T.Cleanup) will make lower friction as we sever ties with our testing framework. There are other neat API's like `T.Attr` and `T.Output`. * The new [json/v2](https://pkg.go.dev/encoding/json/v2@go1.25.5) package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this. * The new [jsontext](https://pkg.go.dev/encoding/json/jsontext@go1.25.5#example-package-StringReplace) may come in handy for implementing JWT templates depending on how we want to design it. * And much more! --------- Co-authored-by: Chris Stockton <chris.stockton@supabase.io>

cstockton · 2025-12-20T16:35:26Z

Note: this PR depends on #2304

Update to Go v1.25.5

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings:

Updating all apierrors constructors to use const fmt strings with args
Removing fmt.Sprintf usages that violate go vet fmt checks
Refactoring internal error/message helpers to accept fmt + params

In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Why update?

Aside from security related reasons and general best practices here are some highlights im looking forward to!

The flight recorder could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future.
The synctest package means no more DI for now func() time.Time :D
Addition of t.Context() and t.Cleanup(func()) will make lower friction as we sever ties with our testing framework. There are other neat API's like T.Attr and T.Output.
The new json/v2 package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this.
The new jsontext may come in handy for implementing JWT templates depending on how we want to design it.
And much more!

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Right now exhaustive is incompatible with Go v1.25.5, after reviewing the repo I think it would be best to remove it: - It seems to be unmaintained, no changes in over a year - Much of exhaustive's value has been absorbed into staticcheck - Supporting it would add complexity to our build pipeline With these things in mind it doesn't seem it worth keeping.

coveralls · 2025-12-22T20:09:53Z

Pull Request Test Coverage Report for Build 20463314291

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

For more information on this, see Tracking coverage changes with pull request builds.
To avoid this issue with future PRs, see these Recommended CI Configurations.
For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

43 of 86(50.0%) changed or added relevant lines in 19 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-0.002%) to 68.782%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/admin.go	0	1	0.0%
internal/api/logout.go	0	1	0.0%
internal/api/oauthserver/handlers.go	1	2	50.0%
internal/api/oauthserver/service.go	0	1	0.0%
internal/api/phone.go	0	1	0.0%
internal/api/provider/provider.go	0	1	0.0%
internal/api/signup.go	0	1	0.0%
internal/api/token.go	1	2	50.0%
internal/api/web3.go	1	2	50.0%
internal/api/mfa.go	2	4	50.0%

Totals
Change from base Build 20463305468:	-0.002%
Covered Lines:	14742
Relevant Lines:	21433

💛 - Coveralls

fadymak

🙌

This reverts commit 058836f.

Note: this PR depends on #2304 ## Update to Go v1.25.5 As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test. ## Why update? Aside from security related reasons and general best practices here are some highlights im looking forward to! * The [flight recorder](https://go.dev/blog/flight-recorder) could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future. * The [synctest](https://pkg.go.dev/testing/synctest) package means no more DI for `now func() time.Time` :D * Addition of [t.Context()](https://pkg.go.dev/testing#T.Context) and [t.Cleanup(func())](https://pkg.go.dev/testing#T.Cleanup) will make lower friction as we sever ties with our testing framework. There are other neat API's like `T.Attr` and `T.Output`. * The new [json/v2](https://pkg.go.dev/encoding/json/v2@go1.25.5) package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this. * The new [jsontext](https://pkg.go.dev/encoding/json/jsontext@go1.25.5#example-package-StringReplace) may come in handy for implementing JWT templates depending on how we want to design it. * And much more! --------- Co-authored-by: Chris Stockton <chris.stockton@supabase.io>

cstockton · 2025-12-20T16:35:26Z

Note: this PR depends on #2304

Update to Go v1.25.5

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings:

Updating all apierrors constructors to use const fmt strings with args
Removing fmt.Sprintf usages that violate go vet fmt checks
Refactoring internal error/message helpers to accept fmt + params

In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Why update?

Aside from security related reasons and general best practices here are some highlights im looking forward to!

The flight recorder could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future.
The synctest package means no more DI for now func() time.Time :D
Addition of t.Context() and t.Cleanup(func()) will make lower friction as we sever ties with our testing framework. There are other neat API's like T.Attr and T.Output.
The new json/v2 package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this.
The new jsontext may come in handy for implementing JWT templates depending on how we want to design it.
And much more!

As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test.

Right now exhaustive is incompatible with Go v1.25.5, after reviewing the repo I think it would be best to remove it: - It seems to be unmaintained, no changes in over a year - Much of exhaustive's value has been absorbed into staticcheck - Supporting it would add complexity to our build pipeline With these things in mind it doesn't seem it worth keeping.

coveralls · 2025-12-22T20:09:53Z

Pull Request Test Coverage Report for Build 20463314291

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

For more information on this, see Tracking coverage changes with pull request builds.
To avoid this issue with future PRs, see these Recommended CI Configurations.
For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

43 of 86(50.0%) changed or added relevant lines in 19 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-0.002%) to 68.782%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/admin.go	0	1	0.0%
internal/api/logout.go	0	1	0.0%
internal/api/oauthserver/handlers.go	1	2	50.0%
internal/api/oauthserver/service.go	0	1	0.0%
internal/api/phone.go	0	1	0.0%
internal/api/provider/provider.go	0	1	0.0%
internal/api/signup.go	0	1	0.0%
internal/api/token.go	1	2	50.0%
internal/api/web3.go	1	2	50.0%
internal/api/mfa.go	2	4	50.0%

Totals
Change from base Build 20463305468:	-0.002%
Covered Lines:	14742
Relevant Lines:	21433

💛 - Coveralls

fadymak

🙌

This reverts commit 058836f.

Note: this PR depends on #2304 ## Update to Go v1.25.5 As part of this upgrade several changes were needed to resolve go vet failures around non-constant format strings: - Updating all apierrors constructors to use const fmt strings with args - Removing fmt.Sprintf usages that violate go vet fmt checks - Refactoring internal error/message helpers to accept fmt + params In addition stricter checks in the standard library for x509 certificate creation required a change to a SAML test in internal/conf. Now I start with a valid certificate and then set the serial number to an invalid value. To do this I opted for a small refactor to PopulateFields to return the cert object instead of copying the code within the test. ## Why update? Aside from security related reasons and general best practices here are some highlights im looking forward to! * The [flight recorder](https://go.dev/blog/flight-recorder) could be great for debugging performance bottlenecks. I personally am super excited for this feature, I hope the new streamable tracing API will enable a new class of interesting visual tools in the future. * The [synctest](https://pkg.go.dev/testing/synctest) package means no more DI for `now func() time.Time` :D * Addition of [t.Context()](https://pkg.go.dev/testing#T.Context) and [t.Cleanup(func())](https://pkg.go.dev/testing#T.Cleanup) will make lower friction as we sever ties with our testing framework. There are other neat API's like `T.Attr` and `T.Output`. * The new [json/v2](https://pkg.go.dev/encoding/json/v2@go1.25.5) package offers more efficient memory usage and faster API's. When I've ran profiling in the past JSON is a significant portion of our CPU time so we should see some nice gains for this. * The new [jsontext](https://pkg.go.dev/encoding/json/jsontext@go1.25.5#example-package-StringReplace) may come in handy for implementing JWT templates depending on how we want to design it. * And much more! --------- Co-authored-by: Chris Stockton <chris.stockton@supabase.io>

cstockton requested a review from a team as a code owner December 20, 2025 16:35

Merge branch 'master' into cs/bump-go-1.25.5
cfc163f

fadymak approved these changes Dec 23, 2025
View reviewed changes

Comment threadinternal/conf/saml_test.go Outdated

Chris Stocktonand others added 2 commits December 23, 2025 07:25

chore: remove commented code
42b7c6d

Merge branch 'master' into cs/bump-go-1.25.5
a2792ea

cstockton merged commit 058836f into masterDec 23, 2025
6 checks passed

cstockton deleted the cs/bump-go-1.25.5 branch December 23, 2025 14:39

hf added a commit that referenced this pull request Jan 12, 2026
Revert "chore: update Go from v1.23.7 to v1.25.5 (#2303)"
92507a2
This reverts commit 058836f.

cstockton requested a review from a team as a code owner December 20, 2025 16:35

Merge branch 'master' into cs/bump-go-1.25.5
cfc163f

fadymak approved these changes Dec 23, 2025
View reviewed changes

Comment threadinternal/conf/saml_test.go Outdated

Chris Stocktonand others added 2 commits December 23, 2025 07:25

chore: remove commented code
42b7c6d

Merge branch 'master' into cs/bump-go-1.25.5
a2792ea

cstockton merged commit 058836f into masterDec 23, 2025
6 checks passed

cstockton deleted the cs/bump-go-1.25.5 branch December 23, 2025 14:39

hf added a commit that referenced this pull request Jan 12, 2026
Revert "chore: update Go from v1.23.7 to v1.25.5 (#2303)"
92507a2
This reverts commit 058836f.

cstockton requested a review from a team as a code owner December 20, 2025 16:35

Merge branch 'master' into cs/bump-go-1.25.5
cfc163f

fadymak approved these changes Dec 23, 2025
View reviewed changes

Comment threadinternal/conf/saml_test.go Outdated

Chris Stocktonand others added 2 commits December 23, 2025 07:25

chore: remove commented code
42b7c6d

Merge branch 'master' into cs/bump-go-1.25.5
a2792ea

cstockton merged commit 058836f into masterDec 23, 2025
6 checks passed

cstockton deleted the cs/bump-go-1.25.5 branch December 23, 2025 14:39

hf added a commit that referenced this pull request Jan 12, 2026
Revert "chore: update Go from v1.23.7 to v1.25.5 (#2303)"
92507a2
This reverts commit 058836f.

cstockton requested a review from a team as a code owner December 20, 2025 16:35

Merge branch 'master' into cs/bump-go-1.25.5
cfc163f

fadymak approved these changes Dec 23, 2025
View reviewed changes

Comment threadinternal/conf/saml_test.go Outdated

Chris Stocktonand others added 2 commits December 23, 2025 07:25

chore: remove commented code
42b7c6d

Merge branch 'master' into cs/bump-go-1.25.5
a2792ea

cstockton merged commit 058836f into masterDec 23, 2025
6 checks passed

cstockton deleted the cs/bump-go-1.25.5 branch December 23, 2025 14:39

hf added a commit that referenced this pull request Jan 12, 2026
Revert "chore: update Go from v1.23.7 to v1.25.5 (#2303)"
92507a2
This reverts commit 058836f.

cstockton requested a review from a team as a code owner December 20, 2025 16:35

Merge branch 'master' into cs/bump-go-1.25.5
cfc163f

fadymak approved these changes Dec 23, 2025
View reviewed changes

Comment threadinternal/conf/saml_test.go Outdated

Chris Stocktonand others added 2 commits December 23, 2025 07:25

chore: remove commented code
42b7c6d

Merge branch 'master' into cs/bump-go-1.25.5
a2792ea

cstockton merged commit 058836f into masterDec 23, 2025
6 checks passed

cstockton deleted the cs/bump-go-1.25.5 branch December 23, 2025 14:39

hf added a commit that referenced this pull request Jan 12, 2026
Revert "chore: update Go from v1.23.7 to v1.25.5 (#2303)"
92507a2
This reverts commit 058836f.

cstockton requested a review from a team as a code owner December 20, 2025 16:35

Merge branch 'master' into cs/bump-go-1.25.5
cfc163f

fadymak approved these changes Dec 23, 2025
View reviewed changes

Comment threadinternal/conf/saml_test.go Outdated

Chris Stocktonand others added 2 commits December 23, 2025 07:25

chore: remove commented code
42b7c6d

Merge branch 'master' into cs/bump-go-1.25.5
a2792ea

cstockton merged commit 058836f into masterDec 23, 2025
6 checks passed

cstockton deleted the cs/bump-go-1.25.5 branch December 23, 2025 14:39

hf added a commit that referenced this pull request Jan 12, 2026
Revert "chore: update Go from v1.23.7 to v1.25.5 (#2303)"
92507a2
This reverts commit 058836f.

cstockton requested a review from a team as a code owner December 20, 2025 16:35

Merge branch 'master' into cs/bump-go-1.25.5
cfc163f

fadymak approved these changes Dec 23, 2025
View reviewed changes

Comment threadinternal/conf/saml_test.go Outdated

Chris Stocktonand others added 2 commits December 23, 2025 07:25

chore: remove commented code
42b7c6d

Merge branch 'master' into cs/bump-go-1.25.5
a2792ea

cstockton merged commit 058836f into masterDec 23, 2025
6 checks passed

cstockton deleted the cs/bump-go-1.25.5 branch December 23, 2025 14:39

hf added a commit that referenced this pull request Jan 12, 2026
Revert "chore: update Go from v1.23.7 to v1.25.5 (#2303)"
92507a2
This reverts commit 058836f.

Uh oh!

Conversation

cstockton commented Dec 20, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Update to Go v1.25.5

Why update?

Uh oh!

coveralls commented Dec 22, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 20463314291

Warning: This coverage report may be inaccurate.

Details

💛 - Coveralls

Uh oh!

fadymak left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

cstockton commented Dec 20, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Update to Go v1.25.5

Why update?

Uh oh!

coveralls commented Dec 22, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 20463314291

Warning: This coverage report may be inaccurate.

Details

💛 - Coveralls

Uh oh!

fadymak left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

cstockton commented Dec 20, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Update to Go v1.25.5

Why update?

Uh oh!

coveralls commented Dec 22, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 20463314291

Warning: This coverage report may be inaccurate.

Details

💛 - Coveralls

Uh oh!

fadymak left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

cstockton commented Dec 20, 2025•
edited
Loading

coveralls commented Dec 22, 2025•
edited
Loading

cstockton commented Dec 20, 2025•
edited
Loading

coveralls commented Dec 22, 2025•
edited
Loading

cstockton commented Dec 20, 2025•
edited
Loading

coveralls commented Dec 22, 2025•
edited
Loading

cstockton commented Dec 20, 2025•
edited
Loading

coveralls commented Dec 22, 2025•
edited
Loading

cstockton commented Dec 20, 2025•
edited
Loading

coveralls commented Dec 22, 2025•
edited
Loading