chore: upgrade go v1.26 and dependencie

Author: hgiasac

CLAUDE.md

@@ -198,7 +198,7 @@ Production-ready HTTP client with:
 
 ### Prerequisites
 
-- **Go 1.24+** (as specified in [go.mod](go.mod:3))
+- **Go 1.26.1+** (as specified in [go.work](go.work:1))
 - **golangci-lint** for linting
 - **Docker** (optional, for integration tests)
 
@@ -226,11 +226,20 @@ make go-tidy
 # Generate JSON schema
 make build-jsonschema
 
+# Generate test configuration from OpenAPI specs
+make generate-test-config
+
+# Remove build output directory
+make clean
+
 # Start DDN environment
 make start-ddn
 
 # Stop DDN environment
 make stop-ddn
+
+# Build and test full supergraph integration
+make build-supergraph-test
 ```
 
 ### Testing
@@ -248,9 +257,21 @@ go test -v ./connector/internal/contenttype/
 ```
 
 Test fixtures are in:
-- [connector/testdata/](connector/testdata/) - Connector test configurations
+- [connector/testdata/](connector/testdata/) - Connector test configurations:
+  - `petstore3/` - Petstore API OpenAPI 3.0 example with query/mutation snapshots
+  - `jsonplaceholder/` - JSONPlaceholder API integration example
+  - `auth/` - Authentication scheme examples
+  - `patch/` - JSON Patch before/after examples
+  - `compression/` - Compression handling tests
+  - `presets/` - Argument preset examples
+  - `tls/` - TLS/mTLS certificate tests with `certs/` and `certs_s1/` subdirectories
+  - `multi-schemas/` - Multi-API composition (cat.yaml, dog.yaml)
+  - `raw/` - Raw/schemaless request examples
+  - `stripe/` - Stripe API example
 - [ndc-http-schema/command/testdata/](ndc-http-schema/command/testdata/) - CLI test data
-- [tests/](tests/) - Integration tests
+- [tests/](tests/) - Integration tests and DDN engine configurations
+
+The CI test script ([scripts/test.sh](scripts/test.sh)) runs coverage collection per module, starts a Hydra OAuth server for auth integration tests, and uses `ndc-test` for NDC specification compliance validation.
 
 ### Building
 
@@ -387,10 +408,12 @@ Combine multiple API specifications into a single connector:
 - **Retry with Backoff** - Configurable retry strategy with exponential backoff
 - **Timeout Management** - Per-request and global timeouts
 - **Header Forwarding** - Forward headers from Hasura engine
-- **Argument Presets** - Set default argument values
-- **Response Transforms** - Transform API responses before returning
-- **Distributed Execution** - Send requests to multiple servers
+- **Argument Presets** - Set default argument values using JSONPath for nested field navigation
+- **Response Transforms** - Transform API responses before returning via JSONPath/templates
+- **Distributed Execution** - Fan-out requests to multiple upstream servers; controlled via `HTTPOptions` (fields: `servers`, `parallel`, `concurrency`)
 - **Schemaless Requests** - GraphQL-to-REST proxy without schema
+- **Compression** - Automatic gzip/deflate request encoding and response decompression via `Accept-Encoding`
+- **JSON Patch** - Modify OpenAPI specs at conversion time without editing source files
 
 ### 4. Observability
 
@@ -436,6 +459,22 @@ The project uses Go workspaces ([go.work](go.work:1)):
 - Local modules: `./ndc-http-schema`, `./exhttp`
 - Run `make go-tidy` after dependency changes
 
+### Linter Configuration
+
+The project uses golangci-lint v2 (see [.golangci.yml](.golangci.yml)):
+
+**Formatters:** `gci`, `gofmt`, `gofumpt`, `goimports`, `golines`
+
+**Complexity thresholds:**
+- Function length: 200 lines / 90 statements
+- Cyclomatic complexity: 40 (`gocyclo`), 30 (`cyclop`)
+- Cognitive complexity: 60 (`gocognit`)
+- Nesting complexity: 15 (`nestif`)
+
+**Per-directory exclusions:**
+- `ndc-http-schema`: `goconst` disabled (many repeated schema strings)
+- `ndc-http-schema/openapi`: `dupl` disabled (similar OpenAPI parsing patterns)
+
 ## Important Files
 
 ### Configuration Files
@@ -502,6 +541,33 @@ The project uses Go workspaces ([go.work](go.work:1)):
 2. Update conversion logic in [ndc-http-schema/configuration/](ndc-http-schema/configuration/)
 3. Regenerate JSON schema: `make build-jsonschema`
 
+### Using the Patch System
+
+The connector supports JSON Patch (RFC 6902) to modify OpenAPI specs without editing source files. Patches are applied before schema conversion.
+
+**Patch file format:**
+```yaml
+# patch-after.yaml - applied to the converted NDC schema
+- op: remove
+  path: /settings/securitySchemes/petstore_auth
+- op: replace
+  path: /settings/servers/0/url/value
+  value: https://api.example.com
+```
+
+**Register patches in config:**
+```yaml
+files:
+  - file: openapi.yaml
+    spec: openapi3
+    patchBefore:
+      - path: patch-before.yaml  # applied before conversion
+    patchAfter:
+      - path: patch-after.yaml   # applied after conversion
+```
+
+Patch examples: [connector/testdata/patch/](connector/testdata/patch/), [ndc-http-schema/command/testdata/patch/](ndc-http-schema/command/testdata/patch/)
+
 ## Testing with Hasura DDN
 
 ### Local Development
@@ -550,6 +616,18 @@ ndc-http-schema convert --log-level=debug -f openapi.yaml
 HASURA_LOG_LEVEL=debug ./server/main.go serve
 ```
 
+## CI/CD Pipelines
+
+Located in [.github/workflows/](.github/workflows/):
+
+| Workflow | Trigger | What it does |
+|---|---|---|
+| `test.yaml` | Push/PR | Runs unit tests, NDC compliance tests (`ndc-test`), coverage reports posted to PRs |
+| `lint.yaml` | Push/PR | Detects all workspace modules, runs `golangci-lint` per module, checks `gofmt` |
+| `release.yaml` | Tag `v*` | Builds multi-platform Docker images (`linux/amd64`, `linux/arm64`), cross-compiles CLI binaries via `gox`, creates draft GitHub release, generates plugin manifests |
+
+**Platforms for CLI release:** `linux/amd64`, `linux/arm64`, `darwin/amd64`, `darwin/arm64`, `windows/amd64`
+
 ## Contributing
 
 1. Fork the repository

Dockerfile

@@ -1,5 +1,5 @@
 # build context at repo root: docker build -f Dockerfile .
-FROM golang:1.25 AS builder
+FROM golang:1.26 AS builder
 
 WORKDIR /app
 

connector/internal/client.go

@@ -13,6 +13,7 @@ import (
 	"strings"
 	"unicode"
 
+	"github.com/hasura/gotel"
 	"github.com/hasura/ndc-http/connector/internal/contenttype"
 	"github.com/hasura/ndc-http/exhttp"
 	rest "github.com/hasura/ndc-http/ndc-http-schema/schema"
@@ -26,7 +27,7 @@ import (
 	"golang.org/x/sync/errgroup"
 )
 
-var tracer = connector.NewTracer("HTTPClient")
+var tracer = gotel.NewTracer("HTTPClient")
 
 // HTTPClient represents a http client wrapper with advanced methods.
 type HTTPClient struct {

connector/internal/contenttype/parameter.go

@@ -72,7 +72,7 @@ func (ssp ParameterItems) find(keys []Key) (*ParameterItem, int) {
 		isEqual := false
 
 		for j, value := range item.keys {
-			isEqual = value == keys[j]
+			isEqual = len(keys) > j && value == keys[j] //nolint:gosec
 			if !isEqual {
 				return nil, -1
 			}

connector/types.go

@@ -4,14 +4,14 @@ import (
 	"errors"
 	"net/http"
 
-	"github.com/hasura/ndc-sdk-go/v2/connector"
+	"github.com/hasura/gotel"
 )
 
 var errBuildSchemaFailed = errors.New("failed to build NDC HTTP schema")
 
 // State is the global state which is shared for every connector request.
 type State struct {
-	Tracer *connector.Tracer
+	Tracer *gotel.Tracer
 }
 
 type options struct {

exhttp/go.mod

@@ -1,57 +1,58 @@
 module github.com/hasura/ndc-http/exhttp
 
-go 1.24.13
+go 1.26.1
 
 require (
 	github.com/cenkalti/backoff/v5 v5.0.3
-	github.com/hasura/goenvconf v0.6.1
+	github.com/hasura/goenvconf v0.6.2
+	github.com/hasura/gotel v0.6.2
 	github.com/hasura/ndc-sdk-go/v2 v2.2.1-0.20260124011343-f658e14823b0
 	github.com/prometheus/common v0.67.5
-	go.opentelemetry.io/otel v1.39.0
-	go.opentelemetry.io/otel/trace v1.39.0
+	go.opentelemetry.io/otel v1.42.0
+	go.opentelemetry.io/otel/trace v1.42.0
 	gotest.tools/v3 v3.5.2
 )
 
 require (
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
-	github.com/alecthomas/kong v1.13.0 // indirect
+	github.com/alecthomas/kong v1.14.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.5 // indirect
-	github.com/klauspost/compress v1.18.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
+	github.com/klauspost/compress v1.18.4 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
-	github.com/prometheus/procfs v0.19.2 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/bridges/otelslog v0.14.0 // indirect
-	go.opentelemetry.io/contrib/propagators/b3 v1.39.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.15.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.15.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.39.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.39.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0 // indirect
-	go.opentelemetry.io/otel/exporters/prometheus v0.61.0 // indirect
-	go.opentelemetry.io/otel/log v0.15.0 // indirect
-	go.opentelemetry.io/otel/metric v1.39.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.39.0 // indirect
-	go.opentelemetry.io/otel/sdk/log v0.15.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/net v0.49.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260122232226-8e98ce8d340d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260122232226-8e98ce8d340d // indirect
-	google.golang.org/grpc v1.78.0 // indirect
+	go.opentelemetry.io/contrib/bridges/otelslog v0.17.0 // indirect
+	go.opentelemetry.io/contrib/propagators/b3 v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.18.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/prometheus v0.64.0 // indirect
+	go.opentelemetry.io/otel/log v0.18.0 // indirect
+	go.opentelemetry.io/otel/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.42.0 // indirect
+	go.opentelemetry.io/otel/sdk/log v0.18.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.42.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	golang.org/x/net v0.51.0 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/grpc v1.79.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 )