fix(deps): bump protocol/go to 0.37.0 and sdk to 0.26.0 in /service

[alkalescent]

Summary

Bumps the two OpenTDF module pins in service/go.mod to their latest releases:

• github.com/opentdf/platform/protocol/go v0.36.0 → v0.37.0
• github.com/opentdf/platform/sdk v0.25.0 → v0.26.0

main's service code already references protocol/go v0.37.0 sdkconnect types, so the module builds in the workspace but cannot be released at the old pins: the release-branch guard (.github/scripts/work-init.sh) builds each module against its pinned deps and fails. This bump makes the service module releasable and gives the in-flight service feature PRs a releasable base.

Only service/go.mod and service/go.sum change (via go get + go mod tidy).

Notes

• Supersedes dependabot fix(deps): bump github.com/opentdf/platform/protocol/go from 0.36.0 to 0.37.0 in /service #3718, which bumps only protocol/go for /service.
• Unblocks the staged service v0.20.0 release (chore(main): release service 0.20.0 #3702).

Testing

• GOWORK=off go build ./... in service/ passes (mirrors the pinned-deps release guard).

Summary by CodeRabbit

• Chores
  • Updated underlying platform dependencies to newer versions, which may include stability and compatibility improvements.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the OpenTDF module dependencies within the service directory to their latest versions. These changes ensure that the service module remains compatible with the current workspace configuration and satisfies the release-branch build requirements, effectively unblocking the upcoming service release.

Highlights

• Dependency Updates: Updated 'github.com/opentdf/platform/protocol/go' to v0.37.0 and 'github.com/opentdf/platform/sdk' to v0.26.0 in the service module.
• Release Readiness: Aligned module pins to ensure compatibility with release-branch build guards and unblock the v0.20.0 service release.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

The modules were pinned far too low, / We needed the versions to grow. / With thirty-seven and twenty-six, / We gave the build pipeline a fix, / And now the release is a go.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a2554358-2663-4bc8-908c-1aace7258cce

📥 Commits

Reviewing files that changed from the base of the PR and between 8b63934 and b62fcee.

⛔ Files ignored due to path filters (1)

• service/go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• service/go.mod

---

📝 Walkthrough

Walkthrough

This PR bumps two direct Go module dependencies in service/go.mod: github.com/opentdf/platform/protocol/go from v0.36.0 to v0.37.0, and github.com/opentdf/platform/sdk from v0.25.0 to v0.26.0.

Changes

Dependency Bump

Layer / File(s)	Summary
go.mod version bump service/go.mod	Updates protocol/go and sdk require entries to their next minor versions.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• opentdf/platform#3707: Also bumps github.com/opentdf/platform/protocol/go to v0.37.0 in service/go.mod.
• opentdf/platform#3658: Also bumps both protocol/go and sdk dependency versions in service/go.mod.
• opentdf/platform#3459: Also bumps protocol/go in the same service/go.mod file.

Suggested reviewers: elizabethhealy, c-r33d

Poem

A hop, a skip, a version bump,
protocol and sdk take a jump,
v0.37, v0.26 so bright,
tiny diff, but all done right,
🐇 munching carrots, go.mod tight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: bumping the two service dependencies to the new versions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bump-service-deps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates the dependencies in service/go.mod and service/go.sum, upgrading github.com/opentdf/platform/protocol/go to version v0.37.0 and github.com/opentdf/platform/sdk to version v0.26.0. I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	213.779848ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	117.829168ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	643.043609ms
Throughput	155.51 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	45.002755777s
Average Latency	447.897255ms
Throughput	111.10 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• examples
• otdfctl
• sdk
• service
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-pull-3721
✅ go@pull-3721-pull-3721
✅ go@main-main
✅ go@pull-3721-main
✅ go@main-v0.9.0
✅ java@main-main
✅ go@pull-3721-v0.9.0
✅ java@main-pull-3721
✅ java@main-v0.9.0
✅ js@main-main
✅ js@main-pull-3721
✅ js@main-v0.9.0
cukes-report
opentdfplatformPJFTXB.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1
govulncheck-failure-2
govulncheck-failure-0
govulncheck-failure-5