chore: bump dependencies and run linting

CHANGELOG.md

@@ -7,6 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ### Changed
 - Schema: reads inside write transactions now use a cheap hash-only lookup (`schema_revision`) to check the cache before loading the full schema blob, reducing DB round-trips on cache hits (https://github.com/authzed/spicedb/pull/3160)
 - Updated the Prometheus buckets for `grpc_server_handling_seconds` and `spicedb_datastore_query_latency` to be able to correlate them (https://github.com/authzed/spicedb/pull/3188)
+- Bumped dependencies (https://github.com/authzed/spicedb/pull/3192)
 
 ### Fixed
 - When SpiceDB loses a connection to a CockroachDB node, every read happening in the server blocks for a short period of time (https://github.com/authzed/spicedb/pull/3181)

Dockerfile

@@ -1,5 +1,5 @@
 # use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
-FROM golang:1.26.4-alpine@sha256:f23e8b227fb4493eabe03bede4d5a32d04092da71962f1fb79b5f7d1e6c2a17f AS spicedb-builder
+FROM golang:1.26.4-alpine@sha256:3ad57304ad93bbec8548a0437ad9e06a455660655d9af011d58b993f6f615648 AS spicedb-builder
 WORKDIR /go/src/app
 RUN apk update && apk add --no-cache git
 COPY . .

Dockerfile.release

@@ -1,6 +1,6 @@
 # vim: syntax=dockerfile
 # use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
-ARG BASE=cgr.dev/chainguard/static@sha256:99a5f826e71115aef9f63368120a6aa518323e052297718e9bf084fb84def93c
+ARG BASE=cgr.dev/chainguard/static@sha256:77d8b8925dc27970ec2f48243f44c7a260d52c49cd778288e4ee97566e0cb75b
 
 FROM $BASE
 ARG TARGETOS

cmd/spicedb/integration/restgateway_integration_test.go

@@ -15,7 +15,8 @@ import (
 func TestRESTGateway(t *testing.T) {
 	require := require.New(t)
 
-	tester, err := newTester(t,
+	tester, err := newTester(
+		t,
 		&dockertest.RunOptions{
 			Repository:   "authzed/spicedb",
 			Tag:          "ci",

cmd/spicedb/integration/schemawatch_integration_test.go

@@ -109,10 +109,10 @@ func TestSchemaWatch(t *testing.T) {
 				OutputStream: ww,
 			}
 
-			go (func() {
+			go func() {
 				err = pool.Client.Logs(opts)
 				assert.NoError(t, err)
-			})()
+			}()
 
 			select {
 			case <-ww.c:

cmd/spicedb/integration/serve_integration_test.go

@@ -30,7 +30,8 @@ import (
 func TestServe(t *testing.T) {
 	requireParent := require.New(t)
 
-	tester, err := newTester(t,
+	tester, err := newTester(
+		t,
 		&dockertest.RunOptions{
 			Repository:   "authzed/spicedb",
 			Tag:          "ci",
@@ -238,10 +239,10 @@ func TestGracefulShutdown(t *testing.T) {
 					OutputStream: ww,
 				}
 
-				go (func() {
+				go func() {
 					err = pool.Client.Logs(opts)
 					assert.NoError(t, err)
-				})()
+				}()
 
 				select {
 				case <-ww.c:

cmd/spicedb/integration/servetesting_integration_test.go

@@ -29,7 +29,8 @@ import (
 func TestTestServer(t *testing.T) {
 	require := require.New(t)
 	key := uuid.NewString()
-	tester, err := newTester(t,
+	tester, err := newTester(
+		t,
 		&dockertest.RunOptions{
 			Repository: "authzed/spicedb",
 			Tag:        "ci",

cmd/spicedb/integration/servetesting_race_test.go

@@ -24,7 +24,8 @@ import (
 func TestCheckPermissionOnTesterNoFlakes(t *testing.T) {
 	_, b, _, _ := runtime.Caller(0)
 	basepath := filepath.Dir(b)
-	tester, err := newTester(t,
+	tester, err := newTester(
+		t,
 		&dockertest.RunOptions{
 			Repository:   "authzed/spicedb",
 			Tag:          "ci",

cmd/spicedb/memoryprotection/memory_protection_integration_test.go

@@ -49,7 +49,8 @@ func TestServeWithMemoryProtectionMiddleware(t *testing.T) {
 	})
 
 	serverPort := serveResource.GetPort("50051/tcp")
-	conn, err := grpc.NewClient(fmt.Sprintf("localhost:%s", serverPort),
+	conn, err := grpc.NewClient(
+		fmt.Sprintf("localhost:%s", serverPort),
 		grpc.WithTransportCredentials(insecure.NewCredentials()),
 		grpcutil.WithInsecureBearerToken(serverToken),
 	)

e2e/cockroach/cockroach.go

@@ -153,7 +153,8 @@ func (cs Cluster) Stop(out io.Writer) error {
 // Init runs the cockroach init command against the cluster
 func (cs Cluster) Init(ctx context.Context, out, errOut io.Writer) {
 	// this retries until it succeeds, it won't return unless it does
-	if err := e2e.Run(ctx, out, errOut, "./cockroach",
+	if err := e2e.Run(
+		ctx, out, errOut, "./cockroach",
 		"init",
 		"--insecure",
 		"--host="+cs[0].Addr,
@@ -165,7 +166,8 @@ func (cs Cluster) Init(ctx context.Context, out, errOut io.Writer) {
 // SQL runs the set of SQL commands against the cluster
 func (cs Cluster) SQL(ctx context.Context, out, errOut io.Writer, sql ...string) error {
 	for _, s := range sql {
-		if err := e2e.Run(ctx, out, errOut,
+		if err := e2e.Run(
+			ctx, out, errOut,
 			"./cockroach", "sql", "--insecure", "--host="+cs[0].Addr,
 			"-e", s,
 		); err != nil {
@@ -181,7 +183,8 @@ func (cs Cluster) NetworkDelay(ctx context.Context, out io.Writer, node int, dur
 	if err != nil {
 		return err
 	}
-	return e2e.Run(ctx, out, out,
+	return e2e.Run(
+		ctx, out, out,
 		"sudo",
 		"./chaosd",
 		"attack",
@@ -196,7 +199,8 @@ func (cs Cluster) NetworkDelay(ctx context.Context, out io.Writer, node int, dur
 
 // TimeDelay adds a skew to the clock of the given node
 func (cs Cluster) TimeDelay(ctx context.Context, out io.Writer, node int, duration time.Duration) error {
-	return e2e.Run(ctx, out, out,
+	return e2e.Run(
+		ctx, out, out,
 		"sudo",
 		"./chaosd",
 		"attack",

e2e/go.mod

@@ -5,43 +5,43 @@ go 1.26.4
 replace github.com/authzed/spicedb => ../
 
 require (
-	github.com/authzed/authzed-go v1.9.0
-	github.com/authzed/grpcutil v0.0.0-20240123194739-2ea1e3d2d98b
-	github.com/authzed/spicedb v1.29.5
+	github.com/authzed/authzed-go v1.10.0
+	github.com/authzed/grpcutil v0.0.0-20260105210157-e237581949c2
+	github.com/authzed/spicedb v1.54.0
 	github.com/brianvoe/gofakeit/v6 v6.28.0
 	github.com/ecordell/optgen v0.2.6
-	github.com/jackc/pgx/v5 v5.9.2
+	github.com/jackc/pgx/v5 v5.10.0
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/tools v0.44.0
-	google.golang.org/grpc v1.80.0
-	mvdan.cc/gofumpt v0.9.2
+	golang.org/x/tools v0.46.0
+	google.golang.org/grpc v1.81.1
+	mvdan.cc/gofumpt v0.10.0
 )
 
 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 // indirect
-	buf.build/go/protovalidate v1.1.3 // indirect
+	buf.build/go/protovalidate v1.2.0 // indirect
 	cel.dev/expr v0.25.1 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/authzed/cel-go v0.20.2 // indirect
-	github.com/authzed/ctxkey v0.0.0-20250226155515-d49f99185584 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.40.1 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.32.3 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.3 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.15 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.3 // indirect
-	github.com/aws/smithy-go v1.24.0 // indirect
+	github.com/authzed/ctxkey v0.0.0-20260210154927-ca132876f62c // indirect
+	github.com/aws/aws-sdk-go-v2 v1.42.0 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.25 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.24 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.29 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.2.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.43.3 // indirect
+	github.com/aws/smithy-go v1.27.1 // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/ccoveille/go-safecast/v2 v2.0.0 // indirect
+	github.com/ccoveille/go-safecast/v2 v2.0.1 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/certifi/gocertifi v0.0.0-20210507211836-431795d63e8d // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
@@ -54,8 +54,7 @@ require (
 	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/google/cel-go v0.27.0 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/cel-go v0.28.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
@@ -69,24 +68,23 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/common v0.69.0 // indirect
 	github.com/prometheus/procfs v0.20.1 // indirect
-	github.com/rs/zerolog v1.34.0 // indirect
+	github.com/rs/zerolog v1.35.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/stoewer/go-strcase v1.3.1 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
-	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	golang.org/x/exp v0.0.0-20260611194520-c48552f49976 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260622175928-b703f567277d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	resenje.org/singleflight v0.4.3 // indirect