Repository navigation
feat!: connect-go v2 — module becomes github.com/pitabwire/frame/v3 - #705
Merged
Merged
Conversation
…e/frame/v3 Frame's public API exposes Connect interceptor and error types, so moving to connectrpc.com/connect/v2 is a breaking change and the module path moves to /v3. - Every Connect interceptor (auth, validation, tenancy access, function access, tenancy claims, language) is now a connect.ServerInterceptor that covers unary and streaming RPCs alike; add NewValidationClientInterceptor. - DefaultList, DefaultListWithBinder and Service.ConnectDefaultInterceptors return []connect.ServerInterceptor for connect.NewServer. - data.ErrorConvertToAPI and authorizer.ToConnectError return connect v2 errors, keeping wire messages and attaching the original error as the cause. - otelconnect v0.12.0 (server interceptor); regenerate the ping test service with protoc-gen-connect-go v2.0.0; tests use connectinprocess. - Upgrade all dependencies to their latest stable releases; toolchain go1.26.9. - Fix duplicate crv/x JSON tags in openid.JWK that stopped EC and OKP JWKS keys from decoding; drop deprecated http2.ConfigureServer and otel/log/global. - Add docs/migrating-v3.md, the v2 -> v3 migration guide for services.
The duplicate crv/x JSON tags that made these keys undecodable are fixed, so the skipped tests now pass.
pitabwire
added
enhancement
saadmk11/changelog-ci@v1.2.0 cannot build its image (its Debian archive returns 404) and has failed every PR since 2026-09-14. Its job is named build, which the main ruleset requires, so it blocks every merge. release-drafter already writes the changelog.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
This PR moves frame to connect-go v2 (
connectrpc.com/connect/v2v2.0.0, released 2026-10-07).Breaking: the module path becomes
github.com/pitabwire/frame/v3. Frame's public API exposes Connect interceptor and error types. Those types change shape in connect v2, so under Go semver this is a new major version. It is meant to ship as v3.0.0.Why
Services can't move to connect v2 until frame provides v2 interceptors and errors. If a service migrates today, it loses frame's authentication, authorization, validation and tenancy interceptor chain. connect v1 and v2 can coexist in one module, but frame's helpers had to choose one.
Changes
connect.ServerInterceptor:NewAuthInterceptor,NewValidationInterceptor,NewTenancyAccessInterceptor,NewFunctionAccessInterceptor,tenancy.NewClaimsInterceptor[WithBinder]andlocalization/interceptors/connect.NewLanguageInterceptor. A single function wraps unary and streaming RPCs alike, and the enriched context now reaches streaming handlers as well. This fixes the language interceptor, which never propagated to streaming handlers.NewValidationClientInterceptorprovides client-side validation. The v1 interceptor served both sides.DefaultList,DefaultListWithBinderandService.ConnectDefaultInterceptorsnow return[]connect.ServerInterceptor, ready forconnect.NewServer(...). The order is unchanged: otel → validation → auth → claims → extras.data.ErrorConvertToAPIandauthorizer.ToConnectErrornow return connect v2*connect.Error. The codes and wire messages are unchanged. The original error is attached withWithCause.NewServerInterceptor. Frame doesn't import validate, grpchealth, grpcreflect or authn. connect v1 remains only as an indirect dependency of otelconnect v0.12.0, which supports both majors in one package.frametestsping service is regenerated withprotoc-gen-connect-gov2.0.0. Tests useconnectinprocessand realconnect.Serverchains.security/openid. TheJWKstruct declared thecrvandxJSON tags twice, soencoding/jsondropped both and EC and OKP JWKS keys never decoded.go vetflagged this. The fix removes the duplicate fields and re-enables the EC and Ed25519 authentication tests, which had been skipped.x/net/http2.ConfigureServerand relies onhttp.Server.Protocols. Telemetry usesotel.SetLoggerProvider.docs/migrating-v3.md. It covers import paths, a signature table, before/after code, connect v2 call sites, the new 4 MiB default read limit, and testing. It is also in the mkdocs nav and linked from the README.Gates (local)
go build ./...andgo vet ./...: clean.golangci-lint run: 0 issues.go test ./... -count=1 -p 2: all packages pass, including the testcontainers suites.govulncheck ./...on go1.26.9: 0 reachable vulnerabilities. One module-level advisory has no fix: GO-2026-5932, x/crypto/openpgp, which frame doesn't call.