chore: refresh vulnerable Go runtime dependencies

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Set up Go and run tests
         uses: ./.github/actions/setup-go-service
         with:
-          go-version: "1.26.3"
+          go-version: "1.26.5"
           cache: false
           run-go-test: "true"
           go-test-race: "true"
@@ -40,7 +40,7 @@ jobs:
       - name: Set up Go and run golangci-lint
         uses: ./.github/actions/setup-go-service
         with:
-          go-version: "1.26.3"
+          go-version: "1.26.5"
           cache: false
           run-golangci-lint: "true"
           golangci-lint-args: "--timeout=5m ./..."
@@ -56,7 +56,7 @@ jobs:
       - name: Set up Go and run security scans
         uses: ./.github/actions/setup-go-service
         with:
-          go-version: "1.26.3"
+          go-version: "1.26.5"
           cache: false
           run-gosec: "true"
           run-govulncheck: "true"

MODULE.bazel

@@ -9,7 +9,7 @@ bazel_dep(name = "rules_cc", version = "0.2.18")
 bazel_dep(name = "rules_go", version = "0.60.0")
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
-go_sdk.download(version = "1.26.3")
+go_sdk.download(version = "1.26.5")
 
 cc_configure = use_extension("@rules_cc//cc:extensions.bzl", "cc_configure_extension")
 use_repo(cc_configure, "local_config_cc", "local_config_cc_toolchains")

go.mod

@@ -12,7 +12,7 @@ require (
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/golang-migrate/migrate/v4 v4.19.1
 	github.com/google/uuid v1.6.0
-	github.com/jackc/pgx/v5 v5.9.1
+	github.com/jackc/pgx/v5 v5.9.2
 	github.com/nats-io/nats-server/v2 v2.12.7
 	github.com/nats-io/nats.go v1.51.0
 	github.com/prometheus/client_golang v1.23.2

go.sum

@@ -72,8 +72,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.9.1 h1:uwrxJXBnx76nyISkhr33kQLlUqjv7et7b9FjCen/tdc=
-github.com/jackc/pgx/v5 v5.9.1/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
+github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4=

identityclient/client.go

@@ -327,7 +327,7 @@ func (c *Client) IssueServiceToken(
 	}
 	request.Header.Set("Content-Type", "application/json")
 	if strings.TrimSpace(c.bootstrapKey) != "" {
-		request.Header.Set("X-Identity-Bootstrap-Key", c.bootstrapKey)
+		request.Header.Set("Authorization", "Bearer "+c.bootstrapKey)
 	}
 
 	response, err := c.httpClient.Do(request)

identityclient/client_test.go

@@ -451,6 +451,12 @@ func TestResolveServiceTokenIssuesAndCachesByScopeSet(t *testing.T) {
 	var identityCalls atomic.Int32
 	identityServer := testutil.NewTestServer(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		identityCalls.Add(1)
+		if got := r.Header.Get("Authorization"); got != "Bearer identity-bootstrap-key" {
+			t.Fatalf("expected bearer bootstrap authorization, got %q", got)
+		}
+		if got := r.Header.Get("X-Identity-Bootstrap-Key"); got != "" {
+			t.Fatalf("expected legacy bootstrap header to be absent, got %q", got)
+		}
 		testutil.WriteJSON(t, w, http.StatusCreated, map[string]any{
 			"token":      "identity-service-token",
 			"token_type": "Bearer",
@@ -553,6 +559,9 @@ func TestIssueServiceTokenAllowsMTLSWithoutBootstrapKey(t *testing.T) {
 	t.Parallel()
 
 	identityServer := testutil.NewTestServer(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("Authorization"); got != "" {
+			t.Fatalf("expected no authorization header without a bootstrap key, got %q", got)
+		}
 		if got := r.Header.Get("X-Identity-Bootstrap-Key"); got != "" {
 			t.Fatalf("expected no bootstrap key header, got %q", got)
 		}