jeremyhahn · dependabot · Jun 3, 2026 · Jun 8, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,88 @@
+# Dependabot configuration for go-objstore.
+#
+# Covers every dependency ecosystem that actually exists in the repo (the core
+# Go module, the per-language SDKs, and GitHub Actions). Updates are grouped and
+# weekly to keep PR volume low. Paths that no longer exist (e.g. the removed
+# JavaScript SDK) are intentionally absent so Dependabot stops scanning them.
+version: 2
+updates:
+  # ---- Go modules ----
+  - package-ecosystem: gomod
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      go-modules:
+        patterns: ["*"]
+
+  - package-ecosystem: gomod
+    directory: "/api/sdks/go"
+    schedule:
+      interval: weekly
+    groups:
+      go-sdk:
+        patterns: ["*"]
+
+  - package-ecosystem: gomod
+    directory: "/examples/encryption"
+    schedule:
+      interval: weekly
+    groups:
+      examples:
+        patterns: ["*"]
+
+  # ---- TypeScript SDK (npm) ----
+  - package-ecosystem: npm
+    directory: "/api/sdks/typescript"
+    schedule:
+      interval: weekly
+    groups:
+      typescript-sdk:
+        patterns: ["*"]
+
+  # ---- Python SDK (pip) ----
+  - package-ecosystem: pip
+    directory: "/api/sdks/python"
+    schedule:
+      interval: weekly
+    groups:
+      python-sdk:
+        patterns: ["*"]
+
+  # ---- Ruby SDK (bundler) ----
+  - package-ecosystem: bundler
+    directory: "/api/sdks/ruby"
+    schedule:
+      interval: weekly
+    groups:
+      ruby-sdk:
+        patterns: ["*"]
+
+  # ---- Rust SDK (cargo) ----
+  - package-ecosystem: cargo
+    directory: "/api/sdks/rust"
+    schedule:
+      interval: weekly
+    groups:
+      rust-sdk:
+        patterns: ["*"]
+
+  # ---- C# SDK (nuget) ----
+  - package-ecosystem: nuget
+    directory: "/api/sdks/csharp"
+    schedule:
+      interval: weekly
+    groups:
+      csharp-sdk:
+        patterns: ["*"]
+
+  # ---- GitHub Actions ----
+  # Keeps workflow actions current (avoids the Node-20 deprecation churn).
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ["*"]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -7,7 +7,7 @@ on:
     branches: [ main, develop ]
 
 env:
-  GO_VERSION: '1.26.3'
+  GO_VERSION: '1.26.4'
   COVERAGE_THRESHOLD: 89
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
@@ -50,7 +50,7 @@ jobs:
     - name: Upload coverage to Codecov
       uses: codecov/codecov-action@v6
       with:
- file: ./coverage/unit.out
+ files: ./coverage/unit.out
         flags: unittests
         name: codecov-umbrella
         fail_ci_if_error: false
@@ -106,7 +106,7 @@ jobs:
         cache: true
 
     - name: Run golangci-lint
-      uses: golangci/golangci-lint-action@v7
+      uses: golangci/golangci-lint-action@v9
       with:
         version: v2.11.1
         args: --timeout=10m

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -6,7 +6,7 @@ on:
       - 'v*'
 
 env:
-  GO_VERSION: '1.26.3'
+  GO_VERSION: '1.26.4'
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
@@ -355,7 +355,7 @@ jobs:
       run: |
         cat > Dockerfile.cli << 'EOF'
         # Multi-stage build for go-objstore CLI
-        FROM golang:1.26.3-alpine AS builder
+        FROM golang:1.26.4-alpine AS builder
         RUN apk add --no-cache git ca-certificates make
         WORKDIR /build
         COPY go.mod go.sum ./
@@ -426,7 +426,7 @@ jobs:
       run: |
         cat > Dockerfile.server << 'EOF'
         # Multi-stage build for go-objstore server (all protocols)
-        FROM golang:1.26.3-alpine AS builder
+        FROM golang:1.26.4-alpine AS builder
         RUN apk add --no-cache git ca-certificates make
         WORKDIR /build
         COPY go.mod go.sum ./

diff --git a/.gitignore b/.gitignore
@@ -109,6 +109,7 @@ go.work.sum
 gosec-results.json
 storage/
 
-# Tooling
+# AI assistant / local tooling — never commit
 .serena/
+.claude/
 CLAUDE.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,7 +10,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ### Changed
 
-- Go toolchain upgraded from 1.21 to 1.26.3
+- Go toolchain upgraded from 1.21 to 1.26.4
 - All SDK packages updated to version 0.2.0 for API parity across languages
 - TypeScript SDK: JavaScript SDK consolidated into TypeScript package (@go-objstore/client)
   - Ships compiled JavaScript (ESM + CJS) usable from plain JavaScript projects

diff --git a/Dockerfile b/Dockerfile
@@ -1,6 +1,6 @@
 # Multi-stage build for go-objstore
 # Stage 1: Build the application
-FROM golang:1.26.3-alpine AS builder
+FROM golang:1.26.4-alpine AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git ca-certificates make