Bump src/submodules/opslevel-go from e7cefed to 7304fbb

[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps src/submodules/opslevel-go from e7cefed to 7304fbb.

Commits

• 7304fbb Cut Release 'v2026.10.15'
• 269d20f Bump github.com/go-playground/validator/v10 from 10.30.4 to 10.30.5 (#648)
• ce0e078 Fix GO-2026-6612: bump golang.org/x/net to v0.60.0 and Go toolchain to 1.26.9...
• 8614cfd Bump github.com/relvacode/iso8601 from 1.8.1 to 1.8.2 (#650)
• 4be688b Bump github.com/relvacode/iso8601 from 1.8.0 to 1.8.1 (#649)
• 3382dea Bump github.com/go-playground/validator/v10 from 10.30.3 to 10.30.4 (#646)
• c6ed6fa Cut Release 'v2026.9.7'
• 7872a54 Add ListTeamsIncludingProperties for batched team metadata reads (#643)
• 1967195 Bump github.com/rs/zerolog from 1.34.0 to 1.35.1 (#635)
• cc98577 Bump github.com/stretchr/testify from 1.11.1 to 1.12.1 (#636)
• Additional commits viewable in compare view

[Farjaad]

Dependency review: not safe to merge as-is

• Scope: Submodule pointer src/submodules/opslevel-go e7cefed → 7304fbb. That's 74 upstream commits covering releases v2025.12.5 → v2026.10.15, much more than the 10 commits listed in the PR body. Only the submodule pointer changes; src/go.mod/src/go.sum are untouched.
• Notable changes: Module path renamed opslevel-go/v2025 → /v2026; Go 1.26 / toolchain go1.26.9; GO-2026-6612 fix (x/net v0.60.0); go-graphql-client 0.14.4 → 0.16.0, resty 2.17.2, zerolog 1.35.1, validator 10.30.5; new tool directives. Features: campaigns, on-call, Kubernetes/custom integrations, team properties, user tags/teams. Fixes: HTML unescaping (#602), service parent query (#603), stricter CaseSensitive validation (#627).
• Why it's not safe: The bump leaves src/go.mod/go.sum stale, so go build ./... and go vet ./... fail with go: updates to go.mod needed; go mod tidy. Also, the CLI still requires and replaces /v2025 while the submodule now declares /v2026. That works through the directory replace, but task update-opslevel-go still targets /v2025 and the imports should be migrated.
• Behavior change for users: Filter predicates with caseSensitive on exists/matches are now rejected by validation.
• Verification:
  • CI: Tests did not run. A submodule pointer change doesn't match the src/**.go / src/go.mod / src/go.sum path filter.
  • Locally (Go 1.26.9, submodule at 7304fbb): go build ./... and go vet ./... fail without tidy, and both pass on the old submodule (e7cefed). After go mod tidy: build, vet and go test ./common/... pass. ./cmd/... integration tests weren't run (they need an API token).
• Suggested fix: A follow-up PR that includes this submodule bump plus the tidied src/go.mod/src/go.sum (and ideally migrates imports to /v2026). Changing src/go.mod will also trigger the Tests workflow.

[Farjaad]

@dependabot rebase

[Farjaad]

Dependency review (updated): safe to merge

This replaces my earlier "not safe to merge as-is" comment. I pushed two commits on top of Dependabot's submodule bump to fix the problems it caused. Inline comments explain each change.

What I pushed

• 7cad03e go mod tidy: syncs src/go.mod/src/go.sum with opslevel-go v2026.10.15. Without it, go build/go vet fail with updates to go.mod needed.
• 7173c0e golangci-lint v1.64.8 → v2.1.2: opslevel-go now requires newer goconst/nakedret/unconvert versions that v1.64.8 no longer compiles against, which broke the Tests job. .golangci.yml is migrated to the v2 format with the same rule set, and one new deprecation warning is suppressed in cmd/property.go.

src/go.sum has no inline notes; it's the lockfile hashes that go mod tidy regenerated, and go mod verify passes.

Verification

• CI: Tests (gofumpt, go vet, golangci-lint, ./common tests) and CodeQL pass on 7173c0e.
• Local, Go 1.26.9: the same task ci steps pass (golangci-lint: 0 issues), and go mod verify passes.
• e2e suite passes against the API with a test-account token: Domain, Infrastructure, Service, System and Team happy paths (5/5, ~35s), with no cleanup errors.
• Not run: the ./cmd integration tests (task test-integration), and the release workflow (dispatch-only).

Remaining caveats (not blocking)

• The CLI still imports and replaces opslevel-go/v2025 while the submodule declares /v2026. The directory replace makes this work, but Taskfile.yml's OPSLEVEL_GO_PKG (used by task update-opslevel-go) and the imports should move to /v2026 in a follow-up.
• User-visible upstream change: filter predicates with caseSensitive on exists/matches are now rejected by opslevel-go's validation.
• The Tests path filter doesn't match submodule pointer changes, so future opslevel-go bumps won't run tests unless go.mod also changes.
• Because commits were pushed by hand, Dependabot will no longer rebase this PR automatically.

[Farjaad]

Added by go mod tidy. Only opslevel-go's own _test.go files import the /v2026 path, and tidy includes test dependencies of dependencies, so it resolves this from the module proxy. It isn't linked into the CLI: go list -deps ./... has no /v2026 packages, and the binary still builds from ./submodules/opslevel-go through the /v2025 replace. v2026.10.15 is also the same release as submodule commit 7304fbb. It goes away once we migrate imports to /v2026.

[Farjaad]

Switched the tool from github.com/golangci/golangci-lint/cmd/golangci-lint (v1.64.8) to the /v2 module at v2.1.2, the same version opslevel-go uses.

Why: opslevel-go v2026.10.15 requires jgautheron/goconst v1.8.1, alexkohler/nakedret/v2 v2.0.6 and a newer golangci/unconvert. Go uses the highest required version of each, and golangci-lint v1.64.8 doesn't compile against them (not enough arguments in call to goconstAPI.Run, etc.), which is what failed the Tests job on 7cad03e. Go never picks a version below what a dependency requires, so upgrading the linter was the only fix. task lint / task fix still call go tool golangci-lint, so nothing else needed to change.

[Farjaad]

The indirect requirement that comes with the golangci-lint v2 tool directive below. Most of the other go.mod/go.sum changes in this PR are linter and opslevel-go dependencies moving to the versions that v2 and opslevel-go v2026.10.15 require.

[Farjaad]

Converted to the v2 config format with golangci-lint migrate. linters-settings became linters.settings, and the exclusions presets below are how v2 spells v1's default exclusion rules, so nothing new is excluded. run.timeout: 2m was dropped because v2 has no timeout by default; lint finishes in a few seconds here.

[Farjaad]

Two deliberate edits to what migrate generated:

1. Order of all / -SA5001: migrate sorted these alphabetically, putting -SA5001 before all. Staticcheck applies these entries in order, so that would have turned SA5001 back on. I restored the original order.
2. -ST* and -QF*: v2 merged stylecheck (ST) and the quick-fix checks (QF) into the staticcheck linter, so all now includes them. In v1 the staticcheck linter only ran SA checks, and we never enabled stylecheck. Without these exclusions, v2 reports about 50 new findings: 25× ST1003 naming (teamId → teamID, JsonPrint → JSONPrint), 23× QF suggestions and 1× ST1005. Excluding them keeps lint enforcing the same rules as before. Enabling them would be a separate style cleanup.

[Farjaad]

The only new lint finding after the migration is a real SA1019, not a style check. opslevel-go v2026 deprecates Client.GetProperty in favor of Service.GetProperty / Team.GetProperty (added with team custom properties in OpsLevel/opslevel-go#609).

The deprecated method's query is unchanged (account.property(owner:, definition:)), so opslevel get property behaves exactly as before: service owners work, and team owners error from the API, which was already true. Switching to the new methods would mean working out whether the alias is a service or a team, which would add team support to the command. That's a feature for its own PR, so I suppressed the warning on this line instead.