fix: fix detecting requires on interface members for abstract selection rewriter

[devsergiy]

Update engine to 2.0.0-rc.226 (2025-09-12)

Bug Fixes

• detecting requires on interface members (#1295) (70bd5d5)

Summary by CodeRabbit

• Chores
  • Upgraded router and test-suite dependencies to the latest available versions.
  • Aligns version pins across modules for consistent, reproducible builds.
  • Improves compatibility with recent GraphQL tooling and incorporates upstream stability/security enhancements.
  • No changes to user-facing behavior; existing features continue to work as before.

Checklist

• I have discussed my proposed changes in an issue and have received approval to proceed.
• I have followed the coding standards of the project.
• Tests or benchmarks have been added or updated.
• Documentation has been updated on https://github.com/wundergraph/cosmo-docs.
• I have read the Contributors Guide.

[coderabbitai]

Walkthrough

Updated Go module dependencies: bumped github.com/wundergraph/graphql-go-tools/v2 in router and router-tests; updated cosmo demo and router pseudo-versions in router-tests. No code changes, only go.mod edits.

Changes

Cohort / File(s)	Summary
Go module dependency updates router/go.mod, router-tests/go.mod	Bump github.com/wundergraph/graphql-go-tools/v2 from v2.0.0-rc.225 to v2.0.0-rc.226. In router-tests, also update github.com/wundergraph/cosmo/demo and github.com/wundergraph/cosmo/router to new pseudo-versions.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• fix: planner fixes for parent entity jumps and unique nodes selections #2044: Updates the same go.mod dependencies, including graphql-go-tools and cosmo router/demo pins.
• fix: go.mod references to security merge commit #2048: Similar go.mod dependency bumps for graphql-go-tools and cosmo/router.
• fix: fix merging fetches and add dependencies update #2053: Aligns the same dependency entries in router and router-tests go.mod files.

Pre-merge checks (3 passed)

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title clearly summarizes the primary change: a bugfix for detecting "requires" on interface members in the abstract selection rewriter, which aligns with the PR description and changeset; it is specific and understandable for a reviewer scanning history. The phrasing is concise and directly related to the main fix.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

Tip

👮 Agentic pre-merge checks are now available in preview!

Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.

• Built-in checks – Quickly apply ready-made checks to enforce title conventions, require pull request descriptions that follow templates, validate linked issues for compliance, and more.
• Custom agentic checks – Define your own rules using CodeRabbit’s advanced agentic capabilities to enforce organization-specific policies and workflows. For example, you can instruct CodeRabbit’s agent to verify that API documentation is updated whenever API schema files are modified in a PR. Note: Upto 5 custom checks are currently allowed during the preview period. Pricing for this feature will be announced in a few weeks.

Please see the documentation for more information.

Example:

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Please share your feedback with us on this Discord post.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Router image scan passed

✅ No security vulnerabilities found in image:

ghcr.io/wundergraph/cosmo/router:sha-78b1c5dde63677c80f3312205f0e89681eaab71d

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (2)

router/go.mod (1)

53-55: Optional: align golang.org/x/net with router-tests to reduce divergence.

router uses v0.38.0, router-tests uses v0.41.0. Not a blocker, but aligning can avoid duplicate module downloads and subtle CI diffs.

Here’s the minimal change if you want it:

- golang.org/x/net v0.38.0
+ golang.org/x/net v0.41.0

router-tests/go.mod (1)

30-30: graphql-go-tools v2.0.0-rc.226 in tests matches router: good; consider adding a regression test for the interface “requires” case.

A small integration test asserting the abstract selection rewriter handles “requires” on interface members would guard against regressions.

I can draft a minimal router-tests case reproducing #1295 and asserting the fix—want me to open an issue and provide the test?

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 106e871 and 50f6f28.

⛔ Files ignored due to path filters (2)

• router-tests/go.sum is excluded by !**/*.sum
• router/go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• router-tests/go.mod (1 hunks)
• router/go.mod (1 hunks)

🧰 Additional context used

🧠 Learnings (2)

📓 Common learnings

Learnt from: StarpTech
PR: wundergraph/cosmo#2157
File: router-tests/go.mod:16-16
Timestamp: 2025-08-20T22:13:25.222Z
Learning: github.com/mark3labs/mcp-go v0.38.0 has regressions and should not be used in the wundergraph/cosmo project. v0.36.0 is the stable version that should be used across router-tests and other modules.

📚 Learning: 2025-08-20T22:13:25.222Z

Learnt from: StarpTech
PR: wundergraph/cosmo#2157
File: router-tests/go.mod:16-16
Timestamp: 2025-08-20T22:13:25.222Z
Learning: github.com/mark3labs/mcp-go v0.38.0 has regressions and should not be used in the wundergraph/cosmo project. v0.36.0 is the stable version that should be used across router-tests and other modules.

Applied to files:

• router-tests/go.mod
• router/go.mod

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (12)

• GitHub Check: build-router
• GitHub Check: image_scan
• GitHub Check: integration_test (./. ./fuzzquery ./lifecycle ./modules)
• GitHub Check: build_push_image
• GitHub Check: build_push_image (nonroot)
• GitHub Check: image_scan (nonroot)
• GitHub Check: integration_test (./events)
• GitHub Check: build_test
• GitHub Check: integration_test (./telemetry)
• GitHub Check: build_test
• GitHub Check: Analyze (go)
• GitHub Check: Analyze (javascript-typescript)

🔇 Additional comments (3)

router/go.mod (1)

34-34: Approve bump to github.com/wundergraph/graphql-go-tools v2.0.0-rc.226 — run go mod tidy & verify no rc.225 remains

Matches PR goal ("detecting requires on interface members").

• Run in router: cd router && go mod tidy (commit updated go.sum).
• Verify no stale rc.225 across the repo (sandbox search returned "No files were searched"):

# from repo root
cd router && go mod tidy
# then (from repo root) search for any remaining rc.225 references
rg -nP --no-ignore -uu -g '!vendor/**' 'github\.com/wundergraph/graphql-go-tools/v2\s+v2\.0\.0-rc\.225' || echo "OK: no rc.225 found"
rg -nP --no-ignore -uu -g '!vendor/**' 'github\.com/wundergraph/graphql-go-tools/v2\s+v2\.0\.0-rc\.[0-9]+' || true

router-tests/go.mod (2)

28-28: Router pseudo-version bump: consistent with demo; good.

Same publication caveat as above for external users without replace directives.

If you plan to tag soon, ensure this pseudo-version corresponds to the commit you intend to expose.

---

26-26: Updated demo pseudo-version: OK — confirm it's published and resolvable without local replaces.

Sandbox couldn't locate router-tests/go.mod (sed: "can't read go.mod"); verification inconclusive. Locally run:
sed -n '26p' router-tests/go.mod
Temporarily comment out any replace for github.com/wundergraph/cosmo/demo (or remove go.work overrides) and run:
go mod download github.com/wundergraph/cosmo/demo@v0.0.0-20250912064154-106e871ee32e