[dependabot]

Bumps go.temporal.io/sdk from 1.47.0 to 1.49.0.

Release notes

Sourced from go.temporal.io/sdk's releases.

v1.49.0

Highlights

Standalone Activities are now GA

With the following updates, Standalone Activities are now generally available (GA)!

• Renamed the standalone activity client.StartActivityOptions.Details option to StaticDetails, and client.ActivityExecutionDescription.GetDetails to GetStaticDetails.
• Added missing description fields: ExecutionTime and TotalHeartbeatCount.
• Corrected stand-alone activity API documentation to use activity terminology, document that GetActivityHandleOptions.RunID may be empty to target the latest run, and describe TerminateActivityOptions.Reason as a termination reason.
• Added opt-in payload fields to client.DescribeActivityOptions: IncludeInput, IncludeOutcome, IncludeHeartbeatDetails and IncludeLastFailure.
• Standalone activity client calls now supply converter.ActivitySerializationContext when encoding and decoding activity payloads: ExecuteActivity (input and static summary/details), ActivityHandle.Describe (heartbeat details, last failure, and static summary/details), and ActivityHandle.Get (result and failure).
• Standalone activities started from a redelivered Nexus operation handler now reuse the Nexus request ID, preventing duplicate Nexus links when an idempotent start resolves to the original run.
• client.ActivityHandle now supports operator commands for standalone activities: Pause, Unpause, UpdateOptions and RestoreOriginalOptions. Operator commands remain experimental.
• Standalone Activities as Nexus operations remain experimental.

Local Activity memory savings

Local activity scheduling no longer uses a fixed 100,000-entry task queue. The queue now grows with demand, avoiding both the up-front allocation and a possible worker deadlock when the queue and all local activity execution slots were full.

Other Notable Changes

Added

• Worker heartbeats now report the Go runtime version (plus RoadRunner, when the SDK is embedded in a RoadRunner binary), detected hosting environments (Docker, Kubernetes, and common cloud platforms), and the operating system and architecture. This is sent once per worker with the first heartbeat accepted by the server and can be turned off with client.Options.DisableWorkerEnvironmentInfo.
• Added converter.NexusSerializationContext support for Nexus callers and handlers. Callers use it for inputs, results, and failures; handlers use it for inputs, synchronous results, and failures. Asynchronous handler results and detached standalone handles are not yet supported. Standalone USE_EXISTING handles use their start request's context.
• Added temporal.NewPayloadValidationError to create non-retryable application errors with optional structured details for payload validation failures. Passing nil omits details.
• Added Go 1.27+ generic methods on the experimental temporalnexus.NexusClient for starting workflow-, activity-, and workflow-update-backed Nexus operations.
• Workflow task completions larger than the gRPC request size limit are now paginated automatically when the namespace supports it. Paginated workflow task completions require Temporal Server 1.32.0 or later.

... (truncated)

Changelog

Sourced from go.temporal.io/sdk's changelog.

[1.49.0] - 2026-09-14

Added

• Worker heartbeats now report the Go runtime version (plus RoadRunner, when the SDK is embedded in a RoadRunner binary), detected hosting environments (Docker, Kubernetes, and common cloud platforms), and the operating system and architecture. This is sent once per worker with the first heartbeat accepted by the server and can be turned off with client.Options.DisableWorkerEnvironmentInfo.
• Standalone activity client calls now supply converter.ActivitySerializationContext when encoding and decoding activity payloads: ExecuteActivity (input and static summary/details), ActivityHandle.Describe (heartbeat details, last failure, and static summary/details), and ActivityHandle.Get (result and failure).
• Added converter.NexusSerializationContext support for Nexus callers and handlers. Callers use it for inputs, results, and failures; handlers use it for inputs, synchronous results, and failures. Asynchronous handler results and detached standalone handles are not yet supported. Standalone USE_EXISTING handles use their start request's context.
• Added temporal.NewPayloadValidationError to create non-retryable application errors with optional structured details for payload validation failures. Passing nil omits details.
• Added Go 1.27+ generic methods on the experimental temporalnexus.NexusClient for starting workflow-, activity-, and workflow-update-backed Nexus operations.
• Workflow task completions larger than the gRPC request size limit are now paginated automatically when the namespace supports it. Paginated workflow task completions require Temporal Server 1.32.0 or later.
• The temporal_activity_execution_failed and temporal_local_activity_execution_failed worker metrics now carry a failure_reason attribute. Each is now split into one time series per reason, which may affect existing dashboards.
• Added support for Workflow Queries as Nexus Operations.

Standalone Activity operator commands

• client.ActivityHandle now supports operator commands for standalone activities: Pause, Unpause, UpdateOptions and RestoreOriginalOptions.
• Added opt-in payload fields to client.DescribeActivityOptions: IncludeInput, IncludeOutcome, IncludeHeartbeatDetails and IncludeLastFailure.
• Added missing description fields: ExecutionTime and TotalHeartbeatCount.

Changed

• Standalone Activities are now generally available (GA). (Standalone Activities as Nexus operations and Standalone Activities operator commands remain experimental. Operator commands are pause, unpause, updateOptions, restoreOriginal.)

💥 Breaking Changes

• Description payload fields that previously came back unconditionally are now opt-in and must be requested via client.DescribeActivityOptions: GetHeartbeatDetails (IncludeHeartbeatDetails) and GetLastFailure (IncludeLastFailure).
• Renamed the standalone activity client.StartActivityOptions.Details option to StaticDetails, and client.ActivityExecutionDescription.GetDetails to GetStaticDetails.

... (truncated)

Commits

• 58115b5 Prepare release 1.49.0 (#2691)
• 628f610 Remove Experimental tag from Standalone Activities (#2690)
• 7ac9167 add back comment (#2687)
• 77dce1c Fix/2547 random stream interleaving (#2666)
• 3a7139f Fix task handler cache teardown (#2638)
• b9f176d Synchronize local activity cancellation test (#2682)
• 902937a Standalone Activities operator commands and optional payloads (#2646)
• fee1a45 Use ActivitySerializationContext for standalone activities (#2680)
• bbe58bd 💥 Rename Standalone Activity Details to StaticDetails (#2681)
• 1cc2c92 chore: bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#2679)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[claude]

Claude finished @dependabot[bot]'s task in 30s —— View job

---

Review Complete ✓

Summary:
This is a dependency bump for go.temporal.io/sdk from v1.47.0 to v1.48.0, with a transitive update to github.com/nexus-rpc/sdk-go from v0.6.0 to v0.7.0.

Findings:

• ✓ No logic changes, only dependency metadata updates
• ✓ Release notes show no breaking changes
• ✓ New features and bug fixes in v1.48.0 (workflow randomization, improved error handling, performance improvements)
• ✓ No code modifications required

Verdict: Trivial dependency bump — no P1/P2 findings. Safe to merge.

---

|

[claude]

Trivial dependency bump with no logic changes; no P1/P2 findings.

[github-actions]

Antigravity (agy) review — informational

Model: gemini-3.1-pro-high.

No significant issues found.

[claude]

Claude finished @dependabot[bot]'s task in 1m 4s —— View job

---

Review Complete ✓

• Gather context (diff between pinned SHAs, restricted to go.mod/go.sum)
• Classify change
• Submit verdict

Diff summary (go.mod +2/-2, go.sum +4/-4):

• go.temporal.io/sdk bumped 1.47.0 → 1.48.0
• Transitive: github.com/nexus-rpc/sdk-go 0.6.0 → 0.7.0, and golang.org/x/crypto v0.54.0 now pulled in as a direct requirement
• No source files changed, no logic changes

Verdict: Trivial dependency bump — no P1/P2 findings. Approved.

[claude]

Trivial dependency bump (go.temporal.io/sdk 1.47.0→1.48.0, transitive nexus-rpc/sdk-go and golang.org/x/crypto bumps); go.mod/go.sum only, no logic changes.

[github-actions]

Antigravity (agy) review — informational

Model: gemini-3.1-pro-high.

Here is the review of the provided diff.

Finding 1

Severity: P2
File: internal/gitops/reader.go (approx. line 150 inside RefreshLoop and line 290 in gitOutput)
Concrete failure scenario: The RefreshLoop accepts a ctx context.Context for managing its lifecycle, but it does not pass this context down to refresh(), runGit(), or gitOutput(). Inside gitOutput, exec.Command is used instead of exec.CommandContext. If a transient network failure causes the underlying git clone or git fetch operation to hang indefinitely, the git subprocess will never be terminated when the context is canceled (e.g., during graceful shutdown or timeout). This leads to a permanent goroutine leak where RefreshLoop stays blocked on exec.Command.CombinedOutput(), holding the exclusive r.mu.Lock() and completely freezing all subsequent GitOps repository reads across the API until the process is hard-killed.
Proposed fix: Update refresh(), runGit(), and gitOutput() to accept ctx context.Context. Pass the ctx from RefreshLoop into refresh(). Finally, in gitOutput(), use exec.CommandContext(ctx, "git", fullArgs...) instead of exec.Command to ensure the subprocess correctly respects the cancellation signal.

Finding 2

Severity: P2
File: internal/gitops/reader.go (approx. line 270 in resolveKnownHostsPathLocked)
Concrete failure scenario: resolveKnownHostsPathLocked creates a temporary file in the system temp directory (/tmp) to house the known_hosts keys, caches the path in r.resolvedKnownHostsPath, and returns this cached string on all subsequent calls. In long-running processes, temporary files in /tmp are routinely deleted by OS cleanup utilities (such as systemd-tmpfiles or tmpwatch) if they haven't been modified recently. If the OS deletes this file while the API is running, subsequent git fetch operations using ssh will fail with a "Host key verification failed" error because StrictHostKeyChecking=yes requires the host key to be present. This permanently breaks GitOps syncs until the mctl-api pod is restarted.
Proposed fix: Before returning the cached r.resolvedKnownHostsPath, perform an os.Stat check to verify the file still exists on disk. If the file has been purged, fall through and recreate it:

	if r.resolvedKnownHostsPath != "" {
		if _, err := os.Stat(r.resolvedKnownHostsPath); err == nil {
			return r.resolvedKnownHostsPath, nil
		}
		// File was likely deleted by an OS temp cleaner; recreate it.
	}

Finding 3

Severity: P3
File: internal/api/handlers_domains.go and internal/api/handlers_repos.go (approx. lines 105, 175, 230 in handlers_domains.go; line 95 in handlers_repos.go)
Concrete failure scenario: Several HTTP endpoints (DeleteDomain, VerifyDomain, ListDomains, SyncRepos) use the standard library http.Error(w, ...) to return JSON-formatted error strings (e.g., http.Error(w, {"error":"backstage unavailable"}, ...)). However, http.Error automatically forces the HTTP response Content-Type header to text/plain; charset=utf-8 and appends a newline. Strict API clients expecting standard application/json error payloads will fail to parse these responses. This also creates hygiene inconsistencies since the newly added RBAC checks in these same files correctly use the project's internal writeError(w, ...) helper which formats the JSON appropriately.
Proposed fix: Replace all direct uses of http.Error(w, ...) in handlers_domains.go and handlers_repos.go with the project's standard writeError(w, statusCode, message) helper to guarantee valid JSON formatting and the correct application/json Content-Type headers.

[claude]

Claude finished @dependabot[bot]'s task in 35s —— View job

---

Review Complete ✓

Diff Analysis:

• Files changed: 2 (go.mod, go.sum)
• Lines modified: +6/-6 (dependency metadata only)
• Source code changes: None

Changes:

• go.temporal.io/sdk v1.47.0 → v1.48.0
• github.com/nexus-rpc/sdk-go v0.6.0 → v0.7.0 (transitive)

Findings:

• ✓ Trivial dependency bump with no logic modifications
• ✓ No breaking changes in release notes (v1.48.0 adds features and fixes bugs)
• ✓ Only dependency metadata changed (go.mod/go.sum)
• ✓ No source code files modified

Verdict: Approved — Safe to merge.

--- · PR Branch

[github-actions]

Antigravity (agy) review

agy run failed on this PR; see the workflow log. Not blocking merge.

[claude]

Trivial dependency bump: go.temporal.io/sdk v1.47.0→v1.48.0 with transitive sdk-go v0.6.0→v0.7.0. No source changes, no logic modifications. Release notes show no breaking changes. Safe to merge.

[github-actions]

Skipping — this commit (3a88060) already has a Claude review verdict. Push a new commit, or check the run log if you expected a fresh pass and the previous run actually failed.

[github-actions]

Antigravity (agy) review — informational

Model: gemini-3.1-pro-high.

No significant issues found.

[github-actions]

Skipping — this commit (7865e27) already has a Claude review verdict. Push a new commit, or check the run log if you expected a fresh pass and the previous run actually failed.

[claude]

Claude finished @dependabot[bot]'s task in 22s —— View job

---

Review Complete ✓

• Fetch pinned commits
• Diff d3fe2c6...bf2a28b
• Classify change
• Submit verdict

Diff: go.mod (+5/-5) and go.sum (+10/-10) only — no source files changed.

Change: go.temporal.io/sdk 1.47.0 → 1.49.0, with transitive bumps to go.temporal.io/api (1.63.4→1.63.5), github.com/nexus-rpc/sdk-go (0.6.0→0.7.0), golang.org/x/net (0.57.0→0.58.0), and google.golang.org/grpc (1.83.1→1.83.2).

Verdict: Trivial dependency bump, no logic changes — approved.
· PR Branch

[claude]

Trivial dependency bump (go.temporal.io/sdk 1.47.0→1.49.0, transitive api/nexus-rpc/grpc/x-net bumps); go.mod/go.sum only, no logic changes.

[mashkovd]

@dependabot rebase

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Claude review failed to complete on both tokens (see the run log; the 'Reviewer failure diagnostics' group in the review job says why). Re-trigger with @claude review once the underlying issue is resolved.

[claude]

Claude finished @mashkovd's task in 14s —— View job

---

Review complete

• Reviewed diff 35967b7...d14ef37

go.temporal.io/sdk goes from 1.47.0 to 1.50.0, with transitive api and nexus-rpc/sdk-go bumps. The test fake in internal/temporalclient/client_mock_test.go gains GetFirstExecutionRunID so it satisfies the new WorkflowRun interface. The repo doesn't use the standalone-activity APIs that the release notes list as breaking changes.

Verdict: approved, with 0 P1, 0 P2 and 0 P3 findings. This was a static review, so I didn't run any builds or tests.
· PR branch

[claude]

Dependency bump (temporal sdk 1.50.0) plus a one-line test fake update for the new WorkflowRun interface method; no use of the breaking standalone-activity APIs. No P1/P2 findings.