Kitex is the CloudWeGo Go RPC framework for Thrift, Kitex Protobuf, and gRPC. On 22 September 2026 main gained two maintenance commits, 22 insertions and 3 deletions, and version.go still reports v0.16.3. The gopkg bump pulls a Thrift skip panic fix onto main while the v0.16.3 tag stays on gopkg v0.2.0, and the new Dependabot file only opens updates for CloudWeGo modules and Sonic.
The gopkg bump is one require line ¶
The gopkg bump edits go.mod and go.sum. The direct require moves from github.com/cloudwego/gopkg v0.2.0 to v0.2.1. No Kitex Go file changes, and the pull request text does not describe v0.2.1.
v0.2.1 is two gopkg commits past v0.2.0: a May 2026 panic fix in Thrift skip, and a 21 September change to ReadBinary when the span cache is off. The v0.16.3 tag still requires v0.2.0, the same pin the v0.16.2 bump introduced.
Minimum version selection lets a service require github.com/cloudwego/gopkg v0.2.1 and get it while Kitex stays on the v0.16.3 tag. The nested module github.com/cloudwego/kitex/pkg/protocol/bthrift still requires v0.1.3-0.20241115063537-a218fe69d609. That lower pin loses when the root module is in the build. It still applies when the nested module is built alone. The package text already points new code at github.com/cloudwego/gopkg/protocol/thrift.
A negative type id used to panic in Skip ¶
Generated struct code in tool/internal_pkg/pluginmode/thriftgo/struct_tpl.go calls thrift.Binary.Skip for a field the local type does not know. skipStructReader in pkg/generic/thrift/read.go calls in.Skip(fieldType) when the field id is absent. RawReader.Read in pkg/generic/thrift/raw.go uses thrift.NewSkipDecoder when the caller did not pass a length.
gopkg keeps typeToSize, a 256 slot table of fixed sizes. The old skip path indexed that table with the type value. A type byte of 128 or higher is negative when read as a signed integer, and a negative index into a Go array panics. Positive unknown ids such as TType(122) already returned an error. The May commit message calls the negative case a panic.
typeSize indexes with uint8(t). A negative id lands on a high slot. Those slots are zero, so the fixed size fast path does not run, and skip returns the existing error. New tests cover Binary.Skip, BufferReader.Skip, and SkipDecoder.Next with TType(-106). They also skip a struct, a map, and a list whose nested type byte is 150, the same bit pattern as that negative id. v0.16.3 does not include the helper. Main after this bump does, and so does any build that selects gopkg v0.2.1.
ReadBinary copies once when the span cache is off ¶
The September gopkg change touches BinaryProtocol.ReadBinary only when spanCacheEnable is false. The old expression was []byte(string(buf[4:l])), a copy into a string and a second copy into a slice so the result does not alias the input. The replacement allocates one slice:
data := buf[4:l]
b = make([]byte, len(data))
copy(b, data)
The span cache branch still calls spanCache.Copy. The new test turns the cache off, reads hello, writes j into source byte 4 (the first payload byte), and checks the result stays hello. It then writes a into the result and checks the source stays jello. A benchmark covers 16, 256, 4096, and 65536 byte payloads. No timings are in the commit.
BufferReader.ReadBinary, which readBinary in pkg/generic/thrift/read.go calls, is a different method. It allocates with dirtmake.Bytes and fills that slice from bufiox. The September patch does not touch it. Legacy callers still reach it through ReadBinary in pkg/protocol/bthrift/binary.go, which forwards to gthrift.Binary.ReadBinary. SetSpanCache still selects the branch on the byte slice API. With the cache on, the new make and copy do not run.
Dependabot watches two name patterns ¶
The Dependabot commit adds .github/dependabot.yml. It is 19 lines. No Go source moves with it.
version: 2
updates:
- package-ecosystem: gomod
schedule:
interval: daily
time: "10:00"
timezone: Asia/Shanghai
allow:
- dependency-name: github.com/cloudwego/*
dependency-type: all
- dependency-name: github.com/bytedance/sonic
dependency-type: all
groups:
cloudwego-dependencies:
patterns:
- github.com/cloudwego/*
- github.com/bytedance/sonic
directories:
- /
GitHub documents daily as Monday to Friday. The run is 10:00 Asia/Shanghai (02:00 UTC). dependency-type: all includes indirect modules whose names match. The group cloudwego-dependencies puts every match in one pull request, so a Sonic bump and a netpoll bump share a diff.
directories is only /, so pkg/protocol/bthrift/go.mod is ignored. With no open-pull-requests-limit and no cooldown, version updates keep the documented defaults: at most five open pull requests, and a 3 day wait after a release. Security updates ignore both defaults. GitHub also applies allow to security updates, so an unlisted name is not proposed.
Matched from the root go.mod: the github.com/cloudwego/* modules (gopkg v0.2.1, netpoll v0.7.2, thriftgo v0.4.5, and the rest of that org) plus github.com/bytedance/sonic v1.15.0. Sonic is there because pkg/utils/json_sonic.go uses it in Map2JSONStr and JSONStr2Map, with EscapeHTML, ValidateString, and a panic fallback to the standard library.
Left unmatched: github.com/bytedance/gopkg v0.1.4 (different org), github.com/bytedance/sonic/loader v0.5.0 (the Sonic entry has no wildcard), golang.org/x/net v0.24.0 and the other golang.org/x lines, protobuf v1.33.0 and genproto, plus github.com/json-iterator/go, github.com/tidwall/gjson, gopkg.in/yaml.v3, and github.com/jhump/protoreflect.
The go line is still go 1.20.
What to watch ¶
Tag builds keep the old skip path until version.go passes v0.16.3. A direct require of gopkg v0.2.1 selects the fix. Dependabot will not edit pkg/protocol/bthrift/go.mod.
Treat the first grouped pull request as several bumps in one diff. github.com/bytedance/sonic/loader and github.com/bytedance/gopkg will be absent unless the patterns grow. Version updates open on weekdays at 10:00 Asia/Shanghai after the 3 day wait. Security updates skip that wait, then still have to match the allow list, so golang.org/x/net v0.24.0 and protobuf v1.33.0 stay a manual bump.