Bump hey-sdk to v0.33.1

Merged
JE
4d ago
+8-7

Summary

Move github.com/basecamp/hey-sdk/go from v0.32.1 to the published v0.33.1 release, with no CLI call-site changes or new commands.

What HEY CLI picks up:

  • 422 reasons survive. Refused writes carry HEY's actual validation reasons rather than a bare validation error, including contact, draft and thread-comment writes (SDK #262). apierr.FromSDK already passes the SDK's message and hint through.
  • A successful write whose response body breaks stays successful. Raw and form writes no longer invite a resend just because the successful response body was truncated or exceeded the size cap (SDK #256).
  • Redirected non-idempotent writes are not replayed after a hop's 401. Credentials are refreshed for later requests, but the original write is not made again (SDK #269).
  • Go OAuth token requests refuse redirects. Exchange and refresh requests do not forward their sensitive form bodies to a redirect destination (SDK #271).
  • 304 revalidation keeps pagination headers, plus the kin-openapi / x/net advisory bumps (SDK #261, SDK #258).

Release: https://github.com/basecamp/hey-sdk/releases/tag/v0.33.1

Alongside go.mod/go.sum:

  • Re-sync the embedded MCP model from the exact go/v0.33.1 checkout. Its model content is unchanged from v0.33.0; only provenance moves for this patch.
  • Recompute nix/package.nix vendorHash with make update-nix-hash, including a successful verification build. Keep the CLI package version unchanged; this PR does not cut a CLI release.

Verification

  • make check replace-check: pass (fmt, vet, lint, unit tests, skill-sync tests, tidy, CLI surface, release lockstep, no local replacements).
  • govulncheck ./... under Go 1.27.3: no vulnerabilities affecting the CLI. One module-level advisory remains in code the CLI does not call.
  • make build: pass.
  • make update-nix-hash: new vendorHash verified by a successful Nix build.
  • Reviewed the follow-up diff: dependency version/checksums, MCP provenance and Nix vendorHash only; git diff --check passes.

The Nix toolchain is pinned independently by flake.lock and still resolves Go 1.27.0. That pre-existing release-hardening concern is separate from this SDK bump and should be fixed before the next CLI release; this PR does not claim to fix Nix's Go toolchain.