[Benehiko]

What I did

• Bumped github.com/docker/secrets-engine/client from v0.2.0 to v0.2.2 and secrets-engine/x from v0.8.3 to v0.8.5. Both require go >= 1.26.10. main already uses 1.26.10 in .go-version and the Dockerfile, so the only Go change here is the go directive in go.mod, from 1.26.8 to 1.26.10.
• Removed jwtExpiry from internal/registry/desktop.go: compose no longer parses exp out of the access token itself. client v0.2.2 rejects stored tokens that are not JWTs (ErrInvalidAccessToken, which wraps ErrNoSession). Docker Desktop's docker-auth store already fills in the claims, expiry included, from the JWT when it saves a Hub credential and when it reads one from the legacy credential helper. Claims.ExpiresAt is therefore the only expiry source compose needs. A session without an expiry claim is still reused for sessionTTL.

Testing

• go build ./... and golangci-lint run --build-tags e2e ./... pass with Go 1.26.10.
• go test ./internal/... ./cmd/... ./pkg/... passes, except for three pkg/watch tests (TestGitBranchSwitch, TestWatchBrokenLink, TestWatchCountInnerFile). They also fail on main on macOS, and this change doesn't touch pkg/watch.

AI disclosure

Prepared with an AI coding agent (alki, running Claude) and reviewed by the author.

[docker-agent]

Assessment: 🟢 APPROVE

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Benehiko]

Added a second commit that removes jwtExpiry: compose no longer parses exp out of the access token itself. Docker Desktop's docker-auth store already fills in the claims, expiry included, from the JWT. It does this when saving a Hub credential (enrichHubCredential in pinata's internal/store) and when reading one from the legacy credential helper (mergeTokenPair in docker-auth). Together with the JWT check in client v0.2.1, Claims.ExpiresAt is the only expiry source compose needs. A session without an expiry claim is still reused for sessionTTL. (Comment posted by an AI agent on the author's behalf.)

[ndeloof]

AI_AGENT_DISCLOSURE.md file must be removed from your commit once you confirm having reviewed changes on your own (this is to prevent automated PRs created by AI farms)

[thaJeztah]

Is go1.27 required for secrets-engine? If not, can we keep it on go1.26?

the Go version in go.mod should stick to MVS (https://research.swtch.com/vgo-mvs), like all other dependencies.

[thaJeztah]

(at least if go1.27 is an absolute requirement, it should not include a .patch version, or it should be .0)

[Benehiko]

downgraded to 1.26.10 on the SDK so this should be good now

[Benehiko]

I bump Go in this PR @ndeloof @glours; I suppose you would rather want it in another PR with its own commit?

[docker-agent]

Assessment: 🟢 APPROVE