chore(deps): bump connectrpc.com/connect from 1.19.2 to 1.21.0

[dependabot]

Bumps connectrpc.com/connect from 1.19.2 to 1.21.0.

Release notes

Sourced from connectrpc.com/connect's releases.

v1.21.0

What's Changed

[!IMPORTANT]

This release adds a security-related feature for servers. The new handler option WithRequestGate runs after the request headers are available and before any message is received. Use this new option to register checks (e.g. authentication) that should happen before the request is decompressed or unmarshaled, and before any interceptors are run. See the documentation for details.

Governance

• Add pkwarren as a maintainer by @​bufdev in connectrpc/connect-go#929 🎉

Enhancements

• Add WithRequestGate handler option by @​emcfarlane in connectrpc/connect-go#962
• Create release binary for protoc-gen-connect-go by @​emcfarlane in connectrpc/connect-go#966

Bugfixes

• Fix issue with user-agent getting inappropriately injected into request headers by @​jhump in connectrpc/connect-go#934
• Fix client streaming operations blocking indefinitely after context cancellation by @​haru0017 in connectrpc/connect-go#937
• Fix flaky HTTP2 testcase assertion by @​emcfarlane in connectrpc/connect-go#940
• Fix data race and connection leak in duplexHTTPCall by @​emcfarlane in connectrpc/connect-go#938
• Fix off-by-one in WithHTTPGetMaxURLSize URL length check by @​fchimpan in connectrpc/connect-go#955
• Fix connect.WithGRPC typo in the missing client option error by @​NotAFlightRisk in connectrpc/connect-go#956
• Only send a 304 when the request was a GET by @​NotAFlightRisk in connectrpc/connect-go#957
• Fix panic in stream Spec and Peer when client construction failed by @​NotAFlightRisk in connectrpc/connect-go#959
• Fix dropped headers on errStreamingClientConn by @​mohit-bhandari45 in connectrpc/connect-go#964

New Contributors

• @​haru0017 made their first contribution in connectrpc/connect-go#937
• @​dongjiang1989 made their first contribution in connectrpc/connect-go#945
• @​fchimpan made their first contribution in connectrpc/connect-go#955
• @​NotAFlightRisk made their first contribution in connectrpc/connect-go#956
• @​mohit-bhandari45 made their first contribution in connectrpc/connect-go#964

Full Changelog: connectrpc/connect-go@v1.20.0...v1.21.0

v1.20.0

What's Changed

Other changes

• Bump minimum supported Go version to 1.25 by @​jonbodner-buf in #922
• Update Unary-Get query parameter order to match spec recommendation by @​oliversun9 in #926

New Contributors

• @​jonbodner-buf made their first contribution in #922

Full Changelog: connectrpc/connect-go@v1.19.2...v1.20.0

Commits

• 41b7f30 Prepare for v1.21.0 (#972)
• 6058c20 Fix dropped headers on errStreamingClientConn (#964)
• 014693a Refine WithRequestGate API and documentation (#968)
• d9b4b1d Create release binary for protoc-gen-connect-go (#966)
• 5111260 Add WithRequestGate handler option (#962)
• febfc19 Fix panic in stream Spec and Peer when client construction failed (#959)
• cb5da57 Update Go version for CI (#958)
• 9646326 Only send a 304 when the request was a GET (#957)
• 2a02fea Fix connect.WithGRPC typo in the missing client option error (#956)
• eae42d2 Fix off-by-one in WithHTTPGetMaxURLSize URL length check (#955)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[cursor]

PR Summary

Low Risk
Dependency-only bump with no code changes; main operational note is requiring Go 1.25+ for builds and CI.

Overview
This PR only updates module metadata: the toolchain directive moves from Go 1.24.2 to Go 1.25.0, and connectrpc.com/connect is bumped from 1.19.2 to 1.21.0, with matching go.sum checksums. No application or library source files change.

The newer Connect release (pulled in transitively) raises the minimum Go version and includes server/client fixes and features such as WithRequestGate; this repo’s errconnect usage is limited to mapping trogonerror codes to connect.Code, so behavior should stay the same unless upstream changes those types or constants.

^{Reviewed by Cursor Bugbot for commit d4e609b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 10bcc09b-b13e-494a-a74a-25d5072a1f29

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}