build(deps): bump github.com/oapi-codegen/runtime from 1.1.2 to 1.6.0

Bumps [github.com/oapi-codegen/runtime](https://github.com/oapi-codegen/runtime) from 1.1.2 to 1.6.0.
- [Release notes](https://github.com/oapi-codegen/runtime/releases)
- [Commits](https://github.com/oapi-codegen/runtime/compare/v1.1.2...v1.6.0)

---
updated-dependencies:
- dependency-name: github.com/oapi-codegen/runtime
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -3,8 +3,8 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
-    open-pull-requests-limit: 15
+      interval: "weekly"
+    open-pull-requests-limit: 3
     groups:
       actions:
         patterns:
@@ -22,9 +22,12 @@ updates:
     directories:
       - "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
     open-pull-requests-limit: 15
     groups:
+      golang-x-packages:
+        patterns:
+          - "golang.org/x/*"
       aws-sdk:
         patterns:
           - "github.com/aws/aws-sdk-go-v2/*"

go.mod

@@ -83,7 +83,7 @@ require (
 	github.com/moby/moby/api v1.54.1
 	github.com/netbirdio/management-integrations/integrations v0.0.0-20260416123949-2355d972be42
 	github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45
-	github.com/oapi-codegen/runtime v1.1.2
+	github.com/oapi-codegen/runtime v1.6.0
 	github.com/okta/okta-sdk-golang/v2 v2.18.0
 	github.com/ory/dockertest/v4 v4.0.0
 	github.com/oschwald/maxminddb-golang v1.12.0

go.sum

@@ -496,8 +496,10 @@ github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
 github.com/nxadm/tail v1.4.11/go.mod h1:OTaG3NK980DZzxbRq6lEuzgU+mug70nY11sMd4JXXHc=
-github.com/oapi-codegen/runtime v1.1.2 h1:P2+CubHq8fO4Q6fV1tqDBZHCwpVpvPg7oKiYzQgXIyI=
-github.com/oapi-codegen/runtime v1.1.2/go.mod h1:SK9X900oXmPWilYR5/WKPzt3Kqxn/uS/+lbpREv+eCg=
+github.com/oapi-codegen/nullable v1.1.0 h1:eAh8JVc5430VtYVnq00Hrbpag9PFRGWLjxR1/3KntMs=
+github.com/oapi-codegen/nullable v1.1.0/go.mod h1:KUZ3vUzkmEKY90ksAmit2+5juDIhIZhfDl+0PwOQlFY=
+github.com/oapi-codegen/runtime v1.6.0 h1:7Xx+GlueD6nRuyKoCPzL434Jfi3BetbiJOrzCHp/VPU=
+github.com/oapi-codegen/runtime v1.6.0/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/okta/okta-sdk-golang/v2 v2.18.0 h1:cfDasMb7CShbZvOrF6n+DnLevWwiHgedWMGJ8M8xKDc=

management/internals/shared/grpc/components_encoder.go

@@ -61,8 +61,6 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 		return &proto.NetworkMapEnvelope{
 			Payload: &proto.NetworkMapEnvelope_Full{
 				Full: &proto.NetworkMapComponentsFull{
-					Serial:     networkSerial(c.Network),
-					Network:    toAccountNetwork(c.Network),
 					PeerConfig: in.PeerConfig,
 					// components.Peers always contains the target peer
 					Peers:            []*proto.PeerCompact{toPeerCompact(c.Peers[c.PeerID])},

management/internals/shared/grpc/components_encoder_test.go

@@ -758,9 +758,6 @@ func TestEncodeNetworkMapEnvelope_NilComponentsGracefulDegrade(t *testing.T) {
 	assert.Equal(t, "netbird.cloud", full.DnsDomain)
 	assert.Len(t, full.Peers, 1)
 	assert.Empty(t, full.Policies)
-	require.NotNil(t, full.Network, "client runs Calculate() over the envelope and dereferences Network unconditionally; a nil here would crash the receiver")
-	assert.Equal(t, "net-empty", full.Network.Identifier)
-	assert.Equal(t, uint64(9), full.Serial)
 }
 
 func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
@@ -779,12 +776,6 @@ func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
 func emptyNetworkMapComponents() *types.NetworkMapComponents {
 	return types.EmptyNetworkMapComponents(
 		&types.NetworkMapComponents{
-			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}},
-			Network: &types.Network{
-				Identifier: "net-empty",
-				Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
-				Serial:     9,
-			},
-		},
+			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}}},
 	)
 }

shared/management/networkmap/decode.go

@@ -228,17 +228,15 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 	return c, nil
 }
 
-// decodeAccountNetwork never returns nil — Calculate() dereferences
-// c.Network unconditionally, and servers that predate the fix omit the field
-// entirely from the empty-components envelope.
 func decodeAccountNetwork(an *proto.AccountNetwork) *types.Network {
-	n := &types.Network{}
 	if an == nil {
-		return n
+		return nil
+	}
+	n := &types.Network{
+		Identifier: an.Identifier,
+		Dns:        an.Dns,
+		Serial:     an.Serial,
 	}
-	n.Identifier = an.Identifier
-	n.Dns = an.Dns
-	n.Serial = an.Serial
 	if an.NetCidr != "" {
 		if _, ipnet, err := net.ParseCIDR(an.NetCidr); err == nil && ipnet != nil {
 			n.Net = *ipnet

shared/management/networkmap/envelope_test.go

@@ -221,66 +221,6 @@ func TestEnvelopeRoundTrip_AllGroupShortCircuitParity(t *testing.T) {
 		"client-side Calculate must connect the same remote peers as the server")
 }
 
-// TestEnvelopeToNetworkMap_EmptyComponents covers the graceful-degrade path
-// the server takes for a peer that is missing from the account or absent from
-// the validated-peers map. The legacy server short-circuited before
-// Calculate() and shipped a NetworkMap carrying only the account Network; the
-// components path runs Calculate() on the client instead, so the envelope must
-// carry Network or the client panics dereferencing a nil *types.Network.
-func TestEnvelopeToNetworkMap_EmptyComponents(t *testing.T) {
-	localPeerKey := randomWgKey(t)
-	c := types.EmptyNetworkMapComponents(&types.NetworkMapComponents{
-		PeerID: "peer-A",
-		Network: &types.Network{
-			Identifier: "net-empty",
-			Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
-			Serial:     7,
-		},
-		Peers: map[string]*types.ComponentPeer{
-			"peer-A": {ID: "peer-A", Key: localPeerKey, IP: netip.AddrFrom4([4]byte{100, 64, 0, 1})},
-		},
-	})
-
-	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
-		Components: c,
-		DNSDomain:  "netbird.cloud",
-	})
-	require.NotNil(t, envelope.GetFull().Network, "empty envelope must carry the account Network")
-
-	wire, err := goproto.Marshal(envelope)
-	require.NoError(t, err, "marshal envelope")
-	var decoded proto.NetworkMapEnvelope
-	require.NoError(t, goproto.Unmarshal(wire, &decoded), "unmarshal envelope")
-
-	result, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), &decoded, localPeerKey, "netbird.cloud")
-	require.NoError(t, err, "EnvelopeToNetworkMap must degrade gracefully on empty components")
-	require.Equal(t, uint64(7), result.NetworkMap.Serial)
-	require.Empty(t, result.NetworkMap.RemotePeers, "unvalidated peer connects to nobody")
-}
-
-// TestEnvelopeToNetworkMap_MissingNetwork simulates a server that omits
-// AccountNetwork from the envelope. Clients must degrade rather than panic, so
-// they survive talking to a management server that predates the encoder fix.
-func TestEnvelopeToNetworkMap_MissingNetwork(t *testing.T) {
-	c, localPeerKey := buildSmokeComponents(t)
-
-	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
-		Components: c,
-		DNSDomain:  "netbird.cloud",
-	})
-	envelope.GetFull().Network = nil
-
-	wire, err := goproto.Marshal(envelope)
-	require.NoError(t, err, "marshal envelope")
-	var decoded proto.NetworkMapEnvelope
-	require.NoError(t, goproto.Unmarshal(wire, &decoded), "unmarshal envelope")
-
-	result, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), &decoded, localPeerKey, "netbird.cloud")
-	require.NoError(t, err, "a missing AccountNetwork must not panic the client")
-	require.NotNil(t, result.Components.Network)
-	require.NotEmpty(t, result.NetworkMap.RemotePeers, "the rest of the snapshot stays usable")
-}
-
 // buildSmokeComponents returns a minimal NetworkMapComponents (2 peers, 1
 // group, 1 allow policy) plus the receiving peer's WG public key. Sufficient
 // to validate the encode → marshal → decode → Calculate pipeline produces