[akselkvitberg]

Summary

Fixes from a security review of the SDK, current module versions, and the repository's first CI.

Changes

• No more changes to shared HTTP clients. New set its Transport on http.DefaultClient (or on the client passed to WithClient), which changed the User-Agent and transport for every other HTTP call in the program. It now works on a copy.
• 30 second default timeout when no client is passed. A client passed with WithClient keeps its own timeout.
• The token only goes to the API host over HTTPS. With a token source configured, requests to any other host, including redirect targets, are refused before the Authorization header is added. http is only allowed for loopback hosts, for local testing.
• Response bodies are capped at 10 MiB.
• NullableString.Set(nil) no longer panics; it unsets the value.
• Dependencies updated: golang.org/x/oauth2 v0.12.0 → v0.37.0, github.com/samber/lo v1.38.1 → v1.53.0. x/net, x/exp, appengine and protobuf are no longer needed. The go directive is now 1.26.0, required by the updated modules (Core API uses Go 1.27). This replaces Bump golang.org/x/net from 0.15.0 to 0.17.0 #1 and resolves the 8 open Dependabot alerts (x/net, x/oauth2, protobuf).
• CI: .github/workflows/test.yml builds, vets and runs go test -race on pull requests and pushes to main, and runs govulncheck against the latest stable Go. .github/dependabot.yml updates Go modules and actions weekly.

Not included

Error responses still lose their body; #16 replaces that with ProblemDetails errors. That PR and the rest of its stack (#17–#20) touch client_request.go and nullable_string.go, so whichever merges second needs a small rebase.

Verification

• go build ./..., go vet ./... and go test ./... pass locally (Windows has no cgo here, so -race runs only in CI). New tests cover: http.DefaultClient and a caller's client are left unchanged, User-Agent, token sent to the API host, refused for another host, a redirect and non-loopback http, an invalid API URL, no restriction without a token, the body limit, and Set(nil).
• govulncheck finds no vulnerabilities in the module's dependencies. It reports standard library issues for the local go1.27.0, fixed in go1.27.2; CI checks against the latest Go.

🤖 Generated with Claude Code