feat(resolve): update astjson to arena-safe API, remove redundant copies (#1400)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Bumped CI lint action version and adjusted module dependencies
(added/upgraded entries).

* **Refactor**
* Improved internal JSON/value memory management to use arena-scoped
lifetimes for safer GC behavior.
  * Minor printing/formatting tweaks in execution logging.

* **Tests**
* Added a comprehensive GC-stress test suite validating arena safety and
resolver behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Updates `github.com/wundergraph/astjson` to a version that copies input
bytes onto the arena internally, eliminating the need for manual
pre-copy steps in `loader.go`. Removes the `parseStringOnArena` helper
(16 call sites) and `stringValueOnArena` helper (7 call sites), and
drops the inline byte copy in `mergeResult`. Updates all call sites for
the revised astjson API (`SetValue`, `AppendToArray`, `SetNull`,
`AppendArrayItems`, `TrueValue` now take an arena argument). Adds 47 GC
safety tests covering all astjson-touching codepaths in `loader.go` and
`resolvable.go`, including status-code error paths, error filtering,
resolvable scalar walks, and type mismatches.

## Checklist

- [ ] I have discussed my proposed changes in an issue and have received
approval to proceed.
- [x] I have followed the coding standards of the project.
- [x] Tests or benchmarks have been added or updated.

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: jensneuse

.github/workflows/execution.yml

@@ -59,7 +59,7 @@ jobs:
         uses: golangci/golangci-lint-action@v8.0.0
         with:
           working-directory: execution
-          version: v2.4.0
+          version: v2.10.1
           args: --timeout=3m
   ci:
     name: CI Success

.github/workflows/v2.yml

@@ -63,7 +63,7 @@ jobs:
         uses: golangci/golangci-lint-action@v8.0.0
         with:
           working-directory: v2
-          version: v2.4.0
+          version: v2.10.1
           args: --timeout=3m
   ci:
     name: CI Success

go.work

@@ -1,7 +1,5 @@
 go 1.25
 
-toolchain go1.25.1
-
 use (
 	examples/federation
 	execution

v2/go.mod

@@ -20,6 +20,7 @@ require (
 	github.com/jensneuse/diffview v1.0.0
 	github.com/kingledion/go-tools v0.6.0
 	github.com/kylelemons/godebug v1.1.0
+	github.com/phf/go-queue v0.0.0-20170504031614-9abe38d0371d
 	github.com/pkg/errors v0.9.1
 	github.com/r3labs/sse/v2 v2.8.1
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
@@ -28,7 +29,7 @@ require (
 	github.com/tidwall/gjson v1.17.0
 	github.com/tidwall/sjson v1.0.4
 	github.com/vektah/gqlparser/v2 v2.5.30
-	github.com/wundergraph/astjson v1.0.0
+	github.com/wundergraph/astjson v1.1.0
 	github.com/wundergraph/go-arena v1.1.0
 	go.uber.org/atomic v1.11.0
 	go.uber.org/goleak v1.3.0
@@ -57,7 +58,6 @@ require (
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/oklog/run v1.0.0 // indirect
-	github.com/phf/go-queue v0.0.0-20170504031614-9abe38d0371d // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rogpeppe/go-internal v1.13.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect

v2/go.sum

@@ -133,10 +133,8 @@ github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
 github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
 github.com/vektah/gqlparser/v2 v2.5.30 h1:EqLwGAFLIzt1wpx1IPpY67DwUujF1OfzgEyDsLrN6kE=
 github.com/vektah/gqlparser/v2 v2.5.30/go.mod h1:D1/VCZtV3LPnQrcPBeR/q5jkSQIPti0uYCP/RI0gIeo=
-github.com/wundergraph/astjson v1.0.0 h1:rETLJuQkMWWW03HCF6WBttEBOu8gi5vznj5KEUPVV2Q=
-github.com/wundergraph/astjson v1.0.0/go.mod h1:h12D/dxxnedtLzsKyBLK7/Oe4TAoGpRVC9nDpDrZSWw=
-github.com/wundergraph/go-arena v1.0.0 h1:RVYWpDkJ1/6851BRHYehBeEcTLKmZygYIZsvBorcOjw=
-github.com/wundergraph/go-arena v1.0.0/go.mod h1:ROOysEHWJjLQ8FSfNxZCziagb7Qw2nXY3/vgKRh7eWw=
+github.com/wundergraph/astjson v1.1.0 h1:xORDosrZ87zQFJwNGe/HIHXqzpdHOFmqWgykCLVL040=
+github.com/wundergraph/astjson v1.1.0/go.mod h1:h12D/dxxnedtLzsKyBLK7/Oe4TAoGpRVC9nDpDrZSWw=
 github.com/wundergraph/go-arena v1.1.0 h1:9+wSRkJAkA2vbYHp6s8tEGhPViRGQNGXqPHT0QzhdIc=
 github.com/wundergraph/go-arena v1.1.0/go.mod h1:ROOysEHWJjLQ8FSfNxZCziagb7Qw2nXY3/vgKRh7eWw=
 github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 h1:FnBeRrxr7OU4VvAzt5X7s6266i6cSVkkFPS0TuXWbIg=

v2/pkg/engine/datasource/grpc_datasource/execution_plan.go

@@ -281,23 +281,23 @@ func (r *RPCExecutionPlan) String() string {
 	result.WriteString("RPCExecutionPlan:\n")
 
 	for _, call := range r.Calls {
-		result.WriteString(fmt.Sprintf("    Call %d:\n", call.ID))
+		fmt.Fprintf(&result, "    Call %d:\n", call.ID)
 
 		if len(call.DependentCalls) > 0 {
 			result.WriteString("      DependentCalls: [")
 			for k, depID := range call.DependentCalls {
 				if k > 0 {
 					result.WriteString(", ")
 				}
-				result.WriteString(fmt.Sprintf("%d", depID))
+				fmt.Fprintf(&result, "%d", depID)
 			}
 			result.WriteString("]\n")
 		} else {
 			result.WriteString("      DependentCalls: []\n")
 		}
 
-		result.WriteString(fmt.Sprintf("      Service: %s\n", call.ServiceName))
-		result.WriteString(fmt.Sprintf("      Method: %s\n", call.MethodName))
+		fmt.Fprintf(&result, "      Service: %s\n", call.ServiceName)
+		fmt.Fprintf(&result, "      Method: %s\n", call.MethodName)
 
 		result.WriteString("      Request:\n")
 		formatRPCMessage(&result, call.Request, 8)

v2/pkg/engine/resolve/fetchtree.go

@@ -383,6 +383,6 @@ func (p *PlanPrinter) printRepresentations(reps []Representation) {
 
 func (p *PlanPrinter) print(lines ...string) {
 	for _, l := range lines {
-		p.buf.WriteString(fmt.Sprintf("%s%s\n", strings.Repeat("  ", p.depth), l))
+		fmt.Fprintf(&p.buf, "%s%s\n", strings.Repeat("  ", p.depth), l)
 	}
 }