refactor: replace go-multierror with stdlib, remove dep

[SoulPancake]

Description

For #673

What problem is being solved?

How is it being solved?

What changes are made to solve it?

References

Review Checklist

• I have clicked on "allow edits by maintainers".
• I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
• The correct base branch is being used, if not main
• I have added tests to validate that the change in functionality is working as expected

Summary by CodeRabbit

• Chores
  • Updated dependencies to enhance stability and compatibility.

[coderabbitai]

Walkthrough

Removes the hashicorp/go-multierror and hashicorp/errwrap dependencies from go.mod and bumps openfga/language/pkg/go from v0.2.1 to v0.3.0. In model.go, the multierror import is replaced with stdlib errors, and ReadModelFromModFGA now collects file-read failures in a []error slice returned via errors.Join.

Changes

Replace go-multierror with stdlib errors.Join

Layer / File(s)	Summary
Dependency removal and error aggregation rewrite go.mod, internal/authorizationmodel/model.go	go.mod removes hashicorp/go-multierror and hashicorp/errwrap, bumps openfga/language/pkg/go to v0.3.0. model.go drops the multierror import, replaces the accumulator with a []error slice, and returns combined errors via errors.Join in ReadModelFromModFGA.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related issues

• fix: remove go-multierror dependency #673: The changes directly implement the refactoring described in this issue by removing go-multierror from go.mod and replacing its usage in ReadModelFromModFGA with a []error slice combined via errors.Join.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title clearly and concisely summarizes the main objective: replacing go-multierror with the Go standard library and removing the dependency.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/remove-go-multierror

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[SoulPancake]

Draft because we will bump the openfga/language/pkg/go too to remove the transitive dependency

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​openfga/​language/​pkg/​go@​v0.2.1 ⏵ v0.3.0	+1

View full report

[Copilot]

✅ Ready to approve

The change cleanly replaces the only go-multierror usage with errors.Join() and the dependency removals in go.mod/go.sum align with the refactor.

Note: this review does not count toward required approvals for merging.

Pull request overview

This PR removes the github.com/hashicorp/go-multierror dependency from the CLI by switching the remaining multi-error accumulation logic to Go’s standard library errors.Join, and tidying module dependencies accordingly.

Changes:

• Replaced go-multierror usage with a []error accumulator and errors.Join() in modular model loading.
• Removed github.com/hashicorp/go-multierror (and the indirect github.com/hashicorp/errwrap) from module dependencies.
• Updated github.com/openfga/language/pkg/go from v0.2.1 to v0.3.0 as part of dependency cleanup/tidy.

File summaries

File	Description
internal/authorizationmodel/model.go	Replaces multierror aggregation with []error + errors.Join() when reading modular model files.
go.mod	Drops go-multierror / errwrap and bumps openfga/language/pkg/go to v0.3.0.
go.sum	Removes go-multierror and errwrap checksums and updates checksums for the bumped language module.

Copilot's findings

• Files reviewed: 2/3 changed files
• Comments generated: 0

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

🧹 Nitpick comments (1)

go.mod (1)

16-16: ⚡ Quick win

Sync depguard allowlist with the dependency removal objective.

Line 16 completes the language package bump, but .golangci.yaml still allows github.com/hashicorp/go-multierror. Removing it from the depguard allowlist would keep lint policy aligned and prevent accidental reintroduction.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 16, The language package dependency has been bumped in
go.mod, but the depguard allowlist in .golangci.yaml still permits
github.com/hashicorp/go-multierror, which should have been removed as part of
the dependency removal objective. Update .golangci.yaml to remove the
github.com/hashicorp/go-multierror entry from the depguard allowlist to ensure
the lint policy stays synchronized with the actual dependencies and prevents
accidental reintroduction of the removed package.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@go.mod`:
- Line 16: The language package dependency has been bumped in go.mod, but the
depguard allowlist in .golangci.yaml still permits
github.com/hashicorp/go-multierror, which should have been removed as part of
the dependency removal objective. Update .golangci.yaml to remove the
github.com/hashicorp/go-multierror entry from the depguard allowlist to ensure
the lint policy stays synchronized with the actual dependencies and prevents
accidental reintroduction of the removed package.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4bf07598-1620-4720-bf17-93ffad91d8c3

📥 Commits

Reviewing files that changed from the base of the PR and between f0879ce and e009bac.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• go.mod
• internal/authorizationmodel/model.go