fix(router): prevent data races in batched validation error responses

[endigma]

Summary

Update router and router-tests to go-tools v2.20.2 to prevent validation error paths from racing with pooled walker reuse during batched requests.

Closes #3216

Tests

Verified with Go 1.25.14:

• Both modules pass go mod tidy -diff.
• Full router suite passes with -race (2,170 tests, 7 skipped).
• Batch integration suite passes 10 repetitions with -race (190 tests).

Summary by CodeRabbit

• Chores
  • Applied routine maintenance updates across the project.
  • No user-facing behavior or functionality changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9627eae7-3d54-4dc0-bca3-e0572a640a7e

📥 Commits

Reviewing files that changed from the base of the PR and between 2a1bfdd and 9033e25.

⛔ Files ignored due to path filters (2)

• router-tests/go.sum is excluded by !**/*.sum
• router/go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• router-tests/go.mod
• router/go.mod

🚧 Files skipped from review as they are similar to previous changes (1)

• router-tests/go.mod

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

Walkthrough

The router and router-tests Go modules update github.com/wundergraph/graphql-go-tools/v2 to stable version v2.20.2.

Changes

GraphQL tools dependency update

Layer / File(s)	Summary
Align GraphQL tools versions router/go.mod, router-tests/go.mod	Both modules now require stable version v2.20.2 instead of development snapshots.

Priority: ➖ Normal — Schedule the router dependency pin because it addresses data races in batched validation error responses.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to feb93

The router and router-tests modules now use graphql-go-tools v2.20.2 to address pooled-walker validation races. No current merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the objective of updating the router dependency to prevent data races in batched validation error responses. It contains no issue identifier. At 69 characters, it exceed…

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Router-nonroot image scan passed

✅ No security vulnerabilities found in image:

ghcr.io/wundergraph/cosmo/router:sha-48b0cbf5b0ebfc96fd1f466000b2255c41b6138c-nonroot

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.80%. Comparing base (cfcefd3) to head (feb938a).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3217      +/-   ##
==========================================
- Coverage   66.99%   62.80%   -4.19%     
==========================================
  Files         778      266     -512     
  Lines       63328    31575   -31753     
  Branches     7847        0    -7847     
==========================================
- Hits        42425    19832   -22593     
+ Misses      18193    10191    -8002     
+ Partials     2710     1552    -1158     

see 524 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Aenimus]

LGTM!