chore: bump github.com/alibaba/OpenSandbox/sdks/sandbox/go from 1.0.3 to 1.0.4

[dependabot]

Bumps github.com/alibaba/OpenSandbox/sdks/sandbox/go from 1.0.3 to 1.0.4.

Release notes

Sourced from github.com/alibaba/OpenSandbox/sdks/sandbox/go's releases.

Go Sandbox SDK v1.0.4

What's New

Breaking Changes

• The credential vault binding match no longer carries a Ports field. Port is now derived from the scheme (https → 443, http → 80), matching what the intercept layer (iptables/nft) actually redirects. If your Go code constructs credential vault bindings and sets Match.Ports, remove that field on upgrade — port selection is now implicit from the scheme. This removes a field that never provided real flexibility (only 80/443 were ever intercepted). #1189

Features

• Added a client-side sandbox pool (OSEP-0005) for the Go SDK, enabling millisecond-level sandbox acquisition from pre-warmed idle instances. The new SandboxPool API (via PoolBuilder) provides a background reconcile loop with leader election, fill-deficit / shrink-excess management, exponential backoff on warmup failures, and near-expiry-aware idle reuse. InMemoryPoolStateStore covers single-process deployments; a separate optional poolredis sub-module (go-redis v9) provides RedisPoolStateStore with atomic Lua-script operations for distributed setups. The main SDK module stays on go 1.20 with zero external dependencies — the pool is a fully opt-in, backward-compatible addition. Aligned with the Python and Kotlin pool implementations. #1198
• Added run_once and withSession isolation convenience helpers to the Go SDK. sandbox.IsolationRunOnce(ctx, req, run, handlers) wraps create → run → delete into a single call with guaranteed cleanup, and sandbox.IsolationWithSession(ctx, req, fn) scopes a multi-run isolated workflow with auto-delete on exit. Cleanup is best-effort so it never masks the original error. These build on the execd-backed isolation support added to the Go SDK (isolated.go, sandbox_isolated.go). #1008 #1222
• Added an LRU + TTL endpoint cache with in-flight request deduplication. The SDK now caches (sandbox_id, port, use_server_proxy) → Endpoint to avoid repeated resolution round-trips. It is enabled by default (TTL 600s, max size 1024) and tunable via ConnectionConfig; Kill() actively invalidates cached entries for the sandbox. #1133
• Sandbox lifecycle responses now surface extensions. The Go SDK response models expose opensandbox.extensions.* data returned by create/get/list so callers can read extension values round-tripped from the server. #1112
• Added the optional resourceRequests field to sandbox creation. Kubernetes-backed sandboxes can now set resource requests separately from limits (enabling Burstable QoS). Omitting the field preserves the existing behavior where requests equal limits. #1074

Misc

• Updated the Go SDK README GitHub links to the new opensandbox-group/OpenSandbox org (Go module/import paths unchanged). #1197
• Bumped the Go Sandbox SDK version constant to 1.0.4 and added a regression test that locks the default User-Agent to the release version. #1248

Contributors

• @​GreenShadeZhang
• @​Pangjiping
• @​jianpingpei
• @​jwx0925

Commits

• 7e5cdcf Merge pull request #134 from Pangjiping/feat/execd-bootstrap-bash
• 645bea9 Merge pull request #135 from Pangjiping/feat/redirect-logs
• 0f3e146 Merge pull request #142 from Pangjiping/fix/egress-default-action
• 24cf791 Merge pull request #126 from alibaba/feature/kubernetes-sigs-agent-sandbox
• 4ffe3c2 fix(components/execd): change default action to deny-all
• c3b6542 Merge pull request #136 from Spground/feature/public-update-readme-why-batch-...
• b539b7a refactor(server): share k8s template loader
• a35fb2e Merge pull request #138 from ninan-nn/feature/egress_sdk_support
• 06c2572 feat(sdks): sandbox egress rule support
• 1317e00 Merge pull request #137 from Pangjiping/chore/api-style
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[zpzjzj]

LGTM