chore(deps): bump github.com/eshaffer321/walmart-client-go/v2 from 2.1.0 to 2.2.1

[dependabot]

Bumps github.com/eshaffer321/walmart-client-go/v2 from 2.1.0 to 2.2.1.

Release notes

Sourced from github.com/eshaffer321/walmart-client-go/v2's releases.

v2.2.1

Fixed

• Response cookies now retain their domain and path scope in an in-memory cookie jar instead of overwriting the persistent browser snapshot. This prevents purchase-history cookies from poisoning subsequent order-detail requests with HTTP 456.

v2.2.0

Added

• GetOrderWithGroup sends the purchase-history group ID with order-detail requests.
• ErrBotChallenge lets callers detect Walmart's HTTP 456 bot-protection response with errors.Is.

Changed

• Browser cURL imports now capture the active getOrder persisted-query hash and a safe request-header profile alongside cookies.
• Refreshing from cURL replaces the previous browser snapshot instead of retaining stale WAF cookies.
• Order, purchase-history, and ledger requests now use current browser headers plus per-request correlation and trace IDs.

Fixed

• Updated the getOrder GraphQL variables and persisted-query hash to match Walmart's current web client.
• GetOrderAutoDetect no longer repeats a request after an HTTP 456 bot challenge.
• Cookie files are saved atomically with owner-only permissions, including files created by older releases.

Changelog

Sourced from github.com/eshaffer321/walmart-client-go/v2's changelog.

[2.2.1] - 2026-07-15

Fixed

• Response cookies now retain their domain and path scope in an in-memory cookie jar instead of overwriting the persistent browser snapshot. This prevents purchase-history cookies from poisoning subsequent order-detail requests with HTTP 456.

[2.2.0] - 2026-07-15

Added

• GetOrderWithGroup sends the purchase-history group ID with order-detail requests.
• ErrBotChallenge lets callers detect Walmart's HTTP 456 bot-protection response with errors.Is.

Changed

• Browser cURL imports now capture the active getOrder persisted-query hash and a safe request-header profile alongside cookies.
• Refreshing from cURL replaces the previous browser snapshot instead of retaining stale WAF cookies.
• Order, purchase-history, and ledger requests now use current browser headers plus per-request correlation and trace IDs.

Fixed

• Updated the getOrder GraphQL variables and persisted-query hash to match Walmart's current web client.
• GetOrderAutoDetect no longer repeats a request after an HTTP 456 bot challenge.
• Cookie files are saved atomically with owner-only permissions, including files created by older releases.

Commits

• d908f3d fix: preserve response cookie paths (#18)
• 90eb9ac fix: harden Walmart browser sessions (#17)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)