Update go modules (main) (minor) - #3285
Conversation
|
ff4d004 to
5f37272
Compare
5f37272 to
c8f3087
Compare
|
🤖 Finished Review · ✅ Success · Started 2:49 AM UTC · Completed 3:01 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.70 |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 2:26 AM UTC · Completed 2:38 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $7.22 |
|
Risk Assessment: moderate (2/5) DetailsRoutine Renovate bot minor Go module bump across 5 lockfile/manifest files with no protected paths, security-sensitive files, or CI changes touched; only elevated signal is the large blast radius from touching 5 dependency files simultaneously. Previous runRisk Assessment: moderate (2/5) DetailsRenovate bot dependency bump across 5 go.mod/go.sum files elevates the change-size and dependency-files sub-scores (Tier 1 avg ~2.0), but no protected paths, no CI or security-sensitive changes, low recent churn, and stable history keep Tier 2 low (~1.6), yielding a composite of 2 (moderate). Previous run (2)Risk Assessment: moderate (2/5) DetailsRenovate bot-authored Go module minor-version bump touching only 4 go.mod files + 1 go.sum (~1152 lines); change-size composite is elevated by 'large' blast radius and >=2 dependency files, but no protected paths, no security-sensitive files, no CI/workflow changes, tests unaffected, bot author, and Tier 2 shows only low-to-moderate recent churn on lockfiles that routinely co-change, yielding weighted composite ~1.89 -> moderate (2). |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 3:15 AM UTC · Completed 3:21 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $1.36 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 3:05 AM UTC · Completed 3:18 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $6.84 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 3:39 AM UTC · Completed 3:50 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $7.69 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
🤖 Finished Review · ✅ Success · Started 2:47 AM UTC · Completed 2:55 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.54 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Review · Commit: |
|
🤖 Finished Review · ✅ Success · Started 3:03 AM UTC · Completed 3:13 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $4.21 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ❌ Failure (post-script /home/runner/work/.fullsend/.fullsend/.fullsend-cache/resources/sha256/21644e0238d0b83db763fa138c412322223b0ba4a919a542b839e11b6a3d62e7/scripts/post-review.sh failed: exit status 1) · Started 2:07 AM UTC · Completed 2:14 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.96 |
|
🤖 Review · Commit: |
|
🤖 Finished Review · ✅ Success · Started 2:23 AM UTC · Completed 2:31 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.26 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Review · Commit: |
|
🤖 Finished Review · ✅ Success · Started 2:34 AM UTC · Completed 2:41 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.44 |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Review · Commit: |
|
🤖 Review · Commit: |
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
|
🤖 Finished Review · ✅ Success · Started 2:38 AM UTC · Completed 2:49 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $5.58 |
|
|
||
| // Maybe less important in acceptance, but it seems sensible to use the fork here too | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.21.8-0.20260626175242-ae5f0ae7a0b0 | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry f9eefe19c7b2 |
There was a problem hiding this comment.
[critical] build-breakage
Invalid replace-directive syntax: replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry f9eefe19c7b2 uses a bare 12-char short SHA with no semver/pseudo-version prefix. go.mod requires the replacement target to carry a valid version. The analogous replace in root go.mod:62 correctly reads v0.21.8-0.20260702142841-f9eefe19c7b2. go mod tidy, go build, and go mod verify in acceptance/ will fail on this file. See also: [consistency] and [supply-chain] findings at this location.
Suggested fix: Restore a full pseudo-version matching the root go.mod: replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.21.8-0.20260702142841-f9eefe19c7b2, then run go mod tidy in acceptance/ and commit the regenerated acceptance/go.sum.
| github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.61.0 // indirect | ||
| github.com/KeisukeYamashita/go-vcl v0.4.0 // indirect | ||
| github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect | ||
| github.com/Microsoft/go-winio 75610162e7da // indirect |
There was a problem hiding this comment.
[critical] build-breakage
Invalid require line: github.com/Microsoft/go-winio 75610162e7da // indirect is missing the version token. A require line must be <path> <version> where the version is a semver or pseudo-version (previous value was v0.6.3-0.20251027160822-ad3df93bed29). The same malformed entry also appears at acceptance/go.mod:62 and tools/go.mod:88. The go tool will refuse to parse these files.
Suggested fix: Rewrite each occurrence in root go.mod, acceptance/go.mod, and tools/go.mod as a proper pseudo-version (e.g. github.com/Microsoft/go-winio v0.6.3-0.<yyyymmddhhmmss>-75610162e7da // indirect) — regenerate via go mod tidy in each affected module.
| github.com/pkg/errors v0.9.1 // indirect | ||
| github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect | ||
| github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect | ||
| github.com/planetscale/vtprotobuf 8ae5a48058df // indirect |
There was a problem hiding this comment.
[critical] build-breakage
Invalid require line: github.com/planetscale/vtprotobuf 8ae5a48058df // indirect is missing the version token (same class of bug as the go-winio entries; previous value was v0.6.1-0.20240319094008-0393e58bdf10). The same malformed entry also appears at tools/go.mod:441. The go tool will refuse to parse these files.
Suggested fix: Rewrite each occurrence in root go.mod and tools/go.mod with a full pseudo-version (e.g. github.com/planetscale/vtprotobuf v0.6.1-0.<yyyymmddhhmmss>-8ae5a48058df // indirect) — regenerate via go mod tidy.
| // gocloud.dev >= v0.44.0 removed the docstore/awsdynamodb package, which | ||
| // tektoncd/chains (via tektoncd/cli) still imports | ||
| replace gocloud.dev => gocloud.dev v0.43.0 | ||
| replace gocloud.dev => gocloud.dev v0.46.0 |
There was a problem hiding this comment.
[high] logic-error
Intentional-pin violation. The two-line block comment immediately above the replace directive states: gocloud.dev >= v0.44.0 removed the docstore/awsdynamodb package, which tektoncd/chains (via tektoncd/cli) still imports. The PR changes the replace target from gocloud.dev v0.43.0 to gocloud.dev v0.46.0, directly contradicting the documented reason for the pin. If the comment is still accurate, go build in tools/ will fail because docstore/awsdynamodb no longer exists at v0.46.0. If the pin is genuinely obsolete, the comment is now misleading and should have been removed in the same commit. Renovate cannot read intent encoded in free-text comments — this is exactly the class of change a maintainer should adjudicate, not a bot batch. See also: [supply-chain] finding at this location.
Suggested fix: Either (a) revert to replace gocloud.dev => gocloud.dev v0.43.0 and add an allowedVersions/ignoreVersions rule for gocloud.dev in the Renovate config so future minor bumps don't retry it, or (b) verify tektoncd/chains no longer needs docstore/awsdynamodb, drop the replace directive entirely, and remove the now-stale comment in the same commit.
|
|
||
| // Maybe less important in acceptance, but it seems sensible to use the fork here too | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.21.8-0.20260626175242-ae5f0ae7a0b0 | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry f9eefe19c7b2 |
There was a problem hiding this comment.
[medium] consistency
Duplicated replace directive between root go.mod and acceptance/go.mod has drifted in this PR: both are intended to pin the same fork commit (f9eefe19c7b2, per the preserved comment Maybe less important in acceptance, but it seems sensible to use the fork here too), but the acceptance/ side now uses a bare short SHA while root uses the full pseudo-version. Divergent pinning between module trees invites subtle build/type mismatches when the fork's API drifts. See also: [build-breakage] finding at this location.
Suggested fix: Once the syntax bug is fixed, keep both replace directives in lock-step (identical pseudo-version strings) or centralize the pin via a go.work-level directive. Consider adding a comment or lint rule noting the two must match, since Renovate treats them as related.
|
|
||
| // Maybe less important in acceptance, but it seems sensible to use the fork here too | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.21.8-0.20260626175242-ae5f0ae7a0b0 | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry f9eefe19c7b2 |
There was a problem hiding this comment.
[low] supply-chain
The replace directive substitutes upstream github.com/google/go-containerregistry with a fork under the github.com/conforma organization. This is an existing pattern in the repo (also present in root go.mod), not new to this PR — flagged for awareness rather than as a change-introduced risk. Consumers of the acceptance module that assume they are building against Google's upstream are silently getting the fork instead.
Suggested fix: No action required if the fork is intentional and maintained by the conforma org. Consider adding a note in CONTRIBUTING or a top-of-file comment describing why the fork is used and how it is kept in sync with upstream, so future auditors can quickly verify provenance.
This PR contains the following updates:
v1.3.0→v1.4.0v0.20.0→v0.22.0v0.23.0v1.21.0→v1.24.0v1.25.0v1.11.0→v1.12.0v1.13.0v1.31.0→v1.33.0v1.0.0→v1.2.0v1.25.0→v1.30.0v1.62.0→v1.64.0v0.16.0→v0.17.1v0.16.0→v0.17.1v0.6.0→v0.8.1v0.15.0→v0.20.0v1.21.1→v1.22.0v1.13.1→v1.14.0v1.4.0→v1.5.0v1.6.0→v1.8.0v0.10.0→v0.11.0v0.10.0→v0.11.0v1.32.0→v1.35.0v0.55.0→v0.59.0v0.55.0→v0.59.0v1.45.2→v1.60.1v3.4.0→v3.5.0ad3df93→7561016v1.3.0→v1.4.1v1.2.5→v1.6.8v2.23.1→v2.27.0v1.4.2→v1.6.0v1.2.2→v1.5.3v1.3.9→v1.4.12v0.1.0→v0.2.1v1.42.0→v1.43.4v1.55.3→v1.60.4v1.38.10→v1.41.4v1.51.1→v1.55.4v1.97.3→v1.106.5v1.107.0v1.0.11→v1.5.4v1.30.17→v1.33.4v4.6.1→v4.10.0v5.6.0→v5.8.0v0.10.1→v0.11.7v0.10.0→v0.11.0v2.6.0→v2.7.0ae5f0ae→f9eefe1v2.2.3→v2.3.0v3.19.0→v3.20.0v0.15.0→v0.16.0v0.6.1→v0.7.0v0.13.7→v0.14.0v2.2.0→v2.4.23a137a8→ffadbf3220c5c2→c455327v1.11.5→v1.12.0v29.5.3+incompatible→v29.7.2+incompatiblev0.7.0→v0.8.1v1.0.4→v1.1.0v2.9.0→v2.13.10v1.2.6→v1.3.0v0.23.1→v0.24.0v0.24.0→v0.25.0v0.32.4→v0.33.0v0.32.4→v0.33.0v0.30.0→v0.33.0v0.26.4→v0.27.0v0.26.4→v0.27.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v1.18.0→v1.19.2f665c8d→c99c5cfd62b90e→e7be49av2.11.4→v2.12.2v0.28.0→v0.30.0v0.31.0v25.2.10+incompatible→v25.12.19+incompatible7a66278→7b32099098045d→7b32099v1.1.0→v1.2.0545e8a4→ef3492d5a72de7→1fb717av2.22.0→v2.23.0v2.29.0→v2.30.0v2.23.0→v2.24.0v1.22.0→v1.23.0v1.39.1→v1.42.1v0.10.0→v0.11.1v1.1.2→v1.2.0v0.9.1→v0.12.0v0.10.0→v0.11.0661be99→a09352bv1.8.2→v1.11.0v1.2.0→v1.6.0v1.10.0→v1.20.0v1.18.6→v1.19.2v2.3.0→v2.4.0v0.8.0→v0.9.0v1.0.0→v1.3.0v3.0.13→v3.2.0v0.20260309.0→v0.20260804.0v1.11.2→v1.12.3v1.3.0→v1.4.139d0f17→341c2f0b1d8f4d→341c2f0v1.8.10→v1.18.11v0.5.0→v0.6.0v1.1.1→v1.3.0v0.29.0→v0.32.2v0.2.0→v0.3.3v0.6.0→v0.7.0v0.7.1→v0.12.2v1.2.0→v1.3.0v0.68.2→v0.69.0v1.15.2→v1.19.0v1.15.2→v1.19.0v2.3.0→v2.4.320ebb0f→4e6772a0393e58→8ae5a485aafc22→884566082ca368→8845660v1.23.2→v1.24.1v0.68.0→v0.70.1v0.20.1→v0.21.1a481f6a→1fd8a60v0.2.0→v0.3.0v1.14.1→v1.16.0v0.11.0→v0.12.0v2.24.8-0.20260309165252-619ce2117e08→v2.28.0v3.23.12→v3.24.5v0.1.6→v0.2.2v3.0.4→v3.1.3v2.0.1→v2.3.0v2.2.2-0.20260601073857-5d098a2b6443→v2.3.0v1.1.4→v1.3.0v1.2.1→v1.3.0v2.0.3→v2.1.3v2.0.4→v2.1.3v0.7.0→v0.8.0v2.6.0→v2.8.1v0.26.2→v0.29.0v0.44.1→v0.46.0v0.35.0→v0.37.0