Skip to content

🚨 Update go modules (main) (major) - #3133

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-major-go-modules
Open

🚨 Update go modules (main) (major)#3133
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-major-go-modules

Conversation

@renovate

@renovate renovate Bot commented Feb 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/MakeNowJust/heredoc v1.0.0 → v2.0.1 age adoption passing confidence
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 → v6.0.3 age adoption passing confidence
gopkg.in/go-jose/go-jose.v2 v2.6.3 → v4.1.5 age adoption passing confidence
helm.sh/helm/v3 v3.20.2 → v4.2.4 age adoption passing confidence

Release Notes

MakeNowJust/heredoc (github.com/MakeNowJust/heredoc)

v2.0.1

Compare Source

Version 2.0.1

Fixes

  • Correct import path for Go modules

v2.0.0

Compare Source

Version 2.0.0

Breaking Changes

  • Treats only white space (U+0020) and horizontal tabs (U+000D) as space characters. (#​6)
santhosh-tekuri/jsonschema (github.com/santhosh-tekuri/jsonschema/v5)

v6.0.3

Compare Source

v6.0.2

Compare Source

v6.0.1

Compare Source

Bug Fixes:

  • fix/schema: field RecursiveRef misspelled
  • fix/schema: missing Deprecated field

check https://redirect.github.com/santhosh-tekuri/jsonschema/discussions/172 to see notes for migrating from v5 to v6

v6.0.0

Compare Source

Improvements

  • mixed dialect support
  • custom $vocabulary support
  • sermver format
  • support for localisation for ValidationError
  • command jv
    • support stdin
    • --insecure and --cacert flag
    • --quiet flag

check https://redirect.github.com/santhosh-tekuri/jsonschema/discussions/172 to see notes for migrating from v5 to v6

helm/helm (helm.sh/helm/v3)

v4.2.4: Helm v4.2.4

Compare Source

Helm v4.2.4 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

Installation and Upgrading

Download Helm v4.2.4. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • Minimal fix to build failure from #​31211. 3900f43 (Scott Rigby)
  • fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158 (#​32521) f7c6e8f (Terry Howe)
  • chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 035a2c3 (dependabot[bot])
  • fix: pass registry client to downloader.Manager in upgrade f76a5f4 (Gates Wang)
  • Apply suggestions 5a7c6c7 (Will Noble)
  • Properly format the extra field in gzipped packages 2281848 (Will Noble)
  • Fix missing conflict retry with server-side apply (#​32088) 2c979a1 (Jakub Jaruszewski)
  • Potential fix for pull request finding 2bd2c66 (kimsungmin1)
  • fix(registry): resolve golangci-lint issues in token-auth tests 183a540 (kimsm28)
  • chore: go mod tidy after rebase on main 08d8da1 (kimsm28)
  • fix(registry): use plain-http registry in token-auth scope test 9655b5a (kimsm28)
  • Update pkg/registry/client.go 430dfac (Terry Howe)
  • test: improve client_scope_test.go to avoid data races and brittle assertions 9569605 (kimsm28)
  • fix typos in withScopeHint function comment 63f2b68 (kimsm28)
  • fix registry test failures by adjusting DockerRegistryHost and auth server listener management f7488c0 (kimsm28)
  • fix variable naming requestUrl -> requestURL 8fe78fb (kimsm28)
  • fix typo, remove unnecessary code, fix to avoid to use the assertion in http hanlder d0670d2 (kimsm28)
  • change suite.Nil, suite.NotNill to more proper function(suite.NoError, suite.Error) 804256e (kimsungmin1)
  • change client_scope_test.go to use httptest d79bceb (kimsungmin1)
  • fix typo d34fcd9 (kimsungmin1)
  • remove freeport dependency 9fbd190 (kimsungmin1)
  • add newline in license header 9275661 (kimsungmin1)
  • fix scope when helm push to a registry that use token auth fef91f3 (kimsungmin1)
  • fix panic on repeated IsReachable calls e89ce68 (Mohammad Abdolirad)
  • fix(provenance): check error return in Digest ff1ac83 (Sebastien Tardif)
  • fix: address review feedback 4b4dedb (Sebastien Tardif)
  • fix: fetch logs from all containers in test pods 7c80103 (Sebastien Tardif)
  • chore: rename savedErr to clear its specific purpose ecc9cd2 (Jeaeun Kim)
  • chore: fix lint f6211ba (Jeaeun Kim)
  • chore: store err separately for clarity 3507ea5 (Jeaeun Kim)
  • chore: Improve error reporting for helm template --debug with --show-only 211ffae (Jeaeun Kim)
  • Address review comments 51a9837 (Matheus Pimenta)
  • Fix vanishing empty lines 83a8b70 (Matheus Pimenta)

Full Changelog: helm/helm@v4.2.3...v4.2.4

v4.2.3: Helm v4.2.3

Compare Source

Helm v4.2.3 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Installation and Upgrading

Download Helm v4.2.3. The common platform binaries are here:

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.4 and 3.21.4 are the next patch releases scheduled for August 12, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 43e8b7f (Terry Howe)

v4.2.2: Helm v4.2.2

Compare Source

Helm v4.2.2 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Revert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #​32214

Installation and Upgrading

Download Helm v4.2.2. The common platform binaries are here:

This release was signed by @​gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.3 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • Revert "fix(kube): prevent spurious early exit in WaitForDelete during informer sync" b05881c (George Jenkins)

Full Changelog: helm/helm@v4.2.1...v4.2.2

v4.2.1: Helm v4.2.1

Compare Source

Helm v4.2.1 is a patch release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Fixed data race detected by -race flag when concurrent goroutines (upgrade + rollback, install + uninstall) both call GetWaiterWithOptions on the same FailingKubeClient instance #​31925
  • Fixed helm command success messages writing to stderr instead of stdout. Now correctly outputing to stdout #​32056
  • Fixed Helm 4 emitting "unable to find exact version" when using version range constraints #​31757
  • Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #​32081
  • Bumped golang.org/x/net to v0.55.0 to address GO-2026-5026 #​32153
  • Fixed SDK errors by upgrading dependencies: cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 #​32128
  • Dependency updates

Installation and Upgrading

Download Helm v4.2.1. The common platform binaries are here:

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.2 and 3.21.2 are the next patch releases scheduled for July 8, 2026
  • 4.3.0 and 3.22.0 are the next minor releases scheduled for September 9, 2026

Changelog

  • fix: protect FailingKubeClient.RecordedWaitOptions from data race (#​31925) d591a19 (Terry Howe)
  • fix: route registry client output to stdout instead of stderr (#​32056) 2a9fcae (Terry Howe)
  • chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 ffa5bd6 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 9f9dbaf (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 64a2891 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.37.0 to 0.38.0 e54a4a2 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 acb762b (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 768586d (dependabot[bot])
  • fix(version): avoid false range detection on prerelease x/X eabfae5 (Benoit Tigeot)
  • fix(version): version range || can has no space e3fd51f (Benoit Tigeot)
  • feat: report in debug the version we select with version range arg 1e47395 (Benoit Tigeot)
  • fix: prevent warning when using version range constraints a33e239 (Benoit Tigeot)
  • fix(kube): always propagate context.Canceled in WaitForDelete fa06d44 (Terry Howe)
  • fix(kube): prevent spurious early exit in WaitForDelete during informer sync 360d483 (Terry Howe)
  • chore(deps): bump github.com/tetratelabs/wazero from 1.11.0 to 1.12.0 7651edf (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 b132e7e (dependabot[bot])
  • fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026 eee491a (Terry Howe)
  • chore(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 3e3c575 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 c4ce2bb (dependabot[bot])
  • chore(deps): bump actions/stale from 10.2.0 to 10.3.0 3892dc2 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 c4bbb62 (dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 a0d7f16 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 8a3de05 (dependabot[bot])
  • fix(upstream): upgrade to cli-utils 1.2.1, controller-runtime 0.24.1 and k8s 1.36.1 57a4803 (Matheus Pimenta)
  • chore(deps): bump github.com/fluxcd/cli-utils from 1.2.0 to 1.2.1 b33ae02 (dependabot[bot])

Full Changelog: helm/helm@v4.2.0...v4.2.1

v4.2.0: Helm v4.2.0

Compare Source

Helm v4.2.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

  • Join the discussion in Kubernetes Slack:
    • for questions and just to hang out
    • for discussing PRs, code, and bugs
  • Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
  • Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

  • Switch to goreleaser for release builds
  • Kubernetes client libraries to v1.36
  • Add mustToToml template function
  • deprecate unused --hide-notes and --render-subchart-notes flags
  • --dry-run=server now respects generateName:

Installation and Upgrading

Download Helm v4.2.0. The common platform binaries are here:

This release was signed by @​gjenkins8 with key BF88 8333 D96A 1C18 E268 2AAE D79D 67C9 EC01 6739, which can be found at https://keys.openpgp.org/vks/v1/by-fingerprint/BF888333D96A1C18E2682AAED79D67C9EC016739. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

  • 4.2.1 will contain only bug fixes
  • 4.3.0 is the next feature release

Changelog

  • Bump to version v4.2 0646808 (George Jenkins)
  • build: Clean up Goreleaser change (#​32098) e23bf3a (Scott Rigby)
  • fix: add -extldflags -static to dist target to match build-cross f60ab7c (Terry Howe)
  • build: use goreleaser build with manual archive creation 64aa46f (Terry Howe)
  • chore: remove build-cross dependency from test-acceptance d199a1a (Terry Howe)
  • ci: add fetch-depth 0 to canary checkout for goreleaser 8289940 (Terry Howe)
  • fix: address goreleaser build issues flagged in review c075022 (Terry Howe)
  • fix: pass VERSION as GORELEASER_CURRENT_TAG to preserve v-prefix in archive names 04885dd (Terry Howe)
  • fix: disable goreleaser checksums.txt and restrict zip to windows only 93103ce (Terry Howe)
  • fix: use index for optional env var in version_template e49a1dc (Terry Howe)
  • fix: canary build file names eaa0910 (Terry Howe)
  • Fix archive name 5a75279 (Terry Howe)
  • fix goreleaser archive 37284a9 (Terry Howe)
  • add support for loong64 45336cc (Terry Howe)
  • fix artifact directory a9659b0 (Terry Howe)
  • update configuration to v2 e368f17 (Terry Howe)
  • remove GOTOOLCHAIN e7bea85 (Terry Howe)
  • chore: replace mitchellh/gox with goreleaser 075c096 (Terry Howe)
  • chore(deps): bump github.com/distribution/distribution/v3 12f2c41 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 58e8ffd (dependabot[bot])
  • chore(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 e61bbfb (dependabot[bot])
  • Upgrade kstatus to 1.2 and controller-runtime to 0.24 081c6df (Matheus Pimenta)
  • fix: adds topLevel permissions to improve openSSF scores 277d970 (Gagan H R)
  • Upgrade Go to 1.26, Kubernetes to 1.36, kstatus to 1.1 a4a9cc7 (Matheus Pimenta)
  • fix(templating): hooks conflicting with templates in post-renderers (#​32049) 8f56f24 (Matheus Pimenta)
  • docs: fix grammar and spacing in CONTRIBUTING.md db40adb (Mohit)
  • chore(deps): bump the k8s-io group with 7 updates 775e794 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 934ace3 (dependabot[bot])
  • fix(templating): SplitManifests must preserve line endings for downstream YAML parsers (#​31952) 265c5eb (Matheus Pimenta)
  • chore(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 48e2b7d (dependabot[bot])
  • Update pkg/chart/common/util/coalesce.go a8e2497 (Evans Mungai)
  • test(values): Add test for nil cleanup in partially overridden subchart maps 52fc971 (Johannes Lohmer)
  • fix(values): do not copy chart-default nils into coalesced values 0063877 (Johannes Lohmer)
  • test(values): add test for subchart nil producing %!s() 6eb4ebf (Johannes Lohmer)
  • test(values): add tests for subchart nil value regressions 5cb4e7d (Johannes Lohmer)
  • chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 b5c7c80 (dependabot[bot])
  • fix(templating): fix wrong YAML separator parsing for post-renderers (#​31941) a27f1ad (Matheus Pimenta)
  • fix: add debug logging to HTTP getter for helm pull c26be60 (Cairon)
  • chore(deps): bump golang.org/x/crypto from 0.49.0 to 0.50.0 953f5f0 (dependabot[bot])
  • chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0 10fc5f3 (dependabot[bot])
  • chore(deps): bump golang.org/x/text from 0.35.0 to 0.36.0 d89e7c6 (dependabot[bot])
  • chore: Update release notes script for Helm v4 8a95461 (George Jenkins)
  • refactor(cli): share RetryingRoundTripper via pkg/kubeenv 213c869 (Sumit Solanki)
  • chore(deps): bump github.com/lib/pq from 1.12.2 to 1.12.3 bd5027a (dependabot[bot])
  • fix: unnecessary-format lint issues from merge 087736b (George Jenkins)
  • fix: Plugin missing provenance bypass 586eb57 (George Jenkins)
  • chore(deps): bump github.com/fluxcd/cli-utils c8c5dfa (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp 998466c (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp b0cec58 (dependabot[bot])
  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp 6ebfb29 (dependabot[bot])
  • test(kube): fix flaky WaitForDelete test by avoiding informer sync race a7f8443 (Terry Howe)
  • test(kube): fix flaky WaitForDelete timing in status wait tests 4c0d21f (Terry Howe)
  • chore(deps): bump github.com/distribution/distribution/v3 08dea9c (dependabot[bot])
  • Minor nit: fix import instructions to comply with canonical import paths de58531 (Anmol Virdi)
  • chore(deps): bump github.com/distribution/distribution/v3 9b1ad4c (dependabot[bot])
  • fix(action): return correct error variable in prepareUpgrade 8ef2d45 (Rhys McNeill)
  • chore(deps): bump github.com/lib/pq from 1.12.1 to 1.12.2 cd7cf76 (dependabot[bot])
  • chore(deps): bump github/codeql-action from 4.30.7 to 4.35.1 45ee55b (dependabot[bot])
  • chore(deps): bump github.com/lib/pq from 1.12.0 to 1.12.1 9a06741 (dependabot[bot])
  • chore(deps): bump actions/setup-go from 6.2.0 to 6.4.0 d1e31ca (dependabot[bot])
  • fix(kube): clarify server-side apply patch errors f257c95 (abhay1999)
  • fix: pin codeql-action/upload-sarif to commit SHA in scorecards workflow 7025480 (Terry Howe)
  • refactor(cli): decouple EnvSettings from pkg/kube 64f1d0a (Sumit Solanki)
  • docs(registry): fix incorrect and improve clarity of comments in client.go 85bf56e (Debasish Mohanty)
  • refactor(cli): decouple EnvSettings from pkg/kube to avoid import cycles 1549937 (Sumit Solanki)
  • chore(deps): bump github.com/ProtonMail/go-crypto from 1.3.0 to 1.4.1 c7a75b1 (dependabot[bot])
  • chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.0 3a7573a (dependabot[bot])
  • chore(deps): bump github.com/fatih/color from 1.18.0 to 1.19.0 0229da1 (dependabot[bot])
  • docs(engine): fix misleading toTOML doc comment c1a5a6e (Ilya Kiselev)
  • feat(engine): add mustToToml template function b075f7a (Ilya Kiselev)
  • chore: fix unnecessary-format issues from revive 7edfff3 (Matthieu MOREL)
  • chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 37185d2 (dependabot[bot])
  • chore: fix bool-compare issues from testifylint 071558d (Matthieu MOREL)
  • chore: enable perfsprint linter 6249489 (Matthieu MOREL)
  • ignore error plugin loads (cli, getter) 47a0840 (George Jenkins)
  • chore(deps): bump golang.org/x/crypto from 0.48.0 to 0.49.0 3d06fd1 (dependabot[bot])
  • fix(kube): remove legacy import comments from test files e64d628 (Terry Howe)
  • pkg/kube: remove legacy import comments d7cdc9e (abhay1999)
  • fix: Plugin version path traversal 36dcc27 (George Jenkins)
  • chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0 c4be7af (dependabot[bot])
  • chore: fix some minor issues in the comments 259f181 (tsinglua)
  • fix: Chart dot-name path bug 6018499 (George Jenkins)
  • chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.1 to 0.23.3 74e7cf8 (dependabot[bot])
  • fix: insert newline after doc separators glued to content by template trimming af94abf (Matheus Pimenta)
  • chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 16073b1 (dependabot[bot])
  • chore: enable modernize linter (#​31860) e31a078 (Matthieu MOREL)
  • Restored --atomic flag on install command 16573f8 (Travis Leeden)
  • fix: bump go.opentelemetry.io/otel/sdk to v1.40.0 for GO-2026-4394 b550ce9 (Terry Howe)
  • fix: bump fluxcd/cli-utils to v0.37.2-flux.1 1dfa77e (Terry Howe)
  • Update pkg/cmd/status.go 5d40f17 (Matthieu MOREL)
  • chore(internal): enable perfsprint linter (#​31871) d4f6193 (Matthieu MOREL)
  • chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 82d9bed (dependabot[bot])
  • chore(pkg): fix perfsprint linter issues part 6 dc0e3f1 (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter e3c74fd (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter 1d2d63c (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter 63f03c0 (Matthieu MOREL)
  • chore(pkg): enable perfsprint linter c25c988 (

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 3061ab1 to ad5b351 Compare February 27, 2026 09:54
@renovate

renovate Bot commented Feb 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: acceptance/go.sum
Command failed: go get -t ./...
go: gopkg.in/go-jose/go-jose.v4@v4.1.5: parsing go.mod:
	module declares its path as: github.com/go-jose/go-jose/v4
	        but was required as: gopkg.in/go-jose/go-jose.v4

@github-actions github-actions Bot added size: L and removed size: S labels Feb 27, 2026
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch 7 times, most recently from 55a7196 to ca1e8bd Compare March 12, 2026 12:48
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch 3 times, most recently from 4ddfa54 to 6a6166b Compare March 18, 2026 09:16
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch 3 times, most recently from 8eb3e76 to f1aa247 Compare March 26, 2026 13:42
@github-actions github-actions Bot added size: XS and removed size: L labels Mar 26, 2026
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch 2 times, most recently from 7c8ec28 to 2b721f7 Compare April 1, 2026 17:17
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch 2 times, most recently from 2be196d to 458ca5f Compare April 10, 2026 21:58
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 458ca5f to 61bcaeb Compare April 16, 2026 19:20
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 11:51 AM UTC · Completed 12:04 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch 2 times, most recently from 8dbb0b6 to e59397d Compare August 11, 2026 16:58
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 4:59 PM UTC · Completed 5:13 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from e59397d to 6df0bd0 Compare August 13, 2026 17:17
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 5:18 PM UTC · Completed 5:35 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 6df0bd0 to 8f5337f Compare August 14, 2026 16:28
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 4:30 PM UTC · Completed 4:42 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 8f5337f to d0c5515 Compare August 20, 2026 13:13
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:14 PM UTC · Completed 1:26 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from d0c5515 to 1d71ec6 Compare August 20, 2026 19:27
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 7:28 PM UTC · Completed 7:41 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 1d71ec6 to 6ef1314 Compare September 9, 2026 15:39
@renovate
renovate Bot requested a review from a team as a code owner September 9, 2026 15:39
@renovate
renovate Bot force-pushed the renovate/main-major-go-modules branch from 6ef1314 to 73d90c0 Compare September 10, 2026 13:48
@coderabbitai

coderabbitai Bot commented Sep 10, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 200af72e-b990-4d7e-b3c2-c16cd31da472

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added size: L and removed size: M labels Sep 10, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:49 PM UTC · Completed 2:00 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $5.66

@fullsend-ai-review fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Sep 10, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Sep 10, 2026

Copy link
Copy Markdown

Risk Assessment: moderate (2/5)

Details

Bot-authored major Go module bump touching only 5 dependency manifests with no protected/security/CI paths yields low Tier 1 risk, tempered slightly by very recent multi-author churn on go.mod/go.sum files.

fullsend-ai-review[bot]
fullsend-ai-review Bot suggested changes Sep 10, 2026
View reviewed changes

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread acceptance/go.mod
golang.org/x/exp v0.0.0-20260603202125-055de637280b
golang.org/x/sync v0.23.0
gopkg.in/go-jose/go-jose.v2 v2.6.3
gopkg.in/go-jose/go-jose.v4 v4.1.5

@fullsend-ai-review fullsend-ai-review Bot Sep 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] correctness

Removes gopkg.in/go-jose/go-jose.v2 v2.6.3 from require and adds gopkg.in/go-jose/go-jose.v4 v4.1.5, but acceptance/image/image.go:60 still imports gopkg.in/go-jose/go-jose.v2/json. The github.com/go-jose/go-jose/v4 entry in the indirect block is a different module path and does not satisfy the gopkg.in/... import. go build ./... / go mod tidy in the acceptance module will fail with a missing-module error.

Suggested fix: Either (a) migrate acceptance/image/image.go from gopkg.in/go-jose/go-jose.v2/json to the v4 API, or (b) keep the v2 require alongside v4 in acceptance/go.mod until the call-site migration lands.

Comment thread go.mod
cuelang.org/go v0.16.0
github.com/CycloneDX/cyclonedx-go v0.10.0
github.com/MakeNowJust/heredoc v1.0.0
github.com/MakeNowJust/heredoc/v2 v2.0.1

@fullsend-ai-review fullsend-ai-review Bot Sep 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] correctness

Promotes github.com/MakeNowJust/heredoc/v2 v2.0.1 into the root direct-require block, but no .go file imports the /v2 path — all 19 call sites across cmd/* and internal/* still import github.com/MakeNowJust/heredoc (v1). v1 is retained (moved into the second require block without // indirect), so builds keep working, but go mod tidy will drop v2 and revert the intended upgrade. Both majors also sit in the module graph with no call-site benefit.

Suggested fix: Migrate all 19 heredoc import sites to github.com/MakeNowJust/heredoc/v2 and drop the v1 require, or drop the heredoc/v2 line and keep v1.

Comment thread go.mod
github.com/package-url/packageurl-go v0.1.3
github.com/qri-io/jsonpointer v0.1.1
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3

@fullsend-ai-review fullsend-ai-review Bot Sep 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] correctness

Promotes github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 into the root direct-require block, but no source file imports the /v6 path — the three call sites (internal/policy/policy.go, internal/evaluation_target/application_snapshot_image/application_snapshot_image.go, pkg/schema/schema.go) still import jsonschema/v5. v5 remains (in the second require block); v6 will be dropped by go mod tidy. jsonschema validates untrusted policy input, so any security fixes in v6 do not protect the running code — the immediate defect is that the intended upgrade is a no-op.

Suggested fix: Migrate the three call sites to the jsonschema/v6 API (constructor, resource loading, and error types differ) and remove v5, or drop the v6 entry until the migration is done.

Comment thread go.mod
replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.21.8-0.20260702142841-f9eefe19c7b2

require (
github.com/MakeNowJust/heredoc v1.0.0

@fullsend-ai-review fullsend-ai-review Bot Sep 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] code-organization

Root go.mod now has two separate require (...) blocks after the replace directive. The second block contains entries (heredoc v1, jsonschema/v5, go-openapi/runtime, google/uuid, pmezard/go-difflib, golang.org/x/text, gopkg.in/yaml.v3, k8s.io/api) that lack the conventional // indirect marker. This is a formatting artifact of the Renovate change: the file is not go mod tidy-clean, and running tidy will both collapse the blocks and prune the unused new-major entries.

Suggested fix: Run go mod tidy locally after resolving the heredoc/v2 and jsonschema/v6 call-site questions, then commit the result.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@fullsend-ai-review fullsend-ai-review[bot] fullsend-ai-review[bot] requested changes
Reviewers whose approvals may not affect merge requirements

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code main major renovate risk/moderate PR risk: moderate size: L

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants