🚨 Update go modules (main) (major) - #3287
Conversation
|
85b690d to
1858720
Compare
1858720 to
88d311d
Compare
88d311d to
cbd1b47
Compare
|
🤖 Finished Review · ✅ Success · Started 3:17 AM UTC · Completed 3:27 AM UTC |
ReviewThis PR (a Renovate/Konflux mintmaker bulk MAJOR-version bump across ~30 Go modules) is unmergeable in its current form. The update automation produced multiple build-breaking defects (corrupted import paths, duplicate/conflicting FindingsCritical
High
Medium
Low
Next steps:
Previous runReviewFindingsCritical
High
Low
Labels: PR updates Go dependency files (go.mod, go.sum) and Go source imports, matching both the dependencies and go label descriptions. Next steps:
Previous run (2)ReviewFindingsCritical
High
Labels: PR updates Go dependency files and Go source imports, matching the dependencies and go label descriptions. Previous run (3)ReviewFindingsCritical
Labels: Renovate bot PR updating Go module dependencies to new major versions Previous run (4)ReviewFindingsCritical
Medium
Labels: Automated dependency update PR modifying Go module files. Previous run (5)Review —
|
| Module | Old entries | New (broken) | Affected files |
|---|---|---|---|
cenkalti/backoff |
/v4 v4.3.0 + /v5 v5.0.3 |
Both → /v7 v7.0.0 (exact duplicate) |
go.mod, acceptance/go.mod, tools/go.mod |
go.yaml.in/yaml |
/v2 v2.4.x + /v3 v3.0.4 |
Both → /v3 v3.0.4 (exact duplicate) |
go.mod, acceptance/go.mod, tools/go.mod |
theupdateframework/go-tuf |
v0.7.0 + /v2 v2.4.1 |
Both → /v2 at v2.4.2 vs v2.4.1 (conflict) |
go.mod, acceptance/go.mod, tools/go.mod |
hashicorp/hcl |
v1.0.1-vault-7 + /v2 v2.23.0 |
Both → /v2 at v2.24.0 vs v2.23.0 (conflict) |
go.mod, tools/go.mod |
alibabacloud-go/tea-utils |
v1.4.5 + /v2 v2.0.6 |
Both → /v2 at v2.0.9 vs v2.0.6 (conflict) |
go.mod, tools/go.mod |
pelletier/go-toml |
v1.9.5 + /v2 v2.3.0 |
Both → /v2 at v2.4.3 vs v2.3.0 (conflict) |
acceptance/go.mod |
bombsimon/wsl |
/v4 v4.7.0 + /v5 v5.6.0 |
Both → /v5 at v5.8.0 vs v5.6.0 (conflict) |
tools/go.mod |
golang-jwt/jwt |
/v4 v4.5.2 + /v5 v5.3.0 |
Both → /v5 at v5.3.1 vs v5.3.0 (conflict) |
tools/go.mod |
jstemmer/go-junit-report |
v1.0.0 (indirect) |
→ /v2 v2.1.0 duplicates existing direct dep |
go.mod |
Remediation: When bumping a module to a new major version whose path already exists in go.mod, the old entry should be removed rather than rewritten. The surviving entry should carry the higher version. The tool needs to deduplicate after rewriting module paths.
🟠 High: Missing go.sum updates
The PR updates tools/kubectl/go.sum but omits updates to go.sum, acceptance/go.sum, and tools/go.sum. These files must be regenerated (via go mod tidy) to include checksums for all newly referenced module versions. Without this, go build and go test will fail with checksum verification errors.
Remediation: Run go mod tidy in each module directory after fixing the go.mod duplicate entries.
Verdict
This PR has 9 critical findings (duplicate/conflicting module entries across 3 go.mod files, plus a broken import path) and 1 high finding (missing go.sum updates). The automated tool has a systematic defect when the same underlying module exists at multiple major versions in a go.mod — it bumps both entries to the same target, producing invalid module files. The PR cannot be merged in its current state and will fail to compile.
Recommendation: The dependency update tool's logic needs to handle the "two old majors collapse into one new major" case by removing one entry and keeping only the higher version. After fixing the tool or manually deduplicating, run go mod tidy in all module directories and verify with go build ./....
Previous run (6)
Review — ✋ Changes Requested
This is an automated major Go dependency update PR from the mintmaker/Renovate bot. While the intent (updating major versions of Go modules) is correct, the execution has produced several build-breaking issues that prevent compilation. The automated tooling appears to have replaced old major-version module paths with new ones without detecting that the target major version already existed in the require block, creating duplicate entries. Additionally, some import path rewriting in source files is incorrect.
Findings
1. 🔴 Duplicate and conflicting go.mod entries across all modules (High — Correctness)
The dependency updater replaced old module major versions (e.g., backoff/v4, backoff/v5) with the latest major version (e.g., backoff/v7), but in many cases the target major version already existed in the require block. This creates either exact duplicates or version conflicts for the same module path. Go's toolchain rejects duplicate require directives and these will cause go mod tidy and go build to fail.
Affected modules and specific conflicts:
| Module path | Conflict type | Files |
|---|---|---|
github.com/cenkalti/backoff/v7 |
Exact duplicate (two identical v7.0.0 lines) |
go.mod, acceptance/go.mod, tools/go.mod |
github.com/theupdateframework/go-tuf/v2 |
Version conflict: v2.4.2 vs existing v2.4.1 |
go.mod, acceptance/go.mod, tools/go.mod |
github.com/alibabacloud-go/tea-utils/v2 |
Version conflict: v2.0.9 vs existing v2.0.6 |
go.mod, tools/go.mod |
github.com/hashicorp/hcl/v2 |
Version conflict: v2.24.0 vs existing v2.23.0 |
go.mod, tools/go.mod |
go.yaml.in/yaml/v3 |
Exact duplicate (v3.0.4) |
go.mod, acceptance/go.mod, tools/go.mod |
github.com/pelletier/go-toml/v2 |
Version conflict: v2.4.3 vs existing v2.3.0 |
acceptance/go.mod |
github.com/golang-jwt/jwt/v5 |
Version conflict: v5.3.1 vs existing v5.3.0 |
tools/go.mod |
github.com/bombsimon/wsl/v5 |
Version conflict: v5.8.0 vs existing v5.6.0 |
tools/go.mod |
github.com/jstemmer/go-junit-report/v2 |
Duplicate: new indirect v2.1.0 alongside existing direct v2.1.0 |
go.mod |
Remediation: For each conflict, keep only the higher version and remove the duplicate line. For exact duplicates, remove the redundant line. Running go mod tidy after fixing should reconcile the dependency graph.
2. 🔴 Incorrect go-junit-report import path — doubled /v2/v2/ (High — Correctness)
The bot changed the import in internal/applicationsnapshot/junit.go and junit_test.go from:
"github.com/jstemmer/go-junit-report/v2/junit"to:
"github.com/jstemmer/go-junit-report/v2/v2/junit"The current code already correctly imports from the v2 module (github.com/jstemmer/go-junit-report/v2 v2.1.0 is a direct dependency in go.mod). The /v2/junit suffix refers to the junit sub-package within the v2 module. The bot appears to have prepended another /v2 module-path component to the existing import, producing a nonsensical /v2/v2/junit path that does not exist.
Remediation: Revert the import path change in these two files — the current import github.com/jstemmer/go-junit-report/v2/junit is already correct. Also revert the go.mod change that adds a duplicate go-junit-report/v2 indirect entry.
3. 🔴 jsonschema v5 → v6: import path changed without code adaptation (High — Correctness)
The import path for santhosh-tekuri/jsonschema was changed from /v5 to /v6 in three files:
internal/evaluation_target/application_snapshot_image/application_snapshot_image.gointernal/policy/policy.gopkg/schema/schema.go
However, no code was changed to adapt to the v6 API. The v6 release is a major version with breaking API changes. The codebase uses jsonschema.CompileString(), jsonschema.NewCompiler(), compiler.AddResource(), compiler.MustCompile(), schema.Validate(), and *jsonschema.ValidationError — several of these have different signatures or behavior in v6. This will cause compilation failures.
Remediation: Either:
- Keep
jsonschema/v5until the code can be adapted to the v6 API, or - Update all usage sites to match the v6 API (likely requires changes to
CompileString,AddResource,NewCompilerusage, and error handling patterns)
Summary
This PR cannot be merged as-is — the go.mod duplicates alone will prevent any CI build from succeeding, and the incorrect import paths and API-incompatible version bumps add further compilation failures. The root cause appears to be a limitation in the automated dependency updater: when replacing a retired major version (e.g., backoff/v4) with the latest (e.g., backoff/v7), it does not detect that an intermediate version of the same target module (e.g., backoff/v5 also being replaced to backoff/v7) is already present, creating duplicates.
Recommend regenerating this PR after improving the bot's deduplication logic, or manually resolving the conflicts and verifying compilation with go build ./... and go mod tidy across all modules (./, acceptance/, tools/, tools/kubectl/).
Previous run (7)
Review — request-changes
This automated dependency update PR (Renovate/Mintmaker) bumps ~30 Go modules to major versions across go.mod, go.sum, and source import paths. While the intent is correct and includes security-positive upgrades (notably migrating from the EOL go-jose/v2 which is affected by CVE-2025-27144), the automated tool has produced several build-breaking issues that must be resolved before merging.
Critical: Duplicate dependency lines in go.mod files
The automated tool merges distinct Go major-version dependency pairs into duplicate lines. When two separate major versions of a module coexist (e.g., backoff/v4 and backoff/v5 — perfectly valid under Go's module system), both are naively bumped to the same target version, producing identical duplicate require entries. Go rejects go.mod files with duplicate module paths.
Affected pairs across root go.mod, acceptance/go.mod, and tools/go.mod:
github.com/cenkalti/backoff/v7 v7.0.0(duplicated — was v4 + v5)github.com/theupdateframework/go-tuf/v2(v2.4.2 + v2.4.1)go.yaml.in/yaml/v3 v3.0.4(duplicated — was yaml/v2 + yaml/v3)github.com/alibabacloud-go/tea-utils/v2(v2.0.9 + v2.0.6)github.com/hashicorp/hcl/v2(v2.24.0 + v2.23.0)github.com/pelletier/go-toml/v2(v2.4.3 + v2.3.0, acceptance)github.com/bombsimon/wsl/v5(v5.8.0 + v5.6.0, tools)github.com/golang-jwt/jwt/v5(v5.3.1 + v5.3.0, tools)
Remediation: Each pair of distinct major versions must be treated as separate modules. Only bump the version that is actually outdated; do not merge two different major-version modules into a single line. Remove the duplicates and run go mod tidy.
Critical: Broken import path for go-junit-report
The import in internal/applicationsnapshot/junit.go and junit_test.go was changed from github.com/jstemmer/go-junit-report/v2/junit to github.com/jstemmer/go-junit-report/v2/v2/junit — a double /v2/v2/ that does not exist. The original import already correctly referenced the v2 module. The tool naively prepended /v2 again because it bumped a separate indirect v1 entry to v2.
Remediation: Do not modify these import paths — they already reference the correct v2 module. Deduplicate the go.mod entries.
Critical: jsonschema v5 → v6 API incompatibility
The import changed from santhosh-tekuri/jsonschema/v5 to /v6 but no API usage was updated. The v6 library has breaking API changes that will cause compilation failures:
compiler.AssertFormat = true—AssertFormatis now a method, not a settable field (pkg/schema/schema.go)compiler.AddResource(url, io.Reader)— now requires a pre-parsed JSON value fromjsonschema.UnmarshalJSON(), not anio.Reader(pkg/schema/schema.go)compiler.MustCompile(url)— removed in v6; must usecompiler.Compile()which returns(*Schema, error)(pkg/schema/schema.go)jsonschema.CompileString()— removed in v6 (internal/policy/policy.go)
Remediation: Update all jsonschema API usage to match v6, or keep jsonschema at v5 if migration is not intended in this PR.
High: Missing go.sum updates
Only tools/kubectl/go.sum is updated. The root go.sum, acceptance/go.sum, and tools/go.sum are missing checksum updates for the new dependency versions, which will cause build failures.
Remediation: Run go mod tidy in each module directory after fixing the go.mod issues.
Security note: This PR includes security-positive dependency upgrades — notably migrating from the end-of-life gopkg.in/go-jose/go-jose.v2 (affected by CVE-2025-27144, DoS via memory exhaustion in JWS/JWE parsing) to v4.1.4. The golang-jwt/jwt and go-tuf upgrades are also positive supply chain hygiene improvements.
Recommendation: The automated tool's naive major-version bumping has produced several build-breaking issues. These need manual intervention to resolve the duplicate go.mod entries, fix the broken import path, and either update jsonschema API usage for v6 or keep it at v5. Consider running the update tool with more granular configuration, or applying these major bumps individually with proper testing.
Previous run (8)
Review
Findings
Critical
-
[api-contract]
go.mod:8— The PR bumpsgithub.com/MakeNowJust/heredocfrom v1.0.0 toheredoc/v2v2.0.1 in go.mod, but does not update the 15+ source files that importgithub.com/MakeNowJust/heredoc(e.g.,cmd/root/root_cmd.go,cmd/validate/image.go,internal/policy/policy_test.go,internal/opa/rule/rule_test.go, etc.). In Go, a major version bump changes the module path, so all import statements must change fromgithub.com/MakeNowJust/heredoctogithub.com/MakeNowJust/heredoc/v2. Without these changes, the build will fail.
Remediation: Update all Go source files importinggithub.com/MakeNowJust/heredocto importgithub.com/MakeNowJust/heredoc/v2instead, or revert the major version bump in go.mod. -
[api-contract]
go.mod:32— The PR bumpsgithub.com/santhosh-tekuri/jsonschema/v5v5.3.1 tojsonschema/v6v6.0.2 in go.mod, but does not update the 3 source files that import v5:pkg/schema/schema.go,internal/policy/policy.go, andinternal/evaluation_target/application_snapshot_image/application_snapshot_image.go. The import path must change fromjsonschema/v5tojsonschema/v6. Additionally, jsonschema v6 has breaking API changes. Without source code updates, the build will fail.
Remediation: Update all Go source files importingjsonschema/v5to importjsonschema/v6, and adapt to any API changes in the v6 release, or revert the major version bump. -
[api-contract]
tools/go.mod:14— The PR bumpshelm.sh/helm/v3tohelm.sh/helm/v4v4.2.2 in tools/go.mod, but does not updatetools/tools.go(which importshelm.sh/helm/v3/cmd/helm),Makefile(line 207:go run -modfile tools/go.mod helm.sh/helm/v3/cmd/helm), orhack/helm.sh(lines 28-29: references tohelm.sh/helm/v3/pkg/chartutilandhelm.sh/helm/v3/cmd/helm). All these references use the v3 import path and will fail to resolve after the module path changes to v4.
Remediation: Updatetools/tools.go,Makefile, andhack/helm.shto referencehelm.sh/helm/v4instead ofhelm.sh/helm/v3, or revert the major version bump. -
[logic-error]
go.mod— The PR introduces numerous duplicaterequireentries across all four go.mod files. Examples:cenkalti/backoff/v7appears twice (in go.mod, tools/go.mod, acceptance/go.mod),go-tuf/v2with conflicting versions v2.4.2 and v2.4.1,go.yaml.in/yaml/v3duplicated,hashicorp/hcl/v2with v2.24.0 and v2.23.0,alibabacloud-go/tea-utils/v2with v2.0.9 and v2.0.6,pelletier/go-toml/v2with v2.4.2 and v2.3.0 (acceptance/go.mod),bombsimon/wsl/v5with v5.8.0 and v5.6.0 (tools/go.mod),golang-jwt/jwt/v5with v5.3.1 and v5.3.0 (tools/go.mod). Go's toolchain does not permit duplicate module entries in go.mod —go mod tidyandgo buildwill reject files with duplicate require directives.
Remediation: Remove duplicate require entries, keeping only the highest version of each module. Rungo mod tidyon each module to clean up.
Previous run (9)
Review
Findings
Critical
-
[logic-error]
go.mod:32— The PR bumps the direct dependencygithub.com/santhosh-tekuri/jsonschema/v5to/v6, but no.gosource files are modified. In Go, a major version bump changes the import path. At least 3 source files importjsonschema/v5(pkg/schema/schema.go,internal/policy/policy.go,internal/evaluation_target/application_snapshot_image/application_snapshot_image.go). The build will fail because the v5 import path will no longer resolve.
Remediation: Either revert the jsonschema bump to stay on v5, or update all Go import statements fromjsonschema/v5tojsonschema/v6and adapt to any API changes. -
[logic-error]
go.mod:8— The PR bumpsgithub.com/MakeNowJust/heredocfrom v1 to/v2, but no.gosource files are modified. 19 Go source files importgithub.com/MakeNowJust/heredoc(without/v2). The build will fail because the old import path will no longer be listed in go.mod.
Remediation: Either revert this bump, or update all 19 Go source files to importgithub.com/MakeNowJust/heredoc/v2. -
[logic-error]
tools/go.mod:14— The PR bumpshelm.sh/helm/v3tohelm.sh/helm/v4, buttools/tools.goimportshelm.sh/helm/v3/cmd/helm. No Go source files are changed. The build will fail.
Remediation: Either revert the helm bump, or updatetools/tools.goto importhelm.sh/helm/v4/cmd/helm. -
[logic-error]
acceptance/go.mod:38— The PR bumpsgopkg.in/go-jose/go-jose.v2to.v4, butacceptance/image/image.goimportsgopkg.in/go-jose/go-jose.v2/json. No Go source files are changed. The build will fail.
Remediation: Either revert this bump, or updateacceptance/image/image.goto importgopkg.in/go-jose/go-jose.v4/jsonand adapt to any API changes.
Medium
- [logic-error]
go.mod— The diff introduces duplicate module entries within individual go.mod files where the same module path appears with two different versions. Affected modules include:go-tuf/v2(v2.4.1 and v2.4.2),hcl/v2(v2.23.0 and v2.24.0),go-toml/v2(v2.3.0 and v2.4.2),jwt/v5(v5.3.0 and v5.3.1),wsl/v5(v5.6.0 and v5.8.0),tea-utils/v2(v2.0.6 and v2.0.9),yaml/v3(duplicated). These duplicates will causego mod tidyto fail.
Remediation: Remove the duplicate entries, keeping only the higher version for each duplicated module path. Rungo mod tidyin each module directory to validate.
Previous run (10)
Review
Findings
Critical
-
[api-contract]
go.mod:8— The modulegithub.com/MakeNowJust/heredochas been replaced withgithub.com/MakeNowJust/heredoc/v2in go.mod, but 19 Go source files still import the old path"github.com/MakeNowJust/heredoc". In Go modules, a/v2suffix is a distinct import path; the old import path will not resolve against the new module declaration. This will cause a compilation failure.
Remediation: Update all import statements in Go source files from"github.com/MakeNowJust/heredoc"to"github.com/MakeNowJust/heredoc/v2". Affected files include:cmd/fetch/fetch_policy.go,cmd/initialize/init_policies.go,cmd/inspect/inspect_policy_data.go,cmd/inspect/inspect_policy.go,cmd/root/root_cmd.go,cmd/sigstore/initialize.go,cmd/track/track_bundle.go,cmd/validate/image_test.go,cmd/validate/image.go,cmd/validate/input.go,cmd/validate/policy.go,cmd/validate/vsa.go, and several files underinternal/. -
[api-contract]
tools/go.mod:14— The modulehelm.sh/helm/v3has been replaced withhelm.sh/helm/v4in tools/go.mod, buttools/tools.goline 29 still importshelm.sh/helm/v3/cmd/helm. This is a different module path and will cause a compilation failure.
Remediation: Update the import intools/tools.gofromhelm.sh/helm/v3/cmd/helmtohelm.sh/helm/v4/cmd/helm. -
[api-contract]
acceptance/go.mod:38— The modulegopkg.in/go-jose/go-jose.v2has been replaced withgopkg.in/go-jose/go-jose.v4in acceptance/go.mod, butacceptance/image/image.goline 60 still importsgopkg.in/go-jose/go-jose.v2/json. The.v2and.v4vanity import paths resolve to different modules, so this will fail to compile.
Remediation: Update the import inacceptance/image/image.gofromgopkg.in/go-jose/go-jose.v2/jsontogopkg.in/go-jose/go-jose.v4/json, and verify the API is compatible.
High
-
[logic-error]
go.mod:148— Multiple duplicate dependency entries will be introduced. The diff replaces old major versions with new ones but leaves the original lines in place, creating duplicates with conflicting versions. Confirmed duplicates in go.mod:cenkalti/backoff/v6(two identical lines from replacing both v4 and v5),tea-utils/v2(v2.0.9 replacing v1 line while v2.0.6 already exists),go-tuf/v2(v2.4.2 replacing v0 line while v2.4.1 already exists),go.yaml.in/yaml/v3(two identical lines from replacing v2 while v3 already exists). The same pattern appears in acceptance/go.mod and tools/go.mod.
Remediation: Remove the old version lines when adding the new version lines. For entries where the old and new versions resolve to the same major version path, ensure only one line exists. Rungo mod tidyto validate. -
[logic-error]
acceptance/go.mod:182— The diff replacesgithub.com/pelletier/go-toml v1.9.5withgithub.com/pelletier/go-toml/v2 v2.4.2, whilego-toml/v2 v2.3.0already exists at line 183, creating a duplicatego-toml/v2entry with conflicting versions.
Remediation: Remove the duplicatego-toml/v2entry and keep only the newer version.
Previous run (11)
Review
Findings
Critical
-
[duplicate dependency / invalid go.mod]
go.mod— The diff introduces multiple duplicaterequireentries with conflicting versions:hashicorp/hcl/v2(v2.24.0 vs v2.23.0),theupdateframework/go-tuf/v2(v2.4.2 vs v2.4.1),alibabacloud-go/tea-utils/v2(v2.0.9 vs v2.0.6),cenkalti/backoff/v6(duplicated identically),golang-jwt/jwt/v5(v5.3.1 vs v5.3.0),go.yaml.in/yaml/v3(duplicated identically). Go tooling does not allow duplicate module paths and will fail to parse this file.
Remediation: Remove duplicate entries, keeping only one version per module path. -
[duplicate dependency / invalid go.mod]
tools/go.mod— Same duplicate patterns:bombsimon/wsl/v5(v5.8.0 vs v5.6.0),cenkalti/backoff/v6duplicated,alibabacloud-go/tea-utils/v2duplicated,go-tuf/v2duplicated,hashicorp/hcl/v2duplicated,go.yaml.in/yaml/v3duplicated. All cause go.mod parse failures.
Remediation: Remove all duplicate module path entries. -
[duplicate dependency / invalid go.mod]
acceptance/go.mod— Duplicate entries:cenkalti/backoff/v6duplicated,go-tuf/v2(v2.4.2 vs v2.4.1),go.yaml.in/yaml/v3duplicated.
Remediation: Remove duplicate entries. -
[duplicate dependency / invalid go.mod]
tools/kubectl/go.mod— Duplicatego.yaml.in/yaml/v3 v3.0.4entries after changingyaml/v2toyaml/v3without removing the existingyaml/v3line.
Remediation: Remove the duplicate line. -
[import path mismatch / build failure]
go.mod:8 — The diff changesgithub.com/MakeNowJust/heredoc v1.0.0toheredoc/v2 v2.0.1, but 19.gosource files import"github.com/MakeNowJust/heredoc"(without/v2). In Go modules, major version bumps change the import path, so the code will fail to compile.
Remediation: Either revert the heredoc version bump, or update all 19.gofiles to import"github.com/MakeNowJust/heredoc/v2". -
[import path mismatch / build failure]
acceptance/go.mod:38 — The diff changesgopkg.in/go-jose/go-jose.v2togo-jose.v4, butacceptance/image/image.goimports"gopkg.in/go-jose/go-jose.v2/json". Build failure.
Remediation: Either revert the go-jose version bump, or update the import inacceptance/image/image.goto v4. -
[import path mismatch / build failure]
tools/go.mod:14 — The diff changeshelm.sh/helm/v3tohelm/v4, buttools/tools.goimports"helm.sh/helm/v3/cmd/helm". Build failure.
Remediation: Either revert the helm version bump, or updatetools/tools.goimport tohelm/v4.
High
- [missing go.sum update]
go.mod— The PR changes multiple go.mod files with major version bumps but includes no go.sum file updates.go mod tidymust be run in each module directory after fixing go.mod issues.
Remediation: Rungo mod tidyin each module directory and commit the updated go.sum files.
Info
-
[sub-agent-failure]
N/A— The style-conventions sub-agent did not return findings: model unavailable. -
[sub-agent-failure]
N/A— The intent-coherence sub-agent did not return findings: model unavailable.
Previous run (12)
Review
Findings
Critical
-
[build-breakage]
go.mod:8— The PR bumpsgithub.com/MakeNowJust/heredocfrom v1.0.0 toheredoc/v2v2.0.1, but no.gosource files are updated. 19 Go files importgithub.com/MakeNowJust/heredoc(v1 path). In Go modules, a v1-to-v2 major bump changes the import path togithub.com/MakeNowJust/heredoc/v2. The build will fail.
Remediation: Either update all 19.gofiles to importheredoc/v2and adapt to API changes, or do not bump this dependency. -
[build-breakage]
go.mod:32— The PR bumpsgithub.com/santhosh-tekuri/jsonschema/v5tojsonschema/v6v6.0.2, but no.gosource files are updated. Three files (pkg/schema/schema.go,internal/policy/policy.go,internal/evaluation_target/application_snapshot_image/application_snapshot_image.go) importjsonschema/v5. The import path must change tojsonschema/v6, and jsonschema v6 has breaking API changes.
Remediation: Either update all 3.gofiles to importjsonschema/v6and adapt API calls, or do not bump this dependency. -
[build-breakage]
tools/go.mod:14— The PR bumpshelm.sh/helm/v3tohelm/v4v4.2.1, buttools/tools.goline 29 still importshelm.sh/helm/v3/cmd/helm. The import path must change tohelm.sh/helm/v4/cmd/helm.
Remediation: Either updatetools/tools.goto importhelm.sh/helm/v4/cmd/helm, or do not bump Helm.
High
-
[missing-go-sum]
go.mod— The PR modifies 4go.modfiles but includes nogo.sumfile changes. Anygo.modchange requires correspondinggo.sumupdates with cryptographic hashes. Without them,go mod verifyand builds will fail.
Remediation: Rungo mod tidyin each module directory to regeneratego.sumfiles. -
[major-version-scope]
go.mod,acceptance/go.mod,tools/go.mod,tools/kubectl/go.mod— The PR performs ~50 major version bumps across allgo.modfiles without accompanying source code changes, tests, or documentation. In Go, major version bumps change import paths and require source code migration. This appears to be an auto-generated Renovate PR that was not validated with a build.
Medium
- [duplicate-dependencies]
go.mod— The PR creates duplicate dependency entries by replacing multiple old major versions with the same new version. For example:cenkalti/backoff/v4andbackoff/v5are both replaced withbackoff/v6, creating twov6lines. Similarly forgo-tuf/v2,hcl/v2,yaml/v3,tea-utils/v2, andwsl/v5. These duplicates will causego mod tidyerrors.
Low
-
[deprecated-crypto-library]
acceptance/go.mod:38—acceptance/go.modstill directly depends ongopkg.in/go-jose/go-jose.v2v2.6.3. This library is deprecated upstream in favor ofgo-jose/v4(already used elsewhere as indirect). While v2.6.3 has fixes for known CVEs, it will not receive future security patches. -
[logic-error]
go.mod— ~50 major version bumps with zero.gosource file changes. Rungo build ./...andgo test ./...in each module directory to identify all compilation failures. -
[monorepo-coherence] Multiple
go.modfiles — Version inconsistencies across modules after the update. Different modules pin different versions of the same transitive dependencies.
Info
-
[authorization-inference] No linked issue. Authorization inferred from the mechanical nature of the change (Renovate bot dependency update).
-
[dependency-upgrade]
go.mod:230—golang-jwt/jwt/v4v4.5.2 remains as an indirect dependency. Not EOL; contains all known security fixes. -
[dependency-upgrade]
tools/go.mod:175—containerdv1.7.29 remains intools/go.modwhilego.modmoved to v2. -
[dependency-upgrade]
tools/go.mod:473—sigstore/cosign/v2remains intools/go.modwhile other modules moved to v3.
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
cbd1b47 to
cf1d784
Compare
|
🤖 Finished Review · ✅ Success · Started 3:27 AM UTC · Completed 3:39 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
cf1d784 to
5f3e70e
Compare
|
🤖 Finished Review · ✅ Success · Started 2:22 AM UTC · Completed 2:35 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
5f3e70e to
408d259
Compare
|
🤖 Finished Review · ✅ Success · Started 2:20 AM UTC · Completed 2:30 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
408d259 to
ff96088
Compare
|
🤖 Finished Review · ✅ Success · Started 2:18 AM UTC · Completed 2:27 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
ff96088 to
a9f4e2e
Compare
|
🤖 Finished Review · ❌ Failure · Started 2:12 AM UTC · Completed 2:23 AM UTC |
a9f4e2e to
4ce4253
Compare
|
🤖 Finished Review · ✅ Success · Started 2:18 AM UTC · Completed 2:24 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
4ce4253 to
aee77d5
Compare
|
🤖 Review · |
0758d72 to
22652cc
Compare
|
🤖 Finished Review · ✅ Success · Started 2:18 AM UTC · Completed 2:25 AM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
22652cc to
2951435
Compare
|
🤖 Finished Review · ❌ Failure · Started 3:52 AM UTC · Completed 4:07 AM UTC |
2951435 to
81a516d
Compare
|
🤖 Finished Review · ❌ Failure · Started 2:13 AM UTC · Completed 2:31 AM UTC |
81a516d to
28e26b8
Compare
|
🤖 Finished Review · ❌ Failure · Started 2:30 AM UTC · Completed 2:45 AM UTC |
28e26b8 to
db80c3e
Compare
|
🤖 Finished Review · ✅ Success · Started 2:46 AM UTC · Completed 3:01 AM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
dependencies
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
db80c3e to
199d62b
Compare
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
🤖 Finished Review · ✅ Success · Started 3:56 AM UTC · Completed 4:08 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $6.15 |
There was a problem hiding this comment.
Note: The following review comments could not be posted on the diff (GitHub returned 422) and are included here instead:
internal/policy/policy.go(file-level): Line 641 · [critical] api-contract
Call site still uses v5-only helper jsonschema.CompileString('schema.json', ecc.Schema), but the module is bumped to santhosh-tekuri/jsonschema/v6. CompileString was removed in v6 (Compiler.AddResource + Compile flow required). This file will not compile.
Suggested fix: Rewrite the call using v6 API: jsonschema.NewCompiler(), AddResource(url, io.Reader), then Compile(url). Audit every other jsonschema.* reference in the repo for v6 compatibility.
acceptance/go.mod(file-level): Line 10 · [high] api-contract
'gopkg.in/go-jose/go-jose.v2 v2.6.3' -> 'gopkg.in/go-jose/go-jose.v4 v4.1.5'. v3 and v4 fixed multiple decryption/verification issues (CVE-2024-28180 and PBES2 iteration-limit / header-validation changes). Skipping v3 and jumping v2 -> v4 without diffing call sites means historic patterns relying on v2 permissive defaults (no AlgorithmVerifier, no PBES2 iteration cap) will either fail to compile or silently change what tokens are accepted. This is in the acceptance/ test module, so incorrect wiring can MASK verification regressions in the SUT.
Suggested fix: Port acceptance-suite call sites (see critical finding on acceptance/image/image.go:60) to the v4 explicit-algorithm-allowlist API and re-run the acceptance suite. Assert that any test that expects a bad token to be rejected still rejects it.
pkg/schema/schema.go(file-level): Line 41 · [medium] api-contract
With jsonschema/v6 now required, this file still uses v5-shaped Compiler flow ('jsonschema.NewCompiler()'). v6 method signatures differ (AddResource takes (url, io.Reader); Compile returns a different error type). Verify each method on v6's Compiler; the rest of this file may fail to compile.
Suggested fix: Audit pkg/schema/schema.go end-to-end against the v6 API and update call sites.
internal/evaluation_target/application_snapshot_image/application_snapshot_image.go(file-level): Line 374 · [medium] api-contract
File is imported as jsonschema/v6 but still type-asserts on '*jsonschema.ValidationError' (v5's struct). v6 restructured the validation-error type (fields differ, helpers renamed). Verify the assertion, the 'jsonschema.Schema' map, and any Compile callers still compile under v6.
Suggested fix: Audit all jsonschema.* references in this file against the v6 API and adjust as needed.
|
|
||
| "cuelang.org/go/pkg/time" | ||
| "github.com/jstemmer/go-junit-report/v2/junit" | ||
| "github.com/jstemmer/go-junit-report/v2/v2/junit" |
There was a problem hiding this comment.
[critical] correctness
Import path corrupted to 'github.com/jstemmer/go-junit-report/v2/v2/junit' (doubled '/v2/v2/'). Correct v2 path is 'github.com/jstemmer/go-junit-report/v2/junit'. Package will not compile.
Suggested fix: Restore the import to 'github.com/jstemmer/go-junit-report/v2/junit' (single '/v2/'). Fix the identical corruption at internal/applicationsnapshot/junit_test.go:24. Add a lint rule (e.g. golangci-lint importas) rejecting /vN/vN/ patterns.
| "testing" | ||
|
|
||
| "github.com/jstemmer/go-junit-report/v2/junit" | ||
| "github.com/jstemmer/go-junit-report/v2/v2/junit" |
There was a problem hiding this comment.
[critical] correctness
Same doubled-version import path 'github.com/jstemmer/go-junit-report/v2/v2/junit' as in junit.go. Package will not compile.
Suggested fix: Restore to 'github.com/jstemmer/go-junit-report/v2/junit'.
| module github.com/conforma/cli/tools/kubectl | ||
|
|
||
| go 1.26.7 | ||
| go 1.27 |
There was a problem hiding this comment.
[low] correctness
Sibling modules stay at 'go 1.26.7'; this file jumps to 'go 1.27'. If the target toolchain image does not yet support 1.27, GOTOOLCHAIN=auto will silently download an unintended toolchain. Confirm the intent and either align with siblings or add an explicit 'toolchain' directive documenting why.
Suggested fix: Align the 'go' directive with the other modules, or add an explicit 'toolchain' line and document why kubectl needs the newer minor.
This PR contains the following updates:
v4.0.0→v5.0.3v1.0.0→v2.0.1v1.0.1→v2.0.0v1.0.10→v3.2.0v0.2.1→v2.2.4v1.4.5→v2.0.9v15.0.0→v17.0.1v4.7.0→v5.8.0v4.3.0→v7.0.0v5.0.3→v7.0.0v1.1.0→v2.0.5v1.7.33→v2.3.3v26.2.0→v42.0.1v21.0.1→v34.2.1v0.5.0→v1.0.1v1.11.5→v2.5.2v2.9.0→v3.4.1v1.5.1-0.20230307220236-3a3c6141e376→v2.0.2v0.23.1→v1.0.0v0.21.6→v1.0.0v4.5.2→v5.3.1v0.0.4→v1.0.0v73.0.0→v90.0.0v1.8.6→v2.2.3v1.0.2→v2.0.7v1.0.1-vault-7→v2.24.0v1.0.0→v2.1.0v3.0.13→v4.2.0v2.3.3→v3.3.1v1.9.5→v2.4.3v1.4.1→v2.1.3v5.3.1→v6.0.3v3.23.12→v4.26.7v3.24.5→v4.26.7v2.6.2→v3.1.3v0.7.0→v2.4.2v1.4.1→v2.0.0v0.143.3→v2.56.0v1.11.0→v2.56.0v1.17.6→v2.8.0v2.4.4→v3.0.5v2.5.0→v3.0.1v4.13.0→v5.9.11v2.6.3→v4.1.4v3.20.2→v4.2.3Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
GaijinEntertainment/go-exhaustruct (dev.gaijin.team/go/exhaustruct/v4)
v5.0.3Compare Source
A patch release removing spurious read errors reported for every standard library struct literal. No configuration, flag, or diagnostic changes otherwise.
Fixes
No more
$GOROOTread errors (#166). Every run reported one positionless diagnostic per standard library struct literal:$GOROOThere is not an unexpanded environment variable. It is a literal placeholder the compiler substitutes for the real GOROOT when recording positions of files in the Go distribution (cmd/internal/objabi.AbsFile). Those paths travel in export data, so any driver that type-checks dependencies from export data —singlechecker,go vet -vettool, golangci-lint — saw every standard library type positioned at a path that cannot be opened on any machine. Resolving a struct literal reads the file that declares its type in order to pick up directives, and for standard library types that read always failed.Files of the Go distribution are now resolved as directive-free without being read at all, since their sources carry no exhaustruct directives.
Standard library types are still checked. Fields come from
go/types, which this change does not touch — only directive resolution is skipped:A run over a package using standard library types produces an identical set of findings before and after, minus the read errors.
Internal
$GOROOTpositions thatanalysistestcannot produce (it type-checks dependencies from source, where the same definitions have real, readable paths).GOROOTof/cannot match every path.Upgrading
CLI users reinstall. There is nothing to change in configuration — the only difference is the absence of the spurious diagnostics.
v5.0.2Compare Source
A cleanup release that separates the analyzer's two construction lifecycles and trims internal surface. CLI behavior, flags, and diagnostics are unchanged. The only externally visible change is to the programmatic constructor API, which has no consumers on the
dev.gaijin.team/go/exhaustruct/v5module path yet — hence a patch bump rather than a major one.Breaking (programmatic API)
NewAnalyzeris split into two constructors (#160). A singleNewAnalyzer(config Config) (*analysis.Analyzer, error)served two conflicting lifecycles — CLI drivers that mutateConfigthrough flags after construction, and library callers that pass a finishedConfigand expect validation up front. It is now:NewAnalyzer() *analysis.Analyzer— flag-driven, for CLI drivers (singlechecker,go vet -vettool). Configuration is consumed on the first run, after the driver has parsed flags.NewAnalyzerWithConfig(config Config) (*analysis.Analyzer, error)— programmatic, for library consumers such as golangci-lint. TheConfigis copied and its patterns validated immediately; the analyzer exposes no flags, and later mutations of the passedConfighave no effect.Changes
Configpattern fields (EnforcePatterns,IgnorePatterns,OptionalPatterns,AllowEmptyPatterns) are now the namedPatternstype.[]string{...}literals remain assignable, so existing field assignments compile unchanged.Internal
Visitors decoupled from the analyzer struct; the
enginewrapper struct removed; lazy initialization confined to the flag-driven path; pattern validation unified underinternal/pattern; dead methods and an unusedflag.Valueimplementation dropped. No behavior change.Upgrading
CLI users reinstall; flags and output are unchanged. Library callers rename
NewAnalyzer(cfg)toNewAnalyzerWithConfig(cfg).v5.0.1Compare Source
Two v5 API bugs traced to the same root cause:
NewAnalyzercaptured patterns into the processor before the analysis driver parsed flags, so flag-driven values never reached analysis, and theConfigfields had to be typed againstinternal/patternto be writable at all.Fixes
-enforce-rx,-ignore-rx,-optional-rx, and-allow-empty-rxhad no effect under the standalone CLI (#155). Processor construction now happens lazily on first analyzer run, after flags are populated. golangci-lint integrations were unaffected, since they populateConfigprogrammatically before callingNewAnalyzer.analyzer.Configno longer leaks the internalpattern.Listtype (#158). The four pattern fields (EnforcePatterns,IgnorePatterns,OptionalPatterns,AllowEmptyPatterns) are now plain[]string; pattern compilation has moved inside the analyzer. Library callers populating these fields directly drop thepattern.NewListcall:Upgrading
CLI users reinstall. Library callers update
Configfield assignments as shown above.v5.0.0Compare Source
exhaustructv5 reshapes how the linter is configured. Struct tags give way to comment directives, opt-in checking lands as a first-class mode, and patterns now reach down to individual fields. The full reference is in the README; this is the highlight reel.What's new
Comment directives replace struct tags. Three directives —
enforce,ignore,optional— now work at three levels of granularity: type definitions, struct literals, and individual fields. A documented priority order keeps the interaction between them predictable.Explicit mode (
-explicit) flips the default. Instead of checking every struct literal in the project, the linter only checks types you've explicitly marked — either with//exhaustruct:enforceor via-enforce-rx. The right pick for large codebases where exhaustruct should be a precision tool, not a blanket policy.Field-level regex patterns. The pattern flags now accept
Type#Fieldsyntax, so a single configuration line can express optionality across a codebase without touching the type definitions:Optional patterns (
-optional-rx). Regex-based optionality for whole types or specific fields. Closes a long-standing gap for third-party types you can't annotate directly.Derived types and aliases now follow a clearer rule. Field-level directives carry through
type T = Uandtype T U— so a field marked optional stays optional on every alias and derived type. Type-level directives stay attached to the original type, which means you can promote a derived type to "enforced" independently.Better diagnostics.
-report-full-type-pathreportsnet/http.Cookieinstead ofhttp.Cookie, removing ambiguity when import aliases are in play (#146).-debug-cache-metricsprints per-package cache statistics, useful for tuning patterns on large projects.Auto-migration.
exhaustruct -fix ./...rewrites the legacyexhaustruct:"optional"tags to comment directives in one pass — no manual sweep required.Breaking changes
exhaustruct:"optional"is no longer recognized. The-fixflag migrates existing tags automatically; the manual equivalent is a one-line move from the field's struct tag to a//exhaustruct:optionalcomment above (or beside) the field.include/excludevocabulary suggested filtering, but the linter has always been about enforcement. The new names say what they do:-include-rx/-i→-enforce-rx-exclude-rx/-e→-ignore-rx/v5. Update imports and reinstall:Fixes
&T{}returned where the function signature expects*T) are now flagged — previously they slipped past the checker (#147).types.Unaliasso their fields are inspected even behind an alias chain (#149).Migrating from v4
/v4to/v5.exhaustruct -fix ./...to rewrite struct tags to comment directives.-include-rx/-iwith-enforce-rx, and-exclude-rx/-ewith-ignore-rxin CI configs and.golangci.yaml.-explicitif you'd rather opt specific types into checking than opt the rest out.MakeNowJust/heredoc (github.com/MakeNowJust/heredoc)
v2.0.1Compare Source
Version 2.0.1
Fixes
importpath for Go modulesv2.0.0Compare Source
Version 2.0.0
Breaking Changes
alibabacloud-go/cr-20160607 (github.com/alibabacloud-go/cr-20160607)
v2.0.0Compare Source
cr.alibabacloud-go/cr-20181201 (github.com/alibabacloud-go/cr-20181201)
v3.2.0Compare Source
v3.1.3Compare Source
v3.1.2Compare Source
v3.1.1Compare Source
v3.1.0Compare Source
v3.0.6Compare Source
v3.0.5Compare Source
v3.0.4Compare Source
v3.0.3Compare Source
cr.v3.0.2Compare Source
v3.0.1Compare Source
v3.0.0Compare Source
v2.5.0Compare Source
v2.4.0Compare Source
v2.3.2Compare Source
cr.v2.3.1Compare Source
cr.v2.3.0Compare Source
cr.v2.2.2Compare Source
cr.v2.2.1Compare Source
cr.v2.2.0Compare Source
cr.v2.1.0Compare Source
cr.v2.0.1Compare Source
v2.0.0Compare Source
cr.alibabacloud-go/darabonba-openapi (github.com/alibabacloud-go/darabonba-openapi)
v2.2.4Compare Source
Sync WebSocket OpenAPI support from aliyun/darabonba-openapi master (#280).
v2.2.3Compare Source
v2.2.2Compare Source
v2.2.1Compare Source
v2.2.0Compare Source
v2.1.16Compare Source
v2.1.15Compare Source
v2.1.14Compare Source
v2.1.13Compare Source
v2.1.12: Realase v2.1.12Compare Source
v2.1.11Compare Source
v2.1.10Compare Source
Full Changelog: alibabacloud-go/darabonba-openapi@v2.1.9...v2.1.10
v2.1.9Compare Source
v2.1.8Compare Source
v2.1.7Compare Source
v2.1.6Compare Source
v2.1.5Compare Source
v2.1.4Compare Source
v2.1.3Compare Source
v2.1.2Compare Source
v2.1.1Compare Source
v2.1.0Compare Source
v2.0.12Compare Source
Full Changelog: alibabacloud-go/darabonba-openapi@v2.0.11...v2.0.12
v2.0.11Compare Source
Full Changelog: alibabacloud-go/darabonba-openapi@v2.0.10...v2.0.11
v2.0.10Compare Source
Full Changelog: alibabacloud-go/darabonba-openapi@v2.0.9...v2.0.10
v2.0.9Compare Source
v2.0.8Compare Source
Support bearer token credentials request.
v2.0.7Compare Source
Support extends parameters.
v2.0.6Compare Source
feat: support extends parameters
v2.0.5Compare Source
v2.0.4: Release version v2.0.4v2.0.2Compare Source
Add gateway client setter.
v2.0.1Compare Source
Return description and accessDeniedDetail in error info.
v2.0.0Compare Source
Update with tea-utils.
alibabacloud-go/tea-utils (github.com/alibabacloud-go/tea-utils)
v2.0.9Compare Source
v2.0.8Compare Source
v2.0.7Compare Source
v2.0.6Compare Source
Support extends query parameters.
v2.0.5Compare Source
feat: support extends parameters
v2.0.4Compare Source
Refactor: improve design of nonce
v2.0.3Compare Source
Support static method
AssertAsInteger().v2.0.2Compare Source
Fix stringify map value.
v2.0.1Compare Source
Support ca params for server and client.
v2.0.0Compare Source
Remove function panic.
apparentlymart/go-textseg (github.com/apparentlymart/go-textseg/v15)
v17.0.1Compare Source
v17.0.0Compare Source
v16.0.2Compare Source
v16.0.1Compare Source
v16.0.0Compare Source
bombsimon/wsl (github.com/bombsimon/wsl/v4)
v5.8.0Compare Source
What's Changed
cuddle-max-statementsby @bombsimon in #258cuddle-groupcheck by @bombsimon in #257deferallows any expression with intersecting variables by @bombsimon in #260gocuddling same asdeferby @bombsimon in #261CheckErrtakes precedence over all other cuddling rules by @bombsimon in #263Full Changelog: bombsimon/wsl@v5.7.0...v5.8.0
v5.7.0Compare Source
This was a pre-mature release containing regressions and unfinished changes. This release was never included in
golangci-lintand will be replaced with v5.8.0What's Changed
branch-max-linesflag by @bombsimon in #237after-checks by @bombsimon in #253go/defernot inspecting anonymous function bodies by @bombsimon in #255New Contributors
Full Changelog: bombsimon/wsl@v5.6.0...v5.7.0
v5.6.0Compare Source
What's Changed
elseblocks by @bombsimon in #230Full Changelog: bombsimon/wsl@v5.5.0...v5.6.0
v5.5.0Compare Source
What's Changed
newline-after-blocktoafter-blockby @bombsimon in #228Full Changelog: bombsimon/wsl@v5.4.0...v5.5.0
v5.4.0Compare Source
NOTE⚠️
This release immediately got superseded by v5.5.0. The only reason being a fix of a bad name of the new check before widely spread. The check should be referred to as
after-blockwhich it is from v5.5.0 and onwards.What's Changed
newline-after-blockby @bombsimon in #221CommentMapby @bombsimon in #225ast.Inspectinstead ofcheckExprand manually calls by @bombsimon in #226New Contributors
Full Changelog: bombsimon/wsl@v5.3.0...v5.4.0
Thanks