Update go modules (main) (minor)#1632
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
3 times, most recently
from
6530ff8 to
6421e02
Compare
Contributor
Author
ℹ️ Artifact update noticeFile name: docs/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Codecov Report✅ All modified and coverable lines are covered by tests. 🚀 New features to boost your workflow:
|
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
3 times, most recently
from
7f6a07a to
4f6e0d5
Compare
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
from
4f6e0d5 to
cf70ec7
Compare
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
4 times, most recently
from
903a958 to
915f933
Compare
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
3 times, most recently
from
8051b1b to
b414ed3
Compare
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
3 times, most recently
from
5c9e490 to
6625ab3
Compare
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
3 times, most recently
from
e54a0a3 to
830dcc8
Compare
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
from
0633f9c to
39640f3
Compare
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
2 times, most recently
from
3a7e83a to
ebad324
Compare
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
from
ebad324 to
34c1bd8
Compare
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
2 times, most recently
from
d4b7deb to
9444e90
Compare
|
🤖 Review · Started 4:57 PM UTC |
ReviewFindingsCritical
Previous runReviewFindingsCritical
Medium
Labels: Go dependency update PR should carry the go and dependencies labels. Previous run (2)ReviewFindingsCritical
Medium
Low
Previous run (3)ReviewFindingsHigh
Info
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| github.com/open-policy-agent/conftest v0.66.0 | ||
| github.com/open-policy-agent/regal v0.37.0 | ||
| github.com/tektoncd/cli v0.42.1 | ||
| github.com/open-policy-agent/conftest v0.68.2 |
There was a problem hiding this comment.
[high] api-contract
The root go.mod bumps three direct dependencies (conftest v0.66.0→v0.68.2, regal v0.37.0→v0.41.1, tektoncd/cli v0.42.1→v0.45.0) but the corresponding go.sum file is not updated in this PR. The current go.sum on the base branch only contains checksum entries for the old versions, so any build or go mod verify will fail with missing checksum errors.
Suggested fix: Run go mod tidy in the root module directory to regenerate go.sum with the correct checksums for the updated dependencies, and include the updated go.sum in the PR.
|
🤖 Finished Review · ✅ Success · Started 4:57 PM UTC · Completed 5:02 PM UTC |
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
from
9444e90 to
bde67c4
Compare
renovate
Bot
changed the title
|
🤖 Finished Review · ✅ Success · Started 1:17 PM UTC · Completed 1:27 PM UTC |
| exclude google.golang.org/grpc/stats/opentelemetry v0.0.0-20241028142157-ada6787961b3 | ||
|
|
||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.20.7-0.20251103083939-3459088e4bae | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry b75247998fd1 |
There was a problem hiding this comment.
[critical] Invalid Go module syntax
The replace directive uses a bare commit hash b75247998fd1 without a version prefix. Go modules require a valid semver or pseudo-version. This will cause all Go tooling to fail with a parse error. The acceptance/go.mod correctly uses the full pseudo-version format for the same commit.
Suggested fix: Change the replace directive to: replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.20.7-0.20260625125002-b75247998fd1
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
from
bde67c4 to
8b963ab
Compare
|
🤖 Finished Review · ✅ Success · Started 6:35 PM UTC · Completed 6:43 PM UTC |
| exclude google.golang.org/grpc/stats/opentelemetry v0.0.0-20241028142157-ada6787961b3 | ||
|
|
||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.20.7-0.20251103083939-3459088e4bae | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry b75247998fd1 |
There was a problem hiding this comment.
[critical] api-contract
The replace directive uses a bare commit hash b75247998fd1 instead of a valid Go module pseudo-version. The current base branch correctly uses v0.20.7-0.20251103083939-3459088e4bae, and the PRs own acceptance/go.mod correctly uses v0.20.7-0.20260625125002-b75247998fd1 for the new commit. The bare hash form is invalid for replace directives targeting modules that contain a go.mod file, and will cause go mod tidy and all builds to fail.
Suggested fix: Change the replace directive in go.mod to use the full pseudo-version: replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.20.7-0.20260625125002-b75247998fd1 (matching the format used in acceptance/go.mod).
fullsend-ai-review
Bot
added
go
renovate
Bot
force-pushed
the
renovate/main-go-modules
branch
from
8b963ab to
29b5e67
Compare
renovate
Bot
changed the title
|
🤖 Finished Review · ✅ Success · Started 7:21 PM UTC · Completed 7:29 PM UTC |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.20.7-0.20251103083939-3459088e4bae→v0.21.7v0.66.0→v0.68.2v1.12.3→v1.18.0v0.37.0→v0.41.1v0.42.1→v0.45.0Release Notes
conforma/go-containerregistry (github.com/conforma/go-containerregistry)
v0.21.7Compare Source
open-policy-agent/conftest (github.com/open-policy-agent/conftest)
v0.68.2Compare Source
Changelog
OPA Changes
36f23bf: build(deps): bump github.com/open-policy-agent/opa from 1.15.1 to 1.15.2 (#1311) (@dependabot[bot])Other Changes
479de13: build(deps): bump github.com/hashicorp/go-getter from 1.8.5 to 1.8.6 (#1307) (@dependabot[bot])v0.68.1Compare Source
Changelog
Bug Fixes
2631477: fix(push): Use Rego v1 by default (#1290) (@jalseth)v0.68.0Compare Source
Changelog
New Features
a604f55: feat(parser): Add nginx parser (#1289) (@jalseth)Bug Fixes
487a2e1: fix: Skip extensionless files that are not recognized types (#1302) (@ricardbejarano)OPA Changes
472e4e3: build(deps): bump github.com/open-policy-agent/opa from 1.14.1 to 1.15.1 (#1303) (@dependabot[bot])Other Changes
6d521ef: build(deps): bump github.com/google/go-jsonnet from 0.21.0 to 0.22.0 (#1299) (@dependabot[bot])2d5f1c2: build(deps): bump github.com/moby/buildkit from 0.28.0 to 0.29.0 (#1306) (@dependabot[bot])v0.67.1Compare Source
Changelog
Bug Fixes
9cef5a2: fix(releasing): Ensure GoReleaser creates a tar for linux_amd64 (#1294) (@jalseth)Other Changes
8bc9477: build(deps): bump actions/setup-go from 6.0.0 to 6.3.0 (#1278) (@dependabot[bot])7655171: build(deps): bump docker/build-push-action from 6.19.2 to 7.0.0 (#1284) (@dependabot[bot])35ab0ca: build(deps): bump docker/login-action from 3.6.0 to 4.0.0 (#1283) (@dependabot[bot])94e5286: build(deps): bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 (#1275) (@dependabot[bot])45a3835: ci: Update Nix devshell to use go-overlay (#1287) (@jalseth)v0.67.0Compare Source
Changelog
Bug Fixes
69f41ed: fix(plugin): Handle spaces in the plugin command path (#1242) (@jalseth)OPA Changes
59cb419: build(deps): bump github.com/open-policy-agent/opa from 1.12.1 to 1.13.1 (#1262) (@dependabot[bot])507345f: build(deps): bump github.com/open-policy-agent/opa from 1.13.1 to 1.13.2 (#1274) (@dependabot[bot])69b7329: build(deps): bump github.com/open-policy-agent/opa from 1.13.2 to 1.14.1 (#1282) (@dependabot[bot])Other Changes
8ec8ba0: build(deps): bump actions/checkout from 5.0.0 to 6.0.1 (#1230) (@dependabot[bot])fb1d20e: build(deps): bump alpine from 3.23.2 to 3.23.3 (#1264) (@dependabot[bot])84ee4f1: build(deps): bump bats-core/bats-action from 3.0.1 to 4.0.0 (#1270) (@dependabot[bot])06f26a6: build(deps): bump cuelang.org/go from 0.15.1 to 0.15.3 (#1244) (@dependabot[bot])d01f783: build(deps): bump cuelang.org/go from 0.15.3 to 0.15.4 (#1259) (@dependabot[bot])b7f9627: build(deps): bump cuelang.org/go from 0.15.4 to 0.16.0 (#1279) (@dependabot[bot])3e4cf98: build(deps): bump docker/build-push-action from 6.18.0 to 6.19.2 (#1273) (@dependabot[bot])b7060d3: build(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.3 to 0.10.0 (#1265) (@dependabot[bot])e130513: build(deps): bump github.com/hashicorp/go-getter from 1.8.3 to 1.8.4 (#1245) (@dependabot[bot])e5afd3f: build(deps): bump github.com/hashicorp/go-getter from 1.8.4 to 1.8.5 (#1285) (@dependabot[bot])d6f5fb2: build(deps): bump github.com/moby/buildkit from 0.26.3 to 0.27.1 (#1260) (@dependabot[bot])c1ba806: build(deps): bump github.com/moby/buildkit from 0.27.1 to 0.28.0 (#1280) (@dependabot[bot])fc57996: build(deps): bump github.com/spdx/tools-golang from 0.5.5 to 0.5.6 (#1243) (@dependabot[bot])95d756f: build(deps): bump github.com/spdx/tools-golang from 0.5.6 to 0.5.7 (#1251) (@dependabot[bot])a59b8bd: build(deps): bump golang from 1.25.5-alpine to 1.25.6-alpine (#1256) (@dependabot[bot])bde1457: build(deps): bump golang from 1.25.6-alpine to 1.26.1-alpine (#1281) (@dependabot[bot])b2e58f0: build(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.2.0 (#1231) (@dependabot[bot])b1e9f30: ci: Update Dependabot config (#1267) (@jalseth)bf63002: ci: Update setup-go to use Go version from go.mod (#1268) (@jalseth)open-policy-agent/opa (github.com/open-policy-agent/opa)
v1.18.0Compare Source
This release contains a mix of bugfixes and small features. Notably:
User-Agentheader so it conforms to RFC 9110 (see below)GOMAXPROCSis restored and automaticGOMEMLIMITis now supportedopa fmtcorrectness fixesopa test --coverage(ranges in report, inline rule head tracking, conjunction-expression coverage)Breaking: Fix User-Agent according to RFC9110 (#8792)
OPA's outbound HTTP requests (bundle, discovery, decision log, status,
http.send, AWS KMS/ECR)previously sent
User-Agent: Open Policy Agent/<version> (<os>, <arch>), which is not a validRFC 9110
User-Agentvalue because theproducttoken cannot contain spaces. The header is nowOpen-Policy-Agent/<version> (<os>, <arch>). Server-side log filters or WAF rules thatexact-match the old string will need to be updated.
Authored by @sspaink, reported by @SpecLad
Runtime, SDK, Tooling
file_rego_versionspatterns with overlap (#8733) authored by @philipaconradwithon the closing-bracket line of multi-line expressions (#8804) authored by @anneheartrecord, reported by @burnsterast.Notnodes (#8731) authored by @johanfyllingCompiler, Topdown and Rego
ast.Notexpressions (#8717) authored by @johanfylling, reported by @anderseknertfuture.keywords.notnegation insideevery(#8781) authored by @johanfyllingplan/wasmbundle builds (#8732) authored by @philipaconradobject.get(#8729) authored by @anderseknertevery(#8816) authored by @johanfyllingdst.Compare(src)shortcut (#8739) authored by @srenatusDocs, Website, Ecosystem
Miscellaneous
go-version-filewithactions/setup-go(#8751) authored by @srenatusv1.17.1Compare Source
This release uses the latest version of Go (1.26.4) to build OPA, fixing stdlib vulnerabilities in code that OPA's HTTP handler and crypto builtins use:
It is otherwise the same code as v1.17.0.
Note that users building their own OPA binaries and images already control the Golang version, so this is not relevant for them.
Miscellaneous
v1.17.0Compare Source
This release contains a mix of new features, performance improvements, and bugfixes. Notably:
future.keywords.notimport that adds improved semantics to thenotkeyword.Improved Negation Semantics (#8387)
This OPA release introduces a new
future.keywords.notimportthat fixes a long-standing semantic issue with negation in Rego.
Without the import, the compiler expands a negated composite expression like
not f(g(input.x))into a series of sub-expressions evaluated before thenot:If any sub-expression fails — for example,
input.xis undefined orgproduces an undefined result — the entire rule fails rather than the
notsucceeding.This is unintuitive: the user's intent is "the condition does not hold," but
an undefined intermediate value causes a silent failure instead of the expected
notresult.With
import future.keywords.not, composite-expression negation wraps the full compilerexpansion in an implicit body:
Now, if any sub-expression is undefined or fails, the body is unsatisfiable
and the
notexpression succeeds; matching the intuition that "the condition does not hold."Authored by @johanfylling
Rule Labels in Decision Logs (#2089)
Rule annotations now support a
labelsfield. Labels from all successfully evaluatedrules are collected and included in each decision log entry as a top-level
rule_labelsarray. Each element is the merged label map for one successfully evaluated rule, with
inner-scope-wins precedence across the rule's annotation chain
(
subpackages<package<document<rule). Merged maps are deduplicatedacross rules so that identical label sets collapse to a single entry.
The resulting decision log entry will contain:
{"rule_labels": [{"service": "authz", "severity": "low", "team": "platform"}]}Note how
severity: infofrom the package scope is overridden byseverity: lowfromthe rule scope. Queries against
rule_labelscan now rely on each entry carrying thefull label context for a single rule, rather than one entry per contributing scope.
Both the runtime and the Go SDK now process metadata annotations by default.
Authored by @srenatus, reported by @tsandall
Runtime, SDK, Tooling
$refinallOfin JSON schemas (#6523) authored by @deeglaze reported by @mosiac1Compiler, Topdown and Rego
json.verify_schemaandjson.match_schemabuilt-in functions (#6089) authored by @sspaink reported by @ewout8indexfield inMakeNumberRefStmtIR statement (#6266) authored by @sspaink reported by @johanfyllingGenerateJSONfunction (#8690) authored by @anderseknertDocs, Website, Ecosystem
Miscellaneous
inmem.NewFromASTObjectand add missing string case toast.InternedValue(#8707) authored by @anderseknertgo install->go install toolto control checksums (#8646) authored by @srenatusv1.16.2Compare Source
This release updates the version of Go used to build the OPA binaries and images to 1.26.3;
addressing a number of vulnerabilities.
v1.16.1Compare Source
This is a patch release addressing a regression in the plugin manager that may cause the service to hang on shutdown (#8590).
v1.16.0Compare Source
This release contains a mix of new features, performance improvements, and bugfixes. Notably:
uri.parseanduri.is_validbuilt-in functionsNew
uri.parseanduri.is_validbuilt-in functions (#8263)Two new built-in functions have been added:
uri.parsefor parsing a given URI, anduri.is_validfor verifying the structure of a given URI.uri.parse
Parses a URI and returns an object containing its components according to RFC 3986. Empty components are omitted.
uri.is_valid
Returns
trueif the input can be parsed as a URI,falseotherwise.Authored by @charlieegan3 reported by @anivar
Data API Request/Response Metadata (#8570)
Wrapping projects can now attach custom metadata to Data API requests and have evaluation produce response metadata.
Two distinct metadata paths are introduced:
Request metadata: parsed from extra top-level keys in the request body, made available to builtins via
BuiltinContext.RequestMetadata. Logged in the decision log underCustom["request_metadata"].Response metadata: a separate map (
BuiltinContext.ResponseMetadata) that builtins can populate during evaluation. Only included in the API response and decision log if non-empty.In vanilla OPA, no builtins write response metadata, so responses are unchanged. The request metadata map is only allocated when the request carries extra fields; the response map is one empty map per request.
To avoid conflicts with future OPA top-level keys, callers should use a namespaced key:
{"input": {...}, "com.example.opa/md": {...}}.Request with metadata:
Response (response metadata included if, for example, set by a custom builtin):
{ "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135", "result": true, "com.example.opa/response": { "snapshot_version": "v3" } }Decision log entry:
{ "custom": { "request_metadata": { "com.example.opa/metadata": { "corp-id": "acme-42" } }, "response_metadata": { "com.example.opa/response": { "snapshot_version": "v3" } } }, "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135", "input": { "user": "alice" }, "msg": "Decision Log", "path": "example/allow", "result": true }Authored by @srenatus
Runtime, SDK, Tooling
--coverage(#8438) authored by @grosserwiths in expression (#8508) authored by @anderseknerteverybody (#8558) authored by @johanfyllingopa fmtfrom formatting single attribute objects with comments (#7565) authored by @sspaink reported by @anderseknert*tls.Config(#8473) authored by @srenatus reported by @ashu2496Note: Experimental.
Compiler, Topdown and Rego
-in front of a ref (#5014) authored by @mmzzuu reported by @philipaconradtime.parse_duration_nsbuilt-in function (#2719) authored by @sspaink reported by @freeseachergraph.reachable_pathsto return all reachable paths (#5871) authored by @davidmarne-wf reported by @ericjkaounits.parse_bytesbuilt-in function to prevent timeout bypass (#8326) authored by @isaiahvita reported by @anderseknertDocs, Website, Ecosystem
countandsumbuilt-in functions (#8566) authored by @alliasgher reported by @srenatusnotundefined example (#8580) authored by @menma1234Configuration
📅 Schedule: (UTC)
* 0-3 * * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.