Update go modules (main) (patch)#1686
Conversation
ℹ️ Artifact update noticeFile name: acceptance/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
Codecov Report✅ All modified and coverable lines are covered by tests. 🚀 New features to boost your workflow:
|
renovate
Bot
force-pushed
the
renovate/main-patch-go-modules
branch
from
cca90ca to
4a2c267
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/main-patch-go-modules
branch
from
4a2c267 to
d09fee6
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/main-patch-go-modules
branch
from
d09fee6 to
201288b
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/main-patch-go-modules
branch
from
201288b to
7067591
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/main-patch-go-modules
branch
5 times, most recently
from
8a6ccc5 to
a132df5
Compare
renovate
Bot
force-pushed
the
renovate/main-patch-go-modules
branch
from
a132df5 to
23a5b44
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/main-patch-go-modules
branch
from
23a5b44 to
9a8f12b
Compare
renovate
Bot
force-pushed
the
renovate/main-patch-go-modules
branch
from
9a8f12b to
46eef9b
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/main-patch-go-modules
branch
from
46eef9b to
321f66d
Compare
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| go 1.25.3 | ||
|
|
||
| toolchain go1.25.7 | ||
| go 1.25.8 |
There was a problem hiding this comment.
[low] version-inconsistency
The acceptance module Go directive changes from go 1.25.3 (with toolchain go1.25.7) to go 1.25.8, while the root module uses go 1.25.5. Verify CI toolchain version is >= 1.25.8.
|
|
||
| require ( | ||
| github.com/conforma/cli v0.9.2 | ||
| github.com/conforma/cli v0.9.42 |
There was a problem hiding this comment.
[low] large-version-jump
conforma/cli jumps from v0.9.2 to v0.9.42 (40 minor versions). While semver v0.x allows breaking changes at any minor bump, the Renovate label classifies this as patch. Any API breakage would surface at build time once go.sum is regenerated.
| github.com/open-policy-agent/regal v0.37.0 | ||
| github.com/tektoncd/cli v0.42.1 | ||
| oras.land/oras v1.3.0 | ||
| github.com/tektoncd/cli v0.42.2 |
There was a problem hiding this comment.
[info] CVE-remediation
The tektoncd/cli v0.42.2 update addresses CVE-2026-33186, CVE-2026-33810, CVE-2025-61729, and CVE-2025-61726. This is a positive security change.
|
🤖 Finished Review · ✅ Success · Started 6:15 PM UTC · Completed 6:27 PM UTC |
|
🤖 Finished Review · ✅ Success · Started 9:29 PM UTC · Completed 9:36 PM UTC |
|
|
||
| require ( | ||
| github.com/conforma/cli v0.9.2 | ||
| github.com/conforma/cli v0.9.44 |
There was a problem hiding this comment.
[low] api-contract
The conforma/cli dependency jumps from v0.9.2 to v0.9.44. The codebase uses blank imports of github.com/conforma/cli, github.com/conforma/cli/cmd/validate, and github.com/conforma/cli/cmd for side-effect registration. If any of these packages were removed or renamed, the build would fail. However, this is a Renovate-generated PR and build failures would be caught by CI.
Suggested fix: Verify that CI passes (build + acceptance tests) before merging.
| go 1.25.3 | ||
|
|
||
| toolchain go1.25.7 | ||
| go 1.25.8 |
There was a problem hiding this comment.
[info] edge-case
The acceptance/go.mod changes from go 1.25.3 (toolchain go1.25.7) to go 1.25.8, while the root go.mod uses go 1.25.5. The acceptance module now requires a newer Go version than the root module. This is standard practice for multi-module Go repos.
| github.com/open-policy-agent/regal v0.37.0 | ||
| github.com/tektoncd/cli v0.42.1 | ||
| oras.land/oras v1.3.0 | ||
| github.com/tektoncd/cli v0.42.2 |
There was a problem hiding this comment.
[info] dependency-update
tektoncd/cli updated from v0.42.1 to v0.42.2, reportedly addressing CVE-2026-33186, CVE-2026-33810, CVE-2025-61729, and CVE-2025-61726. This is a positive security improvement.
|
🤖 Finished Review · ✅ Success · Started 2:56 PM UTC · Completed 3:02 PM UTC |
|
🤖 Finished Review · ✅ Success · Started 8:14 PM UTC · Completed 8:22 PM UTC |
|
🤖 Finished Review · ✅ Success · Started 2:02 AM UTC · Completed 2:07 AM UTC |
|
🤖 Finished Review · ✅ Success · Started 2:23 PM UTC · Completed 2:31 PM UTC |
| go 1.25.3 | ||
|
|
||
| toolchain go1.25.7 | ||
| go 1.25.8 |
There was a problem hiding this comment.
[low] version-consistency
The acceptance module will declare go 1.25.8 while the root go.mod remains at go 1.25.5. These are separate Go modules and Go 1.21+ automatically downloads the required toolchain version, so this will not cause build failures in practice.
| github.com/conforma/cli v0.9.2 | ||
| github.com/conforma/cli v0.9.46 | ||
| github.com/cucumber/godog v0.15.1 | ||
| ) |
There was a problem hiding this comment.
[low] version-skew
Both modules update conforma/cli from v0.9.2 to v0.9.46 (a 44-patch-version jump). The versions are consistent across modules, but the large jump increases the surface area for behavioral changes.
|
🤖 Finished Review · ✅ Success · Started 5:10 PM UTC · Completed 5:17 PM UTC |
|
🤖 Finished Review · ✅ Success · Started 1:50 AM UTC · Completed 1:57 AM UTC |
|
|
||
| toolchain go1.25.7 | ||
| go 1.25.8 | ||
|
|
There was a problem hiding this comment.
[low] api-contract
The go directive changes from go 1.25.3 (with toolchain go1.25.7) to go 1.25.8 (no separate toolchain line). This tightens the minimum Go version requirement for the acceptance tests from 1.25.3 to 1.25.8.
|
🤖 Finished Review · ✅ Success · Started 1:22 PM UTC · Completed 1:31 PM UTC |
|
🤖 Finished Review · ✅ Success · Started 4:02 PM UTC · Completed 4:09 PM UTC |
|
🤖 Finished Review · ✅ Success · Started 4:36 PM UTC · Completed 4:41 PM UTC |
|
🤖 Finished Review · ✅ Success · Started 2:54 AM UTC · Completed 3:02 AM UTC |
|
🤖 Finished Review · ✅ Success · Started 2:35 PM UTC · Completed 2:44 PM UTC |
| github.com/tufanbarisyildirim/gonginx v0.0.0-20260220081509-8e17ce617db3 // indirect | ||
| github.com/ulikunitz/xz v0.5.15 // indirect | ||
| github.com/valyala/fastjson v1.6.4 // indirect | ||
| github.com/valyala/fastjson v1.6.7 // indirect |
There was a problem hiding this comment.
[low] dependency version skew
The acceptance module tektoncd/pipeline transitive dependency jumps from v0.70.0 to v1.12.0, while the root module has tektoncd/pipeline at v1.3.1. This version skew between separate Go modules is a normal consequence of independent dependency resolution and poses minimal practical risk.
|
🤖 Finished Review · ✅ Success · Started 7:20 PM UTC · Completed 7:27 PM UTC |
|
🤖 Finished Review · ✅ Success · Started 1:08 AM UTC · Completed 1:21 AM UTC |
|
|
||
| require ( | ||
| github.com/conforma/cli v0.9.2 | ||
| github.com/conforma/cli v0.9.50 |
There was a problem hiding this comment.
[high] missing artifact
The PR updates direct dependencies in the root go.mod (conforma/cli v0.9.2 -> v0.9.50, tektoncd/cli v0.42.1 -> v0.42.2, oras.land/oras v1.3.0 -> v1.3.2) but does not include the root go.sum file in the changeset. When go.mod dependency versions change, go.sum must be regenerated to include the new checksums. The all-tests-and-checks CI check is currently failing, which corroborates this issue.
Suggested fix: Run go mod tidy in the repository root to regenerate go.sum and include it in the PR.
| go 1.25.3 | ||
|
|
||
| toolchain go1.25.7 | ||
| go 1.26.3 |
There was a problem hiding this comment.
[medium] version inconsistency
The PR changes acceptance/go.mod Go version from 1.25.3 to 1.26.3 and removes the toolchain directive, while root go.mod remains at 1.25.5. This introduces Go minor version skew between modules and changes toolchain auto-download behavior.
| github.com/conforma/cli v0.9.2 | ||
| github.com/conforma/cli v0.9.50 | ||
| github.com/cucumber/godog v0.15.1 | ||
| ) |
There was a problem hiding this comment.
[low] API contract risk
conforma/cli is bumped from v0.9.2 to v0.9.50, a jump of 48 minor versions. v0.9.x semver allows breaking changes (major version 0). Both repos appear maintained by the same organization, reducing risk, but the magnitude warrants verification.
This PR contains the following updates:
v0.9.2→v0.9.50v0.20.7-0.20251103083939-3459088e4bae→v0.20.7v0.42.1→v0.42.2v1.3.0→v1.3.2Release Notes
conforma/cli (github.com/conforma/cli)
v0.9.50Compare Source
v0.9.49Compare Source
v0.9.48Compare Source
v0.9.47Compare Source
v0.9.46Compare Source
v0.9.44Compare Source
v0.9.43Compare Source
v0.9.42Compare Source
v0.9.41Compare Source
v0.9.40Compare Source
v0.9.39Compare Source
v0.9.38Compare Source
v0.9.37Compare Source
v0.9.36Compare Source
v0.9.35Compare Source
v0.9.34Compare Source
v0.9.33Compare Source
v0.9.32Compare Source
v0.9.31Compare Source
v0.9.30Compare Source
v0.9.29Compare Source
v0.9.27Compare Source
v0.9.26Compare Source
v0.9.25Compare Source
v0.9.24Compare Source
v0.9.23Compare Source
v0.9.22Compare Source
v0.9.19Compare Source
v0.9.17Compare Source
v0.9.16Compare Source
v0.9.14Compare Source
v0.9.13Compare Source
v0.9.9Compare Source
conforma/go-containerregistry (github.com/conforma/go-containerregistry)
v0.20.7Compare Source
tektoncd/cli (github.com/tektoncd/cli)
v0.42.2Compare Source
v0.42.2 Release 🎉
This patch release addresses the following CVEs: CVE-2026-33186, CVE-2026-33810, CVE-2025-61729 and CVE-2025-61726.
Changelog
1e1782fNew version v0.42.2Full Changelog: tektoncd/cli@v0.42.1...v0.42.2
Configuration
📅 Schedule: (UTC)
* 0-3 * * *)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.