chore(deps): update gomod dependencies - #168
Conversation
|
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
1 similar comment
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThis PR updates Go module versions across AWS, OpenAPI, OpenShift, operator, Prometheus, Kubernetes, logging, and Velero dependencies. It also updates the ChangesGo dependency refresh
Estimated code review effort: 2 (Simple) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 82: The dependency entry uses an invalid Go module version string, so
update the github.com/openshift/api requirement to a valid pseudo-version or
tagged release and make the same correction anywhere the version is referenced
in go.mod; use the existing github.com/openshift/api module entry as the locator
and ensure both require and replace-style references parse correctly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 9f8890e0-3711-46bf-8ea9-d25d97cf6b43
📒 Files selected for processing (1)
go.mod
c4d444f to
eed3448
Compare
|
New changes are detected. LGTM label has been removed. |
eed3448 to
7b2e4f7
Compare
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
go.mod (1)
5-131: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAlign the velero pin in
go.mod:102github.com/vmware-tanzu/velero v1.18.2doesn't containpkg/generated/clientset/versioned, which breaks the import chain pulled in bygithub.com/openshift/osde2e. Bump to a compatible velero release or update the upstream dependency.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 5 - 131, Update the github.com/vmware-tanzu/velero dependency in the go.mod require block to a release that contains pkg/generated/clientset/versioned and is compatible with github.com/openshift/osde2e; preserve the existing dependency alignment and verify the import chain resolves.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@go.mod`:
- Around line 5-131: Update the github.com/vmware-tanzu/velero dependency in the
go.mod require block to a release that contains
pkg/generated/clientset/versioned and is compatible with
github.com/openshift/osde2e; preserve the existing dependency alignment and
verify the import chain resolves.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6f8b9fe1-b738-4e2c-b1a5-a9b24b6448c8
📒 Files selected for processing (1)
go.mod
7b2e4f7 to
d70240f
Compare
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
go.mod (1)
5-138: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winAdd provenance/cosign signing and document the AWS SDK exception
- Tekton already covers SBOM and RPM signature scans, but there’s no provenance/cosign signing step.
github.com/aws/aws-sdk-go v1.55.8is flagged by OSV (GO-2022-0635/0646) and needs an explicit security exception.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 5 - 138, Update the release/build workflow associated with this dependency configuration to add provenance generation and Cosign signing, preserving the existing Tekton SBOM and RPM signature scans. Document an explicit security exception for github.com/aws/aws-sdk-go v1.55.8 covering OSV findings GO-2022-0635 and GO-2022-0646, using the repository’s established exception format.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@go.mod`:
- Around line 5-138: Update the release/build workflow associated with this
dependency configuration to add provenance generation and Cosign signing,
preserving the existing Tekton SBOM and RPM signature scans. Document an
explicit security exception for github.com/aws/aws-sdk-go v1.55.8 covering OSV
findings GO-2022-0635 and GO-2022-0646, using the repository’s established
exception format.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 159a0d81-b35c-43ae-8e2d-752cf49adc8d
📒 Files selected for processing (1)
go.mod
d70240f to
33740c0
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
go.mod (1)
11-26: 🔒 Security & Privacy | 🔵 TrivialAdd SBOM/provenance/signing coverage for this dependency refresh
go.sumandgovulncheckcover part of the supply-chain story, but I don't see SBOM, provenance, or artifact-signing wired into the build/release path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 11 - 26, Add supply-chain coverage for the AWS dependency refresh by wiring SBOM generation, build provenance attestation, and release artifact signing into the existing build/release workflow. Ensure these outputs are produced and verified alongside the refreshed Go dependencies, using the repository’s established CI and artifact symbols rather than adding an unrelated path.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@go.mod`:
- Around line 11-26: Add supply-chain coverage for the AWS dependency refresh by
wiring SBOM generation, build provenance attestation, and release artifact
signing into the existing build/release workflow. Ensure these outputs are
produced and verified alongside the refreshed Go dependencies, using the
repository’s established CI and artifact symbols rather than adding an unrelated
path.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b38f5331-8d3e-401b-b9ab-a658fba4569d
📒 Files selected for processing (1)
go.mod
33740c0 to
14cc0b3
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
go.mod (1)
7-7: 🔒 Security & Privacy | 🔵 TrivialVerify release supply-chain controls before merging.
Confirm that the release pipeline checks license compatibility, generates an SBOM with provenance attestations, and signs release artifacts with Sigstore or cosign.
go.modcannot establish these controls.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` at line 7, Verify the release pipeline configuration rather than relying on go.mod: ensure it checks license compatibility, generates an SBOM with provenance attestations, and signs release artifacts using Sigstore or cosign before merging.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 115: Replace the prerelease google.golang.org/protobuf dependency in
go.mod with the stable tagged v1.36.11 release, then regenerate go.sum so module
checksums match the updated requirement.
---
Nitpick comments:
In `@go.mod`:
- Line 7: Verify the release pipeline configuration rather than relying on
go.mod: ensure it checks license compatibility, generates an SBOM with
provenance attestations, and signs release artifacts using Sigstore or cosign
before merging.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6e3d6fff-96a8-4f08-bbb0-af5b5f46eaaa
📒 Files selected for processing (1)
go.mod
| golang.org/x/time v0.15.0 // indirect | ||
| golang.org/x/tools v0.46.0 // indirect | ||
| golang.org/x/tools v0.48.0 // indirect | ||
| google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Replace the protobuf development version with a stable release.
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af contains a prerelease -0 suffix. The path policy prohibits prerelease production dependencies. Use a stable tagged version or document an approved exception, then regenerate go.sum. Public package metadata lists stable v1.36.11. (pkg.go.dev)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 115, Replace the prerelease google.golang.org/protobuf
dependency in go.mod with the stable tagged v1.36.11 release, then regenerate
go.sum so module checksums match the updated requirement.
Sources: Path instructions, MCP tools
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
14cc0b3 to
cdcf970
Compare
|
@red-hat-konflux[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This PR contains the following updates:
v1.42.0→v1.43.4v1.43.5v1.32.25→v1.32.35v1.32.36v1.19.24→v1.19.34v1.19.35v1.18.29→v1.18.35v1.18.36v1.4.29→v1.4.35v1.4.36v2.7.29→v2.7.35v2.7.36v1.4.30→v1.4.36v1.4.37v1.72.1→v1.76.1v1.76.2v1.307.1→v1.321.0v1.321.1v1.13.12→v1.13.15v1.13.16v1.13.29→v1.13.35v1.13.36v1.2.0→v1.5.4v1.5.5v1.31.3→v1.33.4v1.33.5v1.36.6→v1.38.4v1.38.5v1.43.3→v1.45.4v1.45.5v1.27.2→v1.27.7v1.4.3→v1.4.4v0.23.1→v0.24.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.0v0.26.1→v0.28.07023385→ef3492dv2.31.0→v2.32.0v2.32.1v1.42.0→v1.42.1v0.0.458→v0.0.463v0.0.464v0.0.458→v0.0.463v0.0.464v0.1.503→v0.1.508v0.1.509c5eb460→9d7eaabc5eb460→9d7eaabdf412d4→ddca5e0751e0d2→dcf3e27v0.30.0→v0.45.0v0.22.0→v0.46.0v2.4.0→v2.4.3v0.74.0→v0.93.0v0.93.1v0.74.0→v0.93.0v0.93.1v1.23.2→v1.24.1v0.69.0→v0.70.1v0.20.1→v0.21.1v1.9.3→v1.9.4v1.10.2→v1.18.2v3.0.4→v3.0.5v0.37.0→v0.38.0v0.39.0v0.56.0→v0.57.0v0.58.0v0.21.0→v0.22.0v0.46.0→v0.47.0v0.44.0→v0.45.0v0.38.0→v0.40.0v0.41.0v0.46.0→v0.48.0v0.36.2→v0.36.3v0.36.0→v0.36.3v0.36.2→v0.36.3v0.36.2→v0.36.3bc653b6→d427ff9v0.36.2→v0.36.3a95e086→cf1189dv6.4.0→v6.4.2Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)
v1.43.4General Highlights
Module Highlights
github.com/aws/aws-sdk-go-v2: v1.41.5github.com/aws/aws-sdk-go-v2/service/accessanalyzer: v1.45.12github.com/aws/aws-sdk-go-v2/service/account: v1.30.5github.com/aws/aws-sdk-go-v2/service/acm: v1.37.23github.com/aws/aws-sdk-go-v2/service/acmpca: v1.46.12github.com/aws/aws-sdk-go-v2/service/aiops: v1.6.21github.com/aws/aws-sdk-go-v2/service/amp: v1.42.9github.com/aws/aws-sdk-go-v2/service/amplify: v1.38.14github.com/aws/aws-sdk-go-v2/service/amplifybackend: v1.32.20github.com/aws/aws-sdk-go-v2/service/amplifyuibuilder: v1.28.20github.com/aws/aws-sdk-go-v2/service/apigateway: v1.39.1github.com/aws/aws-sdk-go-v2/service/apigatewaymanagementapi: v1.29.14github.com/aws/aws-sdk-go-v2/service/apigatewayv2: v1.34.1github.com/aws/aws-sdk-go-v2/service/appconfig: v1.43.13github.com/aws/aws-sdk-go-v2/service/appconfigdata: v1.23.22github.com/aws/aws-sdk-go-v2/service/appfabric: v1.16.21github.com/aws/aws-sdk-go-v2/service/appflow: v1.51.12github.com/aws/aws-sdk-go-v2/service/appintegrations: v1.37.7github.com/aws/aws-sdk-go-v2/service/applicationautoscaling: v1.41.14github.com/aws/aws-sdk-go-v2/service/applicationcostprofiler: v1.27.12github.com/aws/aws-sdk-go-v2/service/applicationdiscoveryservice: v1.35.13github.com/aws/aws-sdk-go-v2/service/applicationinsights: v1.34.20github.com/aws/aws-sdk-go-v2/service/applicationsignals: v1.19.1github.com/aws/aws-sdk-go-v2/service/appmesh: v1.35.12github.com/aws/aws-sdk-go-v2/service/apprunner: v1.39.14github.com/aws/aws-sdk-go-v2/service/appstream: v1.54.4github.com/aws/aws-sdk-go-v2/service/appsync: v1.53.5github.com/aws/aws-sdk-go-v2/service/arcregionswitch: v1.6.3github.com/aws/aws-sdk-go-v2/service/arczonalshift: v1.22.23github.com/aws/aws-sdk-go-v2/service/artifact: v1.15.5github.com/aws/aws-sdk-go-v2/service/athena: v1.57.4github.com/aws/aws-sdk-go-v2/service/auditmanager: v1.46.12github.com/aws/aws-sdk-go-v2/service/autoscaling: v1.64.4github.com/aws/aws-sdk-go-v2/service/autoscalingplans: v1.30.14github.com/aws/aws-sdk-go-v2/service/b2bi: v1.0.0-preview.100github.com/aws/aws-sdk-go-v2/service/backup: v1.54.11github.com/aws/aws-sdk-go-v2/service/backupgateway: v1.26.3github.com/aws/aws-sdk-go-v2/service/backupsearch: v1.6.23github.com/aws/aws-sdk-go-v2/service/batch: v1.63.2github.com/aws/aws-sdk-go-v2/service/bcmdashboards: v1.1.4github.com/aws/aws-sdk-go-v2/service/bcmdataexports: v1.14.0github.com/aws/aws-sdk-go-v2/service/bcmpricingcalculator: v1.10.9github.com/aws/aws-sdk-go-v2/service/bcmrecommendedactions: v1.1.5github.com/aws/aws-sdk-go-v2/service/bedrock: v1.57.1github.com/aws/aws-sdk-go-v2/service/bedrockagent: v1.52.7github.com/aws/aws-sdk-go-v2/service/bedrockagentcore: v1.15.2github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol: v1.25.1github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime: v1.51.8github.com/aws/aws-sdk-go-v2/service/bedrockdataautomation: v1.13.5github.com/aws/aws-sdk-go-v2/service/bedrockdataautomationruntime: v1.10.4github.com/aws/aws-sdk-go-v2/service/bedrockruntime: v1.50.4github.com/aws/aws-sdk-go-v2/service/billing: v1.10.4github.com/aws/aws-sdk-go-v2/service/billingconductor: v1.28.5github.com/aws/aws-sdk-go-v2/service/braket: v1.39.8github.com/aws/aws-sdk-go-v2/service/budgets: v1.43.4github.com/aws/aws-sdk-go-v2/service/chatbot: v1.14.21github.com/aws/aws-sdk-go-v2/service/chime: v1.41.12github.com/aws/aws-sdk-go-v2/service/chimesdkidentity: v1.27.20github.com/aws/aws-sdk-go-v2/service/chimesdkmediapipelines: v1.26.21github.com/aws/aws-sdk-go-v2/service/chimesdkmeetings: v1.33.15github.com/aws/aws-sdk-go-v2/service/chimesdkmessaging: v1.32.17github.com/aws/aws-sdk-go-v2/service/chimesdkvoice: v1.28.13github.com/aws/aws-sdk-go-v2/service/cleanrooms: v1.42.4github.com/aws/aws-sdk-go-v2/service/cleanroomsml: v1.22.5github.com/aws/aws-sdk-go-v2/service/cloud9: v1.33.20github.com/aws/aws-sdk-go-v2/service/cloudcontrol: v1.29.13github.com/aws/aws-sdk-go-v2/service/clouddirectory: v1.30.12github.com/aws/aws-sdk-go-v2/service/cloudformation: v1.71.9github.com/aws/aws-sdk-go-v2/service/cloudfront: v1.60.4github.com/aws/aws-sdk-go-v2/service/cloudfrontkeyvaluestore: v1.12.24github.com/aws/aws-sdk-go-v2/service/cloudhsm: v1.29.21github.com/aws/aws-sdk-go-v2/service/cloudhsmv2: v1.34.21github.com/aws/aws-sdk-go-v2/service/cloudsearch: v1.32.12github.com/aws/aws-sdk-go-v2/service/cloudsearchdomain: v1.28.20github.com/aws/aws-sdk-go-v2/service/cloudtrail: v1.55.9github.com/aws/aws-sdk-go-v2/service/cloudtraildata: v1.17.13github.com/aws/aws-sdk-go-v2/service/cloudwatch: v1.55.3github.com/aws/aws-sdk-go-v2/service/cloudwatchevents: v1.32.23github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.65.0github.com/aws/aws-sdk-go-v2/service/codeartifact: v1.38.21github.com/aws/aws-sdk-go-v2/service/codebuild: v1.68.13github.com/aws/aws-sdk-go-v2/service/codecatalyst: v1.21.12github.com/aws/aws-sdk-go-v2/service/codecommit: v1.33.12github.com/aws/aws-sdk-go-v2/service/codeconnections: v1.10.20github.com/aws/aws-sdk-go-v2/service/codedeploy: v1.35.13github.com/aws/aws-sdk-go-v2/service/codeguruprofiler: v1.29.20github.com/aws/aws-sdk-go-v2/service/codegurureviewer: v1.34.20github.com/aws/aws-sdk-go-v2/service/codegurusecurity: v1.16.24github.com/aws/aws-sdk-go-v2/service/codepipeline: v1.46.21github.com/aws/aws-sdk-go-v2/service/codestarconnections: v1.35.13github.com/aws/aws-sdk-go-v2/service/codestarnotifications: v1.31.21github.com/aws/aws-sdk-go-v2/service/cognitoidentity: v1.33.22github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider: v1.59.3github.com/aws/aws-sdk-go-v2/service/cognitosync: v1.29.12github.com/aws/aws-sdk-go-v2/service/comprehend: v1.40.21github.com/aws/aws-sdk-go-v2/service/comprehendmedical: v1.31.21github.com/aws/aws-sdk-go-v2/service/computeoptimizer: v1.49.8github.com/aws/aws-sdk-go-v2/service/computeoptimizerautomation: v1.0.8github.com/aws/aws-sdk-go-v2/service/configservice: v1.62.1github.com/aws/aws-sdk-go-v2/service/connect: v1.166.1github.com/aws/aws-sdk-go-v2/service/connectcampaigns: v1.20.20github.com/aws/aws-sdk-go-v2/service/connectcampaignsv2: v1.11.4github.com/aws/aws-sdk-go-v2/service/connectcases: v1.39.1github.com/aws/aws-sdk-go-v2/service/connectcontactlens: v1.33.13github.com/aws/aws-sdk-go-v2/service/connecthealth: v1.0.3github.com/aws/aws-sdk-go-v2/service/connectparticipant: v1.36.7github.com/aws/aws-sdk-go-v2/service/controlcatalog: v1.14.9github.com/aws/aws-sdk-go-v2/service/controltower: v1.28.9github.com/aws/aws-sdk-go-v2/service/costandusagereportservice: v1.34.13github.com/aws/aws-sdk-go-v2/service/costexplorer: v1.63.6github.com/aws/aws-sdk-go-v2/service/costoptimizationhub: v1.22.8github.com/aws/aws-sdk-go-v2/service/customerprofiles: v1.57.2github.com/aws/aws-sdk-go-v2/service/databasemigrationservice: v1.61.10github.com/aws/aws-sdk-go-v2/service/databrew: v1.39.14github.com/aws/aws-sdk-go-v2/service/dataexchange: v1.40.14Configuration
📅 Schedule: (in timezone UTC)
* 2-4 * * 1-5)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.