chore(deps): update go indirect dependencies - #75
Conversation
ℹ️ Artifact update noticeFile name: components/api-server/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: components/control-plane/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: scripts/cli-generator/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: scripts/openapi-ir/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
File name: scripts/sdk-generator/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
3928b0f to
94a47cc
Compare
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
94a47cc to
2ff746e
Compare
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Amber reviewStatus: Complete VerdictCOMMENT — low-risk automated dependency bump, no HyperShell convention violations found. This PR only touches Hi, Amber here. This is a Konflux/mintmaker What I verified
Findings (all Minor)
Cross-PR coordinationI listed and compared all other open PRs in
No material conflict. These overlaps are ordinary Full open PR list reviewed: #216, #214, #212, #211, #210, #209, #208, #207, #206, #201, #200, #194, #189, #188, #185, #182, #179, #151, #150, #148, #135, #109, #73. Findings Summary (ordered by severity, highest first)
Convention Checklist
Rollback: this is a self-contained dependency bump — reverting the merge commit fully restores the prior module graph. |
jsell-rh
left a comment
jsell-rh
left a comment
There was a problem hiding this comment.
Verdict
COMMENT — low-risk automated dependency bump, no HyperShell convention violations found. This PR only touches go.mod/go.sum across the Go modules; the changes are internally consistent (each new version has matching h1:/go.mod go.sum entries) and the one indirect→direct reclassification is legitimate. A couple of minor cross-module/version-hygiene items are worth confirming, and it must not merge until CI (build, vet, test, test-integration, lint) is green, since no Go toolchain is available to validate locally.
Hi, Amber here. This is a Konflux/mintmaker chore(deps) PR bumping Go module dependencies across api-server, control-plane, cli, and the scripts/* generator modules. I reviewed it as a dependency change: correctness of the module graph, direct/indirect classification, version consistency across modules, and supply-chain sanity. All bumped packages are well-known upstream deps; nothing suspicious was introduced.
What I verified
go.sumintegrity: spot-checked the new pins (prometheus/client_golang v1.24.1,go.opentelemetry.io/otel v1.45.0, theprotobufpseudo-version) — each has bothh1:and/go.modhash lines. Consistent.- indirect→direct reclassification is correct:
github.com/prometheus/client_golangmoved into the directrequireblock incomponents/api-server/go.mod. That matches the real direct import incomponents/api-server/plugins/gateways/metrics.go:7, sogo mod tidydid the right thing. Not a concern. - No
go/toolchaindirective changes, no code changes, no manifest/image changes.
Findings (all Minor)
-
[Minor] PR title says "indirect" but the change also bumps direct deps. Besides indirect deps, this bumps direct requires (
google.golang.org/grpc 1.82.1→1.83.0,gorm.io/gorm 1.31.1→1.31.2, OTel core1.44.0→1.45.0) and promotesprometheus/client_golangand (in control-plane)google.golang.org/protobufto direct. The title is slightly inaccurate; harmless but worth noting so reviewers don't assume it's indirect-only. -
[Minor] Mixed OpenTelemetry module versions in
components/api-server/go.mod. Core/metric/trace/sdk are atv1.45.0andotelhttpatv0.70.0, but the OTLP gRPC exporters (otlpmetricgrpc,otlptracegrpc) remain atv1.44.0. OTel exporters generally track the core release; MVS will resolve upward, but please confirm CI actually compiles the exporter code paths againstotel v1.45.0before merge. Confidence: Medium. -
[Minor]
control-planepinsgoogle.golang.org/protobufto an unreleased pseudo-version (v1.36.12-0.20260120151049-f2248ac996af) whileapi-serverstays on the releasedv1.36.11. Depending on an untagged commit is unusual for a mintmaker bump and creates cross-module drift. Prefer a released tag for reproducibility unless a specific fix requires the pseudo-version. Confidence: Medium.
Cross-PR coordination
I listed and compared all other open PRs in openshift-online/hypershell. Only two touch the same dependency files:
- #182
fix(auth): enforce management API JWT audience— editscomponents/api-server/go.mod/go.sum(bumpsrh-trex-aiand addscharmbracelet/*deps). - #194
feat(control-plane): adopt upstream OpenShell Helm chart— editscomponents/control-plane/go.mod(promotessigs.k8s.io/yamlto direct).
No material conflict. These overlaps are ordinary go.mod/go.sum edits with distinct goals; they do not represent competing designs, duplicate solutions, or incompatible assumptions with #75. The only coordination need is routine: whichever of #75/#182/#194 merges second on a shared module will need a go mod tidy/go mod verify re-run to reconcile go.sum. That is normal maintenance, not a design decision. #207 (feat: reconcile-to-request trace correlation) uses OTel APIs but does not modify any go.mod, so it inherits whatever OTel version lands and does not compete with the bump here. All other open PRs (UI, docs/specs, e2e, kind/dev, container-image bump #73) touch disjoint files.
Full open PR list reviewed: #216, #214, #212, #211, #210, #209, #208, #207, #206, #201, #200, #194, #189, #188, #185, #182, #179, #151, #150, #148, #135, #109, #73.
Findings Summary (ordered by severity, highest first)
- [Minor] PR title says "indirect" but direct deps are also bumped/reclassified — Commit/PR hygiene (go.mod L12, L18, L25)
- [Minor] Mixed OTel versions: core/metric at v1.45.0, OTLP exporters left at v1.44.0 — Dependency consistency (components/api-server/go.mod L19–L21)
- [Minor] control-plane pins
protobufto an unreleased pseudo-version while api-server uses a release — Dependency consistency/reproducibility (components/control-plane/go.mod L8)
Convention Checklist
| Convention | Result |
|---|---|
| Conventional commit message | Pass |
go.sum hashes present & consistent for new pins |
Pass |
| indirect/direct classification matches actual imports | Pass |
| Image references consistent across stack | N/A (no image/manifest changes) |
| Build/tests validated | Deferred to CI (no Go toolchain available locally) |
Rollback: this is a self-contained dependency bump — reverting the merge commit fully restores the prior module graph.
| github.com/gorilla/mux v1.7.3 | ||
| github.com/onsi/gomega v1.27.1 | ||
| github.com/openshift-online/rh-trex-ai v0.0.32-0.20260819203335-5798cb607fcb | ||
| github.com/prometheus/client_golang v1.24.1 |
There was a problem hiding this comment.
prometheus/client_golang is (correctly) promoted from indirect to a direct require here — it's directly imported at components/api-server/plugins/gateways/metrics.go:7, so go mod tidy did the right thing. Just noting the PR title ("indirect dependencies") understates that this touches direct requires too.
| go.opentelemetry.io/otel v1.44.0 | ||
| go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 | ||
| go.opentelemetry.io/otel v1.45.0 | ||
| go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0 |
There was a problem hiding this comment.
OTel version skew: core/metric/trace/sdk are bumped to v1.45.0 (and otelhttp to v0.70.0) but these OTLP gRPC exporters stay at v1.44.0. Exporters normally track the core release; MVS will resolve upward, but please confirm CI compiles the exporter paths against otel v1.45.0 before merge. (Minor, Confidence: Medium)
| github.com/openshift-online/hypershell/components/api-server v0.0.0-00010101000000-000000000000 | ||
| google.golang.org/grpc v1.82.1 | ||
| google.golang.org/grpc v1.83.0 | ||
| google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af |
There was a problem hiding this comment.
google.golang.org/protobuf is pinned to an unreleased pseudo-version (v1.36.12-0.2026...) here, while components/api-server/go.mod stays on the released v1.36.11. Depending on an untagged commit is unusual for a mintmaker bump and creates cross-module drift — prefer a released tag for reproducibility unless a specific fix requires it. (Minor, Confidence: Medium)
1 participant
This PR contains the following updates:
d185dfc→faa5f7bv1.1.0→v1.5.4v3.2.0→v3.8.1v4.2.1→v4.3.0v2.8.1+incompatible→v2.8.3+incompatiblev0.6.0→v0.8.1v1.18.0→v1.19.0v1.0.4→v1.1.0v0.135.0→v0.146.0v0.147.0v1.4.3→v1.4.4v1.2.6→v1.3.0v0.21.0→v0.24.0v0.23.1→v0.24.0v0.21.5→v0.21.6v0.23.0→v0.28.0v0.29.1(+1)v0.26.0→v0.28.0v0.29.1(+1)v0.26.0→v0.28.0v0.29.1(+1)v0.26.0→v0.28.0v0.29.1(+1)v0.26.0→v0.28.0v0.29.1(+1)v0.26.0→v0.28.0v0.29.1(+1)v0.26.0→v0.28.0v0.29.1(+1)v0.26.0→v0.28.0v0.29.1(+1)v0.26.0→v0.28.0v0.29.1(+1)v0.26.0→v0.28.0v0.29.1(+1)v0.26.0→v0.28.0v0.29.1(+1)v0.26.0→v0.28.0v0.29.1(+1)v0.26.0→v0.28.0v0.29.1(+1)v1.4.2→v1.5.2v2.29.0→v2.30.0v1.0.0→v1.1.0v5.6.0→v5.10.0v0.4.27→v0.4.28v0.9.3→v0.9.8v1.18.0→v1.19.2v0.1.2→v0.1.3v1.0.0→v1.0.1v2.2.1→v2.2.2v1.1.0→v1.1.1v1.0.0→v1.0.1v1.0.0→v1.0.1v2.3.5→v2.3.6v1.10.9→v1.12.3v1.4.0→v1.4.139d0f17→341c2f0v1.8.10→v1.18.11v0.7.7→v0.9.2v0.1.13→v0.1.15v0.1.14→v0.1.15v0.0.22→v0.0.24v0.0.20→v0.0.24v0.0.24→v0.0.27v0.0.28v0.1.0→v0.3.3v0.6.0→v0.6.1v0.6.0→v0.7.0v0.4.0→v0.4.1v0.5.0→v0.5.2v1.0.0→v1.1.0v0.0.9→v0.1.1v0.0.9→v0.0.145aafc22→8845660v1.16.0→v1.24.1v0.3.0→v0.6.2v0.42.0→v0.70.1v0.10.1→v0.21.1v3.23.12→v3.24.5v0.1.6→v0.2.2v1.9.3→v1.9.4v1.10.1(+1)v0.0.5→v0.0.7v0.33.0→v0.44.0v0.33.0→v0.44.0v0.3.12→v0.4.0v0.6.1→v0.12.0v1.3.0→v1.4.0v1.4.1v1.44.0→v1.45.0v3.0.4→v3.0.5v0.37.0→v0.38.0v0.40.0(+1)v0.21.0→v0.22.0v0.46.0→v0.47.0v0.29.0→v0.47.0v0.44.0→v0.45.0v0.38.0→v0.40.0v0.41.0v1.6.0→v1.6.228399d8→cf1189dv6.4.0→v6.4.2Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
Masterminds/squirrel (github.com/Masterminds/squirrel)
v1.5.4Compare Source
What's Changed
New Contributors
Full Changelog: Masterminds/squirrel@v1.5.3...v1.5.4
v1.5.3Compare Source
v1.5.2: Fix placeholder generation for And/OrCompare Source
What's Changed
v1.5.1Compare Source
What's Changed
New Contributors
Full Changelog: Masterminds/squirrel@v1.5.0...v1.5.1
v1.5.0Compare Source
InnerJoinandCrossJoinmethodsUpdate.Setvaluesv1.4.0Compare Source
Test fix and StatementBuilder.Where
v1.3.0Compare Source
v1.2.0Compare Source
bxcodec/faker (github.com/bxcodec/faker/v3)
v3.8.1: Deprecating v3 moduleCompare Source
Full Changelog: bxcodec/faker@v3.8.0...v3.8.1
v3.8.0Compare Source
What's Changed
New Contributors
Full Changelog: bxcodec/faker@v3.7.0...v3.8.0
v3.7.0Compare Source
What's Changed
for rangeblock by @eval-exec in #151New Contributors
Full Changelog: bxcodec/faker@v3.6.0...v3.7.0
v3.6.0Compare Source
Features
Chores
v3.5.0Compare Source
Features
Fixes
v3.4.0Compare Source
Features
Fixes
v3.3.1Compare Source
Fixes
Chores
v3.3.0Compare Source
Features
Chores
cenkalti/backoff (github.com/cenkalti/backoff/v4)
v4.3.0Compare Source
docker/distribution (github.com/docker/distribution)
v2.8.3+incompatibleCompare Source
v2.8.2+incompatibleCompare Source
docker/go-connections (github.com/docker/go-connections)
v0.8.1Compare Source
v0.8.0Compare Source
v0.7.0Compare Source
fatih/color (github.com/fatih/color)
v1.19.0Compare Source
What's Changed
Fprint,Fprintfby @qualidafial in #282New Contributors
Full Changelog: fatih/color@v1.18.0...v1.19.0
felixge/httpsnoop (github.com/felixge/httpsnoop)
v1.1.0Compare Source
getkin/kin-openapi (github.com/getkin/kin-openapi)
v0.146.0Compare Source
What's Changed
Full Changelog: getkin/kin-openapi@v0.145.0...v0.146.0
v0.145.0Compare Source
What's Changed
Full Changelog: getkin/kin-openapi@v0.144.0...v0.145.0
v0.144.0Compare Source
What's Changed
New Contributors
Full Changelog: getkin/kin-openapi@v0.143.0...v0.144.0
v0.143.0Compare Source
What's Changed
New Contributors
Full Changelog: getkin/kin-openapi@v0.142.0...v0.143.0
v0.142.0Compare Source
What's Changed
Full Changelog: getkin/kin-openapi@v0.141.0...v0.142.0
v0.141.0[Compare Source]
Configuration
📅 Schedule: (in timezone America/New_York)
* 0-7 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.