fix(deps): update go dependencies - #150
Open
red-hat-konflux[bot] wants to merge 1 commit into
Open
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughUpdated go.mod: bumped toolchain to go1.26.3 and go to 1.25.0, upgraded several direct requires, removed one direct require, and refreshed multiple indirect/transitive dependencies. ChangesDependency Updates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/master/go-deps
branch
from
May 31, 2026 17:35
241f986 to
c87d399
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 12-13: Typecheck failures are caused by a breaking change in
oapi-codegen v2.7.0 that removed/renamed generated types (e.g.,
BaseWidgetDashboardTemplate, WidgetModuleFederationMetadata); regenerate the API
artifacts from your OpenAPI spec using oapi-codegen v2.7.0 (or pin go.mod back
to the previous working oapi-codegen version) and commit the updated generated
files: run your repo's codegen steps for the api package, confirm the generated
files contain the expected type definitions and that any import paths
(github.com/oapi-codegen/runtime) and "Code generated|DO NOT EDIT" markers are
present, then either commit the regenerated files or update go.mod to the
known-compatible oapi-codegen version so the undefined-symbol lint errors are
resolved.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 4eb9a9ac-0b1e-4e4d-8be9-c4e52bbbe07b
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
Comment on lines
+12
to
+13
| github.com/oapi-codegen/oapi-codegen/v2 v2.7.0 | ||
| github.com/oasdiff/yaml v0.1.0 |
There was a problem hiding this comment.
Typecheck is currently broken after the codegen/dependency bump.
golangci-lint reports undefined API symbols (e.g., BaseWidgetDashboardTemplate, WidgetModuleFederationMetadata), which is a merge blocker. Please verify generated API artifacts against oapi-codegen/v2@v2.7.0 and commit regenerated files (or pin back until compatible).
#!/bin/bash
set -euo pipefail
# 1) Confirm whether missing symbols are defined anywhere in tracked Go files.
rg -nP --type=go '\btype\s+BaseWidgetDashboardTemplate\b|\btype\s+WidgetModuleFederationMetadata\b' api -C2 || true
# 2) Inspect generated-file markers and generator versions in API package.
rg -nP --type=go 'Code generated|oapi-codegen|DO NOT EDIT' api -C2 || true
# 3) Check whether runtime package imports still exist in generated code.
rg -nP --type=go '"github\.com/oapi-codegen/runtime' api -C2 || true
# 4) Verify current oapi-codegen config references (if present).
fd -i 'oapi|openapi|swagger|codegen' . | sed -n '1,200p'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 12 - 13, Typecheck failures are caused by a breaking
change in oapi-codegen v2.7.0 that removed/renamed generated types (e.g.,
BaseWidgetDashboardTemplate, WidgetModuleFederationMetadata); regenerate the API
artifacts from your OpenAPI spec using oapi-codegen v2.7.0 (or pin go.mod back
to the previous working oapi-codegen version) and commit the updated generated
files: run your repo's codegen steps for the api package, confirm the generated
files contain the expected type definitions and that any import paths
(github.com/oapi-codegen/runtime) and "Code generated|DO NOT EDIT" markers are
present, then either commit the regenerated files or update go.mod to the
known-compatible oapi-codegen version so the undefined-symbol lint errors are
resolved.
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/master/go-deps
branch
2 times, most recently
from
June 1, 2026 05:44
d25873d to
d92e8de
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
go.mod (1)
3-5: Confirm Go 1.25 language compatibility with toolchain go1.26.3 (and watch for flag/experiment behavior changes)
go 1.25.0is backward-compatible at the language level, andtoolchain go1.26.3is a released version (being newer than thegodirective is valid). Main behavior differences to watch for:
-asan: default leak detection behavior changed (can be adjusted viaASAN_OPTIONS=detect_leaks=0)GOMAXPROCS: default behavior changed (can affect concurrency-sensitive tests)encoding/json:jsonv2changes only apply ifGOEXPERIMENT=jsonv2is enabled🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 3 - 5, The go directive and toolchain mismatch needs explicit confirmation and mitigations: verify that the module's go directive "go 1.25.0" is intentionally using a newer toolchain "toolchain go1.26.3", run the test matrix under the toolchain to catch behavioral deltas (ASAN leak detection, GOMAXPROCS defaults, and jsonv2 experiment), and if necessary document or pin expected behaviors (e.g., set ASAN_OPTIONS, explicit GOMAXPROCS in tests, or enable/disable GOEXPERIMENT=jsonv2) so consumers and CI are aware of the differences; update README or CI configuration accordingly referencing the "go 1.25.0" and "toolchain go1.26.3" directives.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@go.mod`:
- Around line 3-5: The go directive and toolchain mismatch needs explicit
confirmation and mitigations: verify that the module's go directive "go 1.25.0"
is intentionally using a newer toolchain "toolchain go1.26.3", run the test
matrix under the toolchain to catch behavioral deltas (ASAN leak detection,
GOMAXPROCS defaults, and jsonv2 experiment), and if necessary document or pin
expected behaviors (e.g., set ASAN_OPTIONS, explicit GOMAXPROCS in tests, or
enable/disable GOEXPERIMENT=jsonv2) so consumers and CI are aware of the
differences; update README or CI configuration accordingly referencing the "go
1.25.0" and "toolchain go1.26.3" directives.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: d4165d75-cc8c-4f27-8d22-4d17d2e1bb51
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/master/go-deps
branch
3 times, most recently
from
June 2, 2026 09:56
b5c62dd to
6dc6eed
Compare
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/master/go-deps
branch
from
June 2, 2026 19:34
6dc6eed to
0201811
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.1.0→v1.2.0v0.133.0→v0.147.0v5.2.5→v5.3.2v0.22.4→v0.24.0v0.25.4→v0.29.1v1.9.3→v1.10.0v5.8.0→v5.10.0v0.9.1→v0.9.2v1.14.33→v1.14.50v1.1.2→v1.2.0v2.5.1→v2.8.0v1.3.1→v1.7.0v0.0.0-20250309154309-f31be36b4037→v0.1.1v0.0.0-20250309153720-d2182401db90→v0.0.14v1.23.2→v1.24.1v0.67.5→v0.70.1v0.19.2→v0.21.1v2.0.0→v2.1.0v1.9.4→v1.10.1v1.10.2v0.6.2→v0.6.3v1.11.1→v1.12.1v1.4.0→v1.4.11.25.7→1.27.0v2.4.3→v2.4.4v0.47.0→v0.55.0v0.32.0→v0.40.0v0.19.0→v0.22.0v0.40.0→v0.47.0v0.33.0→v0.41.0v0.41.0→v0.49.0v1.36.11→v1.36.12v1.6.0→v1.6.2v1.31.1→v1.31.2Release Notes
FiloSottile/edwards25519 (filippo.io/edwards25519)
v1.2.0Compare Source
v1.1.1Compare Source
getkin/kin-openapi (github.com/getkin/kin-openapi)
v0.147.0Compare Source
What's Changed
New Contributors
Full Changelog: getkin/kin-openapi@v0.146.0...v0.147.0
v0.146.0Compare Source
What's Changed
Full Changelog: getkin/kin-openapi@v0.145.0...v0.146.0
v0.145.0Compare Source
What's Changed
Full Changelog: getkin/kin-openapi@v0.144.0...v0.145.0
v0.144.0Compare Source
What's Changed
New Contributors
Full Changelog: getkin/kin-openapi@v0.143.0...v0.144.0
v0.143.0Compare Source
What's Changed
New Contributors
Full Changelog: getkin/kin-openapi@v0.142.0...v0.143.0
v0.142.0Compare Source
What's Changed
Full Changelog: getkin/kin-openapi@v0.141.0...v0.142.0
v0.141.0Compare Source
What's Changed
New Contributors
Full Changelog: getkin/kin-openapi@v0.140.0...v0.141.0
v0.140.0Compare Source
What's Changed
Full Changelog: getkin/kin-openapi@v0.139.0...v0.140.0
v0.139.0Compare Source
What's Changed
Full Changelog: getkin/kin-openapi@v0.138.0...v0.139.0
v0.138.0Compare Source
What's Changed
Full Changelog: getkin/kin-openapi@v0.137.0...v0.138.0
v0.137.0Compare Source
What's Changed
cc4f8d9by @fenollp in #1161Full Changelog: getkin/kin-openapi@v0.136.0...v0.137.0
v0.136.0Compare Source
What's Changed
New Contributors
Full Changelog: getkin/kin-openapi@v0.135.0...v0.136.0
v0.135.0Compare Source
What's Changed
New Contributors
Full Changelog: getkin/kin-openapi@v0.134.0...v0.135.0
v0.134.0Compare Source
What's Changed
New Contributors
Full Changelog: getkin/kin-openapi@v0.133.0...v0.134.0
go-chi/chi (github.com/go-chi/chi/v5)
v5.3.2Compare Source
What's Changed
middleware.NewCompressor(level, "/*")never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in #868 and #1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.Full Changelog: go-chi/chi@v5.3.1...v5.3.2
v5.3.1Compare Source
What's Changed
New Contributors
Full Changelog: go-chi/chi@v5.3.0...v5.3.1
v5.3.0Compare Source
What's Changed
New Contributors
SECURITY: middleware.ClientIP, a replacement for middleware.RealIP
@VojtechVitek submitted PR #967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:
RemoteAddrresolution (convto)middleware.RealIP(Saku0512, Critical / 9.3)It also addresses issues outlined at:
middleware.RealIPis deprecated in this PR with pointers to the new API.The deprecation only adds a
// Deprecated:doc comment; the function keeps working for backward compatibility.Why a new middleware (not "fix RealIP in place")
RealIPhas two unfixable design choices: it mutatesr.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.The new API
Four middlewares, two accessors. Pick exactly one middleware based on your
infrastructure, read the result with one of the two accessors:
Example usage:
And in your handler or downstream middleware:
Thanks to @adam-p, @c2h5oh, @rezmoss, @Saku0512, @convto, @Dirbaio, @jawnsy, @lrstanley, @mfridman, @n33pm, @pkieltyka for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR.
Full Changelog: go-chi/chi@v5.2.5...v5.3.0
go-openapi/jsonpointer (github.com/go-openapi/jsonpointer)
v0.24.0Compare Source
0.24.0 - 2026-06-29
Full Changelog: go-openapi/jsonpointer@v0.23.2...v0.24.0
17 commits in this release.
Implemented enhancements
Refactor
Documentation
Code quality
Testing
Miscellaneous tasks
Updates
Other (technical)
People who contributed to this release
**[jsonpointer](http
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.