Skip to content

fix(deps): update go minor and patch dependencies - autoclosed - #96

Closed
red-hat-konflux[bot] wants to merge 1 commit into
masterfrom
konflux/mintmaker/master/go-minor-and-patch-dependencies
Closed

fix(deps): update go minor and patch dependencies - autoclosed#96
red-hat-konflux[bot] wants to merge 1 commit into
masterfrom
konflux/mintmaker/master/go-minor-and-patch-dependencies

Conversation

@red-hat-konflux

@red-hat-konflux red-hat-konflux Bot commented Feb 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
filippo.io/edwards25519 v1.1.0 → v1.2.0 age confidence indirect minor
github.com/getkin/kin-openapi v0.133.0 → v0.139.0 age confidence require minor
github.com/go-chi/chi/v5 v5.2.5 → v5.3.0 age confidence require minor
github.com/go-openapi/jsonpointer v0.22.4 → v0.23.1 age confidence indirect minor
github.com/go-openapi/swag/jsonname v0.25.4 → v0.26.0 age confidence indirect minor
github.com/go-sql-driver/mysql v1.9.3 → v1.10.0 age confidence indirect minor
github.com/jackc/pgx/v5 v5.8.0 → v5.9.2 age confidence indirect minor
github.com/mailru/easyjson v0.9.1 → v0.9.2 age confidence indirect patch
github.com/mattn/go-sqlite3 v1.14.33 → v1.14.44 age confidence indirect patch
github.com/oapi-codegen/oapi-codegen/v2 v2.5.1 → v2.7.0 age confidence require minor
github.com/oapi-codegen/runtime v1.3.1 → v1.4.1 age confidence require minor
github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 → v0.1.0 age confidence require minor
github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 → v0.0.13 age confidence indirect patch
github.com/prometheus/procfs v0.19.2 → v0.20.1 age confidence indirect minor
github.com/redhatinsights/platform-go-middlewares/v2 v2.0.0 → v2.1.0 age confidence require minor
github.com/speakeasy-api/jsonpath v0.6.2 → v0.6.3 age confidence indirect patch
go (source) 1.25.7 → 1.26.3 age confidence toolchain minor
go.yaml.in/yaml/v2 v2.4.3 → v2.4.4 age confidence indirect patch
golang.org/x/crypto v0.47.0 → v0.52.0 age confidence indirect minor
golang.org/x/mod v0.32.0 → v0.36.0 age confidence indirect minor
golang.org/x/sync v0.19.0 → v0.20.0 age confidence indirect minor
golang.org/x/sys v0.40.0 → v0.45.0 age confidence indirect minor
golang.org/x/text v0.33.0 → v0.37.0 age confidence indirect minor
golang.org/x/tools v0.41.0 → v0.45.0 age confidence indirect minor

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

FiloSottile/edwards25519 (filippo.io/edwards25519)

v1.2.0

Compare Source

v1.1.1

Compare Source

getkin/kin-openapi (github.com/getkin/kin-openapi)

v0.139.0

Compare Source

What's Changed

Full Changelog: getkin/kin-openapi@v0.138.0...v0.139.0

v0.138.0

Compare Source

What's Changed

Full Changelog: getkin/kin-openapi@v0.137.0...v0.138.0

v0.137.0

Compare Source

What's Changed

Full Changelog: getkin/kin-openapi@v0.136.0...v0.137.0

v0.136.0

Compare Source

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.135.0...v0.136.0

v0.135.0

Compare Source

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.134.0...v0.135.0

v0.134.0

Compare Source

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.133.0...v0.134.0

go-chi/chi (github.com/go-chi/chi/v5)

v5.3.0

Compare Source

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

@​VojtechVitek submitted PR #​967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:

It also addresses issues outlined at:

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your
infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler

// Read the result.
func GetClientIP(ctx context.Context) string         // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work

Example usage:

// Pick a single ClientIP middleware based on your deployment
  
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))

// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))

// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))

// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
    "13.32.0.0/15",   // CloudFront IPv4
    "52.46.0.0/18",   // CloudFront IPv4
    "2600:9000::/28", // CloudFront IPv6
))

// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))

// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)

And in your handler or downstream middleware:

clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.

Thanks to @​adam-p, @​c2h5oh, @​rezmoss, @​Saku0512, @​convto, @​Dirbaio, @​jawnsy, @​lrstanley, @​mfridman, @​n33pm, @​pkieltyka for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR.

Full Changelog: go-chi/chi@v5.2.5...v5.3.0

go-openapi/jsonpointer (github.com/go-openapi/jsonpointer)

v0.23.1

Compare Source

0.23.1 - 2026-04-18

Full Changelog: go-openapi/jsonpointer@v0.23.0...v0.23.1

5 commits in this release.

Fixed bugs
  • fix(offset): in Offset method, fixed index of value of array element. by @​fredbi in #​128 ...
Documentation
Updates
People who contributed to this release

jsonpointer license terms

License

v0.23.0

Compare Source

0.23.0 - 2026-04-15

Support for known limitations

Full Changelog: go-openapi/jsonpointer@v0.22.5...v0.23.0

16 commits in this release.

Implemented enhancements
Fixed bugs
Documentation
Miscellaneous tasks
Updates
People who contributed to this release
New Contributors

jsonpointer license terms

License

v0.22.5

Compare Source

0.22.5 - 2026-03-02

Full Changelog: go-openapi/jsonpointer@v0.22.4...v0.22.5

15 commits in this release.

Documentation
Code quality
Miscellaneous tasks
Updates
People who contributed to this release
New Contributors

jsonpointer license terms

License

go-openapi/swag (github.com/go-openapi/swag/jsonname)

v0.26.0

Compare Source

0.26.0 - 2026-04-15

Full Changelog: go-openapi/swag@v0.25.5...v0.26.0

14 commits in this release.

Implemented enhancements
  • feat(jsonname): added new json name provider more respectful of go co… by @​fredbi in #​195 ...
Documentation
Code quality
Miscellaneous tasks
Updates
People who contributed to this release

swag license terms

License

Per-module changes
cmdutils (0.26.0)
Miscellaneous tasks
conv (0.26.0)
Miscellaneous tasks
Updates
fileutils (0.26.0)
Miscellaneous tasks
Updates
jsonname (0.26.0)
Implemented enhancements
  • feat(jsonname): added new json name provider more respectful of go co… by @​fredbi in #​195 ...
Miscellaneous tasks
Updates
jsonutils/adapters/easyjson (0.26.0)
Miscellaneous tasks

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@coderabbitai

coderabbitai Bot commented Feb 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

Updated indirect Go module dependencies in go.mod: bumped several golang.org/x/* and other indirect versions (including github.com/mattn/go-sqlite3), and replaced gopkg.in/yaml.v3 with gopkg.in/yaml.v2 (v2.4.3). No changes to exported APIs or direct module declarations. (≤50 words)

Changes

Cohort / File(s) Summary
Go Module Dependencies
go.mod		 Updated indirect dependency versions: github.com/mattn/go-sqlite3 bumped (v1.14.33 → v1.14.34); replaced gopkg.in/yaml.v3 with gopkg.in/yaml.v2 (v2.4.3); bumped golang.org/x/crypto → v0.48.0, golang.org/x/mod → v0.33.0, golang.org/x/sys → v0.41.0, golang.org/x/text → v0.34.0, golang.org/x/tools → v0.42.0; other indirect entries adjusted accordingly.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The PR description lacks critical information required by the repository template, including description of changes, testing instructions, and checklist completion. Add a proper PR description following the template: include the RHCLOUD issue link, testing instructions, reviewer notes, and complete the checklist items.
✅ Passed checks (2 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check ✅ Passed The title accurately summarizes the main change - updating Go minor and patch dependencies in go.mod file.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch konflux/mintmaker/master/go-minor-and-patch-dependencies

Comment @coderabbitai help to get the list of available commands and usage tips.

@red-hat-konflux red-hat-konflux Bot changed the title chore(deps): update module golang.org/x/sys to v0.41.0 chore(deps): update go minor and patch dependencies Feb 9, 2026
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/master/go-minor-and-patch-dependencies branch 2 times, most recently from 0137672 to acaa6f8 Compare February 9, 2026 20:40
coderabbitai[bot]
coderabbitai Bot reviewed Feb 9, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Fix all issues with AI agents 
In `@go.mod`:
- Line 60: Replace the invalid module path "go.yaml.in/yaml/v2" with the correct
"gopkg.in/yaml.v2" or remove the erroneous entry entirely; if your intent was to
upgrade the YAML dependency to v2.4.3, update the existing "gopkg.in/yaml.v2
v2.4.0 // indirect" entry to v2.4.3 and delete the incorrect "go.yaml.in/yaml/v2
v2.4.3 // indirect" line, then run go mod tidy to reconcile and clean up the
go.mod.
- Around line 61-62: The go.mod entry for the module "golang.org/x/text" is
using the non-existent version v0.34.0; update the version string to "v0.33.0"
(replace the "golang.org/x/text v0.34.0" entry with "golang.org/x/text v0.33.0")
and then run a module sync (e.g., go get golang.org/x/text@v0.33.0 and go mod
tidy) so the change is validated and the dependency graph is consistent with the
existing valid versions like golang.org/x/crypto and golang.org/x/mod.

Comment thread go.mod Outdated
Comment thread go.mod Outdated
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/master/go-minor-and-patch-dependencies branch 4 times, most recently from 7f65e65 to e817249 Compare February 11, 2026 17:05
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/master/go-minor-and-patch-dependencies branch from e817249 to 04efb5f Compare February 17, 2026 21:03
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/master/go-minor-and-patch-dependencies branch 2 times, most recently from 654280c to 2ed4a5c Compare February 25, 2026 21:04
@red-hat-konflux red-hat-konflux Bot changed the title chore(deps): update go minor and patch dependencies fix(deps): update go minor and patch dependencies Feb 27, 2026
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/master/go-minor-and-patch-dependencies branch 13 times, most recently from 89609a8 to e22808d Compare March 6, 2026 01:03
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/master/go-minor-and-patch-dependencies branch 4 times, most recently from a98feb7 to aac7900 Compare March 8, 2026 13:22
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/master/go-minor-and-patch-dependencies branch 25 times, most recently from 6a1cb37 to 5150e1b Compare March 22, 2026 01:11
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/master/go-minor-and-patch-dependencies branch 3 times, most recently from 3ffbb17 to 04eda38 Compare March 23, 2026 13:11
@red-hat-konflux

red-hat-konflux Bot commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 2 additional dependencies were updated

Details:

Package Change
github.com/davecgh/go-spew v1.1.1 -> v1.1.2-0.20180830191138-d8f796af33cc
github.com/pmezard/go-difflib v1.0.0 -> v1.0.1-0.20181226105442-5d4384ee4fb2

@red-hat-konflux
fix(deps): update go minor and patch dependencies
7b35374 
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants