chore(deps): update non-k8s-go-dependencies (major)#216
chore(deps): update non-k8s-go-dependencies (major)#216red-hat-konflux[bot] wants to merge 1 commit intomainfrom
Conversation
red-hat-konflux
Bot
added
area/ci-tooling
ok-to-test
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughUpdated Go module dependency declarations in Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 10✅ Passed checks (10 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @red-hat-konflux[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
go.mod (3)
6-6:⚠️ Potential issue | 🔴 CriticalVersion mismatch for external-snapshotter client.
The package
github.com/kubernetes-csi/external-snapshotter/client/v8appears with two different versions:
- Line 6:
v8.2.0(direct dependency)- Line 27:
v8.4.0(indirect dependency)This inconsistency will cause confusion during dependency resolution. Run
go mod tidyto reconcile the versions, or explicitly update the direct dependency to match the intended version.🔧 Recommended fix
require ( - github.com/kubernetes-csi/external-snapshotter/client/v8 v8.2.0 + github.com/kubernetes-csi/external-snapshotter/client/v8 v8.4.0 github.com/onsi/gomega v1.39.0Then run
go mod tidyto clean up the indirect entries.Also applies to: 27-27
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@go.mod` at line 6, The go.mod has a version mismatch for github.com/kubernetes-csi/external-snapshotter/client/v8 (v8.2.0 vs v8.4.0); update the direct dependency line for github.com/kubernetes-csi/external-snapshotter/client/v8 to the intended version (e.g., v8.4.0) or remove the explicit entry, then run `go mod tidy` to reconcile indirect entries and ensure the dependency graph is consistent.
20-20:⚠️ Potential issue | 🟠 MajorRemove or update the unused gopkg.in/evanphx/json-patch.v5 dependency.
Two different import paths for the same json-patch package are listed in go.mod:
- Line 20:
github.com/evanphx/json-patch/v5 v5.9.11- Line 40:
gopkg.in/evanphx/json-patch.v5 v5.9.11The modern path (
github.com/evanphx/json-patch/v5) is actively used in the codebase, but the legacygopkg.inpath is not imported or referenced anywhere. Since both are marked as indirect dependencies, thegopkg.inentry likely comes from older transitive dependencies. Remove this entry or update the transitive dependencies to eliminate the unused import path and reduce unnecessary binary bloat.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@go.mod` at line 20, Remove the legacy gopkg.in import entry from go.mod: identify the indirect dependency line referencing gopkg.in/evanphx/json-patch.v5 v5.9.11 and delete it (or run `go mod tidy` to drop unused transitive entries), ensuring only the modern github.com/evanphx/json-patch/v5 v5.9.11 remains; verify builds and `go list -m all` to confirm the old gopkg.in path is no longer present.
6-6:⚠️ Potential issue | 🟡 MinorAddress the external-snapshotter version conflict between direct and vendored dependencies.
The codebase has a significant version mismatch:
pkg/common/scheme.godirectly importsgithub.com/kubernetes-csi/external-snapshotter/client/v8, while the vendored Velero (v1.2.0 fork) internally usesclient/v7. Both versions are present ingo.sum, creating a potential schema registration conflict when both callAddToScheme()on the same runtime scheme.The other dependencies listed (go.yaml.in/yaml, gomodules.xyz/jsonpatch, go-hclog) are indirect dependencies with no direct usage in the codebase's core logic, making them lower priority.
Ensure that:
- The CustomScheme in
pkg/common/scheme.gocorrectly handles both v7 and v8 volumesnapshot APIs if both are transitively required- If only v8 is intended, verify that the Velero fork has been updated to use v8 or that the v7 import is not needed
- Run integration tests covering snapshot-related operations to confirm there are no schema conflicts
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@go.mod` at line 6, pkg/common/scheme.go currently registers only one snapshot client version which causes conflicts when both v7 and v8 are present; update CustomScheme to explicitly handle both versions by importing the Velero-fork's client/v7 and the direct client/v8 under distinct aliases (e.g., snapshotv7, snapshotv8) and invoke snapshotv7.AddToScheme(CustomScheme) and snapshotv8.AddToScheme(CustomScheme) (or, if the project should only use v8, update the Velero fork/dependency to v8 or remove the v7 import so only snapshotv8.AddToScheme is called); after making the change run integration tests covering snapshot operations to verify no schema registration conflicts remain.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Around line 36-37: The go.mod contains a duplicate indirect requirement for
the module go.yaml.in/yaml/v3 (v3.0.4) — remove one of the identical lines
declaring go.yaml.in/yaml/v3 v3.0.4 and then run `go mod tidy` to re-evaluate
and clean up dependency metadata; look for the duplicate module entry
"go.yaml.in/yaml/v3" in go.mod to locate and delete the redundant line.
---
Outside diff comments:
In `@go.mod`:
- Line 6: The go.mod has a version mismatch for
github.com/kubernetes-csi/external-snapshotter/client/v8 (v8.2.0 vs v8.4.0);
update the direct dependency line for
github.com/kubernetes-csi/external-snapshotter/client/v8 to the intended version
(e.g., v8.4.0) or remove the explicit entry, then run `go mod tidy` to reconcile
indirect entries and ensure the dependency graph is consistent.
- Line 20: Remove the legacy gopkg.in import entry from go.mod: identify the
indirect dependency line referencing gopkg.in/evanphx/json-patch.v5 v5.9.11 and
delete it (or run `go mod tidy` to drop unused transitive entries), ensuring
only the modern github.com/evanphx/json-patch/v5 v5.9.11 remains; verify builds
and `go list -m all` to confirm the old gopkg.in path is no longer present.
- Line 6: pkg/common/scheme.go currently registers only one snapshot client
version which causes conflicts when both v7 and v8 are present; update
CustomScheme to explicitly handle both versions by importing the Velero-fork's
client/v7 and the direct client/v8 under distinct aliases (e.g., snapshotv7,
snapshotv8) and invoke snapshotv7.AddToScheme(CustomScheme) and
snapshotv8.AddToScheme(CustomScheme) (or, if the project should only use v8,
update the Velero fork/dependency to v8 or remove the v7 import so only
snapshotv8.AddToScheme is called); after making the change run integration tests
covering snapshot operations to verify no schema registration conflicts remain.
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||
| go.yaml.in/yaml/v3 v3.0.4 // indirect |
There was a problem hiding this comment.
Remove duplicate entry for go.yaml.in/yaml/v3.
Lines 36 and 37 are identical, both declaring go.yaml.in/yaml/v3 v3.0.4 as an indirect dependency. Remove one of the duplicate entries and run go mod tidy to clean up the file.
🔧 Recommended fix
github.com/x448/float16 v0.8.4 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
- go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/sync v0.19.0 // indirect📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| go.yaml.in/yaml/v3 v3.0.4 // indirect | |
| go.yaml.in/yaml/v3 v3.0.4 // indirect | |
| github.com/x448/float16 v0.8.4 // indirect | |
| go.yaml.in/yaml/v3 v3.0.4 // indirect | |
| golang.org/x/sync v0.19.0 // indirect |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` around lines 36 - 37, The go.mod contains a duplicate indirect
requirement for the module go.yaml.in/yaml/v3 (v3.0.4) — remove one of the
identical lines declaring go.yaml.in/yaml/v3 v3.0.4 and then run `go mod tidy`
to re-evaluate and clean up dependency metadata; look for the duplicate module
entry "go.yaml.in/yaml/v3" in go.mod to locate and delete the redundant line.
b31746b to
b796450
Compare
openshift-ci
Bot
added
the
needs-rebase
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/major-non-k8s-go-dependencies
branch
from
b796450 to
d8fda2e
Compare
openshift-ci
Bot
removed
the
needs-rebase
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/major-non-k8s-go-dependencies
branch
from
d8fda2e to
4b81c97
Compare
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/major-non-k8s-go-dependencies
branch
from
4b81c97 to
faf1787
Compare
|
@red-hat-konflux[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This PR contains the following updates:
v0.14.1→v1.6.3v0.10.2-0.20260323191807-216dd62a1caf→v1.2.0v2.4.3→v3.0.4v2.5.0→v3.0.1v4.13.0→v5.9.11Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
hashicorp/go-hclog (github.com/hashicorp/go-hclog)
v1.6.3: Optional JSON escapingCompare Source
What's Changed
New Contributors
Full Changelog: hashicorp/go-hclog@v1.6.2...v1.6.3
v1.6.2: Fix level syncingCompare Source
What's Changed
Full Changelog: hashicorp/go-hclog@v1.6.1...v1.6.2
v1.6.1: Fix forcing colorCompare Source
What's Changed
Full Changelog: hashicorp/go-hclog@v1.6.0...v1.6.1
v1.6.0: New level inheritance modeCompare Source
This release adds the ability to have sub-loggers arrange themselves into a tree and sync the level changes downward in the tree.
What's Changed
New Contributors
Full Changelog: hashicorp/go-hclog@v1.5.0...v1.6.0
v1.5.0: Better color and sublogger modsCompare Source
What's Changed
New Contributors
Full Changelog: hashicorp/go-hclog@v1.4.0...v1.5.0
v1.4.0: Add GetLevelCompare Source
What it says on the tin, add GetLevel to the Logger interface.
What's Changed
Full Changelog: hashicorp/go-hclog@v1.3.1...v1.4.0
v1.3.1: Improved multi line output renderingCompare Source
What's Changed
Full Changelog: hashicorp/go-hclog@v1.3.0...v1.3.1
v1.3.0: Field ColorizationCompare Source
This version adds the ability to colorize fields for improved readability.
What's Changed
ColorHeaderAndFieldslogger option by @picatz in #118New Contributors
Full Changelog: hashicorp/go-hclog@v1.2.2...v1.3.0
v1.2.2: Minor formatting fixCompare Source
What's Changed
Full Changelog: hashicorp/go-hclog@v1.2.1...v1.2.2
v1.2.1: testify/go.yaml fixCompare Source
This bumps the version of testify and go.yaml that are referenced by go-hclog to fix a security issue in go.yaml.
v1.2.0: More Restrained ColorCompare Source
What's Changed
New Contributors
Full Changelog: hashicorp/go-hclog@v1.1.0...v1.2.0
v1.1.0: Time and Infer improvementsCompare Source
What's Changed
raw=truewhen special casing empty strings by @angrycub in #102InferLevelsWithTimestampoption by @lgfa29 in #101New Contributors
Full Changelog: hashicorp/go-hclog@v0.17...v1.1.0
v1.0.0: Stable ReleaseCompare Source
This release represents the stable API for go-hclog. It is being used across the fleet of HashiCorp projects and tools, as well as across the Go service landscape.
v0.16.2Compare Source
IMPROVEMENTS
BUG FIXES
WARNwhen detecting log levels #94v0.16.1: Add ability to remove wrappers from file:lineCompare Source
v0.16.0: Improve hclogvet and plaintext renderingCompare Source
v0.15.0Compare Source
Off, which provides a level for filtering all output.LoggerOptions.IndependentLevels, allowing sub-loggers to set their level independently from the parent.openshift/velero (github.com/openshift/velero)
v1.2.0Compare Source
v1.1.0Compare Source
yaml/go-yaml (go.yaml.in/yaml/v2)
v3.0.4Compare Source
v3.0.3Compare Source
v3.0.2Compare Source
v3.0.1Compare Source
v3.0.0Compare Source
v2.4.4Compare Source
gomodules/jsonpatch (gomodules.xyz/jsonpatch/v2)
v3.0.1Compare Source
This release uses our forked gomodules/orderedmap library. Our forked version has 2 major changes:
*OrderedMapinstead ofOrderedMapinside nested orderedmaps.v3.0.0Compare Source
This release uses iancoleman/orderedmap to generate predictable patch. This is very useful if the generated patch is checked into a VCS like git.
evanphx/json-patch (gopkg.in/evanphx/json-patch.v4)
v5.9.11Compare Source
What's Changed
Full Changelog: evanphx/json-patch@v5.9.10...v5.9.11
v5.9.10Compare Source
What's Changed
New Contributors
Full Changelog: evanphx/json-patch@v5.9.0...v5.9.10
v5.9.0Compare Source
What's Changed
Full Changelog: evanphx/json-patch@v5.8.1...v5.9.0
v5.8.1: Fix API breakageCompare Source
This PR fixes Operation containing a reference to internal/json and breaking the ability to manually compose one. This restores that ability using a type alias.
Full Changelog: evanphx/json-patch@v5.8.0...v5.8.1
v5.8.0: Blargh Phixs and EmpathyprovementsCompare Source
This release fixes a few stray panics, addresses large number accuracy, and improves performance!
What's Changed
Full Changelog: evanphx/json-patch@v5.7.0...v5.8.0
v5.7.0: The 2023 ReleaseCompare Source
What's Changed
New Contributors
Full Changelog: evanphx/json-patch@v5.6.0...v5.7.0
v5.6.0: Bug fixesCompare Source
What's Changed
New Contributors
Full Changelog: evanphx/json-patch@v5.5.0...v5.6.0
v5.5.0: Better null handlingCompare Source
This incorporates a few fixes related to how nulls are handles in array's and objects.
v5.3.0: Fix zero sized document crashCompare Source
This fixes a crash bug where submitted an empty slice as the document would panic.
v5.2.0Compare Source
v5.1.0Compare Source
v5.0.0: Proper Go modules releaseCompare Source
This release has a proper /v5 directory, unlike the previous releases that did not have a /v4 dir. Thanks to @BenTheElder for getting this sorted out!
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.