Skip to content

fix(deps): update go dependencies - #454

Open
red-hat-konflux[bot] wants to merge 2 commits into
mainfrom
konflux/mintmaker/main/go-deps
Open

fix(deps): update go dependencies#454
red-hat-konflux[bot] wants to merge 2 commits into
mainfrom
konflux/mintmaker/main/go-deps

Conversation

@red-hat-konflux

@red-hat-konflux red-hat-konflux Bot commented May 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/fsnotify/fsnotify v1.9.0 → v1.10.1 age confidence
github.com/go-chi/chi/v5 v5.2.5 → v5.3.0 age confidence
github.com/go-openapi/jsonpointer v0.22.4 → v0.23.2 age confidence
github.com/go-openapi/swag/jsonname v0.25.4 → v0.26.1 age confidence
github.com/go-sql-driver/mysql v1.9.3 → v1.10.0 age confidence
github.com/jackc/pgx/v5 v5.9.2 → v5.10.0 age confidence
github.com/mattn/go-sqlite3 v1.14.42 → v1.14.47 age confidence
github.com/oapi-codegen/oapi-codegen/v2 v2.6.0 → v2.7.1 age confidence
github.com/oapi-codegen/runtime v1.4.0 → v1.4.2 age confidence
github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 → v0.1.1 age confidence
github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 → v0.0.14 age confidence
github.com/onsi/gomega v1.39.1 → v1.42.1 age confidence
github.com/prometheus/common v0.67.5 → v0.69.0 age confidence
github.com/speakeasy-api/jsonpath v0.6.2 → v0.6.3 age confidence
github.com/speakeasy-api/openapi-overlay v0.10.2 → v0.10.3 age confidence
golang.org/x/crypto v0.50.0 → v0.53.0 age confidence
golang.org/x/mod v0.35.0 → v0.37.0 age confidence
golang.org/x/sync v0.20.0 → v0.21.0 age confidence
golang.org/x/sys v0.43.0 → v0.46.0 age confidence
golang.org/x/text v0.36.0 → v0.38.0 age confidence
golang.org/x/tools v0.44.0 → v0.47.0 age confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

fsnotify/fsnotify (github.com/fsnotify/fsnotify)

v1.10.1

Compare Source

Changes and fixes

  • inotify: don't remove sibling watches sharing a path prefix (#​754)

  • inotify, windows: don't rename sibling watches sharing a path prefix
    (#​755)

v1.10.0

Compare Source

This version of fsnotify needs Go 1.23.

Changes and fixes

  • inotify: improve initialization error message (#​731)

  • inotify: send Rename event if recursive watch is renamed (#​696)

  • inotify: avoid copying event buffers when reading names (#​741)

  • kqueue: skip dangling symlinks (ENOENT) in watchDirectoryFiles, so a bad entry no longer aborts Watcher.Add for the whole directory (#​748)

  • kqueue: drop watches directly in Close() to fix a file descriptor leak when recycling watchers (#​740)

  • windows: fix nil pointer dereference in remWatch (#​736)

  • windows: lock watch field updates against concurrent WatchList to fix a race introduced in v1.9.0 (#​709, #​749)

go-chi/chi (github.com/go-chi/chi/v5)

v5.3.0

Compare Source

What's Changed

New Contributors

SECURITY: middleware.ClientIP, a replacement for middleware.RealIP

@​VojtechVitek submitted PR #​967, which introduces middleware.ClientIP — a replacement for middleware.RealIP that closes the three open spoofing advisories:

It also addresses issues outlined at:

middleware.RealIP is deprecated in this PR with pointers to the new API.

The deprecation only adds a // Deprecated: doc comment; the function keeps working for backward compatibility.

Why a new middleware (not "fix RealIP in place")

RealIP has two unfixable design choices: it mutates r.RemoteAddr, and it tries to be a one-size-fits-all default by walking a hard-coded list of headers any client can supply. Per adam-p's "The perils of the 'real' client IP" (which calls chi out by name on this), there is no safe default — the user must pick their trust source explicitly.

The new API

Four middlewares, two accessors. Pick exactly one middleware based on your
infrastructure, read the result with one of the two accessors:

// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler

// Read the result.
func GetClientIP(ctx context.Context) string         // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work

Example usage:

// Pick a single ClientIP middleware based on your deployment
  
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))

// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))

// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))

// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
    "13.32.0.0/15",   // CloudFront IPv4
    "52.46.0.0/18",   // CloudFront IPv4
    "2600:9000::/28", // CloudFront IPv6
))

// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))

// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)

And in your handler or downstream middleware:

clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.

Thanks to @​adam-p, @​c2h5oh, @​rezmoss, @​Saku0512, @​convto, @​Dirbaio, @​jawnsy, @​lrstanley, @​mfridman, @​n33pm, @​pkieltyka for the prior discussions, detailed reviews, advisory reports, and test contributions that shaped this PR.

Full Changelog: go-chi/chi@v5.2.5...v5.3.0

go-openapi/jsonpointer (github.com/go-openapi/jsonpointer)

v0.23.2

Compare Source

0.23.2 - 2026-06-26

Full Changelog: go-openapi/jsonpointer@v0.23.1...v0.23.2

13 commits in this release.

Implemented enhancements
  • feat(ci): added shared workflow for bot-pr monitoring by @​fredbi ...
Documentation
Miscellaneous tasks
Updates
People who contributed to this release

jsonpointer license terms

License

v0.23.1

Compare Source

0.23.1 - 2026-04-18

Full Changelog: go-openapi/jsonpointer@v0.23.0...v0.23.1

5 commits in this release.

Fixed bugs
  • fix(offset): in Offset method, fixed index of value of array element. by @​fredbi in #​128 ...
Documentation
Updates
People who contributed to this release

jsonpointer license terms

License

v0.23.0

Compare Source

0.23.0 - 2026-04-15

Support for known limitations

Full Changelog: go-openapi/jsonpointer@v0.22.5...v0.23.0

16 commits in this release.

Implemented enhancements
Fixed bugs
Documentation
Miscellaneous tasks
Updates
People who contributed to this release
New Contributors

jsonpointer license terms

License

v0.22.5

Compare Source

0.22.5 - 2026-03-02

Full Changelog: go-openapi/jsonpointer@v0.22.4...v0.22.5

15 commits in this release.

Documentation
Code quality
Miscellaneous tasks
Updates
People who contributed to this release
New Contributors

jsonpointer license terms

License

go-openapi/swag (github.com/go-openapi/swag/jsonname)

v0.26.1

Compare Source

0.26.1 - 2026-06-07

Full Changelog: go-openapi/swag@v0.26.0...v0.26.1

12 commits in this release.

Implemented enhancements
  • feat(loading): sandbox local loading with WithRoot (GHSA-v2xp-g8xf-22pf) by @​fredbi in #​203 ...
  • feat(ci): added shared workflow for bot-pr monitoring by @​fredbi ...
Documentation
Miscellaneous tasks
Security
Updates
People who contributed to this release

swag license terms

License

Per-module changes

conv (0.26.1)

Miscellaneous tasks
Updates

fileutils (0.26.1)

Updates

jsonname (0.26.1)

Updates

jsonutils/adapters/easyjson (0.26.1)

Miscellaneous tasks
Updates

jsonutils/adapters/testintegration/benchmarks (0.26.1)

Miscellaneous tasks
Updates

jsonutils/adapters/testintegration (0.26.1)

Miscellaneous tasks
Updates

jsonutils/fixtures_test (0.26.1)

Updates

jsonutils (0.26.1)

Miscellaneous tasks
Updates

loading (0.26.1)

Implemented enhancements
  • feat(loading): sandbox local loading with WithRoot (GHSA-v2xp-g8xf-22pf) by @​fredbi in #​203 ...
Miscellaneous tasks
Security
Updates

mangling (0.26.1)

Updates

netutils (0.26.1)

Updates

stringutils (0.26.1)

Updates

typeutils (0.26.1)

Updates

yamlutils (0.26.1)

Miscellaneous tasks
Updates

v0.26.0

Compare Source

0.26.0 - 2026-04-15

Full Changelog: go-openapi/swag@v0.25.5...v0.26.0

14 commits in this release.

Implemented enhancements
  • feat(jsonname): added new json name provider more respectful of go co… by @​fredbi in #​195 ...
Documentation

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux

red-hat-konflux Bot commented May 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -t ./...
go: downloading github.com/go-chi/chi/v5 v5.3.0
go: downloading github.com/prometheus/common v0.69.0
go: downloading golang.org/x/sys v0.46.0
go: downloading github.com/jackc/pgx/v5 v5.10.0
go: downloading github.com/mattn/go-sqlite3 v1.14.47
go: downloading golang.org/x/text v0.38.0
go: downloading github.com/go-sql-driver/mysql v1.10.0
go: downloading golang.org/x/sync v0.21.0
go: github.com/RedHatInsights/quickstarts imports
	github.com/RedHatInsights/quickstarts/pkg/generated: cannot find module providing package github.com/RedHatInsights/quickstarts/pkg/generated
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands
File name: go.mod
Post-upgrade command 'make generate' has not been added to the allowed list in allowedCommands

@coderabbitai

coderabbitai Bot commented May 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Walkthrough

Updated the Go toolchain directive to go 1.26.3, bumped direct modules (github.com/go-chi/chi/v5, github.com/oapi-codegen/oapi-codegen/v2, github.com/oapi-codegen/runtime) and refreshed several indirect/transitive dependencies in go.mod.

Changes

Dependency Version Updates

Layer / File(s) Summary
Go module dependency versions
go.mod		 Updated Go directive to go 1.26.3; bumped direct dependencies github.com/go-chi/chi/v5, github.com/oapi-codegen/oapi-codegen/v2, and github.com/oapi-codegen/runtime. Also refreshed multiple indirect/transitive dependencies (fsnotify, go-openapi helpers, MySQL/SQLite drivers, oasdiff/yaml packages, gomega, Speakeasy helpers, and various golang.org/x/* modules).

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The PR body is Renovate-generated and does not follow the required template, missing the Description, testing, checklist, and AI disclosure sections. Add the repository template sections with a brief change summary, linked RHCLOUD ticket, local test steps, reviewer notes, checklist items, and AI disclosure.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title 'fix(deps): update go dependencies' directly describes the main changeset—a routine dependency update—matching the summary and objectives perfectly.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch konflux/mintmaker/main/go-deps

Comment @coderabbitai help to get the list of available commands.

coderabbitai[bot]
coderabbitai Bot reviewed May 26, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
go.mod (1)

62-67: ⚡ Quick win

Security advisories for indirect golang.org/x deps (go.mod lines 62-67)

  • golang.org/x/crypto v0.52.0: includes security fixes released May 21, 2026 (SSH-related panics, certificate restriction bypass, and DoS issues).
  • golang.org/x/sys v0.45.0: includes the May 21, 2026 fix for CVE-2026-39824 (Windows integer overflow).
  • golang.org/x/text v0.37.0: no specific issue indicated for this version in the surfaced advisory info; still not the newest release, so bumping to the latest x/text is recommended.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 62 - 67, Update the indirect golang.org/x modules to
patched releases: bump golang.org/x/crypto and golang.org/x/sys to the versions
that include the May 21, 2026 security fixes and update golang.org/x/text to the
latest release; edit the go.mod entries for golang.org/x/crypto,
golang.org/x/sys, and golang.org/x/text accordingly, then refresh dependencies
(update modules and run tidy) and verify go.sum, run the test/build pipeline to
ensure no regressions.
🤖 Prompt for all review comments with AI agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@go.mod`:
- Around line 62-67: Update the indirect golang.org/x modules to patched
releases: bump golang.org/x/crypto and golang.org/x/sys to the versions that
include the May 21, 2026 security fixes and update golang.org/x/text to the
latest release; edit the go.mod entries for golang.org/x/crypto,
golang.org/x/sys, and golang.org/x/text accordingly, then refresh dependencies
(update modules and run tidy) and verify go.sum, run the test/build pipeline to
ensure no regressions.
ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 498d19f4-da61-42b8-8d3c-e2bec6ed83c0

📥 Commits

Reviewing files that changed from the base of the PR and between 8585343 and e8f490155f39640402e22e244ada9919cc28a225.

📒 Files selected for processing (1)
  • go.mod

@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch 3 times, most recently from 2606c54 to 1716735 Compare May 28, 2026 14:23
@coderabbitai

coderabbitai Bot commented May 28, 2026

Copy link
Copy Markdown

Actionable comments posted: 0

@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch from 1716735 to 182f8e0 Compare May 28, 2026 17:54
@coderabbitai

coderabbitai Bot commented May 28, 2026

Copy link
Copy Markdown

Actionable comments posted: 0

@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch 4 times, most recently from e4d038e to ef39afe Compare May 29, 2026 10:03
@red-hat-konflux
fix(deps): update go dependencies
5c13174 
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main/go-deps branch from ef39afe to 5c13174 Compare May 29, 2026 13:40
@red-hat-konflux

red-hat-konflux Bot commented Jun 29, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@karelhala