Skip to content
This repository has been archived by the owner on May 26, 2023. It is now read-only.

build(deps): Bump github.com/spf13/cobra from 0.0.7 to 1.3.0 #430

Merged
merged 1 commit into from
Feb 18, 2022
Merged

build(deps): Bump github.com/spf13/cobra from 0.0.7 to 1.3.0 #430

merged 1 commit into from
Feb 18, 2022

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 20, 2021 •
edited
Loading

Bumps github.com/spf13/cobra from 0.0.7 to 1.3.0.

Release notes

Sourced from github.com/spf13/cobra's releases.

v1.3.0 - The Fall 2021 release 🍁

Completion fixes & enhancements 💇🏼

In v1.2.0, we introduced a new model for completions. Thanks to everyone for trying it, giving feedback, and providing numerous fixes! Continue to work with the new model as the old one (as noted in code comments) will be deprecated in a coming release.

  • DisableFlagParsing now triggers custom completions for flag names #1161
  • Fixed unbound variables in bash completions causing edge case errors #1321
  • help completion formatting improvements & fixes #1444
  • All completions now follow the help example: short desc are now capitalized and removes extra spacing from long description #1455
  • Typo fixes in bash & zsh completions #1459
  • Fixed mixed tab/spaces indentation in completion scripts. Now just 4 spaces #1473
  • Support for different bash completion options. Bash completions v2 supports descriptions and requires descriptions to be removed for menu-complete, menu-complete-backward and insert-completions. These descriptions are now purposefully removed in support of this model. #1509
  • Fix for invalid shell completions when using ~/.cobra.yaml. Log message Using config file: ~/.cobra.yaml now printed to stderr #1510
  • Removes unnecessary trailing spaces from completion command descriptions #1520
  • Option to hid default completion command #1541
  • Remove __complete command for programs without subcommands #1563

Generator changes ⚙️

Thanks to @​spf13 for providing a number of changes to the Cobra generator tool, streamlining it for new users!

  • The Cobra generator now won't automatically include Viper and cleans up a number of unused imports when not using Viper.
  • The Cobra generator's default license is now none
  • The Cobra generator now works with Go modules
  • Documentation to reflect these changes

New Features ⭐

  • License can be specified by their SPDX identifiers #1159
  • MatchAll allows combining several PositionalArgs to work in concert. This now allows for enabling composing PositionalArgs #896

Bug Fixes 🐛

  • Fixed multiple error message from cobra init boilerplates #1463 #1552 #1557

Testing 👀

  • Now testing golang 1.16.x and 1.17.x in CI #1425
  • Fix for running diff test to ignore CR for windows #949
  • Added helper functions and reduced code reproduction in args_test #1426
  • Now using official golangci-lint github action #1477

Security 🔏

  • Added GitHub dependabot #1427
  • Now using Viper v1.10.0
    • There is a known CVE in an indirect dependency from viper: spf13/cobra#1538. This will be patched in a future release

Documentation 📝

  • Multiple projects added to the projects_using_cobra.md file: #1377 #1501 #1454
  • Removed ToC from main readme file as it is now automagically displayed by GitHub #1429
  • Documentation correct for when the --author flag is specified #1009
  • shell_completions.md has an easier to use snippet for copying and pasting shell completions #1372

... (truncated)

Changelog

Sourced from github.com/spf13/cobra's changelog.

Cobra Changelog

v1.1.3

  • Fix: release-branch.cobra1.1 only: Revert "Deprecate Go < 1.14" to maintain backward compatibility

v1.1.2

Notable Changes

  • Bump license year to 2021 in golden files (#1309) @​Bowbaq
  • Enhance PowerShell completion with custom comp (#1208) @​Luap99
  • Update gopkg.in/yaml.v2 to v2.4.0: The previous breaking change in yaml.v2 v2.3.0 has been reverted, see go-yaml/yaml#670
  • Documentation readability improvements (#1228 etc.) @​zaataylor etc.
  • Use golangci-lint: Repair warnings and errors resulting from linting (#1044) @​umarcor

v1.1.1

  • Fix: yaml.v2 2.3.0 contained a unintended breaking change. This release reverts to yaml.v2 v2.2.8 which has recent critical CVE fixes, but does not have the breaking changes. See spf13/cobra#1259 for context.
  • Fix: correct internal formatting for go-md2man v2 (which caused man page generation to be broken). See spf13/cobra#1049 for context.

v1.1.0

Notable Changes

  • Extend Go completions and revamp zsh comp (#1070)
  • Fix man page doc generation - no auto generated tag when cmd.DisableAutoGenTag = true (#1104) @​jpmcb
  • Add completion for help command (#1136)
  • Complete subcommands when TraverseChildren is set (#1171)
  • Fix stderr printing functions (#894)
  • fix: fish output redirection (#1247)

v1.0.0

Announcing v1.0.0 of Cobra. 🎉

Notable Changes

... (truncated)

Commits
  • 178edbb Bump github.com/spf13/viper from 1.9.0 to 1.10.0 (#1561)
  • 9054739 Remove __complete cmd for program without subcmds (#1563)
  • 19c9c74 Always include the os package import when generating the root command (#1557)
  • 01e05b8 Bump github.com/spf13/viper from 1.8.1 to 1.9.0 (#1554)
  • 36bff0a fix root.go.golden (#1552)
  • 1854bb5 Fix some typos (mostly found by codespell) (#1514)
  • ff2c55e chore(ci): use golangci-lint-action (#1477)
  • 1beb476 fix: Duplicate error message from cobra init boilerplates (#1463)
  • 6f84ef4 Provide option to hide default 'completion' cmd (#1541)
  • ee75a2b Remove trailing spaces from bash completion command description (#1520)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Dec 20, 2021
@dependabot dependabot bot mentioned this pull request Dec 20, 2021
Closed
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/spf13/cobra-1.3.0 branch from f98123e to d076258 Compare January 20, 2022 18:20
@JamesKButcher
Copy link
Contributor

@siggiskulason to investigate please. Quite a significant version jump. Also consider dependencies and footprint

@JamesKButcher JamesKButcher added the hold Intended for PRs we want to flag for ongoing review label Feb 3, 2022
@lenny-goodell
Copy link
Member

Note that if this new minor version jump was bringing in new dependencies we would see them as new indirect entries in the go.mod and the attribution script would flag them.

@siggiskulason
Copy link

I suggest we go ahead with this upgrade:

  1. There are no new dependencies. Some of the indirect dependencies have been updated as per these changes in go.mod:
new old
github.com/spf13/cobra v1.3.0 github.com/spf13/cobra v0.0.7
github.com/spf13/pflag v1.0.5 // indirect github.com/spf13/pflag v1.0.3 // indirect
golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 // golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 // indirect
golang.org/x/sys v0.0.0-20211205182925-97ca703d548d // indirect golang.org/x/sys v0.0.0-20190412213103-97732733099d // indirect
golang.org/x/text v0.3.7 // indirect golang.org/x/text v0.3.2 // indirect

  1. As well as a number of bugfixes, this update contains support for command completion, which was one of the features we wanted to add (as per the ADR). It will therefore enable us to add that feature.

  2. Looking at their version history, they jumped straight from 0.0.7 to 1.0.0 in 2020, so we are replacing an early-2020 version with a late-2021 version.

4 The client is only slighly larger: 10.671.330 vs 10.518.691

Any objections to going ahead, @JamesKButcher / @lenny-intel ?

@JamesKButcher
Copy link
Contributor

Good analysis, thanks @siggiskulason. Looks good to me

@lenny-goodell
Copy link
Member

Any objections to going ahead, @JamesKButcher / @lenny-intel ?

Sounds good!

@lenny-goodell
Copy link
Member

@dependabot recreate

@dependabot
build(deps): Bump github.com/spf13/cobra from 0.0.7 to 1.3.0
b25ef09 
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 0.0.7 to 1.3.0.
- [Release notes](https://github.com/spf13/cobra/releases)
- [Changelog](https://github.com/spf13/cobra/blob/master/CHANGELOG.md)
- [Commits](spf13/cobra@0.0.7...v1.3.0)

---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/spf13/cobra-1.3.0 branch from d076258 to b25ef09 Compare February 16, 2022 21:11
JamesKButcher
JamesKButcher approved these changes Feb 18, 2022
View reviewed changes
Copy link
Contributor

@JamesKButcher JamesKButcher left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@JamesKButcher JamesKButcher merged commit 3761dc7 into main Feb 18, 2022
@dependabot dependabot bot deleted the dependabot/go_modules/github.com/spf13/cobra-1.3.0 branch February 18, 2022 08:22
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@JamesKButcher JamesKButcher JamesKButcher approved these changes

Assignees

@siggiskulason siggiskulason

Labels
dependencies Pull requests that update a dependency file hold Intended for PRs we want to flag for ongoing review
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@JamesKButcher @lenny-goodell @siggiskulason