build(deps): bump the misc-dependencies group across 1 directory with 7 updates - #8845
build(deps): bump the misc-dependencies group across 1 directory with 7 updates#8845dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
area/ci-tooling
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
📝 WalkthroughWalkthrough
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 3: The module version is being used to pin the compiler instead of just
the local toolchain. Update the go directive in go.mod to the language version
and add a toolchain directive for go1.25.8 so consumers are not forced to
require that exact patch release; keep the change localized to the module
directives only.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: a11ae631-544c-4be9-b1fc-91cb6c78cf1e
⛔ Files ignored due to path filters (16)
go.sumis excluded by!**/*.sumvendor/github.com/googleapis/enterprise-certificate-proxy/client/client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/googleapis/enterprise-certificate-proxy/client/util/util.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/api/v3/version/version.gois excluded by!vendor/**,!**/vendor/**vendor/go.etcd.io/etcd/server/v3/etcdserver/api/membership/cluster.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/compute/v1/compute-api.jsonis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/compute/v1/compute-gen.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/compute/v1/compute2-gen.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/compute/v1/compute3-gen.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/internal/version.gois excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/storage/v1/storage-api.jsonis excluded by!vendor/**,!**/vendor/**vendor/google.golang.org/api/storage/v1/storage-gen.gois excluded by!vendor/**,!**/vendor/**vendor/gopkg.in/ini.v1/key.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/core/v1/types.gois excluded by!vendor/**,!**/vendor/**vendor/kubevirt.io/api/core/v1/types_swagger_generated.gois excluded by!vendor/**,!**/vendor/**vendor/modules.txtis excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (1)
go.mod
| module github.com/openshift/hypershift | ||
|
|
||
| go 1.25.7 | ||
| go 1.25.8 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# List Go version/toolchain declarations to confirm whether 1.25.8 is intended
# as a minimum requirement or only as a toolchain hint.
rg -n --hidden --glob '!**/.git/**' '^\s*(go|toolchain)\s+' .Repository: openshift/hypershift
Length of output: 50377
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod (top) =="
cat -n go.mod | sed -n '1,20p'
echo
echo "== go.mod directives =="
rg -n '^\s*(module|go|toolchain)\s+' go.mod
echo
echo "== other go.mod/go.work files =="
fd -a 'go.mod|go.work' .Repository: openshift/hypershift
Length of output: 5097
🌐 Web query:
Go module go directive patch version syntax toolchain directive semantics go.mod go 1.25.8
💡 Result:
In Go modules, the go directive and toolchain directive in go.mod serve distinct purposes regarding language semantics and toolchain management [1][2]. Go Directive The go directive declares the minimum version of Go required to compile the module [3][2]. Its syntax is a language version (e.g., 1.25) [4][5]. While it can technically accept a patch version (e.g., 1.25.8), doing so is generally discouraged unless a specific patch release is strictly required to build the code [6][7]. Setting the directive to a patch version (like 1.25.8) mandates that anyone consuming your module must also use at least that specific Go patch release, which creates unnecessary dependency churn for users [7]. It is recommended to use the major.minor language version (e.g., go 1.25) to maintain wider compatibility while still signaling the required language feature set [6][7]. Toolchain Directive The toolchain directive allows you to specify a preferred Go toolchain version to use when working within that module (e.g., toolchain go1.25.8) [1][2]. Unlike the go directive, the toolchain directive does not impose a requirement on consuming modules; it only dictates the toolchain used by the go command when operating locally in that module [1][2]. This is the appropriate mechanism for pinning a specific patch release or toolchain version for development or security purposes without forcing that requirement onto others [1][7]. Summary of Semantics - Go Directive (go 1.25): Defines the minimum Go language semantics and standard library features required by the module [3][4][1]. It enforces a hard requirement on all consumers [1]. - Toolchain Directive (toolchain go1.25.8): Defines the preferred Go toolchain to execute the go commands [1][2]. It is local to the module and does not impact consumers [1][2]. If no toolchain directive is present, the Go toolchain defaults to the version implied by the go directive (or a newer version if available and compatible) [2][8].
Citations:
- 1: https://go.dev/blog/toolchain
- 2: https://go.dev/doc/toolchain
- 3: https://go.dev/doc/modules/gomod-ref
- 4: https://go.dev/ref/mod
- 5: Should the
godirective ingo.moda semver version (including patch), or not? golang/go#68971 - 6: cmd/go: decide and document official recommendation for typical 'go' version in go.mod for open source libraries golang/go#77830
- 7: go directive in go.mod shouldn't be bumped to every patch version external-secrets/external-secrets#6478
- 8: https://stackoverflow.com/questions/77969574/why-does-the-toolchain-directive-have-no-effect-in-this-case
Use toolchain go1.25.8 if this only pins the compiler
go 1.25.8 raises the module’s required Go version for consumers. If the intent is just to select Go 1.25.8 locally, use toolchain go1.25.8 and keep go at the language version (for example go 1.25).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 3, The module version is being used to pin the compiler
instead of just the local toolchain. Update the go directive in go.mod to the
language version and add a toolchain directive for go1.25.8 so consumers are not
forced to require that exact patch release; keep the change localized to the
module directives only.
… 7 updates Bumps the misc-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [go.etcd.io/etcd/api/v3](https://github.com/etcd-io/etcd) | `3.6.11` | `3.6.12` | | [go.etcd.io/etcd/client/pkg/v3](https://github.com/etcd-io/etcd) | `3.6.11` | `3.6.12` | | [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.6.11` | `3.6.12` | | [go.etcd.io/etcd/server/v3](https://github.com/etcd-io/etcd) | `3.6.11` | `3.6.12` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.280.0` | `0.286.0` | | gopkg.in/ini.v1 | `1.67.2` | `1.67.3` | | [kubevirt.io/api](https://github.com/kubevirt/api) | `1.8.2` | `1.8.4` | Updates `go.etcd.io/etcd/api/v3` from 3.6.11 to 3.6.12 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.11...v3.6.12) Updates `go.etcd.io/etcd/client/pkg/v3` from 3.6.11 to 3.6.12 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.11...v3.6.12) Updates `go.etcd.io/etcd/client/v3` from 3.6.11 to 3.6.12 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.11...v3.6.12) Updates `go.etcd.io/etcd/server/v3` from 3.6.11 to 3.6.12 - [Release notes](https://github.com/etcd-io/etcd/releases) - [Commits](etcd-io/etcd@v3.6.11...v3.6.12) Updates `google.golang.org/api` from 0.280.0 to 0.286.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.280.0...v0.286.0) Updates `gopkg.in/ini.v1` from 1.67.2 to 1.67.3 Updates `kubevirt.io/api` from 1.8.2 to 1.8.4 - [Commits](kubevirt/api@v1.8.2...v1.8.4) --- updated-dependencies: - dependency-name: go.etcd.io/etcd/api/v3 dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: misc-dependencies - dependency-name: go.etcd.io/etcd/client/pkg/v3 dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: misc-dependencies - dependency-name: go.etcd.io/etcd/client/v3 dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: misc-dependencies - dependency-name: go.etcd.io/etcd/server/v3 dependency-version: 3.6.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: misc-dependencies - dependency-name: google.golang.org/api dependency-version: 0.286.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: misc-dependencies - dependency-name: gopkg.in/ini.v1 dependency-version: 1.67.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: misc-dependencies - dependency-name: kubevirt.io/api dependency-version: 1.8.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: misc-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
e9ec830 to
e1eea7a
Compare
|
@dependabot[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
This confirms everything. The workflow runs Test Failure Analysis CompleteJob Information
Test Failure AnalysisErrorSummaryThe Dependabot PR bumps 7 dependencies (including Root CauseThe Dependabot automated PR only updates Specifically, three files are out of date:
This is a well-known limitation of Dependabot: it handles Go module version updates and vendoring but has no mechanism to run project-specific code generation steps. Recommendations
Evidence
|
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
Bumps the misc-dependencies group with 7 updates in the / directory:
3.6.113.6.123.6.113.6.123.6.113.6.123.6.113.6.120.280.00.286.01.67.21.67.31.8.21.8.4Updates
go.etcd.io/etcd/api/v3from 3.6.11 to 3.6.12Release notes
Sourced from go.etcd.io/etcd/api/v3's releases.
... (truncated)
Commits
90b034aversion: bump up to 3.6.128b95963Merge pull request #21811 from Deln0r/release-3.6-backport-21666576a6a0server: allow non-admin maintenance status2286051Merge pull request #21794 from vivekpatani/cherry-pick-21788-release-3.6e1468c8client/pkg/fileutil: use os.Getuid() to skip TestIsDirWriteable as rootaaf38f8Merge pull request #21768 from silentred/release-3.6-etcdutl-invalid-datadir449e34betcdutl: validate data file path and return consistent errors instead of pani...00e1b15Merge pull request #21736 from silentred/release-3.6-bugfix-memberupdate-learner49cd4a4bugfix: MemberUpdate implicitly and unexpectedly promotes a learner9bbe31bMerge pull request #21727 from silentred/release-3.6-bump-go-1.25.10Updates
go.etcd.io/etcd/client/pkg/v3from 3.6.11 to 3.6.12Release notes
Sourced from go.etcd.io/etcd/client/pkg/v3's releases.
... (truncated)
Commits
90b034aversion: bump up to 3.6.128b95963Merge pull request #21811 from Deln0r/release-3.6-backport-21666576a6a0server: allow non-admin maintenance status2286051Merge pull request #21794 from vivekpatani/cherry-pick-21788-release-3.6e1468c8client/pkg/fileutil: use os.Getuid() to skip TestIsDirWriteable as rootaaf38f8Merge pull request #21768 from silentred/release-3.6-etcdutl-invalid-datadir449e34betcdutl: validate data file path and return consistent errors instead of pani...00e1b15Merge pull request #21736 from silentred/release-3.6-bugfix-memberupdate-learner49cd4a4bugfix: MemberUpdate implicitly and unexpectedly promotes a learner9bbe31bMerge pull request #21727 from silentred/release-3.6-bump-go-1.25.10Updates
go.etcd.io/etcd/client/v3from 3.6.11 to 3.6.12Release notes
Sourced from go.etcd.io/etcd/client/v3's releases.
... (truncated)
Commits
90b034aversion: bump up to 3.6.128b95963Merge pull request #21811 from Deln0r/release-3.6-backport-21666576a6a0server: allow non-admin maintenance status2286051Merge pull request #21794 from vivekpatani/cherry-pick-21788-release-3.6e1468c8client/pkg/fileutil: use os.Getuid() to skip TestIsDirWriteable as rootaaf38f8Merge pull request #21768 from silentred/release-3.6-etcdutl-invalid-datadir449e34betcdutl: validate data file path and return consistent errors instead of pani...00e1b15Merge pull request #21736 from silentred/release-3.6-bugfix-memberupdate-learner49cd4a4bugfix: MemberUpdate implicitly and unexpectedly promotes a learner9bbe31bMerge pull request #21727 from silentred/release-3.6-bump-go-1.25.10Updates
go.etcd.io/etcd/server/v3from 3.6.11 to 3.6.12Release notes
Sourced from go.etcd.io/etcd/server/v3's releases.
... (truncated)
Commits
90b034aversion: bump up to 3.6.128b95963Merge pull request #21811 from Deln0r/release-3.6-backport-21666576a6a0server: allow non-admin maintenance status2286051Merge pull request #21794 from vivekpatani/cherry-pick-21788-release-3.6e1468c8client/pkg/fileutil: use os.Getuid() to skip TestIsDirWriteable as rootaaf38f8Merge pull request #21768 from silentred/release-3.6-etcdutl-invalid-datadir449e34betcdutl: validate data file path and return consistent errors instead of pani...00e1b15Merge pull request #21736 from silentred/release-3.6-bugfix-memberupdate-learner49cd4a4bugfix: MemberUpdate implicitly and unexpectedly promotes a learner9bbe31bMerge pull request #21727 from silentred/release-3.6-bump-go-1.25.10Updates
google.golang.org/apifrom 0.280.0 to 0.286.0Release notes
Sourced from google.golang.org/api's releases.
... (truncated)
Changelog
Sourced from google.golang.org/api's changelog.
... (truncated)
Commits
94e4ed9chore(main): release 0.286.0 (#3630)36081a0feat(all): auto-regenerate discovery clients (#3634)7332dd7feat(all): auto-regenerate discovery clients (#3632)b3bb97ffeat(all): auto-regenerate discovery clients (#3631)f25a08bfeat(all): auto-regenerate discovery clients (#3629)182ae99chore(main): release 0.285.0 (#3619)894cccbfeat(all): auto-regenerate discovery clients (#3628)50adeddchore(all): update all (#3625)4f1d165feat(all): auto-regenerate discovery clients (#3626)72b6788feat(all): auto-regenerate discovery clients (#3624)Updates
gopkg.in/ini.v1from 1.67.2 to 1.67.3Updates
kubevirt.io/apifrom 1.8.2 to 1.8.4Commits
fc8ca82api update by KubeVirt Prow build 2066871946104016896ec26de2api update by KubeVirt Prow build 206603955474950144027928bcapi update by KubeVirt Prow build 20656845200650444802d80ceaapi update by KubeVirt Prow build 2064037317160472576f36b99eapi update by KubeVirt Prow build 2063712055399026688a4642edapi update by KubeVirt Prow build 20627457905849835520caa345api update by KubeVirt Prow build 2061878141000880128c4dd9d7api update by KubeVirt Prow build 2060395502003818496fb8eea3api update by KubeVirt Prow build 20568974584656732166520563api update by KubeVirt Prow build 2053965266877943808Summary by CodeRabbit