Conversation
|
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
Contributor
📝 WalkthroughWalkthroughMultiple Go module files were updated to adjust dependency versions and requirements. Several indirect dependencies were upgraded to newer patch versions across various modules. Some direct dependencies were removed or moved to indirect status, and minor formatting changes such as added trailing newlines were made. No changes affected exported or public entities. Changes
Possibly related PRs
Suggested reviewers
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Contributor
|
Thank you for following the naming conventions for pull request titles! 🙏 |
ogzhanolguncu
approved these changes
Jul 17, 2025
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
⛔ Files ignored due to path filters (4)
go/deploy/assetmanagerd/go.sumis excluded by!**/*.sumgo/deploy/billaged/go.sumis excluded by!**/*.sumgo/deploy/builderd/go.sumis excluded by!**/*.sumgo/deploy/metald/go.sumis excluded by!**/*.sum
📒 Files selected for processing (5)
go/deploy/assetmanagerd/go.mod(1 hunks)go/deploy/billaged/go.mod(2 hunks)go/deploy/builderd/go.mod(3 hunks)go/deploy/metald/go.mod(2 hunks)go/go.mod(1 hunks)
🧰 Additional context used
🧠 Learnings (6)
📓 Common learnings
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/{assetmanagerd,billaged,builderd,metald}/**/*.go : When a service's `*.go` code changes significantly, increase the patch-level version number.
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/**/*.{go,js,ts,tsx,py,sh,md,txt,json,yaml,yml,ini,rb,java,c,cpp,h,cs,rs,php,html,css,scss,xml} : Update relevant anchors when modifying associated code.
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/**/*.{go,js,ts,tsx,py,sh,md,txt,json,yaml,yml,ini,rb,java,c,cpp,h,cs,rs,php,html,css,scss,xml} : Make sure to add relevant anchor comments whenever a file or piece of code is too complex, very important, confusing, or could have a bug.
Learnt from: chronark
PR: unkeyed/unkey#3560
File: go/deploy/metald/internal/database/repository.go:0-0
Timestamp: 2025-07-15T14:59:30.212Z
Learning: go/deploy/metald cannot currently import helpers from go/pkg/db because it is not yet part of the main Go module; avoid suggesting such imports until the modules are unified.
go/go.mod (3)
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/{assetmanagerd,billaged,builderd,metald}/**/*.go : When a service's `*.go` code changes significantly, increase the patch-level version number.
Learnt from: chronark
PR: unkeyed/unkey#3560
File: go/deploy/metald/internal/database/repository.go:0-0
Timestamp: 2025-07-15T14:59:30.212Z
Learning: go/deploy/metald cannot currently import helpers from go/pkg/db because it is not yet part of the main Go module; avoid suggesting such imports until the modules are unified.
Learnt from: Flo4604
PR: unkeyed/unkey#3606
File: go/pkg/prometheus/metrics/database.go:29-30
Timestamp: 2025-07-16T10:06:35.397Z
Learning: In Go packages, variables defined in one file within a package (like `latencyBuckets` and `constLabels` in go/pkg/prometheus/metrics/http.go) are accessible from other files in the same package without requiring imports. This is a common pattern for sharing configuration across multiple files within a package.
go/deploy/assetmanagerd/go.mod (7)
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/{assetmanagerd,billaged,builderd,metald}/**/*.go : When a service's `*.go` code changes significantly, increase the patch-level version number.
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/{assetmanagerd,billaged,builderd,metald}/**/Makefile : Never use `go build` for any of the `assetmanagerd`, `billaged`, `builderd`, `metald` binaries.
Learnt from: chronark
PR: unkeyed/unkey#3560
File: go/deploy/metald/internal/database/repository.go:0-0
Timestamp: 2025-07-15T14:59:30.212Z
Learning: go/deploy/metald cannot currently import helpers from go/pkg/db because it is not yet part of the main Go module; avoid suggesting such imports until the modules are unified.
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/{assetmanagerd,billaged,builderd,metald}/**/Makefile : Use `make build` to test that the binary builds.
Learnt from: ogzhanolguncu
PR: unkeyed/unkey#3564
File: go/cmd/cli/commands/deploy/flags.go:17-20
Timestamp: 2025-07-15T14:45:18.920Z
Learning: In the go/cmd/cli/commands/deploy/ directory, ogzhanolguncu prefers to keep potentially temporary features (like UNKEY_DOCKER_REGISTRY environment variable) undocumented in help text if they might be deleted in the future, to avoid documentation churn.
Learnt from: chronark
PR: unkeyed/unkey#3420
File: go/pkg/hydra/store/gorm/gorm.go:486-498
Timestamp: 2025-07-02T11:51:58.572Z
Learning: The Hydra package (go/pkg/hydra) is planned to be migrated from GORM to sqlc for database operations, which explains why raw SQL queries are acceptable in the current implementation.
Learnt from: Flo4604
PR: unkeyed/unkey#3606
File: go/pkg/prometheus/metrics/database.go:29-30
Timestamp: 2025-07-16T10:06:35.397Z
Learning: In Go packages, variables defined in one file within a package (like `latencyBuckets` and `constLabels` in go/pkg/prometheus/metrics/http.go) are accessible from other files in the same package without requiring imports. This is a common pattern for sharing configuration across multiple files within a package.
go/deploy/metald/go.mod (4)
Learnt from: chronark
PR: unkeyed/unkey#3560
File: go/deploy/metald/internal/database/repository.go:0-0
Timestamp: 2025-07-15T14:59:30.212Z
Learning: go/deploy/metald cannot currently import helpers from go/pkg/db because it is not yet part of the main Go module; avoid suggesting such imports until the modules are unified.
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/{assetmanagerd,billaged,builderd,metald}/**/*.go : When a service's `*.go` code changes significantly, increase the patch-level version number.
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/**/*.{go,js,ts,tsx,py,sh,md,txt,json,yaml,yml,ini,rb,java,c,cpp,h,cs,rs,php,html,css,scss,xml} : Update relevant anchors when modifying associated code.
Learnt from: Flo4604
PR: unkeyed/unkey#3606
File: go/pkg/prometheus/metrics/database.go:29-30
Timestamp: 2025-07-16T10:06:35.397Z
Learning: In Go packages, variables defined in one file within a package (like `latencyBuckets` and `constLabels` in go/pkg/prometheus/metrics/http.go) are accessible from other files in the same package without requiring imports. This is a common pattern for sharing configuration across multiple files within a package.
go/deploy/billaged/go.mod (5)
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/{assetmanagerd,billaged,builderd,metald}/**/*.go : When a service's `*.go` code changes significantly, increase the patch-level version number.
Learnt from: chronark
PR: unkeyed/unkey#3560
File: go/deploy/metald/internal/database/repository.go:0-0
Timestamp: 2025-07-15T14:59:30.212Z
Learning: go/deploy/metald cannot currently import helpers from go/pkg/db because it is not yet part of the main Go module; avoid suggesting such imports until the modules are unified.
Learnt from: ogzhanolguncu
PR: unkeyed/unkey#3564
File: go/cmd/cli/commands/deploy/flags.go:17-20
Timestamp: 2025-07-15T14:45:18.920Z
Learning: In the go/cmd/cli/commands/deploy/ directory, ogzhanolguncu prefers to keep potentially temporary features (like UNKEY_DOCKER_REGISTRY environment variable) undocumented in help text if they might be deleted in the future, to avoid documentation churn.
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/**/Makefile : Global makefile should be `Makefile` at the root.
Learnt from: ogzhanolguncu
PR: unkeyed/unkey#3564
File: go/cmd/cli/commands/deploy/deploy.go:153-158
Timestamp: 2025-07-16T09:18:45.379Z
Learning: In the go/cmd/cli/commands/deploy/ CLI codebase, ogzhanolguncu prefers to allow deployment to continue even when Docker push fails (around lines 153-158 in deploy.go) because the team is working locally and needs this behavior for local development workflows where registry access might not be available.
go/deploy/builderd/go.mod (8)
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/{assetmanagerd,billaged,builderd,metald}/**/*.go : When a service's `*.go` code changes significantly, increase the patch-level version number.
Learnt from: chronark
PR: unkeyed/unkey#3560
File: go/deploy/metald/internal/database/repository.go:0-0
Timestamp: 2025-07-15T14:59:30.212Z
Learning: go/deploy/metald cannot currently import helpers from go/pkg/db because it is not yet part of the main Go module; avoid suggesting such imports until the modules are unified.
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/{assetmanagerd,billaged,builderd,metald}/**/Makefile : Never use `go build` for any of the `assetmanagerd`, `billaged`, `builderd`, `metald` binaries.
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/**/*.{go,js,ts,tsx,py,sh,md,txt,json,yaml,yml,ini,rb,java,c,cpp,h,cs,rs,php,html,css,scss,xml} : Update relevant anchors when modifying associated code.
Learnt from: Flo4604
PR: unkeyed/unkey#3606
File: go/pkg/prometheus/metrics/database.go:29-30
Timestamp: 2025-07-16T10:06:35.397Z
Learning: In Go packages, variables defined in one file within a package (like `latencyBuckets` and `constLabels` in go/pkg/prometheus/metrics/http.go) are accessible from other files in the same package without requiring imports. This is a common pattern for sharing configuration across multiple files within a package.
Learnt from: ogzhanolguncu
PR: unkeyed/unkey#3564
File: go/cmd/cli/commands/deploy/flags.go:17-20
Timestamp: 2025-07-15T14:45:18.920Z
Learning: In the go/cmd/cli/commands/deploy/ directory, ogzhanolguncu prefers to keep potentially temporary features (like UNKEY_DOCKER_REGISTRY environment variable) undocumented in help text if they might be deleted in the future, to avoid documentation churn.
Learnt from: CR
PR: unkeyed/unkey#0
File: go/deploy/CLAUDE.md:0-0
Timestamp: 2025-07-09T08:42:29.316Z
Learning: Applies to go/deploy/**/Makefile : Global makefile should be `Makefile` at the root.
Learnt from: ogzhanolguncu
PR: unkeyed/unkey#3564
File: go/cmd/cli/commands/deploy/deploy.go:153-158
Timestamp: 2025-07-16T09:18:45.379Z
Learning: In the go/cmd/cli/commands/deploy/ CLI codebase, ogzhanolguncu prefers to allow deployment to continue even when Docker push fails (around lines 153-158 in deploy.go) because the team is working locally and needs this behavior for local development workflows where registry access might not be available.
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: Test Go API Local / Test
- GitHub Check: Test Agent Local / test_agent_local
- GitHub Check: Test API / API Test Local
- GitHub Check: Build / Build
- GitHub Check: Test Packages / Test
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (2)
go/deploy/billaged/go.mod (1)
47-50: LGTM – dependency bumps only.All three
x/*libraries are bumped to patch-level releases; no API changes are expected.
Nice tidy-up.go/deploy/metald/go.mod (1)
30-31: 👍 Dependency refresh looks safe.
x/sys,x/crypto,x/sync, andx/textupgrades are patch-level; compile-time surface remains unchanged.
No action required.Also applies to: 93-96
Comment on lines
42
to
46
| golang.org/x/text v0.27.0 | ||
| google.golang.org/protobuf v1.36.6 | ||
| gopkg.in/yaml.v2 v2.4.0 | ||
| ) | ||
|
|
Contributor
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Reduce YAML version sprawl – keep either v2 or v3, not both.
The module now has:
gopkg.in/yaml.v2 v2.4.0 // direct (new)
...
gopkg.in/yaml.v3 v3.0.1 // indirect
Shipping two mutually-incompatible major versions of the same package makes the build larger and complicates transitive-dep security updates.
Unless you really need v2’s API surface, it’s cleaner to:
- Migrate internal callers to
yaml.v3(dropyaml.v2), or - Pin
yaml.v2only andgo mod whyeverything that still drags inyaml.v3, then add areplaceto eliminate it.
Please verify actual usages (go grep yaml.v2) before merging.
Also applies to: 160-164
To verify actual usage of both YAML versions and their impact, let’s gather evidence from the module and code imports:
🏁 Script executed:
#!/bin/bash
set -eo pipefail
echo "1) YAML versions declared in go/go.mod:"
grep 'yaml\.v' go/go.mod || echo "No matches in go/go.mod"
echo
echo "2) Imports of yaml.v2 in Go source files:"
rg 'import .*(gopkg\.in/yaml\.v2)' -n go || echo "No direct yaml.v2 imports"
echo
echo "3) Imports of yaml.v3 in Go source files:"
rg 'import .*(gopkg\.in/yaml\.v3)' -n go || echo "No direct yaml.v3 imports"
echo
echo "4) go mod why for yaml.v3 (to see why it's pulled in):"
(cd go && go mod why gopkg.in/yaml.v3) || true
echo
echo "5) Dependency graph entries for any yaml version:"
(cd go && go mod graph | grep 'yaml') || echo "No yaml entries in mod graph"Length of output: 18329
Consolidate YAML dependency to a single major version (v3)
All internal code currently resolves to gopkg.in/yaml.v3 (via github.com/pb33f/libopenapi), and there are no direct imports of v2. However, v2.4.0 is still pulled in by several upstream dependencies (notably github.com/go-redis/redis/v8, github.com/oapi-codegen/oapi-codegen/v2, and github.com/prometheus/common). To eliminate the version sprawl:
• Upgrade those dependencies to versions that depend on yaml.v3
– e.g. bump go-redis/redis → v9, oapi-codegen → latest v2.x/v3.x, prometheus/common → ≥v0.69.0
• Remove the gopkg.in/yaml.v2 v2.4.0 line from go/go.mod
• Run go mod tidy and verify no v2 remains in go.mod or go.mod graph
File: go/go.mod (lines 42–46)
- gopkg.in/yaml.v2 v2.4.0
gopkg.in/yaml.v3 v3.0.1 // indirectCommittable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In go/go.mod around lines 42 to 46, the project currently includes
gopkg.in/yaml.v2 v2.4.0, which conflicts with internal code using yaml.v3. To
fix this, upgrade the dependencies that pull in yaml.v2 (such as
github.com/go-redis/redis, github.com/oapi-codegen/oapi-codegen, and
github.com/prometheus/common) to versions that depend on yaml.v3 (e.g., go-redis
v9, latest oapi-codegen v2.x/v3.x, prometheus/common ≥v0.69.0). Then remove the
gopkg.in/yaml.v2 v2.4.0 line from go.mod, run go mod tidy, and verify that
yaml.v2 is no longer present in go.mod or the module graph.
Comment on lines
+49
to
56
| golang.org/x/crypto v0.40.0 // indirect | ||
| golang.org/x/sys v0.34.0 // indirect | ||
| golang.org/x/text v0.27.0 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect | ||
| google.golang.org/grpc v1.73.0 // indirect | ||
| google.golang.org/protobuf v1.36.6 // indirect | ||
| ) |
Contributor
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Drop the stale builderd replace directive.
builderd is no longer in the require list, yet the replace stanza is still present:
replace github.com/unkeyed/unkey/go/deploy/builderd => ../builderdKeeping unused replaces clutters go mod graph output and may mask accidental re-introductions.
- replace github.com/unkeyed/unkey/go/deploy/builderd => ../builderdAlso applies to: 65-70
🤖 Prompt for AI Agents
In go/deploy/assetmanagerd/go.mod around lines 49 to 56 and also lines 65 to 70,
remove the stale replace directive for `builderd` that points to `../builderd`
since `builderd` is no longer in the require list. This will clean up the go.mod
file by eliminating unused replace statements that clutter the module graph and
prevent confusion.
Comment on lines
+23
to
24
| golang.org/x/sync v0.16.0 | ||
| golang.org/x/time v0.12.0 |
Contributor
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Clean up unused assetmanagerd replace directive.
assetmanagerd is no longer a dependency, but its replace line remains:
replace github.com/unkeyed/unkey/go/deploy/assetmanagerd => ../assetmanagerdRemove it to keep the module file minimal.
- replace github.com/unkeyed/unkey/go/deploy/assetmanagerd => ../assetmanagerdAlso applies to: 63-68
🤖 Prompt for AI Agents
In go/deploy/builderd/go.mod at lines 23-24 and also lines 63-68, remove the
replace directive for github.com/unkeyed/unkey/go/deploy/assetmanagerd pointing
to ../assetmanagerd, as assetmanagerd is no longer a dependency. This will clean
up the module file by eliminating unused replace directives.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Updates Go dependencies across multiple services to their latest versions. This includes:
golang.org/x/cryptofrom v0.39.0 to v0.40.0golang.org/x/sysfrom v0.33.0 to v0.34.0golang.org/x/textfrom v0.26.0 to v0.27.0golang.org/x/syncfrom v0.15.0 to v0.16.0Fixes # (issue)
Type of change
How should this be tested?
Checklist
Required
pnpm buildpnpm fmtconsole.logsgit pull origin mainSummary by CodeRabbit