Close the dependency gaps renovate cannot see - #2314
Closed
csatib02 wants to merge 6 commits into
Closed
Conversation
Renovate moved e2e to v0.22.0 and left the root, the SDK and the syslog-ng config module on v0.21.0. The workspace builds them together, so the versions should match. Signed-off-by: Bence Csati <bence.csati@axoflow.com>
Every module declares go 1.26.0, so resolving updates against 1.25 hides any release that needs the newer toolchain. Signed-off-by: Bence Csati <bence.csati@axoflow.com>
ENVTEST_K8S_VERSION was the only pinned tool version without a renovate annotation, so it stayed on 1.35.0 while envtest-v1.36.2 was available. The binaries ship as envtest-v* releases of controller-tools, which already supplies controller-gen under v* tags. The two need different version extraction, so the envtest pin carries its own dep name and the Makefile rule that strips a leading v no longer applies to it. Signed-off-by: Bence Csati <bence.csati@axoflow.com>
Signed-off-by: Bence Csati <bence.csati@axoflow.com>
golang.org/x/sys was v0.45.0 in the config-reloader module and v0.46.0 in the other four. .go-version said 1.26.0 while .tool-versions and the release Dockerfile both say 1.26.3, so CI compiled on a different toolchain than the shipped image. One docker/login-action on the release publish path was still v2.2.0 while every other use in the same file was v3.7.0. Major updates are disabled in renovate.json, so it was never going to catch up on its own. The KIND node image is not a *_VERSION variable, so the general Makefile manager cannot see it. It now has a manager of its own that also tracks the digest. Signed-off-by: Bence Csati <bence.csati@axoflow.com>
…em pins Major updates were disabled for every dependency, which is why thirteen GitHub actions sit one to four majors behind and one login-action stayed on v2. The fluentd base image installed fluentd 1.19.2 and oj 3.16.11 while both Gemfile.lock files resolve 1.19.3 and 3.17.3. The lockfiles move with bundler updates; these lines never did. Signed-off-by: Bence Csati <bence.csati@axoflow.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
An audit of every dependency surface in the repo against
renovate.jsonfound versions thatrenovate never proposes, either because a manager cannot see the file or because a rule
suppresses the update.
Three things were invisible to renovate.
ENVTEST_K8S_VERSIONwas the only pinned toolversion in the Makefile without a
# renovate:comment, so it stayed on 1.35.0 whileenvtest-v1.36.2 was available. The KIND node image is not a
*_VERSIONvariable, so thegeneral Makefile manager does not match it. Both now have a manager, and the envtest one
carries its own dep name because controller-tools publishes controller-gen under
v*tagsand the envtest binaries under
envtest-v*.Two things were suppressed.
constraints.gosaid 1.25 while every module declares 1.26.0,which hides any release needing the newer toolchain. Major updates were disabled for every
dependency, which is why thirteen GitHub actions sit one to four majors behind and one
docker/login-actionon the release publish path was still v2.2.0 while every other use inthe same file was v3.7.0.
The rest is drift between places that hold the same version.
golang.org/x/syncandgolang.org/x/syseach differed in one module out of five..go-versionsaid 1.26.0 while.tool-versionsand the release Dockerfile say 1.26.3, so CI compiled on a differenttoolchain than the shipped image. The fluentd base image installed fluentd 1.19.2 and oj
3.16.11 while both
Gemfile.lockfiles resolve 1.19.3 and 3.17.3.Enabling major updates will produce a batch of renovate PRs for the actions listed above.
That is the point, but they land as separate reviewable changes rather than here.
Not included:
Chart.yamldeclareskubeVersion: ">=1.22.0-0"while the lowest testedversion is 1.33. Raising the floor makes Helm refuse
helm upgradefor every user below thenew floor, so it belongs in a release where it is the headline rather than in a dependency
change.
Test plan
make check-diffexits 0 on a clean treemake testandmake lintpass on all three modulesoffer 1.36.2, and the KIND node image should track both tag and digest