-
Notifications
You must be signed in to change notification settings - Fork 34
chore(deps): Bump dependencies #466
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
…y with 9 updates Bumps the production-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.46.0` | `0.47.0` | | [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) | `0.5.1` | `0.6.1` | | [github.com/docker/cli](https://github.com/docker/cli) | `29.1.3+incompatible` | `29.1.4+incompatible` | | [github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring](https://github.com/prometheus-operator/prometheus-operator) | `0.87.1` | `0.88.0` | | [golang.org/x/mod](https://github.com/golang/mod) | `0.31.0` | `0.32.0` | | [golang.org/x/net](https://github.com/golang/net) | `0.48.0` | `0.49.0` | | [golang.org/x/tools](https://github.com/golang/tools) | `0.40.0` | `0.41.0` | Updates `golang.org/x/crypto` from 0.46.0 to 0.47.0 - [Commits](golang/crypto@v0.46.0...v0.47.0) Updates `golang.org/x/text` from 0.32.0 to 0.33.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.32.0...v0.33.0) Updates `github.com/cyphar/filepath-securejoin` from 0.5.1 to 0.6.1 - [Release notes](https://github.com/cyphar/filepath-securejoin/releases) - [Changelog](https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md) - [Commits](cyphar/filepath-securejoin@v0.5.1...v0.6.1) Updates `github.com/docker/cli` from 29.1.3+incompatible to 29.1.4+incompatible - [Commits](docker/cli@v29.1.3...v29.1.4) Updates `github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring` from 0.87.1 to 0.88.0 - [Release notes](https://github.com/prometheus-operator/prometheus-operator/releases) - [Changelog](https://github.com/prometheus-operator/prometheus-operator/blob/main/CHANGELOG.md) - [Commits](prometheus-operator/prometheus-operator@v0.87.1...v0.88.0) Updates `golang.org/x/mod` from 0.31.0 to 0.32.0 - [Commits](golang/mod@v0.31.0...v0.32.0) Updates `golang.org/x/net` from 0.48.0 to 0.49.0 - [Commits](golang/net@v0.48.0...v0.49.0) Updates `golang.org/x/term` from 0.38.0 to 0.39.0 - [Commits](golang/term@v0.38.0...v0.39.0) Updates `golang.org/x/tools` from 0.40.0 to 0.41.0 - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.40.0...v0.41.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: golang.org/x/text dependency-version: 0.33.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/cyphar/filepath-securejoin dependency-version: 0.6.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: github.com/docker/cli dependency-version: 29.1.4+incompatible dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring dependency-version: 0.88.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: golang.org/x/mod dependency-version: 0.32.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: golang.org/x/net dependency-version: 0.49.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: golang.org/x/term dependency-version: 0.39.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: golang.org/x/tools dependency-version: 0.41.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <[email protected]>
Fixed the version of github.com/cyphar/filepath-securejoin to v0.5.1 because of go.podman.io/storage v1.61.0 requiring it. Signed-off-by: Michal Vavrinec <[email protected]>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hey - I've found 1 issue, and left some high level feedback:
- The new
replace github.com/cyphar/filepath-securejoin => ... v0.5.1conflicts with the updated indirect requirement tov0.6.1; consider aligning these so that therequiresection and the enforced version viareplaceare consistent. - Most Kubernetes modules were bumped to
v0.34.3butk8s.io/client-goremains atv0.34.2; it’s usually safer to keep these core k8s dependencies on the same patch level unless there’s a specific reason not to.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The new `replace github.com/cyphar/filepath-securejoin => ... v0.5.1` conflicts with the updated indirect requirement to `v0.6.1`; consider aligning these so that the `require` section and the enforced version via `replace` are consistent.
- Most Kubernetes modules were bumped to `v0.34.3` but `k8s.io/client-go` remains at `v0.34.2`; it’s usually safer to keep these core k8s dependencies on the same patch level unless there’s a specific reason not to.
## Individual Comments
### Comment 1
<location> `go.mod:30` </location>
<code_context>
- k8s.io/apimachinery v0.34.2
+ golang.org/x/crypto v0.47.0
+ golang.org/x/text v0.33.0
+ k8s.io/api v0.34.3
+ k8s.io/apimachinery v0.34.3
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
</code_context>
<issue_to_address>
**issue (bug_risk):** Kubernetes module versions are partially bumped, leaving k8s.io/client-go at 0.34.2, which may cause skew.
Since k8s.io/api and k8s.io/apiextensions-apiserver are now at v0.34.3, it’s safer to align k8s.io/client-go to v0.34.3 as well to avoid version skew and potential subtle incompatibilities. If you need to keep client-go at v0.34.2, please confirm there’s a specific reason or known incompatibility.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| k8s.io/apimachinery v0.34.2 | ||
| golang.org/x/crypto v0.47.0 | ||
| golang.org/x/text v0.33.0 | ||
| k8s.io/api v0.34.3 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
issue (bug_risk): Kubernetes module versions are partially bumped, leaving k8s.io/client-go at 0.34.2, which may cause skew.
Since k8s.io/api and k8s.io/apiextensions-apiserver are now at v0.34.3, it’s safer to align k8s.io/client-go to v0.34.3 as well to avoid version skew and potential subtle incompatibilities. If you need to keep client-go at v0.34.2, please confirm there’s a specific reason or known incompatibility.
|
@Ruclo: The following test failed, say
DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
What this PR does / why we need it:
Due to go.podman.io/storage v1.61.0 requiring github.com/cyphar/filepath-securejoin v0.5.1,
I decided to fix the version in order to avoid further issues till support for higher version is adapted.
Which issue(s) this PR fixes (optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close the issue(s) when PR gets merged):Fixes #465
Special notes for your reviewer:
Release note: