Skip to content

Bump github.com/evanphx/json-patch from 4.12.0+incompatible to 5.9.11+incompatible #478

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Apr 23, 2026
+3 −4
Merged

Bump github.com/evanphx/json-patch from 4.12.0+incompatible to 5.9.11+incompatible #478

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ module github.com/openshift/managed-cluster-validating-webhooks
go 1.25.7

require (
github.com/evanphx/json-patch v4.12.0+incompatible
github.com/evanphx/json-patch v5.9.11+incompatible
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 25, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Check for inconsistent import paths across the codebase

echo "=== Direct imports of github.com/evanphx/json-patch (unversioned) ==="
rg -n --type=go '"github\.com/evanphx/json-patch"' -C 2

echo -e "\n=== Direct imports of github.com/evanphx/json-patch/v5 (versioned) ==="
rg -n --type=go '"github\.com/evanphx/json-patch/v5"' -C 2

echo -e "\n=== Count of each import style ==="
echo -n "Unversioned imports: "
rg -c --type=go '"github\.com/evanphx/json-patch"' | wc -l
echo -n "Versioned (/v5) imports: "
rg -c --type=go '"github\.com/evanphx/json-patch/v5"' | wc -l

Repository: openshift/managed-cluster-validating-webhooks

Length of output: 653

The go.mod entry uses the +incompatible suffix, which indicates improper Go module versioning.

Line 6 shows github.com/evanphx/json-patch v5.9.11+incompatible. The +incompatible suffix means this library is using v5 semantics but without adopting the proper /v5 import path convention for Go modules v1.11+. The codebase correctly imports it as github.com/evanphx/json-patch (unversioned) in one location. The versioned path (github.com/evanphx/json-patch/v5) appearing in go.mod is a transitive dependency—this is normal and not a problem.

The concern is whether this library should be migrated to its proper versioned import path if the library maintainers have adopted that convention. Verify the upstream library's current status and consider updating the import if a properly-versioned version is available.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` at line 6, The go.mod entry for the dependency
github.com/evanphx/json-patch is pinned as v5.9.11+incompatible, indicating the
upstream uses v5 semantics without the proper /v5 import path; check the
upstream repository for a proper module v5 release (module path
github.com/evanphx/json-patch/v5) and, if available, update imports and go.mod
to use the canonical v5 module path and version (replace
github.com/evanphx/json-patch v5.9.11+incompatible with
github.com/evanphx/json-patch/v5 v5.x.y), run go mod tidy and fix any import
lines that should change from github.com/evanphx/json-patch to
github.com/evanphx/json-patch/v5 across the codebase.

Copy link
Copy Markdown
Contributor

@diakovnec diakovnec Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

CodeRabbit's Recommendation: ⚠️ Valid but Optional
Migrate to: github.com/evanphx/json-patch/v5

My Advice: 🟡 Low Priority - Can Be Done Later
Pros of migrating to /v5:

✅ Aligns with controller-runtime (our major dependency)
✅ Uses proper Go modules v2+ convention
✅ Better module path hygiene
✅ Same API, same version (v5.9.11)
Cons/Considerations:

⚠️ Requires code changes (import path update)
⚠️ Not urgent - everything works correctly as-is
⚠️ Won't fix the other incompatible paths from k8s libraries
Current Status: ✅ SAFE

All tests pass
Binary builds successfully
No runtime issues
The +incompatible suffix is cosmetic in this case
Recommendation:
For PR #478: ✅ Merge as-is

The upgrade from v4 to v5 is the important change
The +incompatible vs /v5 path issue is a separate cleanup task
For Future PR (optional cleanup):


# Change 1: Update import
# File: pkg/webhooks/service/service_test.go:9
- patchengine "github.com/evanphx/json-patch"
+ patchengine "github.com/evanphx/json-patch/v5"

# Change 2: Update go.mod
- github.com/evanphx/json-patch v5.9.11+incompatible
+ github.com/evanphx/json-patch/v5 v5.9.11

# Then run:
go mod tidy
make test
Impact: Minimal - API is identical, just the import path changes.

Priority: Low - This is a code hygiene improvement, not a bug fix. The current approach works correctly and all tests pass. CodeRabbit's concern is valid but not urgent.

Verdict: Merge PR #478 now, optionally create a follow-up issue to migrate to /v5 import path for consistency with controller-runtime.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@diakovnec, that's a thorough and well-reasoned analysis — agreed on all points. To confirm: the upstream library itself recommends go get -u github.com/evanphx/json-patch/v5 as the "latest and greatest" path, and the github.com/evanphx/json-patch/v5 module is fully available on pkg.go.dev with the complete API. So the migration path is clean when you're ready for it.

Your summary is spot on:

  • ✅ Merge PR #478 as-is — the v4→v5 upgrade is the valuable change here
  • 🟡 Follow-up cleanup — migrate the one import in pkg/webhooks/service/service_test.go from github.com/evanphx/json-patch to github.com/evanphx/json-patch/v5 and update go.mod accordingly

Would you like me to open a follow-up GitHub issue to track the import path cleanup?

📝 Learnings were identified and not saved (knowledge base disabled). Enable

github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344
github.com/go-logr/logr v1.4.3
github.com/onsi/ginkgo/v2 v2.28.1
Expand Down Expand Up @@ -55,7 +55,6 @@ require (
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
github.com/openshift/custom-resource-status v1.1.3-0.20220503160415-f2fdb4999d87 // indirect
github.com/openshift/elasticsearch-operator v0.0.0-20241202183904-81cd6e70c15e // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.66.1 // indirect
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,9 @@ github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf
github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84=
github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
github.com/evanphx/json-patch v5.9.11+incompatible h1:ixHHqfcGvxhWkniF1tWxBHA0yb4Z+d1UQi45df52xW8=
github.com/evanphx/json-patch v5.9.11+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
Expand Down Expand Up @@ -203,7 +204,6 @@ github.com/openshift/operator-custom-metrics v0.5.1 h1:1pk4YMUV+cmqfV0f2fyxY62cl
github.com/openshift/operator-custom-metrics v0.5.1/go.mod h1:0dYDHi/ubKRWzsC9MmW6bRMdBgo1QSOuAh3GupTe0Sw=
github.com/openshift/osde2e-common v0.0.0-20231010150014-8a4449a371e6 h1:MPcnO0eeWEyjLBA4mMgJ8pv8u7DjKC7yS+a39R+zhqs=
github.com/openshift/osde2e-common v0.0.0-20231010150014-8a4449a371e6/go.mod h1:lzmkYjtdf0EgPnoujLNAzorq/7vygGCcgceo/dQI1d0=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
Expand Down
Loading