[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/bombsimon/logrusr/v2	v2.0.1 → v4.2.0

---

Release Notes

bombsimon/logrusr (github.com/bombsimon/logrusr/v2)

v4.2.0

Compare Source

What's Changed

• Fix error value logging by @​avorima in #​30
• Configure dependabot by @​avorima in #​32
• Bump golangci/golangci-lint-action from 3 to 4 by @​dependabot[bot] in #​39
• Bump actions/checkout from 3 to 4 by @​dependabot[bot] in #​38
• Bump actions/setup-go from 4 to 5 by @​dependabot[bot] in #​37
• Bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 by @​dependabot[bot] in #​33
• Bump coverallsapp/github-action from 1.1.3 to 2.2.3 by @​dependabot[bot] in #​36
• Bump github.com/stretchr/testify from 1.8.1 to 1.8.4 by @​dependabot[bot] in #​35
• Bump github.com/go-logr/logr from 1.2.3 to 1.4.1 by @​dependabot[bot] in #​34
• Bump github.com/stretchr/testify from 1.8.4 to 1.9.0 by @​dependabot[bot] in #​40
• Bump golangci/golangci-lint-action from 4 to 5 by @​dependabot[bot] in #​41
• Bump coverallsapp/github-action from 2.2.3 to 2.3.0 by @​dependabot[bot] in #​43
• Bump golangci/golangci-lint-action from 5 to 6 by @​dependabot[bot] in #​42
• Bump github.com/go-logr/logr from 1.4.1 to 1.4.2 by @​dependabot[bot] in #​44
• Bump coverallsapp/github-action from 2.3.0 to 2.3.1 by @​dependabot[bot] in #​45
• Bump coverallsapp/github-action from 2.3.1 to 2.3.2 by @​dependabot[bot] in #​46
• Bump coverallsapp/github-action from 2.3.2 to 2.3.3 by @​dependabot[bot] in #​47
• Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @​dependabot[bot] in #​48
• Bump golangci/golangci-lint-action from 6 to 7 by @​dependabot[bot] in #​49
• Bump golangci/golangci-lint-action from 7 to 8 by @​dependabot[bot] in #​50
• Bump github.com/go-logr/logr from 1.4.2 to 1.4.3 by @​dependabot[bot] in #​51
• Bump actions/checkout from 4 to 5 by @​dependabot[bot] in #​52
• Bump github.com/stretchr/testify from 1.10.0 to 1.11.0 by @​dependabot[bot] in #​53
• Bump github.com/stretchr/testify from 1.11.0 to 1.11.1 by @​dependabot[bot] in #​54
• Bump actions/setup-go from 5 to 6 by @​dependabot[bot] in #​55
• Bump golangci/golangci-lint-action from 8 to 9 by @​dependabot[bot] in #​56
• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in #​57
• Bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4 by @​dependabot[bot] in #​58
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​59
• chore: fix golangci-lint in pipeline by @​bombsimon in #​60
• Bump actions/setup-go from 6 to 7 by @​dependabot[bot] in #​61
• Bump github.com/go-logr/logr from 1.4.3 to 1.4.4 by @​dependabot[bot] in #​62
• Bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @​dependabot[bot] in #​63
• Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 by @​dependabot[bot] in #​64
• Bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @​dependabot[bot] in #​65
• Bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 by @​dependabot[bot] in #​66
• Bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 by @​dependabot[bot] in #​67

New Contributors

• @​avorima made their first contribution in #​30
• @​dependabot[bot] made their first contribution in #​39

Full Changelog: bombsimon/logrusr@v4.1.0...v4.2.0

v4.1.0

Compare Source

What's Changed

• With call depth additive by @​bombsimon in #​28
• Add support for logr.Marshaler by @​bombsimon in #​29

Full Changelog: bombsimon/logrusr@v4.0.0...v4.1.0

v4.0.0

Compare Source

What's Changed

• Adapt FormatFunc return type to the expected logrus.Fields type by @​d1egoaz in #​23
• Bump major version by @​bombsimon in #​24

New Contributors

• @​d1egoaz made their first contribution in #​23

Full Changelog: bombsimon/logrusr@v3.1.0...v4.0.0

v3.1.0

Compare Source

What's Changed

• Fix parallel invocation and also a couple typos per the spellchecker. by @​binaryphile in #​20
• Remove one frame from the default call depth by @​bombsimon in #​21
• Fix GitHub actions by @​bombsimon in #​22

New Contributors

• @​binaryphile made their first contribution in #​20

Full Changelog: bombsimon/logrusr@v3.0.0...v3.1.0

v3.0.0

Compare Source

What's Changed

• Update logr to v1.2.2 and update go.mod to 1.17 by @​aledbf in #​8
• README.md: Replace NewLogger with New by @​cfergeau in #​9
• Update CI, supported versions and README by @​bombsimon in #​10
• Map V-level logging to logrus named logging by @​bombsimon in #​13
• Stop overwriting logger on struct when adding fields by @​bombsimon in #​14
• Simplify severity logging by @​bombsimon in #​15
• Don't create logger in each test case by @​bombsimon in #​16
• V3 release by @​bombsimon in #​17

New Contributors

• @​aledbf made their first contribution in #​8
• @​cfergeau made their first contribution in #​9

Full Changelog: bombsimon/logrusr@v2.0.1...v3.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:46 PM UTC · Completed 10:54 PM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [logic-error] go.mod:37 — The PR title and description claim to update github.com/bombsimon/logrusr/v2 from v2.0.1 to v4.2.0, but the dependency is completely unchanged. Line 37 of go.mod reads github.com/bombsimon/logrusr/v2 v2.0.1 // indirect in both the base branch and the PR head — the lines are byte-identical. No github.com/bombsimon/logrusr/v4 module entry was added anywhere in go.mod or go.sum. In Go modules, a v2-to-v4 major version bump requires changing the module path from /v2 to /v4 per the major version suffix convention. The Renovate bot was unable to perform this change and instead only bumped three unrelated transitive dependencies (testify v1.12.0→v1.12.1, logr v1.4.3→v1.4.4, logrus v1.9.4→v1.10.2). Additionally, logrusr is a transitive indirect dependency pulled in through ArgoCD — no Go source file in this repository imports it directly — so a standalone logrusr major version bump would likely need to be coordinated with an ArgoCD dependency update. Merging this PR would create a false record that logrusr was updated to v4 when it was not. If the v4 update was motivated by a security fix, API change, or compatibility requirement, that requirement remains unaddressed.
  Remediation: Either (1) correctly update to logrusr/v4 by adding github.com/bombsimon/logrusr/v4 to go.mod, removing the /v2 entry, and updating the transitive consumer (ArgoCD or its dependency tree) that requires it — or more practically, update the ArgoCD dependency first which would pull in the correct logrusr version transitively; or (2) retitle the PR to accurately reflect the actual changes (transitive dependency patch bumps for testify, logr, and logrus) and file a separate issue to track the logrusr v4 update if still desired.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [logic error] go.mod:37 — PR claims to update github.com/bombsimon/logrusr/v2 from v2.0.1 to v4.2.0, but the dependency is unchanged at v2.0.1 (line 37). No logrusr/v4 module entry was added. In Go modules, a v2-to-v4 major version bump requires changing the module path from /v2 to /v4 and updating all transitive import paths. The Renovate bot appears to have been unable to perform this change and instead only bumped four unrelated transitive dependencies (testify, logr, logrus, yaml/v3). The PR is labeled ready-for-merge, so merging it will create the false impression that logrusr was updated to v4 when it was not. If the v4 update was motivated by a security fix, API change, or compatibility requirement, that requirement remains unaddressed.
  Remediation: Either (1) correctly update to logrusr/v4 by adding github.com/bombsimon/logrusr/v4 to go.mod, removing the /v2 entry, and updating all transitive consumers (likely within the ArgoCD dependency tree), or (2) retitle the PR to accurately reflect the actual changes (transitive dependency bumps) and investigate why the logrusr update failed, filing a separate issue if the v4 update is still desired.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Looks good to me

Previous run (3)

Review

Findings

High

• [api-contract] go.mod:37 — The PR changes an indirect dependency from github.com/bombsimon/logrusr/v2 v2.0.1 to github.com/bombsimon/logrusr/v4 v4.1.0. This is problematic for two reasons: (1) go.sum contains only checksums for logrusr/v2 and has no entries for logrusr/v4, which will cause go mod verify and builds to fail; (2) since logrusr is an indirect dependency pulled in by argo-cd/v2 v2.14.21, and Go treats /v2 and /v4 as distinct module paths, manually overriding the indirect entry from /v2 to /v4 does not satisfy argo-cd's actual import of logrusr/v2. After go mod tidy, Go will either revert to /v2 or pull in both /v2 and /v4, making this change incorrect or pointless.
  Remediation: Run go mod tidy to regenerate go.mod and go.sum consistently. This will resolve which version of logrusr the dependency graph actually requires. If only /v2 is needed (as expected given argo-cd v2.14.x), revert this change. The logrusr major version can only be upgraded when the consuming dependency (argo-cd) itself upgrades to use /v4.

[red-hat-konflux]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=3 days

Details:

Package	Change
github.com/stretchr/testify	v1.12.0 -> v1.12.1
github.com/go-logr/logr	v1.4.3 -> v1.4.4
github.com/sirupsen/logrus	v1.9.4 -> v1.10.2

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:25 PM UTC · Completed 9:36 PM UTC

Commit: ad6b187 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.18

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Score anchored to prior 2 (moderate): bot-authored dependency bump touching only go.mod and go.sum with an 18-line diff; both dependency lock files modified drives Tier 1 up, but overall change size and protected-path signals are minimal; git history shows 3 fix/revert commits per file in 90 days and 3 distinct authors, sustaining the moderate composite.

Previous run

Risk Assessment: moderate (2/5)

Details

Score anchored to prior 2 (moderate): bot-authored dependency bump touching only go.mod and go.sum with a small diff (24 lines), but both dependency lock files are modified (Tier 1 sub-score 5) and git history confirms four fix/revert commits per file in the past 90 days, sustaining the non-trivial churn signal on the dependency surface that justified the prior score.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Bot-authored dependency bump touching only go.mod and go.sum with a small diff, but both dependency lock files are modified (elevated Tier 1 signal) and these files carry four fix/revert commits in the past 90 days, indicating non-trivial churn on the dependency surface.

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:05 AM UTC · Completed 1:16 AM UTC

Commit: 4e1fdcf · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.44

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:15 AM UTC · Completed 7:25 AM UTC

Commit: 990e58f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.10

[fullsend-ai-review]

Note: The following review comments could not be posted on the diff (GitHub returned 422) and are included here instead:

• go.mod (file-level): Line 37 · [high] logic-error

The PR title and description claim to update github.com/bombsimon/logrusr/v2 from v2.0.1 to v4.2.0, but the dependency is completely unchanged. Line 37 of go.mod reads github.com/bombsimon/logrusr/v2 v2.0.1 // indirect in both the base branch and the PR head. No github.com/bombsimon/logrusr/v4 module entry was added. In Go modules, a v2-to-v4 major version bump requires changing the module path from /v2 to /v4. The Renovate bot only bumped three unrelated transitive dependencies (testify, logr, logrus). Merging this PR would create a false record that logrusr was updated to v4 when it was not.

Suggested fix: Either (1) correctly update to logrusr/v4 by updating the ArgoCD dependency first which would pull in the correct logrusr version transitively; or (2) retitle the PR to accurately reflect the actual changes (transitive dependency patch bumps) and file a separate issue to track the logrusr v4 update if still desired.

[fullsend-ai-review]

See the review comment for full details.