[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/casbin/casbin/v2	v2.135.0 → v3.10.0

---

Release Notes

casbin/casbin (github.com/casbin/casbin/v2)

v3.10.0

Compare Source

Features

• add Explain() API to explain the authorization decisions via LLM API (#​1678) (0fe9505)

v3.9.0

Compare Source

Features

• integrate default detector into Enforcer (#​1665) (6cfc463)

v3.8.2

Compare Source

Bug Fixes

• improve CI benchmark table in PR (#​1663) (f1f03cc)

v3.8.1

Compare Source

Bug Fixes

• fix "Undefined function g" error by copying RM fields in Assertion.copy() (#​1658) (9324df7)

v3.8.0

Compare Source

Features

• add GetAllUsers() API to separate users from roles (#​1652) (1aba8b9)

v3.7.0

Compare Source

Features

• add logger integration to Casbin core enforcement and policy APIs (#​1651) (b190fce)

v3.6.0

Compare Source

Bug Fixes

• add new Logger interface (#​1639) (6b688f0)

Features

• add DefaultLogger (#​1648) (61c876f)
• remove legacy logger implementation (#​1638) (2d7173f)

v3.5.2

Compare Source

Bug Fixes

• remove opencollective links in README (ea5872b)

v3.5.1

Compare Source

Bug Fixes

• add DefaultDetector with DFS-based RBAC cycle detection (#​1632) (c407251)

v3.5.0

Compare Source

Features

• remove github-action-benchmark workflow from CI (#​1631) (53fb4e4)

v3.4.2

Compare Source

Bug Fixes

• add Detector interface (#​1629) (0b35dfa)

v3.4.1

Compare Source

Bug Fixes

• disable benchmark comments on merged commits (#​1615) (b3f4490)

v3.4.0

Compare Source

Features

• fix enforcement failure when renaming domain parameter from 'dom' to arbitrary names (#​1611) (0fd3ee8)

v3.3.0

Compare Source

Features

• add performance comparison CI for pull requests (#​1613) (4d32aaf)

v3.2.0

Compare Source

Features

• return clear error for invalid JSON when EnableAcceptJsonRequest is enabled (#​1610) (80dccb7)

v3.1.0

Compare Source

Features

• add "constraint_definition" section for RBAC policy validation (#​1600) (65d4097)

v3.0.1

Compare Source

Bug Fixes

• improve line ending for TestCasbinJsGetPermissionForUser() (#​1597) (cc7d03a)

v3.0.0

Compare Source

• feat!: upgrade to Casbin v3 (#​1595) (3ced5d7), closes #​1595

BREAKING CHANGES

• Module path changed from github.com/casbin/casbin/v2 to github.com/casbin/casbin/v3. All import paths must be updated to use v3.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:46 PM UTC · Completed 10:56 PM UTC
Commit: 01f864b · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [logic-error] go.mod:39 — The PR title claims to update casbin/casbin/v2 to v3, but the actual diff downgrades casbin/casbin/v2 from v2.135.0 to v2.102.0 (33 minor versions backward). The module path remains github.com/casbin/casbin/v2 — no v3 module path (github.com/casbin/casbin/v3) appears anywhere in the diff. The PR body's own release notes confirm the v3.0.0 breaking change: "Module path changed from github.com/casbin/casbin/v2 to github.com/casbin/casbin/v3." This is a Renovate bot misconfiguration. The go.sum confirms the downgrade is effective (v2.135.0 checksums are removed, only v2.102.0 remains). Casbin is a purely indirect transitive dependency (via argoproj/argo-cd/v2) with zero direct Go imports in this codebase, so practical runtime impact is minimal — but the downgrade is incorrect and the PR title is misleading. No linked issue authorizes this change. See also: [dependency-integrity] and [transitive-dependency-risk] findings below.
  Remediation: Reject this PR. If a genuine v3 migration is desired, the module path must change to github.com/casbin/casbin/v3 and all transitive consumers must be compatible. If the intent is dependency management cleanup, open a new PR with an accurate title.

Low

• [dependency-integrity] go.sum — The go.sum file adds a new entry for github.com/casbin/govaluate v1.2.0/go.mod while retaining the existing v1.3.0 entries. This is consistent with the version regression in go.mod — v2.102.0 of casbin depends on govaluate v1.2.0, so its go.mod checksum is added to go.sum. Standard Go module behavior confirming the downgrade.

• [transitive-dependency-risk] go.mod:39 — Casbin is a transitive dependency via argoproj/argo-cd/v2 with zero direct imports in this codebase. The go.sum confirms the downgrade is effective (v2.135.0 checksums replaced by v2.102.0), meaning no other module in the dependency graph requires a casbin version higher than v2.102.0. Practical impact remains minimal since casbin is not directly imported.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [logic-error] go.mod:39 — The PR title claims to update casbin/casbin/v2 to v3, but the actual diff downgrades casbin/casbin/v2 from v2.135.0 to v2.102.0 (33 minor versions backward). The module path remains github.com/casbin/casbin/v2 — no v3 module path (github.com/casbin/casbin/v3) appears anywhere in the diff. The PR body’s own release notes confirm the v3.0.0 breaking change: “Module path changed from github.com/casbin/casbin/v2 to github.com/casbin/casbin/v3.” This is a Renovate bot misconfiguration. Practical runtime impact is mitigated by casbin being a purely indirect transitive dependency (via argoproj/argo-cd/v2) with zero direct Go imports in this codebase, and Go’s MVS algorithm may override this pin — but the downgrade is still incorrect and the PR title is misleading. See also: [missing-authorization] finding at this location.
  Remediation: Reject this PR. If a genuine v3 migration is desired, the module path must change to github.com/casbin/casbin/v3 and all transitive consumers must be compatible. If the intent is dependency management cleanup, open a new PR with an accurate title.

Low

• [missing-authorization] go.mod:39 — No linked issue authorizes this dependency change. A downgrade whose PR description misrepresents it as an upgrade warrants explicit rationale.

• [dependency-integrity] go.sum — The go.sum file adds a new entry for github.com/casbin/govaluate v1.2.0/go.mod while retaining the existing v1.3.0 entries. Standard Go module behavior confirming the version regression.

• [transitive-dependency-risk] go.mod:39 — Casbin is a transitive dependency via argoproj/argo-cd/v2 with zero direct imports in this codebase. Go’s MVS algorithm may override this pin upward, making the downgrade potentially inert while leaving go.mod inconsistent with the resolved graph.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

Critical

• [logic-error] go.mod:39 — The PR title claims to update casbin/casbin/v2 to v3, but the actual diff downgrades casbin/casbin/v2 from v2.135.0 to v2.102.0 (33 minor versions backward). The module path remains github.com/casbin/casbin/v2 — there is no migration to a v3 module path (github.com/casbin/casbin/v3). The casbin v3.0.0 release notes in the PR body explicitly state the module path changed to /v3, so a proper v3 upgrade would require changing the import path. This PR neither accomplishes its stated goal nor produces a safe change — the downgrade may reintroduce bugs fixed in the 33 skipped releases. This appears to be a Renovate bot misconfiguration. Additionally, the PR title is actively misleading since no v3 migration is present in the diff.
  Remediation: Reject this PR. Either (a) properly migrate to casbin/casbin/v3 by changing the module path and updating all transitive dependency references, or (b) keep the existing v2.135.0 since casbin is an indirect dependency managed by ArgoCD's requirements.

Low

• [missing-authorization] go.mod:39 — No linked issue exists to authorize this dependency change. While the lack of issue linkage is common for Renovate bot PRs, the fact that this PR actually performs a downgrade (rather than the upgrade it claims) means some explicit rationale would be warranted.

• [dependency-integrity] go.sum:65 — The go.sum file adds a new entry for github.com/casbin/govaluate v1.2.0/go.mod while retaining the existing v1.3.0 entries. This is standard Go module behavior (recording checksums for all versions in the module graph), but is a side effect of the questionable downgrade.

• [transitive-dependency-risk] go.mod:39 — Casbin is a transitive dependency via argoproj/argo-cd/v2 v2.14.21 and is not directly imported by any Go source file in this project. Go's minimum version selection (MVS) algorithm would override this pin if any direct or transitive dependency requires a higher version, making the manual pin potentially ineffective or misleading.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

Critical

• [logic-error] go.mod:39 — The PR title claims to update casbin/casbin/v2 to v3, but the actual diff downgrades casbin/casbin/v2 from v2.135.0 to v2.102.0 (33 minor versions backward). The module path remains github.com/casbin/casbin/v2 — there is no migration to a v3 module path (github.com/casbin/casbin/v3). The casbin v3.0.0 release notes explicitly state the module path changed to /v3, so a proper v3 upgrade would require changing the import path. This PR neither accomplishes its stated goal nor produces a safe change — the downgrade may reintroduce bugs fixed in the 33 skipped releases. This appears to be a Renovate bot misconfiguration.
  Remediation: Reject this PR. Either (a) properly migrate to casbin/casbin/v3 by changing the module path and updating all transitive dependency references, or (b) keep the existing v2.135.0 since casbin is an indirect dependency managed by ArgoCD's requirements.
  See also: [scope-mismatch] and [unauthorized-downgrade] findings at this location.

Medium

• [missing-authorization] go.mod:39 — No linked issue exists to authorize this dependency change. While casbin is an indirect dependency not directly used by this project, downgrading any transitive dependency by 33 minor versions warrants explicit rationale documenting why the downgrade is needed and confirming no regressions are introduced.

Low

• [dependency-integrity] go.sum:65 — The go.sum file adds a new entry for github.com/casbin/govaluate v1.2.0/go.mod while retaining the existing v1.3.0 entry. This is standard Go module behavior (recording checksums for all versions in the module graph), but is a side effect of the questionable downgrade.

• [transitive-dependency-risk] go.mod:39 — Casbin is a transitive dependency via argoproj/argo-cd/v2 v2.14.21 and is not directly imported by any Go source file in this project. Go's minimum version selection (MVS) algorithm would override this pin if any direct or transitive dependency requires a higher version, making the manual pin potentially ineffective or misleading.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:25 PM UTC · Completed 9:39 PM UTC

Commit: 760d655 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.87

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Tier 1 signals unchanged from prior assessment (same 2 dependency files, bot author, 7 lines, no protected or security-sensitive paths); composite 0.62x2.0 + 0.38x2.5 = 2.19 rounds to 2 (moderate), consistent with prior score anchoring despite elevated fix/revert history on dep files.

Previous run

Risk Assessment: moderate (2/5)

Details

Tier 1 signals unchanged from prior assessment (same 2 dependency files, bot author, 7 lines, no protected or security-sensitive paths); composite score of 0.62x1.5 + 0.38x1.86 = 1.64 rounds to 2 (moderate), consistent with the prior score anchoring.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Bot-generated dependency change touching only go.mod and go.sum with 7 lines changed. The dependency-file count and zero test ratio elevate the Tier 1 score, but the tiny change size, bot authorship, low churn, and no protected/security-sensitive paths keep overall risk moderate.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:05 AM UTC · Completed 1:19 AM UTC

Commit: d749d49 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.13

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:15 AM UTC · Completed 7:29 AM UTC

Commit: cba5312 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.36

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] logic-error

The PR title claims to update casbin/casbin/v2 to v3, but the actual diff downgrades casbin/casbin/v2 from v2.135.0 to v2.102.0 (33 minor versions backward). The module path remains github.com/casbin/casbin/v2 — no v3 module path appears anywhere in the diff. The PR body's own release notes confirm the v3.0.0 breaking change: 'Module path changed from github.com/casbin/casbin/v2 to github.com/casbin/casbin/v3.' This is a Renovate bot misconfiguration. The go.sum confirms the downgrade is effective. Casbin is a purely indirect transitive dependency with zero direct Go imports, so practical runtime impact is minimal — but the downgrade is incorrect, the PR title is misleading, and no linked issue authorizes this change.

Suggested fix: Reject this PR. If a genuine v3 migration is desired, the module path must change to github.com/casbin/casbin/v3. If the intent is dependency management cleanup, open a new PR with an accurate title.

[fullsend-ai-review]

[low] transitive-dependency-risk

Casbin is a transitive dependency via argoproj/argo-cd/v2 with zero direct imports in this codebase. The go.sum confirms the downgrade is effective (v2.135.0 checksums replaced by v2.102.0), meaning no other module in the dependency graph requires a casbin version higher than v2.102.0. Practical impact remains minimal since casbin is not directly imported.