Skip to content

🚨 Update go modules (main) (major) #3133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
+79 −24
Open

🚨 Update go modules (main) (major) #3133

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion acceptance/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ require (
github.com/yudai/gojsondiff v1.0.0
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
golang.org/x/sync v0.22.0
gopkg.in/go-jose/go-jose.v2 v2.6.3
gopkg.in/go-jose/go-jose.v4 v4.1.4

@fullsend-ai-review fullsend-ai-review Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] api-contract

The PR replaces gopkg.in/go-jose/go-jose.v2 with v4 in acceptance/go.mod, but acceptance/image/image.go (line 60) still imports gopkg.in/go-jose/go-jose.v2/json. In Go, v2 and v4 are distinct module paths. The acceptance module will not compile.

Suggested fix: Update the import in acceptance/image/image.go to the v4 equivalent (github.com/go-jose/go-jose/v4), or keep v2 alongside v4.

@fullsend-ai-review fullsend-ai-review Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] incomplete-security-fix

The go-jose upgrade from v2 to v4 addresses GHSA-78h2-9frx-2jm8 and GHSA-c6gw-w398-hv78, but acceptance/image/image.go still imports v2. Security fixes in v4 will not apply to code importing the v2 module path.

Suggested fix: Update the import in acceptance/image/image.go to the v4 module path, adapt to API changes, and run go mod tidy to remove v2 from the dependency graph.

@fullsend-ai-review fullsend-ai-review Bot Jul 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] incomplete-major-version-bump

go-jose v2→v4: The PR replaces gopkg.in/go-jose/go-jose.v2 with .v4 but acceptance/image/image.go:60 still imports gopkg.in/go-jose/go-jose.v2/json. The old v2 is removed as a direct dependency — if not available transitively, the build will fail. go-jose v4 also removed the json sub-package entirely.

Suggested fix: Update acceptance/image/image.go to use 'encoding/json' instead of 'gopkg.in/go-jose/go-jose.v2/json', then remove v2 from the dependency tree.

@fullsend-ai-review fullsend-ai-review Bot Jul 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] known-vulnerable-dependency

go-jose v2 has known CVEs (CVE-2023-50658, CVE-2024-28180) but remains in the compiled binary because the source code still imports it. The go.mod change does not remediate these vulnerabilities — the vulnerable module stays in the dependency graph.

Suggested fix: Migrate source code away from go-jose v2 imports to actually remove the vulnerable dependency from the module graph.

@fullsend-ai-review fullsend-ai-review Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] correctness

go-jose v2→v4 in acceptance module: the require directive replaces gopkg.in/go-jose/go-jose.v2 with .v4, but acceptance/image/image.go still imports gopkg.in/go-jose/go-jose.v2/json. Unlike the root module changes, the old v2 is not preserved as a fallback dependency. The acceptance/go.sum is also not updated with v4 checksums. This may cause build failures.

Suggested fix: Update the import in acceptance/image/image.go from gopkg.in/go-jose/go-jose.v2/json to the v4 equivalent, update acceptance/go.sum with v4 checksums, verify API compatibility, and run go mod tidy in the acceptance module.

@fullsend-ai-review fullsend-ai-review Bot Jul 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] build-failure

The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4 in acceptance/go.mod, but acceptance/image/image.go (line 60) still imports gopkg.in/go-jose/go-jose.v2/json. Since .v2 is completely removed from the acceptance module's go.mod (no indirect entry remains), the acceptance module will fail to build with an unresolved import error. This also leaves the security vulnerabilities in go-jose v2 (GHSA-78h2-9frx-2jm8, GHSA-c6gw-w398-hv78) unaddressed.

Suggested fix: Either (1) keep gopkg.in/go-jose/go-jose.v2 v2.6.3 in acceptance/go.mod until source code is migrated, or (2) update the import in acceptance/image/image.go from gopkg.in/go-jose/go-jose.v2/json to the v4 equivalent and verify API compatibility, then run go mod tidy.

@fullsend-ai-review fullsend-ai-review Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] logic error

The acceptance module replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with go-jose.v4 v4.1.4 as a direct dependency, but acceptance/image/image.go:60 still imports 'gopkg.in/go-jose/go-jose.v2/json'. Unlike the main module, go-jose.v2 is NOT retained as an indirect dependency. If no transitive dependency pulls in v2, this causes a build failure. Even if v2 is transitively available, the upgrade provides no security benefit since source continues to use v2. If the intent is to remediate CVE GHSA-78h2-9frx-2jm8 and GHSA-c6gw-w398-hv78, the source import must also be updated.

Suggested fix: Update acceptance/image/image.go to import from gopkg.in/go-jose/go-jose.v4/json (verifying API compatibility), or retain .v2 in acceptance/go.mod until the source is migrated.

@fullsend-ai-review fullsend-ai-review Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] build failure

The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4, but acceptance/image/image.go:60 still imports 'gopkg.in/go-jose/go-jose.v2/json'. In Go modules, .v2 and .v4 are entirely separate module paths. Since .v2 is completely removed from acceptance/go.mod (not demoted to indirect), this will cause a compilation failure.

Suggested fix: Either update acceptance/image/image.go to import the v4 module path and adapt to API changes, or retain gopkg.in/go-jose/go-jose.v2 alongside .v4.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] api-contract

The PR replaces gopkg.in/go-jose/go-jose.v2 with gopkg.in/go-jose/go-jose.v4 in acceptance/go.mod, but acceptance/image/image.go line 60 still imports gopkg.in/go-jose/go-jose.v2/json. In Go modules, .v2 and .v4 are distinct module paths. Removing v2 from go.mod while source code still imports it will cause a build failure unless v2 is pulled in transitively. No source file has been updated to use v4.

Suggested fix: Either update acceptance/image/image.go to import gopkg.in/go-jose/go-jose.v4/json (verifying API compatibility) and keep v4 in go.mod, or keep v2 in go.mod until the source code is migrated. Run go mod tidy to verify.

@fullsend-ai-review fullsend-ai-review Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] api-contract

The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4, but acceptance/image/image.go still imports gopkg.in/go-jose/go-jose.v2/json. Since v2 is removed and not retained as indirect, this will cause a build failure. The json subpackage exists in v4, so migration is straightforward.

Suggested fix: Update acceptance/image/image.go to import gopkg.in/go-jose/go-jose.v4/json, or use encoding/json from the standard library.

@fullsend-ai-review fullsend-ai-review Bot Aug 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] api-contract

The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4, but acceptance/image/image.go still imports gopkg.in/go-jose/go-jose.v2/json. In Go modules, .v2 and .v4 are different module paths. Since no go-jose.v2 reference remains in acceptance/go.mod, this will either break the build or go mod tidy will re-add v2 as a transitive dependency, silently negating the intended security upgrade (CVE-2024-28180).

Suggested fix: Either update acceptance/image/image.go to import from gopkg.in/go-jose/go-jose.v4/json (verifying API compatibility), or revert the go-jose change and handle the migration in a separate PR with source code changes.

@fullsend-ai-review fullsend-ai-review Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] API contract violation

gopkg.in/go-jose/go-jose.v2 is bumped to go-jose.v4 v4.1.4, but acceptance/image/image.go:60 still imports gopkg.in/go-jose/go-jose.v2/json. The .v2 and .v4 are different module paths under gopkg.in semantics; the v2 import will no longer resolve.

Suggested fix: Either revert to gopkg.in/go-jose/go-jose.v2 v2.6.3, or update the import path in acceptance/image/image.go to use the v4 module path and adapt to the v4 API.

@fullsend-ai-review fullsend-ai-review Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] build failure

The diff changes the direct dependency from gopkg.in/go-jose/go-jose.v2 v2.6.3 to gopkg.in/go-jose/go-jose.v4 v4.1.4, but acceptance/image/image.go (line 60) still imports gopkg.in/go-jose/go-jose.v2/json. In Go modules, v2 and v4 are completely different module paths. Removing v2 from the require directive while the source code still imports it will cause a build failure.

Suggested fix: Either (a) keep gopkg.in/go-jose/go-jose.v2 as a direct dependency and do not change this line, or (b) update the import in acceptance/image/image.go to use the v4 equivalent import path, and verify gopkg.in/go-jose/go-jose.v4 actually publishes a json sub-package.

k8s.io/api v0.36.0
k8s.io/apimachinery v0.36.0
k8s.io/client-go v0.36.0
Expand Down
6 changes: 4 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ go 1.26.3
require (
cuelang.org/go v0.16.0
github.com/CycloneDX/cyclonedx-go v0.10.0
github.com/MakeNowJust/heredoc v1.0.0
github.com/MakeNowJust/heredoc/v2 v2.0.1

@fullsend-ai-review fullsend-ai-review Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] logic-error

github.com/MakeNowJust/heredoc/v2 v2.0.1 is added as a direct dependency but no source file imports the v2 path. All 19 files import v1. The v2 dependency is unused.

Suggested fix: Either update all 19 source files to import heredoc/v2 or remove the v2 entry from go.mod.

@fullsend-ai-review fullsend-ai-review Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] correctness

heredoc v1→v2 major version bump: go.mod adds heredoc/v2 as a direct dependency but all 19 source files still import the v1 path (github.com/MakeNowJust/heredoc). The v2 module is completely unused and would be removed by go mod tidy. Import paths in all consuming .go files must be updated to github.com/MakeNowJust/heredoc/v2.

Suggested fix: Update all 19 import statements from github.com/MakeNowJust/heredoc to github.com/MakeNowJust/heredoc/v2, verify the v2 whitespace handling change is acceptable, remove the v1 require entry, and run go mod tidy.

@fullsend-ai-review fullsend-ai-review Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] logic error

The PR promotes github.com/MakeNowJust/heredoc/v2 v2.0.1 to a direct dependency and demotes heredoc v1.0.0 to indirect, but all 19 Go source files still import the v1 path. The v2 module is declared as direct but entirely unused. Similarly, github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 is declared as direct, but all 3 source files use the v5 import path. Both v1/v5 are retained as indirect so code compiles, but go mod tidy would reverse these changes. The PR does not accomplish its stated upgrade goal for these two libraries.

Suggested fix: Either (a) update all Go source files to use the new import paths (heredoc/v2, jsonschema/v6) and adapt to API changes, or (b) revert the go.mod changes since without source code changes the upgrade has no effect.

@fullsend-ai-review fullsend-ai-review Bot Aug 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] dependency/import mismatch

github.com/MakeNowJust/heredoc/v2 v2.0.1 is declared as a direct dependency, but all 19 source files still import github.com/MakeNowJust/heredoc (the v1 path). The v2 dependency is unused and go mod tidy would remove it, reverting the intended upgrade.

Suggested fix: Update all 19 source files to import heredoc/v2, then run go mod tidy.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] logic-error

The PR adds github.com/MakeNowJust/heredoc/v2 as a direct dependency, but all 19 Go source files still import github.com/MakeNowJust/heredoc (the v1 path). The v2 direct dependency is unused by any source code and will be removed by go mod tidy. heredoc v1 remains a direct dependency in the second require block, so the build will not break.

Suggested fix: Either update all 19 Go files to import heredoc/v2 (after verifying API compatibility), or remove heredoc/v2 from go.mod.

@fullsend-ai-review fullsend-ai-review Bot Aug 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] dead-dependency

The PR adds github.com/MakeNowJust/heredoc/v2 v2.0.1 as a direct dependency, but all 19 source files that use heredoc still import v1 (github.com/MakeNowJust/heredoc). The v2 module is unused and would be removed by go mod tidy.

Suggested fix: Either migrate all source files to import heredoc/v2 and remove the v1 entry, or remove the v2 entry from go.mod.

@fullsend-ai-review fullsend-ai-review Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] API contract violation

The go.mod bumps github.com/MakeNowJust/heredoc from v1.0.0 to heredoc/v2 v2.0.1, changing the module path per Go module major version semantics. However, all 19 Go source files that import this package still use the v1 import path (without /v2). This will cause compilation failures because the old import path no longer matches any declared dependency.

Suggested fix: Either revert to github.com/MakeNowJust/heredoc v1.0.0, or update all Go import statements from github.com/MakeNowJust/heredoc to github.com/MakeNowJust/heredoc/v2 across all consuming files.

github.com/Maldris/go-billy-afero v0.0.0-20200815120323-e9d3de59c99a
github.com/conforma/crds/api v0.1.7
github.com/conforma/go-gather v1.2.0
Expand All @@ -29,7 +29,7 @@ require (
github.com/open-policy-agent/opa v1.15.2
github.com/package-url/packageurl-go v0.1.3
github.com/qri-io/jsonpointer v0.1.1
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] logic-error

The PR adds github.com/santhosh-tekuri/jsonschema/v6 as a direct dependency, but all 3 Go source files still import jsonschema/v5. The v6 direct dependency is unused and will be removed by go mod tidy. jsonschema/v5 remains a direct dependency in the second require block, so the build will not break.

Suggested fix: Either update the 3 Go files to import jsonschema/v6 and adapt to the v6 API, or remove jsonschema/v6 from go.mod.

@fullsend-ai-review fullsend-ai-review Bot Aug 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] dead-dependency

The PR adds github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 as a direct dependency, but all source files still import jsonschema/v5. The v6 module has no consumer in the codebase.

Suggested fix: Either migrate source files to import jsonschema/v6 and remove the v5 entry, or remove the v6 entry from go.mod.

@fullsend-ai-review fullsend-ai-review Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] API contract violation

The go.mod bumps github.com/santhosh-tekuri/jsonschema from v5 to v6 (jsonschema/v6 v6.0.3). However, all 3 Go source files that import this package still use the v5 import path. The v5 import path no longer resolves to a declared dependency, causing compilation failures.

Suggested fix: Either revert to github.com/santhosh-tekuri/jsonschema/v5 v5.3.1, or update all import statements and adapt call sites to the v6 API.

github.com/secure-systems-lab/go-securesystemslib v0.11.0
github.com/sigstore/cosign/v3 v3.0.4
github.com/sigstore/rekor v1.5.3
Expand Down Expand Up @@ -63,9 +63,11 @@ require (
replace github.com/google/go-containerregistry => github.com/conforma/go-containerregistry v0.21.8-0.20260702142841-f9eefe19c7b2

require (
github.com/MakeNowJust/heredoc v1.0.0
github.com/go-openapi/runtime v0.32.4
github.com/google/uuid v1.6.0
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
golang.org/x/text v0.38.0
gopkg.in/yaml.v3 v3.0.1
k8s.io/api v0.36.0
Expand Down
2 changes: 2 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,7 @@ github.com/KeisukeYamashita/go-vcl v0.4.0 h1:dFxZq2yVeaCWBJAT7Oh9Z+Pp8y32i7b11QH
github.com/KeisukeYamashita/go-vcl v0.4.0/go.mod h1:af2qGlXbsHDQN5abN7hyGNKtGhcFSaDdbLl4sfud+AU=
github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
github.com/MakeNowJust/heredoc/v2 v2.0.1/go.mod h1:6/2Abh5s+hc3g9nbWLe9ObDIOhaRrqsyY9MWy+4JdRM=
github.com/Maldris/go-billy-afero v0.0.0-20200815120323-e9d3de59c99a h1:U//wWgvWVegUHd9m3aL6K+W9WUrXdaM/aVNxHuOmRw4=
github.com/Maldris/go-billy-afero v0.0.0-20200815120323-e9d3de59c99a/go.mod h1:mUDfRDWWpXdfuyUtpCgApCxsgqKppYtPi35Q222DRB8=
github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
Expand Down Expand Up @@ -1026,6 +1027,7 @@ github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDc
github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4=
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY=
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
github.com/sassoftware/relic v7.2.1+incompatible h1:Pwyh1F3I0r4clFJXkSI8bOyJINGqpgjJU3DYAZeI05A=
github.com/sassoftware/relic v7.2.1+incompatible/go.mod h1:CWfAxv73/iLZ17rbyhIEq3K9hs5w6FpNMdUT//qR+zk=
github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4=
Expand Down
45 changes: 24 additions & 21 deletions tools/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,8 @@ require (
github.com/tektoncd/cli v0.44.1
github.com/wadey/gocovmerge v0.0.0-20160331181800-b5bfa59ec0ad
gotest.tools/gotestsum v1.12.1
helm.sh/helm/v3 v3.20.2
helm.sh/helm/v3 v3.21.4
helm.sh/helm/v4 v4.2.4

@fullsend-ai-review fullsend-ai-review Bot Aug 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] dead-dependency

The PR adds helm.sh/helm/v4 v4.2.4 as a new direct dependency, but tools/tools.go only imports helm.sh/helm/v3/cmd/helm. No file imports anything from helm/v4.

Suggested fix: Either update tools/tools.go to import from helm/v4 and remove the v3 import, or remove the v4 entry from tools/go.mod.

k8s.io/kubernetes v1.34.2
sigs.k8s.io/kustomize/kustomize/v5 v5.8.1
)
Expand Down Expand Up @@ -81,13 +82,14 @@ require (
github.com/KeisukeYamashita/go-vcl v0.4.0 // indirect
github.com/MakeNowJust/heredoc v1.0.0 // indirect
github.com/Masterminds/goutils v1.1.1 // indirect
github.com/Masterminds/semver/v3 v3.4.0 // indirect
github.com/Masterminds/semver/v3 v3.5.0 // indirect
github.com/Masterminds/sprig/v3 v3.3.0 // indirect
github.com/Masterminds/squirrel v1.5.4 // indirect
github.com/Masterminds/vcs v1.13.3 // indirect
github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
github.com/MirrexOne/unqueryvet v1.5.4 // indirect
github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
github.com/ProtonMail/go-crypto v1.4.1 // indirect
github.com/ThalesIgnite/crypto11 v1.2.5 // indirect
github.com/agext/levenshtein v1.2.3 // indirect
github.com/agnivade/levenshtein v1.2.1 // indirect
Expand Down Expand Up @@ -174,6 +176,7 @@ require (
github.com/clbanning/mxj/v2 v2.7.0 // indirect
github.com/clipperhouse/displaywidth v0.10.0 // indirect
github.com/clipperhouse/uax29/v2 v2.6.0 // indirect
github.com/cloudflare/circl v1.6.3 // indirect
github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
github.com/cockroachdb/apd/v3 v3.2.1 // indirect
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
Expand All @@ -186,7 +189,7 @@ require (
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
github.com/curioswitch/go-reassign v0.3.0 // indirect
github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
github.com/cyphar/filepath-securejoin v0.6.1 // indirect
github.com/cyphar/filepath-securejoin v0.7.0 // indirect
github.com/dave/dst v0.27.3 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
Expand Down Expand Up @@ -381,7 +384,7 @@ require (
github.com/lestrrat-go/jwx/v3 v3.0.13 // indirect
github.com/lestrrat-go/option/v2 v2.0.0 // indirect
github.com/letsencrypt/boulder v0.20260309.0 // indirect
github.com/lib/pq v1.11.2 // indirect
github.com/lib/pq v1.12.3 // indirect
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
github.com/lithammer/dedent v1.1.0 // indirect
github.com/logrusorgru/aurora v2.0.3+incompatible // indirect
Expand Down Expand Up @@ -579,44 +582,44 @@ require (
gocloud.dev v0.45.0 // indirect
gocloud.dev/docstore/mongodocstore v0.43.0 // indirect
gocloud.dev/pubsub/kafkapubsub v0.43.0 // indirect
golang.org/x/crypto v0.53.0 // indirect
golang.org/x/crypto v0.54.0 // indirect
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
golang.org/x/mod v0.37.0 // indirect
golang.org/x/net v0.56.0 // indirect
golang.org/x/oauth2 v0.36.0 // indirect
golang.org/x/sync v0.22.0 // indirect
golang.org/x/sys v0.46.0 // indirect
golang.org/x/term v0.44.0 // indirect
golang.org/x/text v0.38.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/term v0.45.0 // indirect
golang.org/x/text v0.40.0 // indirect
golang.org/x/time v0.15.0 // indirect
golang.org/x/tools v0.46.0 // indirect
golang.org/x/tools v0.47.0 // indirect
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
google.golang.org/api v0.286.0 // indirect
google.golang.org/genproto v0.0.0-20260406210006-6f92a3bedf2d // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad // indirect
google.golang.org/grpc v1.82.0 // indirect
google.golang.org/grpc v1.82.1 // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/ini.v1 v1.67.3 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
honnef.co/go/tools v0.7.0 // indirect
k8s.io/api v0.36.0 // indirect
k8s.io/apiextensions-apiserver v0.36.0 // indirect
k8s.io/apimachinery v0.36.0 // indirect
k8s.io/apiserver v0.36.0 // indirect
k8s.io/cli-runtime v0.36.0 // indirect
k8s.io/client-go v0.36.0 // indirect
k8s.io/component-base v0.36.0 // indirect
k8s.io/component-helpers v0.36.0 // indirect
k8s.io/api v0.36.2 // indirect
k8s.io/apiextensions-apiserver v0.36.2 // indirect
k8s.io/apimachinery v0.36.2 // indirect
k8s.io/apiserver v0.36.2 // indirect
k8s.io/cli-runtime v0.36.2 // indirect
k8s.io/client-go v0.36.2 // indirect
k8s.io/component-base v0.36.2 // indirect
k8s.io/component-helpers v0.36.2 // indirect
k8s.io/klog/v2 v2.140.0 // indirect
k8s.io/kube-openapi v0.0.0-20260319004828-5883c5ee87b9 // indirect
k8s.io/kubectl v0.36.0 // indirect
k8s.io/metrics v0.36.0 // indirect
k8s.io/streaming v0.36.0 // indirect
k8s.io/kubectl v0.36.2 // indirect
k8s.io/metrics v0.36.2 // indirect
k8s.io/streaming v0.36.2 // indirect
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 // indirect
knative.dev/eventing v0.49.2 // indirect
knative.dev/pkg v0.0.0-20260531000007-52dbd5ece63f // indirect
Expand Down
Loading
Loading