Skip to content

🚨 Update go modules (release-v0.7) (major) #3168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: release-v0.7
Choose a base branch
from
+9 −9
Open

🚨 Update go modules (release-v0.7) (major) #3168

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions acceptance/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ require (
github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e
github.com/pkg/errors v0.9.1
github.com/secure-systems-lab/go-securesystemslib v0.11.0
github.com/sigstore/cosign/v2 v2.6.2
github.com/sigstore/cosign/v3 v3.1.3
github.com/sigstore/rekor v1.5.3
github.com/sigstore/sigstore v1.10.8
github.com/stretchr/testify v1.11.1
Expand All @@ -33,10 +33,10 @@ require (
github.com/wiremock/go-wiremock v1.11.0
github.com/yudai/gojsondiff v1.0.0
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f

@fullsend-ai-review fullsend-ai-review Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] stale-reference

Module path changed from gopkg.in/go-jose/go-jose.v2 to gopkg.in/go-jose/go-jose.v4, but acceptance/image/image.go:60 still imports gopkg.in/go-jose/go-jose.v2/json. Acceptance module build will fail.

Suggested fix: Update import in acceptance/image/image.go:60 from gopkg.in/go-jose/go-jose.v2/json to gopkg.in/go-jose/go-jose.v4/json.

gopkg.in/go-jose/go-jose.v2 v2.6.3
gopkg.in/go-jose/go-jose.v4 v4.1.4

@fullsend-ai-review fullsend-ai-review Bot Jun 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] api-contract

The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4 in the acceptance module direct dependencies, but acceptance/image/image.go (line 60) still imports gopkg.in/go-jose/go-jose.v2/json. These are entirely separate module paths in Go. Removing the .v2 dependency without updating the source code import will cause a compilation failure.

Suggested fix: Either (1) keep gopkg.in/go-jose/go-jose.v2 v2.6.3 in acceptance/go.mod alongside the new .v4 entry, or (2) update acceptance/image/image.go to import from gopkg.in/go-jose/go-jose.v4/json (verifying API compatibility first), or (3) if .v2 is expected to come in as a transitive dep, mark it as // indirect and confirm it resolves correctly.

k8s.io/api v0.36.0
k8s.io/apimachinery v0.36.0

@fullsend-ai-review fullsend-ai-review Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] build-correctness

PR replaces gopkg.in/go-jose/go-jose.v2 with .v4, but acceptance/image/image.go:60 still imports go-jose.v2/json. In Go modules, .v2 and .v4 are different module paths. This will cause a compilation failure unless go-jose.v2 is available as a transitive dependency. Additionally, acceptance/go.sum was not updated despite go.mod changes.

Suggested fix: Keep go-jose.v2 alongside v4, or update the import in acceptance/image/image.go from .v2/json to .v4/json after verifying API compatibility. Run go mod tidy in the acceptance directory.

@fullsend-ai-review fullsend-ai-review Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] api-contract

The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4 without retaining v2. acceptance/image/image.go line 60 imports gopkg.in/go-jose/go-jose.v2/json. Removing v2 from go.mod while source code still imports it will cause a build failure.

Suggested fix: Keep gopkg.in/go-jose/go-jose.v2 in acceptance/go.mod alongside v4, or update the import in acceptance/image/image.go:60 to use the v4 equivalent.

@fullsend-ai-review fullsend-ai-review Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] API contract violation

The PR replaces gopkg.in/go-jose/go-jose.v2 v2.6.3 with gopkg.in/go-jose/go-jose.v4 v4.1.4 in acceptance/go.mod, but acceptance/image/image.go line 60 still imports gopkg.in/go-jose/go-jose.v2/json. In Go modules, go-jose.v2 and go-jose.v4 are distinct module paths; removing v2 from the require block without updating the import statement will cause a compilation error in the acceptance module. No .go files in the acceptance module were changed in this PR.

Suggested fix: Either (a) keep gopkg.in/go-jose/go-jose.v2 in the acceptance/go.mod require block alongside v4, or (b) update the import in acceptance/image/image.go:60 from gopkg.in/go-jose/go-jose.v2/json to gopkg.in/go-jose/go-jose.v4/json (verifying API compatibility first, since the v4 json sub-package may have different behavior or may not exist).

k8s.io/client-go v0.36.0
k8s.io/client-go v1.5.2
oras.land/oras-go/v2 v2.6.2
sigs.k8s.io/kind v0.26.0
sigs.k8s.io/kustomize/api v0.20.1
Expand Down
8 changes: 4 additions & 4 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ go 1.26.4
require (
cuelang.org/go v0.16.0
github.com/CycloneDX/cyclonedx-go v0.10.0

@fullsend-ai-review fullsend-ai-review Bot Jul 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] correctness

Major version dependency bumps (cosign/v2→v3, heredoc→v2, jsonschema/v5→v6) are declared in go.mod without updating the source code import paths on the release-v0.7 branch. Go major version changes alter the module import path, requiring all importing files to be updated. The old versions are retained in a separate require block, creating a confusing state with both old and new major versions listed as direct dependencies.

Suggested fix: For each major version migration, update all source code import paths to use the new module path (e.g., replace all cosign/v2/... imports with cosign/v3/...), adapt to any API changes in the new version, then remove the old version from go.mod. Consider splitting each migration into a separate PR.

github.com/MakeNowJust/heredoc v1.0.0
github.com/MakeNowJust/heredoc/v2 v2.0.1

@fullsend-ai-review fullsend-ai-review Bot Jun 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] api-contract

The PR adds github.com/MakeNowJust/heredoc/v2 v2.0.1 as a direct dependency alongside the existing heredoc v1.0.0, but no Go source file imports heredoc/v2. All 19 source files use the v1 import path. The v2 entry is extraneous.

Suggested fix: Run go mod tidy to clean up the dependency.

@fullsend-ai-review fullsend-ai-review Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] correctness

New major versions (heredoc/v2, jsonschema/v6, cosign/v3) are declared as direct dependencies but no source code imports them. 19 files import heredoc v1, 3 files import jsonschema/v5. Old versions are preserved (preventing a build break), but the new versions are unused and would be removed by 'go mod tidy'.

Suggested fix: Either migrate source code imports to new module paths as part of this PR, or remove unused new major version entries from direct dependencies.

@fullsend-ai-review fullsend-ai-review Bot Jul 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] edge-case

The PR adds heredoc/v2 v2.0.1 as a direct dependency while retaining v1 separately. No source files import heredoc/v2. The entry is likely required as a transitive dependency.

@fullsend-ai-review fullsend-ai-review Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] stale-reference

Module path changed from github.com/MakeNowJust/heredoc to github.com/MakeNowJust/heredoc/v2, but 19 Go source files still import the old v1 path. Build will fail because the old module path is no longer declared in go.mod.

Suggested fix: Update all 19 Go source files to import github.com/MakeNowJust/heredoc/v2 instead of github.com/MakeNowJust/heredoc.

github.com/Maldris/go-billy-afero v0.0.0-20200815120323-e9d3de59c99a
github.com/conforma/go-gather v1.0.2
github.com/docker/docker v28.5.2+incompatible
Expand All @@ -29,9 +29,9 @@ require (
github.com/open-policy-agent/opa v1.15.2
github.com/package-url/packageurl-go v0.1.3
github.com/qri-io/jsonpointer v0.1.1
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
github.com/santhosh-tekuri/jsonschema/v6 v6.0.3

@fullsend-ai-review fullsend-ai-review Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] stale-reference

Module path changed from github.com/santhosh-tekuri/jsonschema/v5 to v6, but 3 Go source files still import the old v5 path (pkg/schema/schema.go:23, internal/policy/policy.go:31, internal/evaluation_target/application_snapshot_image/application_snapshot_image.go:33). Build will fail. Additionally, jsonschema v6 has breaking API changes.

Suggested fix: Update all 3 Go source files to import github.com/santhosh-tekuri/jsonschema/v6 and adapt code to the v6 API.

github.com/secure-systems-lab/go-securesystemslib v0.11.0

@fullsend-ai-review fullsend-ai-review Bot Jun 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] api-contract

The PR adds github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 as a direct dependency alongside the existing jsonschema/v5 v5.3.1, but no Go source file imports jsonschema/v6. All 3 source files use the v5 import path. The v6 entry is extraneous.

Suggested fix: Run go mod tidy to clean up the dependency.

github.com/sigstore/cosign/v2 v2.4.1
github.com/sigstore/cosign/v3 v3.1.3
github.com/sigstore/rekor v1.5.3
github.com/sigstore/sigstore v1.10.8
github.com/sirupsen/logrus v1.9.4
Expand All @@ -52,7 +52,7 @@ require (
golang.org/x/sync v0.22.0
k8s.io/apiextensions-apiserver v0.35.4
k8s.io/apimachinery v0.36.0
k8s.io/client-go v0.36.0
k8s.io/client-go v1.5.2

@fullsend-ai-review fullsend-ai-review Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] API contract violation

k8s.io/client-go changed from v0.36.0 to v1.5.2. Version v1.5.2 is an ancient legacy tag from 2016 that predates Go modules. It does not contain modern packages the codebase imports (dynamic, kubernetes, rest, tools/clientcmd — 24 import statements across the codebase). Renovate incorrectly resolved v1.5.2 as latest because it is the highest semver tag without a /v2 suffix. This change will break compilation in both the main module and the acceptance module.

Suggested fix: Revert k8s.io/client-go to v0.36.0 in both go.mod and acceptance/go.mod.

k8s.io/klog/v2 v2.140.0
k8s.io/kube-openapi v0.0.0-20260319004828-5883c5ee87b9
oras.land/oras-go/v2 v2.6.2
Expand Down
4 changes: 2 additions & 2 deletions tools/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,14 @@ go 1.26.4

require (
github.com/daixiang0/gci v0.13.7
github.com/golangci/golangci-lint v1.64.8
github.com/golangci/golangci-lint/v2 v2.13.0
github.com/google/addlicense v1.2.0
github.com/open-policy-agent/conftest v0.66.0
github.com/tektoncd/chains v0.26.2

@fullsend-ai-review fullsend-ai-review Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[critical] stale-reference

Module path changed from helm.sh/helm/v3 to helm.sh/helm/v4, but tools/tools.go:29, Makefile:207, and hack/helm.sh:28-29 still reference helm.sh/helm/v3. Build and tooling scripts will fail.

Suggested fix: Update all references from helm.sh/helm/v3 to helm.sh/helm/v4 in tools/tools.go, Makefile, and hack/helm.sh.

github.com/tektoncd/cli v0.44.1
github.com/wadey/gocovmerge v0.0.0-20160331181800-b5bfa59ec0ad
gotest.tools/gotestsum v1.12.3
helm.sh/helm/v3 v3.20.2
helm.sh/helm/v4 v4.2.4
k8s.io/kubernetes v1.34.3
sigs.k8s.io/kustomize/kustomize/v5 v5.8.1
)
Expand Down
Loading